List keys (paginated, no secret data).

get

https://staging.ankatech.co/api/v3/key-management/keys

Retrieves ONE PAGE of the tenant's keys. Secret fields (e.g. privateKey)
are omitted. Filters (origin/restricted/kty/status) apply server-side
BEFORE pagination: totalElements is the filtered count. size is capped
at 200 (400 on violation, never clamped). A page beyond the last page
yields an empty content array with the true totals (HTTP 200).

Recent Requests

Time	Status	User Agent
Retrieving recent requests…

Loading…

Query Params

origin

string

enum

Filter by key origin, using the SAME token a key's origin field carries in the response. Absent or empty means no filter. Any other value is rejected with 400.

Allowed:

restricted

boolean

Filter by restriction status

kty

string

enum

Filter by key type, using the SAME token a key's kty field carries in the response: ML-KEM, ML-DSA, SLH-DSA, FALCON, XMSS, LMS, HQC, FRODO, CMCE, BIKE, SABER, NTRU, NTRUPRIME, RSA, EC, OKP, oct, SM2, GOST-EC, and COMPOSITE for every hybrid pairing. A composite key publishes one coarse token; its pairing is named by alg and its construction by compositeMode. Absent or empty means no filter. Any other value is rejected with 400.

status

string

enum

Filter by key lifecycle status, using the SAME token a key's status field carries in the response: active, pending_rotation, rotated, expired, revoked, archived, deleted_logical, suspended, pending_destruction. Absent or empty means no filter. Any other value is rejected with 400.

page

int32

≥ 0

Defaults to 0

Zero-based page index.

size

int32

1 to 200

Defaults to 25

Page size (1..200). Values above 200 are REJECTED with 400, never clamped.

Headers

string

enum

Defaults to application/json

Generated from available response content types

Allowed:

Responses

Language

Credentials

Bearer

JWT

URL

Loading…

Response

Click Try It! to start a request and see the response here! Or choose an example:

application/json

application/problem+json

200Page of keys listed successfully.

401Unauthorized: missing or invalid JWT token.

403Forbidden: authenticated user lacks the required scope.

404Resource not found: keystore unavailable or missing.

413Payload Too Large: response would exceed server limits.

500Internal Server Error: unexpected error while listing keys.

502Bad Gateway: the key administration service is unavailable (connection failure, upstream 5xx, or circuit breaker open).

504Gateway Timeout: the key administration service did not respond within the per-operation S2S read deadline.