# Get local key issuance capability

```{raw} html
<div class="mo-api-page-show-toc" aria-hidden="true"></div>
```

Check whether the environment permits issuing TaaS local token keys.

```text
GET https://billing.moi.matrixorigin.cn/api/v1/taas/token-keys/capabilities
```

## Before you begin

Prepare a personal access token. For creation and management, see [Manage personal access tokens](../../../../../guides/billing/credentials.md#personal-access-token).

Results are scoped to data accessible to the current user.

## Request example

Replace `$MOI_PERSONAL_ACCESS_TOKEN` in the example with your personal access token.

```bash
curl --get "https://billing.moi.matrixorigin.cn/api/v1/taas/token-keys/capabilities" \
  -H "X-API-Key: $MOI_PERSONAL_ACCESS_TOKEN"
```

## Successful response

Returns HTTP `200` with the current local key issuance setting.

:::::::{div} mo-api-tabs mo-api-response-tabs
::::::{tab-set}
:::::{tab-item} Response example

```json
{
  "local_user_token_keys_enabled": false
}
```

:::::
:::::{tab-item} Fields

| Field | Type | Description |
| --- | --- | --- |
| `local_user_token_keys_enabled` | boolean | Whether issuing, updating, rotating, and re-enabling TaaS local keys is allowed. Existing keys can still be read, `revoked`, or deleted when `disabled`. |

:::::
::::::
:::::::

This switch applies to TaaS local keys. Personal access tokens and service-account keys have separate issuance controls.