---
title: "Get a wrapped secret version"
method: GET
path: "/api/secrets/{id}/versions/{version}/wrapped"
---

# Get a wrapped secret version

`GET /api/secrets/{id}/versions/{version}/wrapped`

## Request

- Base URL: `https://api.hyperbrowser.ai`
- URL: `https://api.hyperbrowser.ai/api/secrets/{id}/versions/{version}/wrapped`
- Auth: API key in header `x-api-key`
- TypeScript: <https://skmtc.dev/hyperbrowser/apis/hyperbrowser-api/docs/api/secrets/:id/versions/:version/wrapped/get.ts> (a function with typed inputs; its response is checked against the schema)

Returns a customer-protected version's wrapped envelope, for you to unwrap with your own key. Pass the result to a use as `{name, version, unwrapped}`. See [Customer-protected secrets](/sandboxes/customer-keys). Secrets are enabled for teams on request; please contact support to enable them (otherwise 403 SECRETS_FEATURE_DISABLED). Restricted API keys need the secrets.use scope. When you're signed in rather than using an API key, you must be a team owner or admin (otherwise 403 SECRETS_ADMIN_REQUIRED).

## Path parameters

- `id` string, uuid, required
- `version` union, required
  - integer
  - 'latest'

## Response `200`

Success

- WrappedSecretVersion: A customer-protected version as stored. Unwrap `envelope` with your key to get the inner envelope each use passes as `unwrapped`.
  - `version` integer, required
  - `kid` string, required: ID of the platform public key the inner envelope is encrypted to.
  - `retiresAt` string, date-time, nullable, required: When that platform key is retired, or null.
  - `outerKid` string, required: ID of your key that wrapped the version.
  - `innerDigest` string, required: Unpadded base64url SHA-256 of the inner envelope. Check the envelope you unwrap against it.
  - `envelope` string, required: The wrapped envelope, which only your key can open.

## Other responses

- `400`: Invalid secret ID or version, or SECRET_PROTECTION_MISMATCH: the secret isn't customer-protected, so its envelope is never returned.
- `401`: Authentication required.
- `403`: API_KEY_SCOPE_DENIED (the API key lacks a required scope), SECRETS_FEATURE_DISABLED, or SECRETS_ADMIN_REQUIRED.
- `404`: SECRET_NOT_FOUND or SECRET_VERSION_NOT_FOUND.
- `500`: Internal server error.

## Changes

- **2026-11-10** `94dc06948680`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/hyperbrowser/apis/hyperbrowser-api/changes/api/secrets/:id/versions/:version/wrapped/get.md)

---

[API](https://skmtc.dev/hyperbrowser/apis/hyperbrowser-api.md) - [All operations](https://skmtc.dev/hyperbrowser/apis/hyperbrowser-api/llms.txt) - [OpenAPI document](https://skmtc.dev/hyperbrowser/apis/hyperbrowser-api/revisions/ef089024c533?raw)