listApiKeys.md

List org API keys

Lists every gateway API key in the organization (one entry per key). The raw key value is never returned — only its prefix and metadata.

OpenAPI

openapi: 3.1.0
info:
  title: Barndoor LLM Gateway API
  version: 1.0.0
  description: >
    REST API for the Barndoor LLM Gateway: configure providers, model routes,
    pricing, governance, and operate a multi-provider LLM platform
    programmatically.
    
    All endpoints in this document are scoped to your organization. They are the
    same APIs powering the Barndoor portal under **LLM Configuration**,
    **LLM Controls**, and **Settings - My Models**, exposed for teams that
    prefer scripting over the UI.

## Base URL
    
    All requests are issued against your Barndoor instance:
    
    ```
    https://app.barndoor.ai/api/llm-gateway
    ```
    
    Replace `app.barndoor.ai` with your tenant host if you run on Enterprise.

## Authentication
    
    Endpoints accept a JWT Bearer token issued by your Barndoor identity
    provider. Tokens can be obtained interactively via the Barndoor SDK:
    
    ```ts
    const sdk = await loginInteractive();
    ```
    
    The token must be sent in the `Authorization` header on every request:
    
    ```
    Authorization: Bearer eyJhbGciOi...
    ```
    
    Note: the `bd-...` API keys you create through these endpoints are for
    runtime LLM traffic (`/v1/chat/completions`, `/v1/messages`, etc.), not for
    administrative calls. Administrative endpoints require a user/admin JWT.

## Permissions
    
    Most endpoints require an `admin` (or higher) role on the calling user.
    Read-only endpoints are typically accessible by all authenticated users.
    Read-only listings under `/user/...` are scoped to the authenticated user.

## Errors
    
    Errors are returned as JSON with a stable shape:
    
    ```json
    { "error": "BadRequest", "message": "request_timeout_secs must be between 1
    and 3600" }
    ```

contact:

name: Barndoor Support url: https://barndoor.ai

servers:

• url: https://{host}/api/llm-gateway description: >- Production / Trial (Barndoor SaaS). The gateway lives on your Barndoor control-plane host. For Enterprise or self-hosted deployments, replace the host with your portal hostname — the authoritative value is shown on Settings → My Models in the portal. variables: host: description: Your Barndoor control-plane (portal) hostname default: app.barndoor.ai
• url: https://app.barndooruat.com/api/llm-gateway description: UAT
• url: https://app.barndoordev.com/api/llm-gateway description: Dev

security:

• BearerAuth: []

tags:

• name: Credentials description: >- Reusable upstream credentials (API keys, AWS roles, Vertex service accounts)
• name: Providers description: Named upstream providers backed by credentials and a model family
• name: Provider Catalog description: Read-only catalog of supported upstream provider templates
• name: Model Routes description: Map client-facing aliases to one or more upstream provider/model pairs
• name: Model Pricing description: Per-million-token input/output costs for usage and budget reporting
• name: Rate Limits description: Requests-per-minute and tokens-per-minute caps
• name: Token Budgets description: Daily, weekly, or monthly token and cost ceilings
• name: Model Access description: Allowlist or denylist policies for models, providers, or aliases
• name: Smart Models description: Routing policies that pick a target model based on the request
• name: Governance Configuration description: Org-wide behavior toggles for the LLM Gateway
• name: Route Health description: Operational view of upstream route ejection and recovery
• name: API Keys description: Org-managed gateway API keys (the bd-... keys callers send on /v1/...)
• name: User description: Self-service endpoints for the authenticated user

paths:

/admin/api-keys: get: tags: - API Keys summary: List org API keys description: | Lists every gateway API key in the organization (one entry per key). The raw key value is never returned — only its prefix and metadata. operationId: listApiKeys responses: '200': description: List of API keys content: application/json: schema: type: array items: $ref: '#/components/schemas/ApiKey'

components:

schemas: ApiKey: type: object required: - id - org_id - created_by_user_id - name - key_prefix - scopes - created_at properties: id: type: string format: uuid org_id: type: string format: uuid user_id: type: string format: uuid nullable: true description: Assigned user, for personal-style keys. null for org / group keys. created_by_user_id: type: string format: uuid name: type: string example: CI runner key_prefix: type: string description: First 8 characters of the raw key — safe to display example: bd-abcde scopes: type: array items: type: string group_name: type: string nullable: true expires_at: type: string format: date-time nullable: true created_at: type: string format: date-time revoked_at: type: string format: date-time nullable: true securitySchemes: BearerAuth: type: http scheme: bearer bearerFormat: JWT description: | JWT obtained through Barndoor's authentication flow. Pass the token verbatim in Authorization: Bearer <token>. Use the Barndoor SDK's loginInteractive() helper to obtain a token in scripts and notebooks.