Inspect a workspace integration without exposing secrets.
Owner, Finance, Operations and Security can inspect one workspace’s API key, website and webhook metadata through GET /v1/admin/integrations. A separate admin session and current verification by the exact active passkey are required. Customer write workflows and financial authority remain separate.
01Choose the exact workspace
workspaceId is required. kind is keys, websites or webhooks and defaults to keys. Optional id is an exact record UUID. Pages default to 25 and permit at most 50 records. Ascending record-ID cursors bind the workspace, kind and exact ID filter; use nextCursor as after without changing them. Current workspace names and checkedAt identify the live inspection scope.
02Read masked key metadata
Key access uses the same projection as the customer dashboard: revoked/expired status, current creator membership and bound website proof are considered. Only the masked prefix, last four characters, supported scopes, quota metadata and lifecycle times are returned. No token hash or retrievable secret is selected. The current-minute key count is separate from session, route and shared workspace quotas. Sending authority is not available through these testnet read and order keys. Authentication still performs its own current checks.
03Inspect the original website proof
Website rows include current origin/state/revision, verification kind, checked time and validity. Domain proof can be current, expired, not_active or not_verified. Synthetic proof is accepted only in isolated test mode, as in the customer predicate. DNS challenge tokens are excluded. A current domain proof alone does not authorize a financial transaction or production receiving.
04Read webhook states with the right denominator
Webhook records show the saved endpoint state, origin-only destination, original website, revision and retained successful test time/provider. Destination paths and queries, signing secrets, event bodies and HTTP response bodies are withheld. Per-endpoint counters partition current delivery states, including endpoint tests and merchant events; retries and replays update an original delivery rather than establishing a new paid order. Counts are exact strings. The delivery worker retains its independent website, membership, secret and test validation.
05Follow the original owner workflows
Admin Users & workspaces links to /integrations?workspaceId={id}; key and webhook records can open their exact website metadata. This read endpoint cannot issue, reveal, rotate or revoke keys, send tests, replay deliveries, change website state or grant spending authority. Use the original customer configuration and audited operational workflows. Recovery quarantine and private no-store responses apply.
// Current verified operator admin session required.
GET /v1/admin/integrations?workspaceId={workspaceId}&kind=keys
GET /v1/admin/integrations?workspaceId={workspaceId}&kind=keys&after={nextCursor}
GET /v1/admin/integrations?workspaceId={workspaceId}&kind=websites&id={websiteId}
GET /v1/admin/integrations?workspaceId={workspaceId}&kind=webhooks
// Metadata only. sendingAvailable is false.
// No secret-reveal, financial override or delivery mutation route.Open your workspace