List API keys

GET https://rest.haasapi.com/v1/whitelabel/keys

Returns this partner’s API keys for calling /v1/whitelabel, newest first, each masked to its first 8 characters. The full token is shown only once, when the key is created.

Requires the whitelabel scope.

Example request

curl "https://rest.haasapi.com/v1/whitelabel/keys" \
  -H "Authorization: Bearer hk_live_YOUR_KEY"

Response

200 OK. Returns a PartnerKeys.

{
  "data": [
    {
      "id": "3f7c1e90-4a2b-4c8d-9e10-6b5a2f1d0c34",
      "api_key": "hk_live_-****-****-****-************",
      "label": "production",
      "scopes": "whitelabel",
      "ip_allow_list": "",
      "enabled": true,
      "created_at": "2026-08-28T19:04:11Z",
      "last_used_at": "2026-09-01T08:22:47Z"
    }
  ]
}

Fields

PartnerKeys

The public contract for GET /v1/whitelabel/keys - this partner’s own API keys for calling /v1/whitelabel programmatically. These are modern hk_ keys (the same credential /v1 authenticates with), Partner-scoped and tied to the partner’s own account. The secret is shown only once, at creation (POST /v1/whitelabel/keys -> V1PartnerKeyCreatedDto); every read here is masked to the first 8 characters.

Field	Type	Description
data	array of PartnerKey	This partner’s API keys, masked. The full token is only ever returned once, when the key is created.

PartnerKey

Field	Type	Description
id	string	The key identifier - pass it to DELETE /v1/whitelabel/keys/{key_id} to revoke the key.
api_key	string	The key, masked: the first 8 characters then asterisks. The full token is never shown after creation.
label	string, nullable	The name you gave the key when creating it. null if none.
scopes	string	The key’s scopes. Always whitelabel for a partner key.
ip_allow_list	string	Comma-separated IPs/CIDR ranges the key is restricted to; empty if unrestricted.
enabled	boolean	Whether the key is currently active.
created_at	string	When the key was created. RFC 3339 UTC.
last_used_at	string, nullable	When the key was last used to authenticate. RFC 3339 UTC; null if never used.

Errors

All errors are RFC 9457 problem documents.

Status	Description
400	The request is malformed (invalid limit, unusable cursor, …). (code: invalid_request)
401	Missing, malformed, disabled, or revoked API key. (code: invalid_api_key)
500	An unexpected error inside the API. Nothing about the request caused it; retry, and quote the instance value if it persists. (code: internal_error)
502	An internal service answered in a way the API could not serve. Retry. (code: upstream_error)
503	The request could not be served right now. Retry with the same key - do not discard it. (code: temporarily_unavailable)
504	An internal service did not answer within the deadline. Retry with backoff. (code: upstream_timeout)

{
  "type": "https://docs.haasapi.com/errors/invalid_request",
  "title": "Invalid request",
  "status": 400,
  "detail": "The request is malformed (invalid limit, unusable cursor, …).",
  "code": "invalid_request"
}