# The kept keys that may act for the domain, for you

> The kept keys that may act for the domain, for you: CustomDomain™ API reference in the provider accounts group. Covers parameters, request body and responses.

Source: https://docs.customdomain.ai/docs/api-reference/provider-accounts/getConnectionSavedAccess

## `GET https://api.customdomain.ai/v1/connections/{id}/saved-access`

The saved access resolver's answer for the connection's domain: the workspace's kept provider keys that may write its records for the caller, best first, with no sign in and no new key. The same answer is `rails.saved_access` on `POST /domains:check`, and the console's Connect page offers it first. Its rules, in order: the key is at the domain's provider (`?provider=` asks about another than the one detected), kept (`continuous`) and still working (a key that is only nearing its end counts); an API key caller gets the workspace's keys that serve the connection's application and that it may use (an admin, an owner or the key's maker), never a key an end user's own sign in made; a key whose scope holds the domain's zone is `ready`; otherwise a key made at a secure sign in a member started in the console may be offered with `ready: false`, after one read with it showed it reaches the zone (at most 3 reads a call, each answer kept 10 minutes), and using it adds the zone to its scope. One entry per provider account. An end user's widget token gets an empty list.

### Authentication

`widgetJWT`, `apiKey`, `agentToken`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `id` | path | string | yes |  |
| `provider` | query | string | no | A provider id other than the one detected for the domain. |

### Responses

| Status | Description |
| --- | --- |
| `200` | The saved access, best first |
| `401` | Error envelope: {code, title, details}. |
| `403` | Error envelope: {code, title, details}. |
| `404` | Error envelope: {code, title, details}. |

### `200` response body

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `saved_access` | array of object | yes |  |

The full specification is served at `GET https://api.customdomain.ai/v1/openapi.json`.