# Get a management client

`GET /v1/management-clients/{application_id}` · permission `management-clients:read`

Returns the management client record of one application. The response carries an `ETag` header; send it as `If-Match` to update or delete the record. Only an API key can call this endpoint.

## Request

| Parameter | In | Description |
|---|---|---|
| `application_id` | path | Application ID (`app_…`). |

## Response

`200 OK`

```json
{
  "application_id": "app_01h455vb4pex5vsknk084sn02q",
  "permissions": ["users:read", "users:write"],
  "allowed_cidrs": ["203.0.113.0/24"]
}
```

## Errors

| HTTP | code | When |
|---|---|---|
| 403 | `insufficient_permissions` | The credential lacks `management-clients:read`, or it is not an API key. |
| 404 | `not_found` | The application has no record in this environment. |

## Example

```bash
curl -i https://api.eu.keenauth.com/v1/management-clients/app_01h455vb4pex5vsknk084sn02q \
  -H "Authorization: Bearer $KEENAUTH_SECRET_KEY"
```

CLI: `keenauth management-clients get app_01h455vb4pex5vsknk084sn02q` (the ETag is printed to stderr).