Skip to content

List MCP API Keys

Method

REST method is adopted.

HTTP Method

GET: Get MCP API key list

Naming Convention

To unify the naming of query parameters and nodes and improve readability, snake_case is used for URIs and JSON nodes in requests.

Request and Response

Headers

Meta information is set in HTTP headers, not in the response body.

Request Headers

  • Authorization
  • Content-Type
  • Accept
  • Accept-language

Response Headers

  • Content-Type

Get List

URI

GET /v1/organizations/{organization_id}/projects/{project_id}/mcp_api_key

Path Parameters

Name Type Required Description
organization_id integer Required Organization ID
project_id integer Required Project ID

Query Parameters

Name Type Default Description
page integer 1 Page number (minimum: 1)
limit integer 20 Items per page (minimum: 1, maximum: 100)
sort string asc Sort order (asc or desc)
scope string - Filter by scope (user or project)
permission integer - Filter by permission (0: READ, 1: WRITE)
includeRevoked boolean false Whether to include revoked keys

Response

The response is JSON.

{
  "currentPage": 1,
  "totalCount": 50,
  "list": [
    {
      "id": 1,
      "userId": 1,
      "projectId": 2,
      "name": "mcp for project A",
      "keyPrefix": "abc123",
      "permission": 0,
      "expiresAt": 1735689600000,
      "revokedAt": null,
      "lastUsedAt": 1234567890000,
      "createdAt": 1234567890000,
      "updatedAt": 1234567890000,
      "deletedAt": null,
      "createdBy": "user-cognito-sub",
      "updatedBy": "user-cognito-sub",
      "deletedBy": null
    }
  ]
}

Note: apiKey, keyHash, and salt are not returned for security reasons.

Authentication

Authentication is performed using JSON Web Tokens (JWT) issued by Amazon Cognito.

Error Handling

The status codes for error handling are as follows.

Description Status Code Status Name
Missing credentials 401 Unauthorized
Insufficient permissions 403 Forbidden
Internal server error 500 Internal Server Error

Processing Flow

  1. Extract organization ID and project ID from path parameters
  2. Extract query parameters
  3. Verify the user has access to the project
  4. Filter based on project ID and query parameters
  5. Apply pagination
  6. Apply sort order
  7. Format results (convert dates to epoch milliseconds)
  8. Return results with pagination information

Detailed Flowchart

flowchart TD
    Start([GET Request]) --> Auth[Auth & Parameter Extraction<br/>page, limit, sort]
    Auth --> Service[Service Layer]
    Service --> AccessCheck[Access Check]
    AccessCheck --> HasAccess{Read permission?}
    HasAccess -->|No| Err404[404 Not Found]
    HasAccess -->|Yes| Validate{sort validation}
    Validate -->|NG| Err400[400 Bad Request]
    Validate -->|OK| QueryDB[Repository Layer]
    QueryDB --> CountQuery[Get COUNT]
    CountQuery --> ListQuery[Fetch Records<br/>LIMIT, OFFSET, ORDER BY]
    ListQuery --> Format[Format Response]
    Format --> Success[200 OK<br/>currentPage, totalCount, list]

Filtering

  • By default, only keys that have not been deleted (deletedAt is null) are returned
  • When includeRevoked is false, only keys that have not been revoked (revokedAt is null) are returned
  • Only keys associated with the specified project_id are returned
  • If the scope parameter is specified, only keys with that scope are returned
  • Users can only view keys they own or keys for projects they have access to