---
title: "List a vault's secrets [read]"
method: GET
path: "/vaults/{id}/secrets"
tags: ["vaults"]
---

# List a vault's secrets \[read\]

`GET /vaults/{id}/secrets`

## Request

- Base URL: `https://api.agentsky.dev/v1`
- URL: `https://api.agentsky.dev/v1/vaults/{id}/secrets`
- Auth: HTTP bearer

## Path parameters

- `id` string, required

## Response `200`

OK

- VaultSecretList
  - `secrets` VaultSecret[], required
    - `type` 'vault_secret', required
    - `id` string, required: vsec_…
    - `display_name` string, required
    - `auth_type` 'static_bearer' | 'mcp_oauth' | 'environment_variable', required
    - `mcp_server_url` string
    - `secret_name` string: The environment variable the pod sees
    - `allowed_hosts` string[]: Environment-variable destination metadata. An empty list disables credential injection. Omit this field on update to keep the current sites; send [] to clear them.
    - `status` string, required
    - `expires_at` string, date-time
    - `created_at` string, date-time, required
    - `updated_at` string, date-time, required

## Other responses

- `default`: Error — { error: { code, message } }

## Changes

- **2026-11-02** `e5e8f0229a99`: 2 info
  - added the optional property `error/request_id` to the response with the `default` status
  - added the optional property `secrets/items/allowed_hosts` to the response with the `200` status

[Operation history](https://skmtc.dev/agentsky/apis/agentsky-developer-api/changes/vaults/:id/secrets/get.md)

---

[API](https://skmtc.dev/agentsky/apis/agentsky-developer-api.md) - [All operations](https://skmtc.dev/agentsky/apis/agentsky-developer-api/llms.txt) - [OpenAPI document](https://skmtc.dev/agentsky/apis/agentsky-developer-api/revisions/8280a065ef6a?raw)