---
title: "Share existing secrets with a newly enrolled device by uploading re-encrypted ciphertexts. Plaintext never transits."
method: POST
path: "/api/mcp/tools/env_sync.device_request_secret_share"
tags: ["misc"]
---

# Share existing secrets with a newly enrolled device by uploading re-encrypted ciphertexts. Plaintext never transits.

`POST /api/mcp/tools/env_sync.device_request_secret_share`

## Request

- Base URL: `https://api.ainote.dev`
- URL: `https://api.ainote.dev/api/mcp/tools/env_sync.device_request_secret_share`
- Auth: API key in header `Authorization`

Share existing secrets with a newly enrolled device by uploading re-encrypted ciphertexts. Plaintext never transits.

## Request body

- object
  - `target_device_id` string, uuid, required
  - `device_id` string, uuid, required: The existing device performing the re-encryption (must own access to all secret_node_ids).
  - `secret_shares` object[], required
    - `secret_node_id` string, uuid, required
    - `re_encrypted_ciphertext_b64` string, required
  - `client_hlc` string

## Response `200`

Tool executed successfully

- ToolSuccessResponse: Successful tool invocation. `content` mirrors the MCP `tools/call` result shape: an array of content blocks (text and optionally a structured resource payload).
  - `content` object[]
    - `type` 'text' | 'resource'
    - `text` string

## Other responses

- `400`: Invalid arguments or business-rule violation
- `401`: Missing or invalid McpKey

---

[API](https://skmtc.dev/ainote/apis/ainote-mcp-openapi-mirror.md) · [All operations](https://skmtc.dev/ainote/apis/ainote-mcp-openapi-mirror/llms.txt) · [OpenAPI document](https://skmtc.dev/ainote/apis/ainote-mcp-openapi-mirror/revisions/f6c91d85e027?raw)