# List management clients

`GET /v1/management-clients` · permission `management-clients:read`

Returns the management client records of the environment in cursor pages, ordered by `application_id` (descending by default). A record belongs to an application of type `management` and holds its permission ceiling and IP allowlist on the management API. The signing keys of the client are not part of this resource: manage them with `/v1/applications/{application_id}/credentials`. Only an API key can call this endpoint; the environment comes from the key.

## Request

| Parameter | Type | Required | Description |
|---|---|---|---|
| `limit` | integer | no | 1-100, default 20. |
| `after` | string | no | Cursor from `list_metadata.after`. Exclusive with `before`. |
| `before` | string | no | Cursor from `list_metadata.before`. |
| `order` | string | no | `asc` or `desc` (default). A cursor is only valid with the same `order`. |

## Response

`200 OK`

```json
{
  "data": [
    {
      "application_id": "app_01h455vb4pex5vsknk084sn02q",
      "permissions": ["users:read", "users:write"],
      "allowed_cidrs": ["203.0.113.0/24"]
    }
  ],
  "list_metadata": { "before": null, "after": null }
}
```

A `null` cursor means there are no more records in that direction. No total count is returned. Deleting an application removes its record; a record whose application is gone is never listed and is removed when a page reaches it, so a page can hold fewer records than `limit` while `after` is still set. Keep following the cursor.

## Errors

| HTTP | code | When |
|---|---|---|
| 400 | `invalid_cursor` | The cursor is malformed, tampered with, or was issued for another environment or `order`. |
| 403 | `insufficient_permissions` | The credential lacks `management-clients:read`, or it is not an API key. |
| 422 | `validation_failed` | A query parameter is invalid. |

## Example

```bash
curl "https://api.eu.keenauth.com/v1/management-clients?limit=20" \
  -H "Authorization: Bearer $KEENAUTH_SECRET_KEY"
```

CLI: `keenauth management-clients list --limit 20`