Get keys of brand

GET

/brands/{brand}/keys

const url = 'https://api-uat.flinkey.de/v3/brands/example/keys';
const options = {
  method: 'GET',
  headers: {'flinkey-API-Key': '<flinkey-API-Key>', Authorization: 'Bearer <token>'}
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url https://api-uat.flinkey.de/v3/brands/example/keys \
  --header 'Authorization: Bearer <token>' \
  --header 'flinkey-API-Key: <flinkey-API-Key>'

Purpose

Retrieve available keys for one specific vehicle brand for keyfob matching.

The keyfob area helps determine which key fits to a car.

Use this operation after retrieving available brands with Get brands.

The response contains key and key form information that can be used for keyfob matching, setup and operational support workflows.

When to use this operation

Use this operation when the partner backend or operational backend needs to retrieve key options for a selected vehicle brand.

Typical situations:

continuing a keyfob selection workflow after brand selection,
supporting operational keybed or keyfob matching,
identifying available key forms for a vehicle brand,
retrieving box-related information for a key,
validating whether a selected brand has matching key data,
supporting vehicle setup or support workflows.

For standard access flows, partner backends usually work primarily with Car, User and Assignment.

Use keyfob operations for key matching, setup and support workflows.

Validation notes

The request succeeded with 200 OK without a Customer-ID header.
$top, $skip, $orderby=id desc and the nested filter $filter=keyForm/id eq {keyFormId} were validated successfully.
Multiple result entries can share the same keyForm while representing different box, KPC, IXL, CAN or retrofit-set variants through boxName and boxSapNumber.
The top-level entry ID identifies a catalog combination and is not equivalent to keyForm.id.
CAN and IOX-Keybox catalog entries can be returned but are outside the standard BLE integration scope.
Treat boxSapNumber and imageUrl as opaque strings in normal partner integrations.

Async behavior

Synchronous.

The key list is returned directly in the API response.

Webhook result

No.

This operation does not produce a webhook result.

Security notes

Never log:

flinkey-API-Key,
bearer token,
full request headers.

Use placeholders in documentation, examples, screenshots and AI prompts.

For standard partner integrations, the mobile app must not receive API Manager credentials, backend bearer tokens or the flinkey-API-Key.

Authorizations

apiKey
bearerAuth

Parameters

Path Parameters

brand

required

string

Vehicle brand name

Header Parameters

Customer-ID

string

Not required for this operation

Responses

200

Keys for the selected brand were retrieved successfully

application/json

Array<object>

object

Key database ID

number

brand

Vehicle brand name

string

boxName

Box name associated with the key

string | null

boxSapNumber

Box SAP number associated with the key

string | null

keyForm

Key form information

object

keyForm.id

Key form database ID

number

keyForm.name

Key form name

string

keyForm.imageUrl

Image URL for the key form

string

Example

[
  {
    "id": "KEY-001",
    "brand": "Volkswagen",
    "boxName": "flinkey Box A1",
    "boxSapNumber": "SAP-BOX-001",
    "keyForm": {
      "id": "KF-001",
      "name": "Standard Key",
      "imageUrl": "https://example.com/keyform.png"
    }
  }
]

400

Invalid brand was provided

Recommended handling: Check the brand path parameter and use a brand returned by Get brands

401

Invalid subscription key or missing / invalid access token

Recommended handling: Check flinkey-API-Key, bearer token and environment configuration

404

The given brand could not be found

Recommended handling: Check whether the brand exists and whether the brand value was encoded correctly in the URL

500

Server-side error

Recommended handling: Retry later if appropriate and escalate if persistent