Get an API key's details

GET /api/api-keys/{id}/detail deprecated

Requires: ApiKeyAuthorization.ApiKeys, merchant scope.

Requires API key scope: admin (Administration)

Return the metadata and lifecycle state of an API key with the given id. The key value is never included: it is returned only once, when the key is created. Resolves for the key's owner or an admin; any other caller gets the same 404 as a key that does not exist.

Signed in, you can send this request to your own sandbox merchant from the console and read the answer. Sign in to try it.

Example request

Every block below sends the same request. Replace {{BASE_URL}} with the address of the API you are calling and {{API_KEY}} with your own key.

The request body is a . See the Request body section below for its fields.

cURL PowerShell TypeScript C# Python

cURL

curl -X GET "{{BASE_URL}}/api/api-keys/{id}/detail" \
  -H "api-key: {{API_KEY}}"

PowerShell

$headers = @{
    'api-key' = '{{API_KEY}}'
}

$response = Invoke-RestMethod -Method GET -Uri '{{BASE_URL}}/api/api-keys/{id}/detail' `
    -Headers $headers

npm install @winkpg/winkpg-api

TypeScript (SDK)

import { Configuration, APIKeysApi } from '@winkpg/winkpg-api';

const api = new APIKeysApi(new Configuration({
  basePath: '{{BASE_URL}}',
  apiKey: '{{API_KEY}}',
}));

const { data } = await api.apiKeysGetDetail("3fa85f64-5717-4562-b3fc-2c963f66afa6");

TypeScript (raw HTTP)

const response = await fetch('{{BASE_URL}}/api/api-keys/{id}/detail', {
  method: 'GET',
  headers: {
    "api-key": "{{API_KEY}}",
  },
});

const data = await response.json();

dotnet add package WinkPg.Api.Client

C# (SDK)

using WinkPg.Api.Client.Api;
using WinkPg.Api.Client.Client;

var config = new Configuration { BasePath = "{{BASE_URL}}" };
config.AddApiKey("api-key", "{{API_KEY}}");

var api = new APIKeysApi(config);
var result = await api.ApiKeysGetDetailAsync(Guid.Parse("3fa85f64-5717-4562-b3fc-2c963f66afa6"));

C# (raw HTTP)

using var http = new HttpClient { BaseAddress = new Uri("{{BASE_URL}}") };

var request = new HttpRequestMessage(new HttpMethod("GET"), "/api/api-keys/{id}/detail");
request.Headers.Add("api-key", "{{API_KEY}}");

var response = await http.SendAsync(request);
response.EnsureSuccessStatusCode();
var json = await response.Content.ReadAsStringAsync();

pip install winkpg-api

Python (SDK)

import winkpg_api

configuration = winkpg_api.Configuration(host="{{BASE_URL}}")
configuration.api_key["ApiKey"] = "{{API_KEY}}"

with winkpg_api.ApiClient(configuration) as client:
    api = winkpg_api.APIKeysApi(client)
    result = api.api_keys_get_detail("3fa85f64-5717-4562-b3fc-2c963f66afa6")

pip install requests

Python (raw HTTP)

import requests

headers = {
    "api-key": "{{API_KEY}}",
}

response = requests.request(
    "GET",
    "{{BASE_URL}}/api/api-keys/{id}/detail",
    headers=headers,
)
response.raise_for_status()
data = response.json()

Parameters

Name In Type Description

id required

path

string (uuid)

Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.

suppressNulls required

query

boolean

If true, omit properties with null values.

Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.

Request body

application/json , required

Field	Type	Description

This request body has no documented fields.

Responses

200 OK

Body: ApiKeyDetailDto ApiKeyDetailDto Each item has these fields.

Field Type Description

id required

string (uuid)

Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.

name required

string

Gets or sets the display name of the API key. nullable

Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.

active required

boolean

Gets or sets a value indicating whether the API key is marked active. An inactive key is rejected at authentication regardless of its expiry.

Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.

expireAt required

string (date-time)

Gets or sets the expiration date for the API key. Null indicates the key does not expire. nullable

Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.

userId required

string (uuid)

Gets or sets the user ID that owns this API key.

Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.

keyPrefix required

string

Gets or sets the leading characters of the key value, safe to display. `null` for a key minted before hashed storage that the rewrap has not reached. nullable

Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.

last4 required

string

Gets or sets the trailing characters of the key value, safe to display. `null` for a key the rewrap has not reached. nullable

Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.

environment required

ApiKeyEnvironment ApiKeyEnvironment

Gets or sets which world the key acts in, or `null` when it has never been stamped. nullable

Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.

`Test`	The key acts against the processor's test host. No live money moves. Minted with the sk_test_ prefix.
`Live`	The key acts against the processor's live host. Minted with the sk_live_ prefix.

status required

ApiKeyStatus ApiKeyStatus

Gets or sets the key's administrative state. Resolved at the projection boundary, so a key that predates the field arrives as `Active` rather than unset.

Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.

`Active`	The key is in service. Whether it is currently accepted also depends on its expiry.
`Revoked`	The key has been revoked and is rejected at authentication for good. Revoked keys are retained rather than deleted so the audit trail of what the key did survives it.
`Suspended`	The key has been put out of service temporarily, pending someone deciding whether the use that triggered it was legitimate. Rejected at authentication exactly as a revoked key is, and reinstatable, which is the whole reason it is not one.

revokedAt required

string (date-time)

Gets or sets when the key was revoked, or `null` if it has not been. nullable

Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.

revokedBy required

string (uuid)

Gets or sets who revoked the key, or `null` if it has not been revoked. nullable

Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.

revocationReason required

string

Gets or sets the reason recorded at revocation, when one was given. nullable

Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.

suspendedAt required

string (date-time)

Gets or sets when the key was suspended, or `null` when it is not suspended. nullable

Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.

suspendedBy required

string (uuid)

Gets or sets who suspended the key, or `null` when the platform did or the key is not suspended. Read alongside `suspensionReason`, which says which of the two a null means. nullable

Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.

suspensionReason required

string

Gets or sets why the key was suspended, when it is. nullable

Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.

anomalySourceAction required

ApiKeyAnomalyAction ApiKeyAnomalyAction

Gets or sets this key's own action for an anomalous source, or `null` when it follows the merchant default. nullable

Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.

`LogOnly`	Write the detection to the security log and the metrics and do nothing else. The default, and what a deployment should stay on until its own traffic has been looked at.
`Notify`	Log it and tell the key's owner. The key keeps working: the person who can tell a new office from a stolen credential is the one holding it, so this asks them rather than deciding.
`Suspend`	Log it, tell the owner, and put the key into Suspended so it stops authenticating until somebody reinstates it. Containment ahead of confirmation, which is the right trade only for a merchant that has decided a stalled integration costs less than a credential in the wrong hands.

merchantId required

string (uuid)

Gets or sets the merchant this key was minted for, or `null` when it is not tied to one. nullable

Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.

replacesKeyId required

string (uuid)

Gets or sets the key this one was minted to replace, or `null` when it was not created by a rotation. nullable

Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.

replacedByKeyId required

string (uuid)

Gets or sets the key minted to replace this one, or `null` when it has not been rotated. nullable

Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.

overlapExpiresAt required

string (date-time)

Gets or sets when this key's rotation overlap closes and it stops authenticating, or `null` when it is not in one. Retained after the key is revoked, because the lineage is history. nullable

Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.

isRevoked required

boolean

Gets a value indicating whether the key has been revoked. read only

Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.

isSuspended required

boolean

Gets a value indicating whether the key is suspended, which is reversible, as opposed to revoked, which is not. read only

Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.

isInRotationOverlap required

boolean

Gets a value indicating whether this key is currently inside a rotation overlap: rotated, still in service, and not yet past the window. read only

Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.

hasRotationLineage required

boolean

Gets a value indicating whether this key was minted as a replacement for an earlier one, or has itself been replaced. Either makes it part of a rotation chain worth showing. read only

Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.

creationTime required

string (date-time)

Gets or sets the UTC time the key was created.

Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.

lastModificationTime required

string (date-time)

Gets or sets the UTC time the key record was last modified, when it has been modified. nullable

Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.

lastUsedAt required

string (date-time)

Gets or sets the UTC time the key was last used to authenticate a request, or `null` when it has no recorded use. Covers every kind of API activity, not just transactions. nullable

Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.

recentSourceIps required

array of ApiKeySourceIpDto array of ApiKeySourceIpDto

Gets or sets the addresses the key has recently authenticated from, most recently seen first. Empty when none have been recorded. nullable

Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.

Fields of each ApiKeySourceIpDto:

Field Type Description

address required

string

Gets or sets the address, as the request pipeline resolved it. nullable

Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.

firstSeenAt required

string (date-time)

Gets or sets the UTC time this address was first recorded for the key.

Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.

lastSeenAt required

string (date-time)

Gets or sets the UTC time this address was most recently recorded for the key.

Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.

This body has no documented fields.

allowedCidrs required

array of string array of

Gets or sets the source addresses this key is permitted to authenticate from, as CIDR ranges or bare addresses. Empty means the key is not bound to any and may be used from anywhere. nullable

Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.

isAddressRestricted required

boolean

Gets a value indicating whether the key is bound to a set of source addresses. read only

Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.

scopes required

array of string array of

Gets or sets the capability scopes this key is restricted to. Empty means the key is unrestricted and may reach everything its owning account can. nullable

Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.

isScopeRestricted required

boolean

Gets a value indicating whether the key is restricted to a set of capability scopes. read only

Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.

isExpired required

boolean

Gets a value indicating whether the key's expiry has already passed. A key with no expiry never reports as expired. read only

Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.

hasRotationOverlapLapsed required

boolean

Gets a value indicating whether the key's rotation overlap has closed, so it is refused at authentication even while its stored status still reads active. read only

Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.

isUsable required

boolean

Gets a value indicating whether the key would currently be accepted at authentication: in service, marked active, not past its expiry, and not past a rotation overlap. read only

Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.

This response has no documented body fields.

403 Forbidden

Body: RemoteServiceErrorResponse RemoteServiceErrorResponse Each item has these fields.

Field Type Description

error required

RemoteServiceErrorInfo RemoteServiceErrorInfo

Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.

This response has no documented body fields.

401 Unauthorized

Body: RemoteServiceErrorResponse RemoteServiceErrorResponse Each item has these fields.

Field Type Description

error required

RemoteServiceErrorInfo RemoteServiceErrorInfo

Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.

This response has no documented body fields.

400 Bad Request

Body: RemoteServiceErrorResponse RemoteServiceErrorResponse Each item has these fields.

Field Type Description

error required

RemoteServiceErrorInfo RemoteServiceErrorInfo

Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.

This response has no documented body fields.

404 Not Found

Body: RemoteServiceErrorResponse RemoteServiceErrorResponse Each item has these fields.

Field Type Description

error required

RemoteServiceErrorInfo RemoteServiceErrorInfo

Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.

This response has no documented body fields.

501 Not Implemented

Body: RemoteServiceErrorResponse RemoteServiceErrorResponse Each item has these fields.

Field Type Description

error required

RemoteServiceErrorInfo RemoteServiceErrorInfo

Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.

This response has no documented body fields.

500 Internal Server Error

Body: RemoteServiceErrorResponse RemoteServiceErrorResponse Each item has these fields.

Field Type Description

error required

RemoteServiceErrorInfo RemoteServiceErrorInfo

Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.

This response has no documented body fields.

default The request failed. The body carries the standard error envelope: a machine-readable `error.code`, a human-readable `error.message`, and `error.validationErrors` when the failure was a validation rejection. The error reference lists the values `error.code` can take. The request failed. The body carries the standard error envelope: a machine-readable `error.code`, a human-readable `error.message`, and `error.validationErrors` when the failure was a validation rejection. The error reference lists the values `error.code` can take.

Body: RemoteServiceErrorResponse RemoteServiceErrorResponse Each item has these fields.

Field Type Description

error required

RemoteServiceErrorInfo RemoteServiceErrorInfo

Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.

This response has no documented body fields.

429 The request was refused because a rate limit was exceeded, or because something a later retry can clear stopped it. A rate limit refusal carries an `application/problem+json` body: wait at least the interval `Retry-After` names before retrying, then back off. Limits are tuned per deployment, so read the allowance from the response headers rather than assuming a fixed ceiling. Any other refusal carries the standard error envelope as `application/json`, and its `error.code` names the cause.

Body: RemoteServiceErrorResponse RemoteServiceErrorResponse Each item has these fields.

Field Type Description

error required

RemoteServiceErrorInfo RemoteServiceErrorInfo

Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.

This response has no documented body fields.

Errors

A failed request returns the platform error envelope. The error reference lists every value error.code can carry and shows the four response shapes.

Codes declared by

The API reference isn't available right now

No such operation

This reference may be out of date

Get an API key's details

Example request

Parameters

Request body

Responses

200 OK

403 Forbidden

401 Unauthorized

400 Bad Request

404 Not Found

501 Not Implemented

500 Internal Server Error

Errors

Authentication