> ## Documentation Index
> Fetch the complete documentation index at: https://docs.caratuva.com/llms.txt
> Use this file to discover all available pages before exploring further.

# List API keys

> List all API keys for the caller organization, newest first. The plaintext secret is never included — only the key prefix and metadata. Revoked keys are returned too (with `revokedAt` set).



## OpenAPI

````yaml https://api.caratuva.com/docs-json get /v1/api-keys
openapi: 3.0.0
info:
  title: Caratuva API
  description: >-
    Cross-border B2B payments. Fiat on-ramp → USDC → PIX off-ramp.


    Every request runs in **test** or **live** mode on this single host — there
    is no separate sandbox URL. API keys carry the mode in their prefix
    (`pk_test_…` / `pk_live_…`); dashboard JWTs start in test and re-mint via
    `POST /v1/auth/switch-mode`. Test mode runs the full pipeline against a
    sandbox payment instance (KYB/KYC auto-approve, no real money); live runs on
    real rails and requires approved KYB. Test and live data are fully isolated.
    Check readiness with `GET /v1/onboarding/status`.
  version: 1.0.0
  contact: {}
servers: []
security: []
tags:
  - name: Invoices
    description: Create and manage invoices that collect for one of your sellers.
  - name: Payments
    description: Create a payment (keep your own checkout), fetch it, or cancel it.
  - name: Accounts
    description: >-
      Onboard and manage your sellers, buyers, and your own (self) account at
      the settlement partner.
  - name: Webhooks
    description: Subscribe to outbound event notifications and manage signing secrets.
  - name: API keys
    description: Issue, list, and revoke the API keys that authenticate your integration.
  - name: Access
    description: Request and check production (live-mode) access for your organization.
  - name: Reports
    description: Pull settlement and transfer-pricing reports.
paths:
  /v1/api-keys:
    get:
      tags:
        - API keys
      summary: List API keys
      description: >-
        List all API keys for the caller organization, newest first. The
        plaintext secret is never included — only the key prefix and metadata.
        Revoked keys are returned too (with `revokedAt` set).
      operationId: ApiKeysController_list
      parameters: []
      responses:
        '200':
          description: API keys for the caller org
          content:
            application/json:
              schema:
                type: array
                items:
                  type: object
                  properties:
                    id:
                      type: string
                    orgId:
                      type: string
                    name:
                      type: string
                    keyPrefix:
                      type: string
                    testMode:
                      type: boolean
                    scopes:
                      type: array
                      items:
                        type: string
                    lastUsedAt:
                      type: string
                      nullable: true
                    revokedAt:
                      type: string
                      nullable: true
                    createdAt:
                      type: string
                  required:
                    - id
                    - orgId
                    - name
                    - keyPrefix
                    - testMode
                    - scopes
                    - lastUsedAt
                    - revokedAt
                    - createdAt
                  additionalProperties: false
              examples:
                default:
                  value:
                    - id: ckkey001
                      orgId: ckorg001
                      name: Storefront integration (test)
                      keyPrefix: pk_test_8Qk2pXr0aB9cD3eF7gH1iJ4k
                      testMode: true
                      scopes:
                        - payment_intents:write
                        - payment_intents:read
                      lastUsedAt: null
                      revokedAt: null
                      createdAt: '2026-06-30T12:00:00.000Z'
      security:
        - apiKey: []
        - bearer: []
components:
  securitySchemes:
    apiKey:
      type: apiKey
      in: header
      name: X-API-Key
    bearer:
      scheme: bearer
      bearerFormat: JWT
      type: http

````