# List Server Credentials

Your tenant's server credentials, newest first — active, expired and revoked.

## Overview

- Each credential with its public key, its thumbprint, its role, allow-list and expiry, who made and last changed it, when a token of it was last accepted, its revocation, and `roleNarrows` — whether its role decides which routes its tokens reach (`true` for a credential registered since 6 October 2026; [What a Credential's Role Reaches](https://docs.aureahub.com/docs/guide-server-credentials.md)). There is no private key to show: Aurea never has one. How credentials work: [Server Credentials](https://docs.aureahub.com/docs/guide-server-credentials.md).
- `status`: `active` (its tokens are accepted), `expired` (past `expiresAt`) or `revoked`. Filter with `status` (default `all`); page with `limit` (1–100, default 50) and `cursor`, the previous page's `nextCursor` (`null` on the last page). A cursor this list didn't give answers `400` `SERVER_CREDENTIAL_CURSOR_INVALID` (`cursor is not one this list gave`).
- For the tenant roles `owner`, `tenantadmin`, `non_signing_admin` and `security_admin` ([Roles](https://docs.aureahub.com/docs/authentication.md)), on their own tenant.

## Endpoint

### `GET /v1/admin/tenants/{id}/server-credentials`

Authentication: bearer token required.

The tenant's server credentials, newest first.

**Path parameters**

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `id` | string | yes | Tenant UUID |

**Query parameters**

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `status` | string | no | `all` (default), `active`, `expired` or `revoked` |
| `limit` | integer | no | 1–100, default 50 |
| `cursor` | string | no | The previous page's `nextCursor` |

**Responses**

`200` OK

```json
{
  "data": [
    {
      "id": "2f6d8a4e-1c3b-4e5f-9a7d-0b2c4e6f8a1c",
      "tenantId": "6f1e2d3c-4b5a-4968-8776-a5b4c3d2e1f0",
      "name": "Payments server",
      "role": "signer",
      "status": "active",
      "publicKey": {
        "kty": "EC",
        "crv": "P-256",
        "x": "kTxt6XgA4C3r8RE3iDiksXglx-XqsKZBKcJXz8xb9Bg",
        "y": "2UOzdwbCN0bU_vBmtae1dx458v3t1PXqowMQIp9qahU"
      },
      "thumbprint": "eh1D5t_soPjcyGjYMXEeNtyTxia1As4QO91SxspJPfM",
      "allowedIps": ["203.0.113.0/24"],
      "expiresAt": "2027-10-06T00:00:00.000Z",
      "createdAt": "2026-10-06T08:40:12.307Z",
      "createdBy": "5d2c1b0a-9e8f-4a7b-8c6d-5e4f3a2b1c0d",
      "updatedAt": "2026-10-06T08:40:12.307Z",
      "updatedBy": "5d2c1b0a-9e8f-4a7b-8c6d-5e4f3a2b1c0d",
      "lastUsedAt": "2026-10-06T09:02:55.871Z",
      "revokedAt": null,
      "revokedBy": null,
      "revokeReason": null,
      "roleNarrows": true
    }
  ],
  "nextCursor": null
}
```

`403` Another tenant

```json
{ "statusCode": 403, "error": "ForbiddenError", "message": "Admin access required or you can only access your own tenant." }
```

---

Web version: https://docs.aureahub.com/#server-credentials-list