> ## Documentation Index > Fetch the complete documentation index at: /docs/llms.txt > Use this file to discover all available pages before exploring further. # Retrieve a management key > Retrieves the metadata for an existing management key by its unique identifier. The raw secret is never returned — only `token_prefix`, `permission_mode`, and lifecycle fields. > [!NOTE] > > **Guia relacionado**: guia de Chaves de gerenciamento. Consulte o guia de Chaves de gerenciamento para um passo a passo com exemplos. ## OpenAPI ````yaml get /v2/management-keys/{management_key_id} openapi: 3.1.0 info: title: Toqan Router API version: '2.0' description: Toqan Router API documentation servers: - url: https://router.toqan.ai/eu description: Frankfurt (Europe) - url: https://router.toqan.ai/br description: São Paulo (Brazil) security: - ApiKey: [] tags: - description: >- API keys authenticate programmatic access to the workspace. They expose opaque tokens, per-domain access grants, and budget and rate-limit constraints. name: API keys - name: Logs description: >- OpenTelemetry log query API. Search, filter, aggregate, and facet log records ingested via OTLP. - name: Reporting description: >- GenAI reporting API over canonical analytics rollups. Accepts a metric name, time range, grain, group-by, and filters; returns a typed time series and optional totals. - name: Telemetry description: >- Unified query envelope for traces, metrics, and logs. One request shape, one filter dialect, and one response shape per source, validated by a per-source registry. - name: Traces description: >- Query and inspect ingested trace data: search trace summaries, aggregate metrics, and read individual traces and their spans. - name: Views description: Saved filters and columns for workspace observability pages. - description: List models available through the AI Router. name: Models - name: Alerts description: >- Alerts evaluate a telemetry metric on a fixed interval and fire notifications through notifiers when the value breaches a threshold. Each breach opens a trigger that tracks the incident until the value recovers. - name: Annotation Queues description: Annotation queues collect spans for human review. - name: Budgets description: >- Budgets govern spend, token usage, and request rate across six scopes: workspace, project, identity, API key, provider, and model. Every applicable budget is enforced, and the most restrictive limit applies per dimension. - name: Files description: File upload and retrieval operations. - name: Guardrail Rules description: >- Guardrail Rules conditionally enforce evaluators and plugins for AI Gateway traffic. Rules may be scoped to a project or the whole workspace. - name: Identities description: >- Identities represent end users from your system for usage and engagement tracking. - name: Management keys description: >- Management keys are workspace-scoped credentials that authenticate programmatic access to workspace administration surfaces (API keys, budgets). Unlike project-scoped API keys, a management key always operates at the workspace level. - name: MCP Gateway description: >- Register upstream MCP servers, discover and sync their tools, and assemble gateways that expose a curated tool surface to MCP clients. - name: Model Catalog description: >- Browse the Toqan Router model catalog: every model Toqan Router offers, across every provider, with pricing, capabilities and benchmark data. List endpoints only return models that are not deprecated. This API is public, requires no authentication, and is rate limited to 120 requests per minute per IP. Responses carry a 5-minute cache-control max-age. - name: Monitors description: >- Monitors are custom observability dashboards for traces, runtime metrics, and logs. Each monitor holds widgets that chart one telemetry query. List the metrics, operations, and dimensions available to your workspace with `GET /v3/telemetry/capabilities`, or start from a preset with `GET /v2/monitors/presets`. - name: Notifiers description: Notifier destinations used to send delivery and workflow notifications. - name: Routing Rules description: >- Routing Rules conditionally select models and enforce request plugins for AI Gateway traffic. Rules are evaluated by ascending priority and may be scoped to a project or the whole workspace. - name: Threads description: Threads group related trace invocations and their aggregate usage - name: Smart Routers description: >- Create and manage workspace Smart Routers. A Smart Router selects a model from an eligible pool for each request according to a quality, balanced, or cost profile. - name: Responses - name: Embeddings - description: Beta. Run typed classification questions against a classify model. name: Classify - description: Beta. Run classification decisions with the classify contract. name: Decisions - description: >- Run large offline workloads as JSONL batches and download OpenAI-compatible result files. name: Batches paths: /v2/management-keys/{management_key_id}: get: tags: - Management keys summary: Retrieve a management key description: >- Retrieves the metadata for an existing management key by its unique identifier. The raw secret is never returned — only `token_prefix`, `permission_mode`, and lifecycle fields. operationId: ManagementKeyGet parameters: - name: management_key_id in: path description: Management key id to retrieve (e.g. `01H...`). required: true schema: type: string responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/GetManagementKeyResponse' '401': description: >- Authentication required. See https://router.toqan.ai/docs/reference/errors for the error codes. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '403': description: >- Not permitted for this key, project or workspace. See https://router.toqan.ai/docs/reference/errors for the error codes. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' security: - ApiKey: [] components: schemas: GetManagementKeyResponse: required: - management_key type: object properties: management_key: allOf: - $ref: '#/components/schemas/ManagementKey' description: Requested management-key. Raw token never included. ErrorResponse: type: object properties: message: type: string description: Human-readable error message. code: type: integer description: Numeric error code, when one is available. details: type: array items: {} description: Additional error details, when the service reports any. required: - message ManagementKey: required: - management_key_id - name - permission_mode - token_prefix - status - created_at - updated_at type: object properties: management_key_id: type: string description: |- Canonical key identifier (ULID). Embedded in opaque tokens as `sk-orq--`. name: type: string description: Human-readable name shown in the dashboard. permission_mode: $ref: '#/components/schemas/ManagementPermissionMode' description: |- Permission preset. `all` and `read_only` resolve at auth time from the management capability catalog. `restricted` reads the per-domain `access` map. access: type: object additionalProperties: $ref: '#/components/schemas/AccessLevel' description: |- Per-domain access map. Only populated when `permission_mode` is `MANAGEMENT_PERMISSION_MODE_RESTRICTED`. The authoritative list of valid keys (Domain.id values) is returned by the List management capability catalog endpoint (GET /v2/management-keys/capabilities). token_prefix: type: string description: |- Displayable prefix for UI listings (e.g. "sk-orq-01HXY..."). Safe to expose. status: $ref: '#/components/schemas/ManagementKeyStatus' description: Lifecycle status. created_by_id: type: string description: 'Audit: user who created the key.' updated_by_id: type: string description: 'Audit: user who last updated the key.' created_at: type: string description: Time the key was created. format: date-time updated_at: type: string description: Time the key was last updated. format: date-time last_used_at: type: string description: Last authenticated use. format: date-time expires_at: type: string description: |- Optional expiration. Keys whose `expires_at` is in the past are rejected when used. Unset means the key never expires. format: date-time description: |- ManagementKey defines permissions, expiration, and revocation for a management key. Management keys are always workspace-scoped — there is no project_scope field, and they have no per-user owner (every management key is workspace-owned; `created_by_id` records who created it). ManagementPermissionMode: type: string enum: - MANAGEMENT_PERMISSION_MODE_ALL - MANAGEMENT_PERMISSION_MODE_RESTRICTED - MANAGEMENT_PERMISSION_MODE_READ_ONLY AccessLevel: type: string enum: - ACCESS_LEVEL_NONE - ACCESS_LEVEL_READ - ACCESS_LEVEL_WRITE ManagementKeyStatus: type: string enum: - MANAGEMENT_KEY_STATUS_ACTIVE - MANAGEMENT_KEY_STATUS_DISABLED - MANAGEMENT_KEY_STATUS_REVOKED securitySchemes: ApiKey: type: http scheme: bearer bearerFormat: JWT ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.