---
title: "Get a single app secret (metadata only)"
method: GET
path: "/api/v1/hosting/apps/{app_id}/secrets/{id}"
tags: ["hosting"]
---

# Get a single app secret (metadata only)

`GET /api/v1/hosting/apps/{app_id}/secrets/{id}`

## Request

- Base URL: `https://composal.com` (the document declares no server; this is the origin it was published from)
- URL: `https://composal.com/api/v1/hosting/apps/{app_id}/secrets/{id}`
- Auth: HTTP bearer

## Path parameters

- `app_id` string, required
- `id` string, required

## Response `200`

Secret metadata

- object
  - `id` string, required
  - `hosted_app_id` string, required
  - `organization_id` string, required
  - `slug` string, required
  - `name` string, required
  - `env_key` string, nullable
  - `scope_kind` string, required
  - `status` string, required
  - `description` string, nullable
  - `rotation_policy` string, nullable
  - `expose_to_build` boolean
  - `has_value` boolean
  - `value_kind` string, nullable
  - `value_digest` string, nullable
  - `latest_version_number` integer, nullable
  - `created_at` string, date-time
  - `updated_at` string, date-time

## Other responses

- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not found
- `422`: Unprocessable entity
- `502`: Bad gateway

---

[API](https://skmtc.dev/composal/apis/vex-api.md) - [All operations](https://skmtc.dev/composal/apis/vex-api/llms.txt) - [OpenAPI document](https://skmtc.dev/composal/apis/vex-api/revisions/74298a24e040?raw)