---
title: "Reveal one credential, once"
method: POST
path: "/v1/intakes/{id}/items/{key}/reveal"
tags: ["Intakes"]
---

# Reveal one credential, once

`POST /v1/intakes/{id}/items/{key}/reveal`

## Request

- Base URL: `https://api.briefgate.dev`
- URL: `https://api.briefgate.dev/v1/intakes/{id}/items/{key}/reveal`
- Auth: HTTP bearer

Session-authenticated counterpart to the secret reveal inside /results, for the dashboard. Deliberately one item and an explicit action: /results reveals every secret on an intake at once, which suits an agent collecting them and would mean a person merely opening a page spent a one-time value. The audit entry records the user rather than an API key. Answers 200 with value:null and already_revealed:true when the one chance has been used.

## Path parameters

- `id` string, required
- `key` string, required

## Response `200`

The credential, or the fact that it was already revealed

- object
  - `key` string
  - `value` string, nullable
  - `first_reveal` boolean
  - `already_revealed` boolean
  - `revealed_at` string, date-time
  - `expires_at` string, date-time

## Other responses

- `400`: The item is not a credential
- `401`: Missing or invalid API key
- `404`: Resource not found
- `410`: Expired or purged

---

[API](https://skmtc.dev/briefgate/apis/briefgate-api.md) · [All operations](https://skmtc.dev/briefgate/apis/briefgate-api/llms.txt) · [OpenAPI document](https://skmtc.dev/briefgate/apis/briefgate-api/revisions/b21afed4748b?raw)