> ## Documentation Index
> Fetch the complete documentation index at: https://www.posted.cc/llms.txt
> Use this file to discover all available pages before exploring further.

# List workspace API keys and MCP grants

> Returns credential metadata without bearer secrets. Uses a UUID cursor and a maximum limit of 200.

A signed-in human administrator is required. API keys and MCP credentials cannot replace that session. Sensitive operations can also require recent authentication.

Returns credential metadata without bearer secrets. Uses a UUID cursor and a maximum limit of 200.

[Request conventions](https://www.posted.cc/api-reference/overview.md) · [API keys](https://www.posted.cc/api-keys.md) · [MCP connections](https://www.posted.cc/mcp-connections.md)


## OpenAPI

````yaml api-reference/openapi.json GET /api/workspace-credentials
openapi: 3.1.0
info:
  title: Posted HTTP API
  version: 0.2.6
  description: >-
    All registered application, account, OAuth, MCP transport and health
    endpoints. Publishing and draft request schemas come from the shared runtime
    validators. Replace the example server with your installation. Documentation
    uses simple request examples and does not execute live publishing requests.
servers:
  - url: https://posted-api.example.com
security: []
paths:
  /api/workspace-credentials:
    get:
      tags:
        - API key management
      summary: List workspace API keys and MCP grants
      description: >-
        Returns credential metadata without bearer secrets. Uses a UUID cursor
        and a maximum limit of 200.


        A signed-in human administrator is required. API keys and MCP
        credentials cannot replace that session. Sensitive operations can also
        require recent authentication.
      operationId: get_api_workspace_credentials
      parameters:
        - name: workspaceId
          in: query
          required: true
          schema:
            type: string
            format: uuid
          description: >-
            Workspace UUID returned by list_workspaces. Required for Default
            too.
        - name: limit
          in: query
          required: false
          schema:
            type: integer
            minimum: 1
            maximum: 200
          description: integer
        - name: cursor
          in: query
          required: false
          schema:
            type: string
            format: uuid
            pattern: >-
              ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
          description: uuid
      responses:
        '200':
          description: >-
            Successful response. Examples are illustrative; field values vary by
            record.
          content:
            application/json:
              schema:
                type: object
                properties:
                  items:
                    type: array
                    items: {}
                  hasMore:
                    type: boolean
                  nextCursor:
                    type:
                      - string
                      - 'null'
                additionalProperties: true
              example:
                items: []
                hasMore: false
                nextCursor: null
        default:
          description: >-
            Request failure. Inspect code, message and requestId; respect
            Retry-After on HTTP 429.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      security:
        - sessionCookie: []
components:
  schemas:
    Error:
      type: object
      required:
        - error
      properties:
        error:
          type: object
          required:
            - code
            - message
            - requestId
          properties:
            code:
              type: string
            message:
              type: string
            requestId:
              type: string
  securitySchemes:
    sessionCookie:
      type: apiKey
      in: cookie
      name: posted_session
      description: >-
        Signed-in human browser session; mutation requests also need the exact
        UI Origin

````

## Related topics

- [Revoke a workspace API key or MCP grant](https://www.posted.cc/api-reference/delete_api_workspace_credentials_by_id.md)
- [List personal API keys and MCP grants](https://www.posted.cc/api-reference/get_api_credentials.md)
- [Revoke a personal API key or MCP grant](https://www.posted.cc/api-reference/delete_api_credentials_by_id.md)
- [list_workspaces](https://www.posted.cc/mcp-reference/list_workspaces.md)
- [list_workspace_members](https://www.posted.cc/mcp-reference/list_workspace_members.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.