Skip to content
Kindgi

List secret metadata

GET
/v1/secrets
curl --request GET \
  --url 'https://example.com/v1/secrets?envName=example&scopeKind=tenant&inherit=true&limit=25' \
  --header 'Authorization: Bearer <token>'

Cursor-paginated list of secret metadata at the given (scope, envName). value is ALWAYS absent (structural redaction).

Authorizations

Section titled “Authorizations”

Parameters

Section titled “Parameters”

Query Parameters

Section titled “Query Parameters”
envName
required

Per-environment slug. [a-z][a-z0-9-]{0,62} — RFC-1035-like label.

string
/^[a-z][a-z0-9-]{0,62}$/

[a-z][a-z0-9-]{0,62}. Required on every env + secrets route.

scopeKind
required

Discriminator for the ?scopeKind + ?scopeId + ?inherit triplet. Tenant carries no id (implicit from session); org/project require scopeId.

string
Allowed values: tenant org project

Required on every env + secrets route. Tenant carries no scopeId; org / project require scopeId.

scopeId
string
>= 1 characters

Required IF scopeKind is org or project. MUST be absent if scopeKind=tenant (tenant is implicit from the session). Malformed combinations return 400 scope-invalid.

inherit
boolean
default: true

Default true. false = literal-at-this-scope only (admin/audit view). Load-bearing for policy/config-scoped resources (mcp-endpoints); documented no-op for content-scoped resources (agents/flows/tools/…).

limit
integer
default: 25 >= 1 <= 100

1..100. Default 25.

cursor
string

Opaque cursor from a prior response. Absent → first page.

namePrefix
string

Prefix match on entry name.

Responses

Section titled “Responses”

200

Section titled “200”

Page of secret metadata.

Media typeapplication/json
object
data
required
Array<object>
object
scope
required
One of:
object
kind
required
string
Allowed values: tenant
tenantId
required
string
envName
required

Per-environment slug. [a-z][a-z0-9-]{0,62} — RFC-1035-like label.

string
/^[a-z][a-z0-9-]{0,62}$/
name
required
string
currentVersion
required
integer
createdAt
required
string format: date-time
updatedAt
required
string format: date-time
revokedAt
string format: date-time
revokeReason
string
tags
object
key
additional properties
string
rotationDueAt
string format: date-time
nextCursor
string
Example
{
  "data": [
    {
      "scope": {
        "kind": "tenant"
      }
    }
  ]
}

400

Section titled “400”

Missing or malformed scope / envName.

Media typeapplication/json
object
error
required
object
code
required

Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).

string
message
required
string
details

Optional, kind-specific.

object
key
additional properties
any
requestId
required

Server-assigned request id; also echoed via X-Request-Id header.

string
Examplegenerated
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}

401

Section titled “401”

Missing / malformed / expired / revoked bearer token.

Media typeapplication/json
object
error
required
object
code
required

Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).

string
message
required
string
details

Optional, kind-specific.

object
key
additional properties
any
requestId
required

Server-assigned request id; also echoed via X-Request-Id header.

string
Examplegenerated
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}