---
title: "List a site's secrets"
method: GET
path: "/sites/{id}/secrets"
tags: ["Sites"]
---

# List a site's secrets

`GET /sites/{id}/secrets`

## Request

- Base URL: `https://api.crevio.co/v1`
- URL: `https://api.crevio.co/v1/sites/{id}/secrets`
- Auth: API key in header `Authorization`

Returns the encrypted runtime secrets injected into this site as environment variables, newest first. The decrypted value is never included here — each entry exposes only its last four characters (`last4`). Use the reveal endpoint to read a value.

## Path parameters

- `id` string, required

## Query parameters

- `starting_after` string
- `limit` integer

## Response `200`

List of the site's secrets (values masked)

- ListResponseSecret
  - `object` 'list', required
  - `data` Secret[], required
    - `object` string, required
    - `id` string, required
    - `name` string, required
    - `target` string, required
    - `scope` string, required
    - `site_id` string, nullable, required
    - `site_ids` object, required
    - `description` string, nullable, required
    - `egress_host` string, nullable, required
    - `egress_header` string, nullable, required
    - `egress_placement` string, required
    - `egress_signing` object, required
    - `egress_default_headers` object, required
    - `last4` string, required
    - `value` string, nullable, required
    - `created_at` string, required
  - `has_more` boolean, required
  - `url` string, required

## Other responses

- `400`: Bad request
- `401`: Authentication required
- `404`: Resource not found
- `429`: Rate limit exceeded — 600 requests per minute per credential. Retry after the number of seconds in `Retry-After`.

---

[API](https://skmtc.dev/crevio/apis/crevio-api-v1.md) · [All operations](https://skmtc.dev/crevio/apis/crevio-api-v1/llms.txt) · [OpenAPI document](https://skmtc.dev/crevio/apis/crevio-api-v1/revisions/2219f18ad651?raw)