> ## Documentation Index
> Fetch the complete documentation index at: https://docs.trailercast.io/llms.txt
> Use this file to discover all available pages before exploring further.

# List API keys



## OpenAPI

````yaml api-reference/openapi.yaml GET /api-keys
openapi: 3.1.0
info:
  title: TrailerCast Integration API
  version: 1.0.0
  summary: >-
    Read-only access to call summaries, prospect engagement and Decision Room
    metrics, plus signed webhooks.
  description: >
    Read-only, workspace-scoped API for pulling the deal signals TrailerCast
    captures during a sale,

    and outbound webhooks for near-real-time notification. Start with the guides
    in this section (Introduction, Quickstart, Authentication, Webhooks); the
    endpoint pages below are generated from this spec.


    **Authentication.** Data endpoints take an API key: `Authorization: Bearer
    tck_live_…`.

    Management endpoints take an admin session JWT with the `integrations.crm`
    permission.


    **Pagination.** Every list is keyset-paginated and ascending: `{ data,
    nextCursor, hasMore }`.

    Pass `cursor=<nextCursor>` to continue. `limit` 1–500, default 100.


    **Rate limit.** 300 requests/minute per API key; `429` with `Retry-After`
    when exceeded.


    **Versioning.** Breaking changes ship as a new path (`/api/v2`). Additive
    changes (new fields,

    event types, parameters) may ship at any time; ignore what you do not
    recognise.
  contact:
    name: TrailerCast
    url: https://trailercast.io
servers:
  - url: https://{host}/api/v1
    variables:
      host:
        default: trailercst-backend-production.up.railway.app
        description: Your TrailerCast API host.
  - url: http://localhost:5000/api/v1
    description: Local development
security:
  - apiKey: []
tags:
  - name: Status
  - name: Calls
  - name: Engagement
  - name: Decision Rooms
  - name: Webhook deliveries
  - name: Management — API keys
  - name: Management — Webhooks
paths:
  /api-keys:
    get:
      tags:
        - Management — API keys
      summary: List API keys
      responses:
        '200':
          description: Keys (never the plaintext)
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/ApiKey'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
      security:
        - sessionJwt: []
components:
  schemas:
    ApiKey:
      type: object
      properties:
        id:
          type: integer
        name:
          type: string
        prefix:
          type: string
          example: tck_live_Ab1
        scopes:
          type: array
          items:
            type: string
        createdAt:
          type: string
          format: date-time
        createdByUserId:
          type:
            - integer
            - 'null'
        lastUsedAt:
          type:
            - string
            - 'null'
          format: date-time
        revokedAt:
          type:
            - string
            - 'null'
          format: date-time
    Error:
      type: object
      required:
        - error
      properties:
        error:
          type: string
          description: Human-readable; not stable.
        code:
          type: string
          description: Stable machine code.
  responses:
    Unauthorized:
      description: >-
        Missing, invalid or revoked API key; or a session token on a data
        endpoint
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            error: Invalid API key.
            code: API_KEY_INVALID
    Forbidden:
      description: Permission denied
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            error: You do not have permission to perform this action.
            code: PERMISSION_DENIED
  securitySchemes:
    apiKey:
      type: http
      scheme: bearer
      bearerFormat: tck_live_…
      description: Workspace API key minted via POST /api-keys. Read-only.
    sessionJwt:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: >-
        Admin session token (integrations.crm permission). Management endpoints
        only.

````