Skip to main content
GET
/
v1
/
workspaces
/
{workspace_id}
/
byok-keys
/
{byok_key_id}
Get BYOK key
import requests

url = "https://api.auriko.ai/v1/workspaces/{workspace_id}/byok-keys/{byok_key_id}"

headers = {"Authorization": "Bearer <token>"}

response = requests.get(url, headers=headers)

print(response.text)
{
  "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "workspace_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "provider": "<string>",
  "name": "<string>",
  "key_prefix": "<string>",
  "is_default": true,
  "disabled": true,
  "created_at": "2023-11-07T05:31:56Z",
  "updated_at": "2023-11-07T05:31:56Z",
  "account_tier": "<string>",
  "last_validated_at": "2023-11-07T05:31:56Z"
}
Requires byok:read scope. Naturally idempotent.
The response is redacted metadata only — a masked key_prefix and coarse validation_status, never the provider secret or provider diagnostics.
The response may carry propagation_status: "pending" while a change to this key’s provider takes effect (within about 5 minutes).
All parameters, request/response schemas, and examples are auto-generated from the OpenAPI specification.

Authorizations

​
Authorization
string
header
required

API key authentication. Keys start with ak_ prefix. Example: Authorization: Bearer ak_live_xxxxxxxxxxxx

Path Parameters

​
workspace_id
string<uuid>
required

Workspace identifier

​
byok_key_id
string<uuid>
required

BYOK key identifier

Response

OK

BYOK key metadata. Redacted — the provider secret is never returned.

​
id
string<uuid>
required

Unique identifier for the BYOK key

​
workspace_id
string<uuid>
required

Workspace this key belongs to

​
provider
string
required

Provider identifier

​
name
string
required

Human-readable name for the key

​
key_prefix
string
required

Masked display prefix of the submitted secret

​
is_default
boolean
required

Whether this key is the provider's default for routing

​
disabled
boolean
required

Disabled keys are excluded from routing; the secret stays encrypted at rest

​
validation_status
enum<string>
required

Coarse validation status (no provider diagnostics)

Available options:
valid,
pending,
invalid,
error
​
created_at
string<date-time>
required
​
updated_at
string<date-time>
required
​
account_tier
string | null

Provider account tier used for rate-limit and data-policy routing

​
account_tier_source
enum<string> | null

How the tier was determined

Available options:
auto_detected,
user_specified,
fallback,
null
​
last_validated_at
string<date-time> | null

When the key last passed validation (null if never)

​
propagation_status
enum<string> | null

"pending" while a routing-affecting change for this key's provider is committed but edge propagation has not yet been applied

Available options:
pending,
null