> ## Documentation Index
> Fetch the complete documentation index at: https://hs-df36fa00.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# List All Stored Auth Contexts — GET /v1/auth-contexts

> List stored auth context records, filtered by provider_id or subject_did. Tokens are shown as masked previews only — the full token is never returned.

Returns all `AuthContextRecord` objects, optionally filtered by provider or subject DID. Token values are always masked — use this endpoint to inspect credential metadata, not to retrieve secrets.

## Query Parameters

<ParamField query="provider_id" type="string">
  Return only auth contexts scoped to this provider.
</ParamField>

<ParamField query="subject_did" type="string">
  Return only auth contexts owned by this subject DID.
</ParamField>

## Response

Returns `{ "items": [AuthContextRecord] }`.

<ResponseField name="items" type="array">
  Array of `AuthContextRecord` objects matching the query.

  <Expandable title="AuthContextRecord">
    <ResponseField name="auth_context_id" type="string (UUID)" required>
      The opaque identifier used to reference this credential in invocations.
    </ResponseField>

    <ResponseField name="secret_ref" type="string (UUID)" required>
      Internal reference to the encrypted secret in the secret broker.
    </ResponseField>

    <ResponseField name="subject_did" type="string" required>
      The DID of the subject who owns this auth context.
    </ResponseField>

    <ResponseField name="provider_id" type="string" required>
      The provider this auth context is scoped to.
    </ResponseField>

    <ResponseField name="auth_model" type="object" required>
      The auth model for this credential (e.g. `{ "mode": "bearer_token" }`).
    </ResponseField>

    <ResponseField name="token_preview" type="string" required>
      A masked preview of the stored token. The full token is never returned.
    </ResponseField>

    <ResponseField name="created_at" type="string (ISO 8601)" required>
      UTC timestamp when this auth context was created.
    </ResponseField>

    <ResponseField name="expires_at" type="string (ISO 8601)">
      Expiry timestamp, if one was set at registration.
    </ResponseField>
  </Expandable>
</ResponseField>

## Examples

### List all auth contexts for a provider

```bash theme={null}
curl 'http://your-node:8042/v1/auth-contexts?provider_id=acme-labs'
```

### List all auth contexts for a subject DID

```bash theme={null}
curl 'http://your-node:8042/v1/auth-contexts?subject_did=did:key:z6MkhaXgBZDvotD1X9gRrYkM5Xq9jYQqK6d8r8bQdE1mV2Xa'
```

### Example response

```json theme={null}
{
  "items": [
    {
      "auth_context_id": "018f5a1b-2d3e-7f80-b9c0-1a2b3c4d5e6f",
      "secret_ref": "018f5a1b-9999-7f80-dead-beef00000000",
      "subject_did": "did:key:z6MkhaXgBZDvotD1X9gRrYkM5Xq9jYQqK6d8r8bQdE1mV2Xa",
      "provider_id": "acme-labs",
      "auth_model": { "mode": "bearer_token" },
      "token_preview": "my-s••••••••••",
      "created_at": "2025-01-15T12:00:00Z"
    }
  ]
}
```