API referenceKeys
List child keys
GET /v1/keys
GET https://api.healthcare.dev/v1/keysYour account's child keys, active ones and those revoked in the last 90 days, newest first, with this month's calls and spend for each. Never returns the secrets. Call with a parent key; works on every plan, so child keys stay visible after a downgrade.
Requires an API key: Authorization: Bearer hdev_live_.... See Authentication.
Examples
curl
curl "https://api.healthcare.dev/v1/keys" \
-H "Authorization: Bearer $HDEV_API_KEY"TypeScript
const res = await fetch("https://api.healthcare.dev/v1/keys", {
headers: { Authorization: `Bearer ${process.env.HDEV_API_KEY}` },
});
const { data, meta } = await res.json();Python
import os
import requests
res = requests.get("https://api.healthcare.dev/v1/keys", headers={"Authorization": f"Bearer {os.environ['HDEV_API_KEY']}"})
body = res.json()Try it
Response
Child keys
{
"data": [
{
"id": "string",
"name": "string",
"prefix": "string",
"env": "live",
"scopes": [
"codes"
],
"rps_limit": 1,
"monthly_cap_cents": 1,
"month_to_date": {
"calls": 1,
"spend_cents": 1
},
"created_at": "string",
"last_used_at": "string",
"revoked_at": "string"
}
],
"meta": {
"source": "cms-icd10",
"data_version": "2026.1",
"retrieved_at": "2026-10-24T12:00:00Z",
"license": "Public domain (CMS). Reference data, not medical advice."
},
"links": {
"self": "/v1/keys",
"next": "/v1/keys?cursor=eyJrIjoiRTExLjkifQ"
}
}Fields
| Field | Type | Always present | Description |
|---|---|---|---|
id | string | yes | |
name | string | yes | |
prefix | string | yes | The key's public prefix (hdev_live_k3j9x2ab), never the secret |
env | "live" | "test" | yes | |
scopes | KeyScope[] | yes | Route groups it may call; null for every group except webhooks |
rps_limit | integer | null | yes | Its own requests-a-second limit, if set |
monthly_cap_cents | integer | null | yes | Its monthly spend cap, if set |
month_to_date | object | yes | Usage so far this month; it also counts toward the account's own usage |
created_at | string | yes | |
last_used_at | string | null | yes | |
revoked_at | string | null | yes |
Errors
Errors are application/problem+json (RFC 9457). Branch on type, not on title. See Errors.
| Status | type | When |
|---|---|---|
| 401 | unauthorized | Missing, malformed or revoked API key. |
| 403 | plan-upgrade-required | The plan doesn't include this feature; required_plan names the plan that does. |
| 429 | rate-limited / quota-exceeded | Too many requests per second (retry after Retry-After), or the monthly quota is used up. |