# get_api_key

Fetch one API key by UUID without revealing the secret. Use this to inspect scopes, defaults, limits, expiration, and reset state before changing access.

Agent View of the PolicyLayer registry record for `get_api_key`. HTML page: https://policylayer.com/tools/codeswhat-portkey-admin-mcp/get-api-key

## Facts

- Tool: `get_api_key`
- Server: Portkey Admin (`codeswhat/portkey-admin-mcp`) — https://policylayer.com/tools/codeswhat-portkey-admin-mcp.md
- Homepage: https://github.com/CodesWhat/portkey-admin-mcp
- Risk category: Read (Low risk)
- Registry record: grade F, identity unverified
- Server rate-limited: no
- Parameters: 0
- Recommended policy verdict: Allowed

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "get_api_key",
    "arguments": {}
  }
}
```

## Why get_api_key is rated Low

This is a Read operation as it retrieves and inspects API key metadata (scopes, defaults, limits, expiration, reset state) without modifying data. Severity is medium because while it doesn't directly expose secrets, API key metadata could be used to understand access patterns or inform targeted attacks, and reading API key information is sensitive in administrative contexts.

From the tool's own definition: "Tool description states 'Fetch one API key by UUID without revealing the secret' - a retrieval operation. However, API keys are security-sensitive credentials and examining them could inform privilege escalation attacks."

## Use case

AI agents call get_api_key to retrieve information from Portkey Admin without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

## Recommended policy (PolicyLayer)

Verdict: **Allowed**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Portkey Admin:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "get_api_key": {}
  }
}
```

## Other tools on Portkey Admin (155)

- `cancel_log_export` — Destructive — https://policylayer.com/tools/codeswhat-portkey-admin-mcp/cancel-log-export.md
- `delete_api_key` — Destructive — https://policylayer.com/tools/codeswhat-portkey-admin-mcp/delete-api-key.md
- `delete_collection` — Destructive — https://policylayer.com/tools/codeswhat-portkey-admin-mcp/delete-collection.md
- `delete_config` — Destructive — https://policylayer.com/tools/codeswhat-portkey-admin-mcp/delete-config.md
- `delete_guardrail` — Destructive — https://policylayer.com/tools/codeswhat-portkey-admin-mcp/delete-guardrail.md
- `delete_integration` — Destructive — https://policylayer.com/tools/codeswhat-portkey-admin-mcp/delete-integration.md
- `delete_integration_model` — Destructive — https://policylayer.com/tools/codeswhat-portkey-admin-mcp/delete-integration-model.md
- `delete_mcp_integration` — Destructive — https://policylayer.com/tools/codeswhat-portkey-admin-mcp/delete-mcp-integration.md
- `delete_mcp_server` — Destructive — https://policylayer.com/tools/codeswhat-portkey-admin-mcp/delete-mcp-server.md
- `delete_prompt` — Destructive — https://policylayer.com/tools/codeswhat-portkey-admin-mcp/delete-prompt.md
- `delete_prompt_label` — Destructive — https://policylayer.com/tools/codeswhat-portkey-admin-mcp/delete-prompt-label.md
- `delete_prompt_partial` — Destructive — https://policylayer.com/tools/codeswhat-portkey-admin-mcp/delete-prompt-partial.md
- `delete_provider` — Destructive — https://policylayer.com/tools/codeswhat-portkey-admin-mcp/delete-provider.md
- `delete_rate_limit` — Destructive — https://policylayer.com/tools/codeswhat-portkey-admin-mcp/delete-rate-limit.md
- `delete_secret_reference` — Destructive — https://policylayer.com/tools/codeswhat-portkey-admin-mcp/delete-secret-reference.md
- `delete_usage_limit` — Destructive — https://policylayer.com/tools/codeswhat-portkey-admin-mcp/delete-usage-limit.md
- `delete_user` — Destructive — https://policylayer.com/tools/codeswhat-portkey-admin-mcp/delete-user.md
- `delete_user_invite` — Destructive — https://policylayer.com/tools/codeswhat-portkey-admin-mcp/delete-user-invite.md
- `delete_virtual_key` — Destructive — https://policylayer.com/tools/codeswhat-portkey-admin-mcp/delete-virtual-key.md
- `delete_workspace` — Destructive — https://policylayer.com/tools/codeswhat-portkey-admin-mcp/delete-workspace.md
- `remove_workspace_member` — Destructive — https://policylayer.com/tools/codeswhat-portkey-admin-mcp/remove-workspace-member.md
- `run_prompt_completion` — Execute — https://policylayer.com/tools/codeswhat-portkey-admin-mcp/run-prompt-completion.md
- `start_log_export` — Execute — https://policylayer.com/tools/codeswhat-portkey-admin-mcp/start-log-export.md
- `test_mcp_server` — Execute — https://policylayer.com/tools/codeswhat-portkey-admin-mcp/test-mcp-server.md
- `download_log_export` — Read — https://policylayer.com/tools/codeswhat-portkey-admin-mcp/download-log-export.md
- `get_analytics_group_metadata` — Read — https://policylayer.com/tools/codeswhat-portkey-admin-mcp/get-analytics-group-metadata.md
- `get_analytics_group_models` — Read — https://policylayer.com/tools/codeswhat-portkey-admin-mcp/get-analytics-group-models.md
- `get_analytics_group_users` — Read — https://policylayer.com/tools/codeswhat-portkey-admin-mcp/get-analytics-group-users.md
- `get_cache_hit_latency` — Read — https://policylayer.com/tools/codeswhat-portkey-admin-mcp/get-cache-hit-latency.md
- `get_cache_hit_rate` — Read — https://policylayer.com/tools/codeswhat-portkey-admin-mcp/get-cache-hit-rate.md
- …and 125 more: https://policylayer.com/tools/codeswhat-portkey-admin-mcp.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=codeswhat-portkey-admin-mcp · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/codeswhat-portkey-admin-mcp