## List Bitrix24 account API keys `GET /v1/keys` Returns the management key owner's API keys on the specified Bitrix24 account: personal keys and application authorization keys. ## Parameters | Parameter | Type | Required | Description | |----------|-----|:-----:|----------| | `portalId` (query) | string | yes | Bitrix24 account ID. List: [`GET /v1/portals`](/docs/management-keys/portals). The management key owner must be a member of this account | No pagination: the response contains all of the owner's keys on the account, newest first. ## Examples The request accepts only a management key — see [Limitations](/docs/management-keys#limitations). ### curl — management key ```bash curl "https://vibecode.bitrix24.com/v1/keys?portalId=0d9f7744-f853-47c7-b06e-6f61f9dd1b7f" \ -H "X-Api-Key: YOUR_MANAGEMENT_KEY" ``` ### JavaScript — management key ```javascript const portalId = '0d9f7744-f853-47c7-b06e-6f61f9dd1b7f' const res = await fetch(`https://vibecode.bitrix24.com/v1/keys?portalId=${portalId}`, { headers: { 'X-Api-Key': 'YOUR_MANAGEMENT_KEY', }, }) const { success, data } = await res.json() const activeKeys = data.filter((key) => key.status === 'ACTIVE') console.log('Active keys:', activeKeys.length) ``` ## Response fields | Field | Type | Description | |------|-----|----------| | `success` | boolean | Always `true` on success | | `data` | array | Array of keys | | `data[].id` | string | Key record ID. Accepted by [`GET /v1/keys/:id`](/docs/management-keys/get) and by endpoints that take a key as a resource — for example, `targetApiKeyId` in [bot ownership transfer](/docs/bots/management/transfer) | | `data[].name` | string | Key name set at creation | | `data[].prefix` | string | First characters of the key value | | `data[].suffix` | string | Last four characters of the key value | | `data[].type` | string | Key record type, always `APP` | | `data[].userId` | string | Key owner ID | | `data[].portalId` | string | Bitrix24 account ID | | `data[].clientId` | string \| null | OAuth client ID, if recorded on the key. Otherwise `null` | | `data[].scopes` | array | Key [scopes](/docs/scopes) | | `data[].ipWhitelist` | array | Allowed IP addresses. An empty array means no restriction | | `data[].expiresAt` | string \| null | Expiration date (ISO 8601), `null` — no expiration | | `data[].rateLimit` | number \| null | Individual request limit for AI endpoints, `null` — the platform-wide limit | | `data[].status` | string | `ACTIVE`, `REVOKED`, `EXPIRED` or `BLOCKED` | | `data[].lastUsedAt` | string \| null | Date of the last request made with this key (ISO 8601) | | `data[].createdAt` | string | Creation date (ISO 8601) | | `data[].updatedAt` | string | Date of the last update (ISO 8601) | | `data[].accessMode` | string | `READWRITE` or `READONLY` | | `data[].totalDefault` | boolean \| null | Whether `meta.total` is returned in lists requested with this key. `null` — the platform setting applies | | `data[].issuedVia` | string \| null | Channel through which the key's webhook was issued: `per-portal` and `cloud-shared` — the connector module on the Bitrix24 account, `dev_key` — the owner's developer key, `legacy` — registration through Bitrix24 Network, `none` — no webhook was created, the key has only `vibe:*` permissions. `null` if the channel is not recorded | | `data[].b24Ready` | boolean \| null | Whether the key has working credentials for requests to Bitrix24. `null` for an application authorization key and for a key with only `vibe:*` scopes | ## Response example ```json { "success": true, "data": [ { "id": "6dbad0ce-79a9-43f5-8ca4-3e1af7ef63bc", "name": "CRM integration", "prefix": "vibe_api_XXXXXXXXX", "suffix": "XXXX", "type": "APP", "userId": "fafa9780-eed7-4d29-b040-2448d924f452", "portalId": "0d9f7744-f853-47c7-b06e-6f61f9dd1b7f", "clientId": null, "scopes": ["crm", "task", "im", "vibe:ai", "vibe:search", "vibe:storage"], "ipWhitelist": [], "expiresAt": null, "rateLimit": null, "status": "ACTIVE", "lastUsedAt": "2026-10-23T10:01:53.371Z", "createdAt": "2026-10-14T07:07:00.732Z", "updatedAt": "2026-10-23T10:01:53.371Z", "accessMode": "READWRITE", "totalDefault": null, "issuedVia": "cloud-shared", "b24Ready": true }, { "id": "ef0b2172-aa01-445c-815c-f8ce82559d5e", "name": "Application authorization key", "prefix": "vibe_app_XXXXXXXXX", "suffix": "XXXX", "type": "APP", "userId": "fafa9780-eed7-4d29-b040-2448d924f452", "portalId": "0d9f7744-f853-47c7-b06e-6f61f9dd1b7f", "clientId": null, "scopes": ["crm", "vibe:infra", "vibe:ai", "vibe:search", "vibe:storage"], "ipWhitelist": [], "expiresAt": null, "rateLimit": null, "status": "REVOKED", "lastUsedAt": null, "createdAt": "2026-08-27T06:36:58.910Z", "updatedAt": "2026-08-27T06:37:01.459Z", "accessMode": "READWRITE", "totalDefault": null, "issuedVia": null, "b24Ready": null } ] } ``` ## Error response example 400 — `portalId` was not sent: ```json { "success": false, "error": { "code": "MISSING_PORTAL_ID", "message": "Query parameter portalId is required" } } ``` ## Errors | HTTP | Code | Description | |------|-----|----------| | 400 | `MISSING_PORTAL_ID` | The `portalId` parameter was not sent | | 403 | `NOT_PORTAL_MEMBER` | The management key owner is not a member of the Bitrix24 portal with the given `portalId` | | 403 | `PORTAL_ACCESS_BLOCKED` | The owner's access to the Bitrix24 portal is disabled: their membership is inactive or denied by the portal's access policy | | 403 | `MANAGEMENT_SCOPE_REQUIRED` | The management key lacks the `vibe:mgmt:keys` scope | | 401 | `WRONG_KEY_TYPE` | The request was sent with a Bitrix24 account key — a personal `vibe_api_` key or a `vibe_app_` authorization key. The endpoint accepts only a management key | | 401 | `KEY_INACTIVE` | The management key has been revoked or blocked | | 401 | `KEY_EXPIRED` | The management key has expired | | 401 | `INVALID_API_KEY` | No key with the given value was found | | 401 | `MISSING_API_KEY` | The `X-Api-Key` header was not sent | The `OWNER_DELETED`, `OWNER_BLOCKED` and `ACCOUNT_PENDING_ERASURE` refusals depend on the key owner's account — see [Owner account state](/docs/management-keys#owner-account-state). The full list of common API errors — [Errors](/docs/errors). ## Known specifics **Inactive keys in the list.** The response includes revoked, expired and blocked keys. Working keys are the elements with `status: "ACTIVE"`. **The key value is not returned.** The `prefix` and `suffix` fields do not authorize requests: they help you recognize your key in the list. The key value arrives once — in the response to [creation](/docs/management-keys/create) or [rotation](/docs/management-keys/rotate). ## See also - [Get an API key](/docs/management-keys/get) - [Create an API key](/docs/management-keys/create) - [Update an API key](/docs/management-keys/update) - [Delete an API key](/docs/management-keys/delete) - [Rotate an API key](/docs/management-keys/rotate) - [List Bitrix24 accounts](/docs/management-keys/portals) - [Management keys](/docs/management-keys)