---
title: "List the org's Project secrets, without values."
method: GET
path: "/o/{org}/secrets"
tags: ["Secrets"]
---

# List the org's Project secrets, without values.

`GET /o/{org}/secrets`

## Request

- Base URL: `https://api.prix.dev`
- URL: `https://api.prix.dev/o/{org}/secrets`
- Auth: HTTP bearer

## Query parameters

- `project` string, uuid

## Response `200`

Secrets, never a value.

- object
  - `data` Secret[], required
    - `id` string, uuid, required
    - `name` string, required
    - `kind` 'env' | 'header' | 'login', required
    - `source` 'rush' | 'onepassword', required: Where the value lives; a 1Password secret holds only its reference.
    - `description` string, required
    - `project_id` string, uuid, required
    - `targets` string[], required: Hosts (header) or one origin (login); empty for env.
    - `header_name` string, nullable
    - `header_format` string, nullable
    - `has_totp` boolean, required
    - `created_by` string, uuid, nullable, required: Null once the member who added it has deleted their account; the secret stays with the Project.
    - `created_at` string, date-time, required
    - `value_updated_at` string, date-time, required
    - `last_used_at` string, date-time, nullable

## Other responses

- `401`: No bearer, an unknown, revoked or expired one, or an API key on a route keys cannot call.

---

[API](https://skmtc.dev/getrush/apis/rush-api.md) · [All operations](https://skmtc.dev/getrush/apis/rush-api/llms.txt) · [OpenAPI document](https://skmtc.dev/getrush/apis/rush-api/revisions/e351f947926b?raw)