<!--
{
  "documentType" : "article",
  "framework" : "Security",
  "identifier" : "/documentation/Security/search-attribute-keys-and-values",
  "metadataVersion" : "0.1.0",
  "role" : "collectionGroup",
  "title" : "Search attribute keys and values"
}
-->

# Search attribute keys and values

Filter a keychain item search.

## Discussion

When looking for items using any of the [`SecItemCopyMatching(_:_:)`](/documentation/Security/SecItemCopyMatching(_:_:)), [`SecItemUpdate(_:_:)`](/documentation/Security/SecItemUpdate(_:_:)), or [`SecItemDelete(_:)`](/documentation/Security/SecItemDelete(_:)) functions, you specify a `query` dictionary containing both the item attributes to look for (see [Item attribute keys and values](/documentation/Security/item-attribute-keys-and-values)) and additional search attributes that condition the search. For example, you can use the matching key [`kSecMatchLimit`](/documentation/Security/kSecMatchLimit) with value [`kSecMatchLimitOne`](/documentation/Security/kSecMatchLimitOne) to restrict the output to include only the first result even when more than one item matches.

## Topics

### Item search matching keys

Keys used to condition a keychain item search.

[`kSecMatchPolicy`](/documentation/Security/kSecMatchPolicy)

A key whose value indicates a policy with which a matching certificate or identity must verify.

[`kSecMatchItemList`](/documentation/Security/kSecMatchItemList)

A key whose value indicates a list of items to search.

[`kSecMatchSearchList`](/documentation/Security/kSecMatchSearchList)

A key whose value indicates a list of items to search.

[`kSecMatchIssuers`](/documentation/Security/kSecMatchIssuers)

A key whose value is a string to match against a certificate or identity’s issuers.

[`kSecMatchEmailAddressIfPresent`](/documentation/Security/kSecMatchEmailAddressIfPresent)

A key whose value is a string to match against a certificate or identity’s email address.

[`kSecMatchSubjectContains`](/documentation/Security/kSecMatchSubjectContains)

A key whose value is a string to look for in a certificate or identity’s subject.

[`kSecMatchSubjectStartsWith`](/documentation/Security/kSecMatchSubjectStartsWith)

A key whose value is a string to match against the beginning of a certificate or identity’s subject.

[`kSecMatchSubjectEndsWith`](/documentation/Security/kSecMatchSubjectEndsWith)

A key whose value is a string to match against the end of a certificate or identity’s subject.

[`kSecMatchSubjectWholeString`](/documentation/Security/kSecMatchSubjectWholeString)

A key whose value is a string to exactly match a certificate or identity’s subject.

[`kSecMatchCaseInsensitive`](/documentation/Security/kSecMatchCaseInsensitive)

A key whose value is a Boolean indicating whether case-insensitive matching is performed.

[`kSecMatchDiacriticInsensitive`](/documentation/Security/kSecMatchDiacriticInsensitive)

A key whose value is a Boolean indicating whether diacritic-insensitive matching is performed.

[`kSecMatchWidthInsensitive`](/documentation/Security/kSecMatchWidthInsensitive)

A key whose value is a Boolean indicating whether width-insensitive matching is performed.

[`kSecMatchTrustedOnly`](/documentation/Security/kSecMatchTrustedOnly)

A key whose value is a Boolean indicating whether untrusted certificates should be returned.

[`kSecMatchValidOnDate`](/documentation/Security/kSecMatchValidOnDate)

A key whose value indicates the validity date.

[`kSecMatchLimit`](/documentation/Security/kSecMatchLimit)

A key whose value indicates the match limit.

### Match limit values

Keys used to limit the number of results returned.

[`kSecMatchLimitOne`](/documentation/Security/kSecMatchLimitOne)

A value that corresponds to matching exactly one item.

[`kSecMatchLimitAll`](/documentation/Security/kSecMatchLimitAll)

A value that corresponds to matching an unlimited number of items.

### Additional item search keys

Keys used to specify additional keychain item search options.

[`kSecUseItemList`](/documentation/Security/kSecUseItemList)

A key whose value is an array of items to search.

[`kSecUseKeychain`](/documentation/Security/kSecUseKeychain)

A key whose value is a keychain to operate on.

[`kSecUseOperationPrompt`](/documentation/Security/kSecUseOperationPrompt)

A key whose value is an operation prompt.

[`kSecUseNoAuthenticationUI`](/documentation/Security/kSecUseNoAuthenticationUI)

A key whose value is a Boolean indicating whether to disallow UI authentication.

[`kSecUseAuthenticationUI`](/documentation/Security/kSecUseAuthenticationUI)

A key whose value indicates whether the user is prompted for authentication.

[`kSecUseAuthenticationContext`](/documentation/Security/kSecUseAuthenticationContext)

A key whose value indicates a local authentication context to use.

[`kSecUseDataProtectionKeychain`](/documentation/Security/kSecUseDataProtectionKeychain)

A key whose value indicates whether to treat macOS keychain items like iOS keychain items.

### UI authentication values

Values you use to indicate whether to allow UI authentication.

[`kSecUseAuthenticationUIAllow`](/documentation/Security/kSecUseAuthenticationUIAllow)

A value that indicates user authentication is allowed.

[`kSecUseAuthenticationUIFail`](/documentation/Security/kSecUseAuthenticationUIFail)

A value that indicates user authentication is disallowed.

[`kSecUseAuthenticationUISkip`](/documentation/Security/kSecUseAuthenticationUISkip)

A value that indicates items requiring user authentication should be skipped.


---

Copyright &copy; 2026 Apple Inc. All rights reserved. | [Terms of Use](https://www.apple.com/legal/internet-services/terms/site.html) | [Privacy Policy](https://www.apple.com/privacy/privacy-policy)