> ## Documentation Index
> Fetch the complete documentation index at: https://docs.base44.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API keys, entities, functions, and secrets

> Credential hygiene, data model, backend function, and secret metadata endpoints in the Compliance API

All endpoints on this page require `compliance:inventory:read`.

## API keys

`GET /{workspace_id}/api-keys`

Returns a credential-hygiene inventory of the workspace's API keys. It contains metadata only, never key material. The key you hold appears here, which is intentional: the customer's inventory is complete, and you can verify your own key's scopes.

| Field | Type | Notes |
| - | - | - |
| `id` | string | Matches `actor_id` on this API's audit records. |
| `name`, `description` | string, string or null | |
| `key_prefix` | string | Non-secret prefix, such as `b44k_a3f9c`. |
| `scopes[]` | array of strings | Fully resolved: the key's own scopes, plus the scopes its `permission` grants while the key can act as the workspace owner. A pre-scoping legacy key reports its effective set, never empty. |
| `permission` | string or null | `full_access` or `read_only` when the key acts as the workspace owner across the workspace's public API. The scopes it grants are listed in `scopes[]`. Null when the key holds only its scopes. |
| `status` | string | `active` or `disabled`. Disabled keys stay listed. |
| `created_date`, `created_by_email` | timestamp or null, string | |
| `last_used_at` | timestamp or null | Hourly and asynchronous, so approximate. |
| `disabled_at` | timestamp or null | |
| `expires_at` | null | Always null, because keys don't expire today. |

## Entities

`GET /{workspace_id}/entities`

Returns one row per app and entity: the app's data-model schemas with their row-level security posture. It contains schema metadata only, never records, and never enum values, defaults, or descriptions, which can embed customer data.

| Field | Type | Notes |
| - | - | - |
| `id` | string | `{app_id}:{entity_name}`. |
| `app_id` | string | |
| `entity_name` | string | One row per entity the app defines. |
| `fields[]` | array | `{ name, type }` only. The type is null when untyped. |
| `rls.create`, `rls.read`, `rls.update`, `rls.delete` | string | `"open"` or `"restricted"` per operation. |
| `field_level_rls` | boolean | Any field carries its own rule. |

The classification is resolved the way the engine resolves it. Update and delete inherit from write and then read, create never inherits, and a rule the write gate can't evaluate is reported open, because it doesn't in fact restrict the write.

The raw rule shape is deliberately not returned, because rules embed customer literals. A rule such as `{ "data.tenant_id": "acme-corp-42" }` is customer data rather than structure. Tell Base44 if you need rule detail. It can only be added, never changed.

## Functions

`GET /{workspace_id}/functions`

Returns one row per deployed backend function, including actors, which are stateful handlers reached over WebSocket. The two are distinguished by `kind`. Source is never returned.

| Field | Type | Notes |
| - | - | - |
| `id` | string | `{app_id}:{name}`. |
| `app_id` | string | |
| `name` | string | Also the route segment. |
| `url` | string or null | The function's route on the app's serving hostname, `https://{serving_hostname}/functions/{name}`, using the same hostname reported in [Apps](https://docs.base44.com/developers/references/compliance-api/get-started/apps-and-domains.md). `/api/functions/{name}` is an equivalent alias. Null when the app has no resolvable hostname. |
| `kind` | string | `"function"` or `"actor"`. |
| `internet_reachable` | boolean | Constant true, because no exposure toggle exists. |
| `auth_required` | null | Always null, because it's enforced inside function code rather than platform config. See [Security findings](https://docs.base44.com/developers/references/compliance-api/get-started/security-findings.md). |
| `triggers[]` | array | `{ type, is_active }`. Automatic invokers, from automations and workflows. |
| `required_app_user_connector_ids[]` | array of strings | Connectors an end user must connect for the function to run. |

> [!NOTE]
>
> **How to read triggers:**
>
> * An empty list means no automatic invoker rather than an unused function. A function called from the app's own UI has none, and its exposure is `url` plus `internet_reachable`.
> * Archived workflows are excluded. Paused ones appear with `is_active` set to false, since a paused workflow is one click from firing.
> * The `type` field passes the stored value through. Automations use `scheduled`, `entity`, and `connector`. Workflows add `webhook`, which is externally reachable over HTTP and worth treating as an external surface, plus `in_app_agent`, `app_user_auth`, `app_publish`, `app_payment`, and `goal_file`. Expect further values as new trigger types ship.

## Secrets

`GET /{workspace_id}/secrets`

Returns a metadata union of app-scoped and workspace-scoped secrets. Value fields don't exist in the response at all, and the values are never loaded to produce it.

| Field | Type | Notes |
| - | - | - |
| `id` | string | |
| `scope` | string | `"app"` or `"workspace"`. |
| `app_id` | string or null | Null for workspace-scoped secrets. |
| `name` | string | Secret name only. |
| `created_date`, `created_by` | timestamp, string | The creating user's email. |
| `last_updated_at` | timestamp or null | Rotation proxy: the last time the value was written. See [Privacy and gaps](https://docs.base44.com/developers/references/compliance-api/get-started/privacy-and-gaps.md). |
| `encryption_mode` | string | `fernet` or `kms_envelope`. |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.