---
id: w4/m13/t003
title: Surface metadata — REST/GraphQL/MCP api-keys lists + dashboard columns
worker: worker4
status: done
estimate: 25m
depends_on: [w4/m13/t002]
---

## Objective

Expose `created-by` and `last-used` everywhere keys are listed: the apikeys REST/GraphQL/MCP list responses (additive fields — existing clients unaffected) and the m8 dashboard API-keys page (created/last-used columns, "never used" state rendered honestly).

## Context

- Fragments: `lego/backend/internal/apikeys/{rest,graphql,mcp}.go`; dashboard page from w4/m8 (`dashboard/src/` settings surface).
- Additive-field discipline: bex extensions ride the existing envelope; docs/ADR006-bex-api.md's api-keys section gains the two fields.

## Steps

1. Add the fields to the list view model + three fragments; docs/ADR006-bex-api.md update.
2. Dashboard columns + relative-time rendering; "never" for null last-used.

## Files

- `lego/backend/internal/apikeys/{service,rest,graphql,mcp}.go`
- `dashboard/src/` (m8 API-keys page)
- `docs/ADR006-bex-api.md`

## Acceptance criteria

- [x] All three API surfaces and the dashboard show identical metadata for the same key; a never-used key reads "never", not a zero time.

## Out of scope

- Sorting/filtering by last-used (add only if trivial); rotation UX.
