---
title: "List secrets"
method: GET
path: "/secrets"
tags: ["Secrets"]
---

# List secrets

`GET /secrets`

## Request

- Base URL: `https://api.crevio.co/v1`
- URL: `https://api.crevio.co/v1/secrets`
- Auth: API key in header `Authorization`

Lists the account's environment variables: shared secrets, reusable across its sites, plus a roll-up of every site-owned one. Values are masked here — each entry exposes only `last4`. Read one with the reveal endpoint.

## Query parameters

- `target` 'preview' | 'production'
- `scope` 'shared' | 'site'
- `starting_after` string
- `limit` integer

## Response `200`

List of secrets (values masked)

- ListResponseSecret
  - `object` 'list', required
  - `data` Secret[], required
    - `object` string, required
    - `id` string, required
    - `name` string, required
    - `target` string, required
    - `scope` string, required
    - `site_id` string, nullable, required
    - `site_ids` object, required
    - `description` string, nullable, required
    - `egress_host` string, nullable, required
    - `egress_header` string, nullable, required
    - `egress_placement` string, required
    - `egress_signing` object, required
    - `egress_default_headers` object, required
    - `last4` string, required
    - `value` string, nullable, required
    - `created_at` string, required
  - `has_more` boolean, required
  - `url` string, required

## Other responses

- `400`: Bad request
- `401`: Authentication required
- `429`: Rate limit exceeded — 600 requests per minute per credential. Retry after the number of seconds in `Retry-After`.
- `500`: Internal server error

---

[API](https://skmtc.dev/crevio/apis/crevio-api-v1.md) · [All operations](https://skmtc.dev/crevio/apis/crevio-api-v1/llms.txt) · [OpenAPI document](https://skmtc.dev/crevio/apis/crevio-api-v1/revisions/2219f18ad651?raw)