> ## Documentation Index
> Fetch the complete documentation index at: https://docs.airctrl.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# List accessible records

> Returns record metadata across the active account. It never returns plaintext secret values. Human PATs and Service Account tokens are supported.



## OpenAPI

````yaml /api-reference/openapi.json get /records
openapi: 3.0.0
info:
  title: AIRCTRL API
  description: >-
    Programmatic access to AIRCTRL. Record values are encrypted by the client,
    so the API stores ciphertext and encrypted keys instead of plaintext record
    values.
  version: '1'
  contact: {}
servers:
  - url: https://api.airctrl.dev/v1
    description: Production
security: []
tags:
  - name: Context
    description: Find the accounts available to the caller.
  - name: Projects
    description: Create and manage projects.
  - name: Records
    description: Store and use client-encrypted records.
  - name: Audit
    description: Read record activity and access history.
  - name: Providers
    description: Discover supported AI providers.
  - name: Provider Credentials
    description: Manage encrypted provider credentials.
  - name: Gateways
    description: Create and operate AI gateways.
  - name: Usage
    description: Read gateway usage and spend data.
  - name: Service Accounts
    description: Read Service Account metadata and grant records.
paths:
  /records:
    get:
      tags:
        - Records
      summary: List accessible records
      description: >-
        Returns record metadata across the active account. It never returns
        plaintext secret values. Human PATs and Service Account tokens are
        supported.
      operationId: RecordsController_list
      parameters:
        - name: x-account-id
          required: true
          in: header
          schema:
            type: string
        - name: tab
          required: false
          in: query
          schema:
            type: string
        - name: includeArchived
          required: false
          in: query
          schema:
            type: string
        - name: limit
          required: false
          in: query
          schema:
            type: string
        - name: offset
          required: false
          in: query
          schema:
            type: string
      responses:
        '200':
          description: Accessible record metadata.
          content:
            application/json:
              schema:
                type: object
                properties:
                  ok:
                    type: boolean
                    enum:
                      - true
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/RecordMetadata'
                required:
                  - ok
                  - data
                additionalProperties: false
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '429':
          $ref: '#/components/responses/RateLimited'
        '500':
          $ref: '#/components/responses/InternalError'
      security:
        - personal-access-token: []
        - service-account-token: []
components:
  schemas:
    RecordMetadata:
      type: object
      properties:
        record_id:
          type: string
          format: uuid
        name:
          type: string
        secret_format:
          type: string
          enum:
            - plain
            - json
            - env
            - password
            - api_key
            - database
            - ssh
            - certificate
            - oauth_client
            - cloud_iam
            - service_account
            - webhook
            - license
            - totp
        state:
          type: string
          enum:
            - active
            - locked
            - archived
        tags:
          type: array
          items:
            type: string
        secret_due_at:
          type: string
          format: date-time
          nullable: true
        created_at:
          type: string
          format: date-time
        updated_at:
          type: string
          format: date-time
        rotated_at:
          type: string
          format: date-time
          nullable: true
        rotation_interval_days:
          type: integer
          minimum: 1
          nullable: true
        project_id:
          type: string
          format: uuid
        project_name:
          type: string
          nullable: true
        owner_user_id:
          type: string
          format: uuid
        owner_username:
          type: string
          nullable: true
        owner_display_name:
          type: string
          nullable: true
        owner_tone:
          type: string
          nullable: true
        shared_count:
          type: integer
          minimum: 0
        last_event_at:
          type: string
          format: date-time
          nullable: true
        last_access_at:
          type: string
          format: date-time
          nullable: true
      additionalProperties: false
      required:
        - record_id
        - name
        - secret_format
        - state
        - tags
        - secret_due_at
        - created_at
        - updated_at
        - rotated_at
        - rotation_interval_days
        - project_id
        - project_name
        - owner_user_id
        - owner_username
        - owner_display_name
        - owner_tone
        - shared_count
        - last_event_at
        - last_access_at
    ErrorEnvelope:
      type: object
      properties:
        ok:
          type: boolean
          enum:
            - false
        error:
          type: object
          properties:
            code:
              type: string
              description: Stable error category.
            message:
              type: string
              description: Plain-language reason for the failure.
            details:
              description: Optional validation or error details.
          additionalProperties: false
          required:
            - code
            - message
        requestId:
          type: string
          description: Request identifier to include when contacting support.
      additionalProperties: false
      required:
        - ok
        - error
      description: Standard AIRCTRL error response.
  responses:
    Unauthorized:
      description: >-
        The token is missing, invalid, expired or cannot authenticate this
        request.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorEnvelope'
          example:
            ok: false
            error:
              code: unauthorized
              message: Authentication is required
            requestId: req_example
    Forbidden:
      description: >-
        The authenticated principal does not have the required permission or
        resource access.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorEnvelope'
          example:
            ok: false
            error:
              code: forbidden
              message: not_authorized
            requestId: req_example
    RateLimited:
      description: The caller exceeded the API request limit. Wait before retrying.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorEnvelope'
          example:
            ok: false
            error:
              code: rate_limited
              message: Too many requests
            requestId: req_example
    InternalError:
      description: >-
        AIRCTRL could not complete the request. Retry later and keep the request
        ID for support.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorEnvelope'
          example:
            ok: false
            error:
              code: internal_error
              message: Internal server error
            requestId: req_example
  securitySchemes:
    personal-access-token:
      scheme: bearer
      bearerFormat: JWT
      type: http
      description: Human personal access token (`sk-actrl-pat-...`).
    service-account-token:
      scheme: bearer
      bearerFormat: JWT
      type: http
      description: Service Account token (`sk-actrl-sa-...`).

````