# Read the env a deployment's pack service is to be given

GET

/v1/system/tenants/{tenantId}/deployments/{deploymentId}/pack-env

```sh
curl --request GET \
  --url 'https://example.com/v1/system/tenants/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/deployments/example/pack-env?secrets=values' \
  --header 'Authorization: Bearer <token>'
```

For whatever runs the deployment’s pack service: where each name its pack declares is set (at the deployment’s project, then its org, then the tenant, at the env the server serves), and the values when nothing stands in the way. A name set both ways (`pack-env-ambiguous`), a required one set nowhere (`pack-env-missing`), or one set only as a secret whose value wasn’t asked for (`pack-env-secret-not-yet`) is a `problem`, and then no value is given. With `secrets=values`, each name set only as a secret is given in `secrets`, read at the version its revision names; a secret that can’t be read for a reason the platform fixes is `pack-env-secret-unreadable`, and then no value is given. Each value given out is on the audit record, a secret’s written before the answer. Refused for a retired deployment (`endpoint-retired`) and a closing or suspended tenant. On a key of its own, `system:pack-env`: `system:deployments` reads no value, and `kindgi:system` no secret’s.

## Authorizations

- **[bearerAuth](https://docs.kindgi.com/reference/api.md#bearerauth)**

## Parameters

### Path Parameters

**tenantId**

required

string format: uuid

The tenant’s id (a UUID).

**deploymentId**

required

string

\>= 1 characters <= 128 characters

The deployment’s id, as `GET /v1/system/deployments` lists it.

### Query Parameters

**secrets**

string

Allowed values: values

`values`: give the values of the names set only as a secret too, in `secrets`, each audited before the answer. Only for a key holding `system:pack-env` itself. Left out: such a name is `pack-env-secret-not-yet`, and no secret is read.

## Responses

### 200

Where each name is set, and the values when there is no problem.

application/json

What the deployment’s pack service is to be given: where each declared name is set, and the values when nothing stands in the way, plain ones in `env` and, when asked for (`secrets=values`), secrets in `secrets`. Each value given out is on the audit record: `env-resolved` as the deployment’s system read, and `secret-resolved` (caller `pack-env`, with the request id as its `correlationId` and the system key’s id), written before the answer.

object

**revision**

required

Changes whenever what would be given changes: a value written or removed, a secret set or revoked. Made from scopes, row ids, revisions and update times, never from a value. Send it back with the endpoint (`packEnvRevision`) or `PUT …/pack-env`.

string

**names**

required

Every declared name, required ones first, each list in name order.

Array\<object>

One name the deployment’s pack declares: where it’s set, and why it can’t be given to the pack service, if it can’t (`secretScope`, for `ambiguous` only, names the secret’s scope). Each name is looked for at the deployment’s project, then its org, then the tenant (most specific wins); a tenant-wide deployment’s, at the tenant’s Default project. Never a value.

object

**name**

required

string

**required**

required

boolean

**kind**

required

One of:

- **string**

  string

  Allowed values: env secret

- **null**

  null

**scope**

required

One of:

- **object**

  Where a value is set: the deployment’s project, the project’s org, or the tenant.

  object

  **kind**

  required

  string

  Allowed values: project org tenant

  **id**

  The project’s or the org’s id. Absent for the tenant.

  string

- **null**

  null

**missing**

required

Set nowhere, as a plain value or a secret (optional names too).

boolean

**problem**

Why it can’t be given to the pack service. `ambiguous`: set both as a secret and as a plain value (`secretScope` names the secret’s scope). `secret-not-yet`: set only as a secret, and the orchestrator didn’t ask for secret values (`secrets=values`); a tool reads it per call (`ctx.secrets`). `missing`: a required name set nowhere. `unreadable`: set as a secret, and it can’t be read for a reason the platform fixes, not the owner. Absent when it can be given, and for an optional name set nowhere. The owner’s check (`GET /v1/deployments/{deploymentId}/pack-env`) lists a name set only as a secret as `kind: 'secret'`, with no problem.

string

Allowed values: ambiguous secret-not-yet missing unreadable

**secretScope**

Where a value is set: the deployment’s project, the project’s org, or the tenant.

object

**kind**

required

string

Allowed values: project org tenant

**id**

The project’s or the org’s id. Absent for the tenant.

string

**problem**

Why a deployment’s pack service can’t be given its declared environment, the first in this order: `pack-env-ambiguous` (a name is set both as a secret and as a plain value), `pack-env-secret-not-yet` (a name is set only as a secret, and its value wasn’t asked for), `pack-env-missing` (a required name is set nowhere), `pack-env-secret-unreadable` (a name’s secret is set, but it can’t be read for a reason the platform fixes, not the owner; only a read with `secrets=values` finds it, and only when there’s no other problem). A later runtime may add codes, so treat an unknown one as a reason not yet named.

string

Allowed values: pack-env-ambiguous pack-env-secret-not-yet pack-env-missing pack-env-secret-unreadable

**env**

Each declared name that is set, by name, as plain values. Absent while there is a `problem`: then nothing is given, and the service keeps what it runs.

object

**_key_**

additional properties

string

**secrets**

With `secrets=values` only: each declared name that is set only as a secret, by name (`{}` when there’s none). Never put one into a plain env. Absent while there is a `problem`, and when it wasn’t asked for.

object

**_key_**

additional properties

A secret given to the deployment’s pack service: its value, read at the version `revision` names, and audited before the answer.

object

**value**

required

string

**revision**

required

`ps1-…`: the same for the same value under the same name, and changes whenever what’s given for the name does (a new version, another scope, a revoke or a delete). Made from the name’s part of the deployment’s `revision`, never from the value.

string

##### Example

```json
{
  "names": [
    {
      "kind": "env",
      "scope": {
        "kind": "project"
      },
      "problem": "ambiguous",
      "secretScope": {
        "kind": "project"
      }
    }
  ],
  "problem": "pack-env-ambiguous"
}
```

### 400

A `secrets` other than `values` (`bad-input`).

application/json

object

**error**

required

object

**code**

required

Stable machine-readable discriminant. Values match domain error codes (see `docs/API-ROUTE-CONVENTIONS.md` §4.3).

string

**message**

required

string

**details**

Optional, kind-specific.

object

**_key_**

additional properties

any

**requestId**

required

Server-assigned request id; also echoed via `X-Request-Id` header.

string

##### Examplegenerated

```json
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}
```

### 401

Missing / malformed / expired / revoked bearer token.

application/json

object

**error**

required

object

**code**

required

Stable machine-readable discriminant. Values match domain error codes (see `docs/API-ROUTE-CONVENTIONS.md` §4.3).

string

**message**

required

string

**details**

Optional, kind-specific.

object

**_key_**

additional properties

any

**requestId**

required

Server-assigned request id; also echoed via `X-Request-Id` header.

string

##### Examplegenerated

```json
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}
```

### 403

A tenant’s key or session (`system-principal-required`), a system key without `system:pack-env` (`system-scope-missing`), or with `secrets=values`, a key that doesn’t hold `system:pack-env` itself, `kindgi:system` included (`system-scope-missing`).

application/json

object

**error**

required

object

**code**

required

Stable machine-readable discriminant. Values match domain error codes (see `docs/API-ROUTE-CONVENTIONS.md` §4.3).

string

**message**

required

string

**details**

Optional, kind-specific.

object

**_key_**

additional properties

any

**requestId**

required

Server-assigned request id; also echoed via `X-Request-Id` header.

string

##### Examplegenerated

```json
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}
```

### 404

No such tenant (`tenant-not-found`), or no such deployment in it (`deployment-not-found`).

application/json

object

**error**

required

object

**code**

required

Stable machine-readable discriminant. Values match domain error codes (see `docs/API-ROUTE-CONVENTIONS.md` §4.3).

string

**message**

required

string

**details**

Optional, kind-specific.

object

**_key_**

additional properties

any

**requestId**

required

Server-assigned request id; also echoed via `X-Request-Id` header.

string

##### Examplegenerated

```json
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}
```

### 409

The tenant is closing or suspended (`tenant-closing`, `tenant-suspended`), or the deployment’s pack service was retired (`endpoint-retired`).

application/json

object

**error**

required

object

**code**

required

Stable machine-readable discriminant. Values match domain error codes (see `docs/API-ROUTE-CONVENTIONS.md` §4.3).

string

**message**

required

string

**details**

Optional, kind-specific.

object

**_key_**

additional properties

any

**requestId**

required

Server-assigned request id; also echoed via `X-Request-Id` header.

string

##### Examplegenerated

```json
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}
```

### 501

The server doesn’t give a pack service its declared env: its pack services take theirs from how they’re run (`pack-env-unsupported`). Or, with `secrets=values`, it has nowhere to audit a secret given out, so it gives none (`pack-env-secrets-unaudited`).

application/json

object

**error**

required

object

**code**

required

Stable machine-readable discriminant. Values match domain error codes (see `docs/API-ROUTE-CONVENTIONS.md` §4.3).

string

**message**

required

string

**details**

Optional, kind-specific.

object

**_key_**

additional properties

any

**requestId**

required

Server-assigned request id; also echoed via `X-Request-Id` header.

string

##### Examplegenerated

```json
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}
```

### 503

With `secrets=values`: the secret store is out, a secret changed while it was read, twice, or the secrets’ audit rows weren’t written. Nothing is given: try again (`pack-env-unavailable`).

application/json

object

**error**

required

object

**code**

required

Stable machine-readable discriminant. Values match domain error codes (see `docs/API-ROUTE-CONVENTIONS.md` §4.3).

string

**message**

required

string

**details**

Optional, kind-specific.

object

**_key_**

additional properties

any

**requestId**

required

Server-assigned request id; also echoed via `X-Request-Id` header.

string

##### Examplegenerated

```json
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}
```

## See also

- [`PUT /v1/system/tenants/{tenantId}/deployments/{deploymentId}/pack-env`: Record the env revision a deployment's pack service runs](https://docs.kindgi.com/reference/api/operations/systemdeploymentsrecordpackenv.md)
- [`GET /v1/system/tenants`: List tenants](https://docs.kindgi.com/reference/api/operations/systemtenantslist.md)
- [`POST /v1/system/tenants`: Create a tenant](https://docs.kindgi.com/reference/api/operations/systemtenantscreate.md)
- [`GET /v1/system/tenants/{tenantId}`: Read a tenant](https://docs.kindgi.com/reference/api/operations/systemtenantsget.md)
- [Error code `bad-input`](https://docs.kindgi.com/reference/errors.md#bad-input)
- [Error code `deployment-not-found`](https://docs.kindgi.com/reference/errors.md#deployment-not-found)
- [Error code `endpoint-retired`](https://docs.kindgi.com/reference/errors.md#endpoint-retired)
- [Error code `pack-env-secrets-unaudited`](https://docs.kindgi.com/reference/errors.md#pack-env-secrets-unaudited)
- [Error code `pack-env-unavailable`](https://docs.kindgi.com/reference/errors.md#pack-env-unavailable)
- [Error code `pack-env-unsupported`](https://docs.kindgi.com/reference/errors.md#pack-env-unsupported)
- [Error code `system-principal-required`](https://docs.kindgi.com/reference/errors.md#system-principal-required)
- [Error code `system-scope-missing`](https://docs.kindgi.com/reference/errors.md#system-scope-missing)
- [Error code `tenant-closing`](https://docs.kindgi.com/reference/errors.md#tenant-closing)
- [Error code `tenant-not-found`](https://docs.kindgi.com/reference/errors.md#tenant-not-found)
- [Error code `tenant-suspended`](https://docs.kindgi.com/reference/errors.md#tenant-suspended)
- [Every error code](https://docs.kindgi.com/reference/errors.md)