Skip to main content
Applies to:
  • Plan -
  • Deployment -

​
Summary

Issue: Org owners cannot programmatically list API key metadata across all users in the organization. GET /v1/api_key returns only the caller’s own keys, even for org owners. Cause: The org-wide key listing logic (makeOwnerApiKeysFullResultSetQuery) is only exposed through UI server actions, not through the public REST API. Resolution: Use the Braintrust UI to audit org-wide API keys. A dedicated read-only endpoint is a tracked feature request with no current ETA.

​
Current behavior

​
Workaround

​
Using the UI

Org owners can view and manage all API keys under Settings → API Keys in the Braintrust UI. This is the only method that lists every key in one place.

​
Using user impersonation

User impersonation is a per-request header, not a token exchange. Authenticate with your own API key and set the x-bt-impersonate-user header to the ID or email of the user whose keys you want to list. GET /v1/api_key then returns that user’s keys instead of your own. Braintrust requires that:
  • The requesting user has the Owners permission group role over all organizations the impersonated user belongs to.
  • The requesting user has the Owner role over all organizations the impersonated user belongs to.
  • The impersonated user belongs to at least one organization.
Responses contain key metadata only, never the key secret. If a user also belongs to an organization you don’t own, impersonating them fails with a 403.