> ## Documentation Index > Fetch the complete documentation index at: https://monid.ai/docs/llms.txt > Use this file to discover all available pages before exploring further. # Get an API key > Returns one live (ACTIVE or EXPIRED) key's metadata — scopes, status, expiry, who minted it. The secret is never returned. Revoked keys are not addressable by label; list with `?status=REVOKED` instead. ## OpenAPI ````yaml https://monid.ai/openapi.json get /v1/api-keys/{label} openapi: 3.1.0 info: title: Monid API version: 0.1.0 description: >- Agentic payment platform for data — agents discover and buy data on demand. Authenticated `/v1/*` routes accept a Monid API key or Clerk JWT as a Bearer token. All errors return `{ code, message }`. List endpoints use cursor pagination; consult each operation schema for its last-page cursor encoding. servers: - url: https://api.monid.ai description: Production - url: https://monid.ai description: Public registry alias (public/v1 only) security: [] paths: /v1/api-keys/{label}: get: tags: - API Keys summary: Get an API key description: >- Returns one live (ACTIVE or EXPIRED) key's metadata — scopes, status, expiry, who minted it. The secret is never returned. Revoked keys are not addressable by label; list with `?status=REVOKED` instead. parameters: - schema: type: string minLength: 1 description: Label of the API key. example: ci-runner required: true description: Label of the API key. name: label in: path - $ref: '#/components/parameters/AgentModelHeader' - $ref: '#/components/parameters/AgentHarnessHeader' - $ref: '#/components/parameters/AgentSessionIdHeader' responses: '200': description: The API key (metadata only) content: application/json: schema: $ref: '#/components/schemas/ApiKey' '400': description: Bad request — input failed validation content: application/json: schema: $ref: '#/components/schemas/Error' '401': description: Unauthorized — missing or invalid credentials content: application/json: schema: $ref: '#/components/schemas/Error' '403': description: Forbidden — caller has no workspace or no access content: application/json: schema: $ref: '#/components/schemas/Error' '404': description: API key not found in this workspace content: application/json: schema: $ref: '#/components/schemas/Error' '429': description: >- Rate limited (errorCode `RATE_LIMITED`, message `Rate limited. Retry after Ns.`) — the `Retry-After` header carries whole seconds until the caller may retry; `RateLimit-Limit/-Remaining/-Reset` describe the binding limit as numbers only (also sent on allowed responses that matched a rule; responses that matched no rule, or an `unlimited` exemption, carry none of them). Applies to every authenticated `/v1` route (per API key / user / workspace); POST /v1/run additionally enforces per-provider/endpoint run limits. content: application/json: schema: $ref: '#/components/schemas/Error' '500': description: Internal server error content: application/json: schema: $ref: '#/components/schemas/Error' security: - Bearer: - api_keys:read components: parameters: AgentModelHeader: name: X-Monid-Agent-Model in: header required: false description: >- Model driving the calling agent. Optional; a value that is empty, longer than 256 characters or not printable ASCII is ignored (never an error). schema: type: string maxLength: 256 example: claude-opus-5-5 AgentHarnessHeader: name: X-Monid-Agent-Harness in: header required: false description: >- Agent harness or client making the call (e.g. a coding agent, an agent framework). Optional; a value that is empty, longer than 256 characters or not printable ASCII is ignored (never an error). schema: type: string maxLength: 256 example: claude-code AgentSessionIdHeader: name: X-Monid-Agent-Session-Id in: header required: false description: >- Caller-side session identifier, so the calls of one agent session (discover → inspect → run → polling) can be correlated. Optional; a value that is empty, longer than 256 characters or not printable ASCII is ignored (never an error). schema: type: string maxLength: 256 example: 01JABCDEF0123456789XYZ schemas: ApiKey: type: object properties: label: type: string description: Human-readable label. Unique per workspace. example: ci-runner keyPrefix: type: string description: Display prefix of the key (e.g. "monid_test_a1b2c3d4..."). example: monid_test_a1b2c3d4 owner: type: string description: >- User id the key belongs to (bills to, listed under). Always a user; a child key inherits its parent's owner. createdBy: type: string description: >- Who minted the key — `USER#` (dashboard), `API_KEY#` (another key), `AEP#` (AEP grant) — an actor id: `USER#` (dashboard), `API_KEY#` (another key), `AEP#` (an enrolled agent), `CLERK`, `SYSTEM`. example: USER#user_2abc scopes: type: array items: type: string enum: - '*' - runs:* - resources:* - wallet:* - topups:* - controls:* - api_keys:* - runs:create - runs:get - runs:list - runs:update - resources:read - resources:create - resources:update - resources:delete - wallet:read - wallet:update - topups:create - controls:read - controls:create - controls:update - controls:delete - api_keys:read - api_keys:create - api_keys:update - api_keys:revoke minItems: 1 description: >- Scope grants: `{resource}:{action}` over runs, resources, wallet, topups, controls and api_keys with read/create/update/delete, plus `{resource}:*` and `*`. Catalog reads need no scope. Fixed at creation. example: - runs:* - resources:* - wallet:read - topups:* - controls:read - api_keys:* status: type: string enum: - ACTIVE - EXPIRED - REVOKED description: >- ACTIVE, EXPIRED (derived from expiresAt) or REVOKED. Only ACTIVE keys authenticate. origin: type: string enum: - DASHBOARD - API - AEP - SYSTEM description: >- Channel the key was minted through — derived from `createdBy`: DASHBOARD, API, AEP or SYSTEM. expiresAt: type: string format: date-time description: Expiry (ISO 8601). Absent ⇒ never expires. revokedAt: type: string format: date-time description: When the key was revoked. Present only when REVOKED. revokedBy: type: string description: >- Who revoked the key (present only when REVOKED) — an actor id: `USER#` (dashboard), `API_KEY#` (another key), `AEP#` (an enrolled agent), `CLERK`, `SYSTEM`. example: USER#user_2abc createdAt: type: string format: date-time description: Creation time (ISO 8601). lastUsedAt: type: string format: date-time description: Last time the key authenticated a request. Absent if never used. required: - label - keyPrefix - owner - createdBy - scopes - status - origin - createdAt Error: type: object properties: code: type: integer description: HTTP status code, duplicated in the body. example: 400 message: type: string description: Human-readable error description. example: Bad Request hints: type: object additionalProperties: anyOf: - type: string - type: object properties: kind: type: string enum: - command - discover - inspect - run - getRun - stop - releaseResource - topup command: type: string query: type: string provider: type: string endpoint: type: string runId: type: string resourceId: type: string stripe: type: string dashboard: type: string docs: type: string comment: type: string required: - kind description: >- Optional next actions, rendered for the calling client like run-response hints (e.g. the paid TinyFish version on a free-quota 429 — spending permission required). errorCode: type: string enum: - RATE_LIMITED - X402_WORKSPACE_RESOURCES - X402_WORKSPACE_ONLY - X402_ACCRUING_COST - X402_EXCEEDS_SETTLEMENT_WINDOW - X402_VALIDITY_WINDOW_TOO_SHORT - X402_UNBOUNDED_PRICE - X402_PROMOTION - INSUFFICIENT_SCOPE - WALLET_INSUFFICIENT_FUNDS - IDENTITY_PROVIDER_UNKNOWN - IDENTITY_LINK_REQUIRES_SESSION - IDENTITY_LINK_STATE_INVALID - IDENTITY_VERIFICATION_FAILED - IDENTITY_PROVIDER_UNAVAILABLE - IDENTITY_ALREADY_LINKED - IDENTITY_USER_ALREADY_LINKED - IDENTITY_LINK_RATE_LIMITED - IDENTITY_REQUIRED - PROMO_IDENTITY_REDEEMED - PROMO_REDEEM_REQUIRES_SESSION - PROMO_CODE_REDEEMED_BY_WORKSPACE - PROMO_CODE_REDEEMED_BY_USER description: >- OPTIONAL machine-readable discriminant from the documented `ApiErrorCode` registry. Absent on legacy errors; clients MUST treat unknown values as absent. required: - code - message securitySchemes: Bearer: type: http scheme: bearer description: >- Monid API key (`Authorization: Bearer mk_...`) or Clerk-issued JWT. Each operation lists the ONE scope an API key needs. `{resource}:*` grants every action on that resource; `*` grants everything; Clerk sessions hold `*`. Operations with an empty list need no scope. Scope catalog: `GET /v1/api-keys/scopes`. x-aep-authentication-method: api-key ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.