---
title: "Reveals a secret value from H2O Secure Store and writes it to a file."
method: POST
path: "/v1/{name}/h2oSecureStore:revealSecretToFile"
tags: ["H2OSecureStoreService"]
---

# Reveals a secret value from H2O Secure Store and writes it to a file.

`POST /v1/{name}/h2oSecureStore:revealSecretToFile`

## Request

- Base URL: `https://docs.h2o.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://docs.h2o.ai/v1/{name}/h2oSecureStore:revealSecretToFile`
- Auth: none declared
- TypeScript: <https://skmtc.dev/h2o/apis/ai-h2o-engine-sandbox-v1-filesystem-proto/docs/v1/:name/h2oSecureStore:revealSecretToFile/post.ts> (a function with typed inputs; its response is checked against the schema)

Retrieves a secret version from the secure store and writes its value to
the specified path in the sandbox filesystem. The caller must be authorized
to reveal the specified secret version.

Files are created with secure 0600 permissions (owner read/write only)
to protect sensitive data.

The secret version name can use the "latest" alias to retrieve the most
recently created version:
"workspaces/{workspace}/secrets/{secret}/versions/latest"
(-- api-linter: core::0136::prepositions=disabled
    aip.dev/not-precedent: The preposition "to" clearly indicates the destination
    format (file) and is essential for clarity. Alternative names like "RevealSecretAsFile"
    would be ambiguous. --)

## Path parameters

- `name` string, required

## Request body

- object: Request to reveal a secret value to a file.
  - `secretVersion` string, required: The version segment can be a specific version ID or "latest" to retrieve the most recently created SecretVersion. Example: "workspaces/my-workspace/secrets/api-key/versions/latest"
  - `path` string, required: Required. The absolute path in the sandbox filesystem where the secret value should be written. Must start with a forward slash (e.g., "/home/sandbox/.credentials/token"). If the file exists, it will be overwritten. Parent directories will be created automatically if they don't exist for security convenience (unlike other file operations which require explicit opt-in via create_parent_directories parameter). The file will be created with 0600 permissions (owner read/write only).

## Response `200`

A successful response.

- V1RevealSecretToFileResponse: Response after revealing a secret to a file.
  - `secretVersion` string: Output only. The resource name of the SecretVersion that was revealed. Format: "workspaces/{workspace}/secrets/{secret}/versions/{version}" If "latest" was used in the request, this will contain the actual version ID.
  - `fileInfo` V1FileInfo: FileInfo contains metadata about a file or directory.
    - `path` string: Output only. The absolute path of the file or directory.
    - `size` string, int64: Output only. The size of the file in bytes. For directories, this is typically 0 or the size of the directory metadata.
    - `type` 'FILE_TYPE_UNSPECIFIED' | 'FILE_TYPE_REGULAR' | 'FILE_TYPE_DIRECTORY' | 'FILE_TYPE_SYMLINK': FileType indicates the type of filesystem entry. - FILE_TYPE_UNSPECIFIED: The file type is not specified. - FILE_TYPE_REGULAR: A regular file. - FILE_TYPE_DIRECTORY: A directory. - FILE_TYPE_SYMLINK: A symbolic link.
    - `modifyTime` string, date-time: Output only. The last modification time of the file or directory (mtime).
    - `mode` string: Output only. Unix file mode and permission bits in octal notation. The format follows standard Unix permissions represented as a string. Examples: "0644" (rw-r--r--), "0755" (rwxr-xr-x), "0777" (rwxrwxrwx).

## Other responses

- `default`: An unexpected error response.

---

[API](https://skmtc.dev/h2o/apis/ai-h2o-engine-sandbox-v1-filesystem-proto.md) - [All operations](https://skmtc.dev/h2o/apis/ai-h2o-engine-sandbox-v1-filesystem-proto/llms.txt) - [OpenAPI document](https://skmtc.dev/h2o/apis/ai-h2o-engine-sandbox-v1-filesystem-proto/revisions/297cfadc1d39?raw)