---
title: "GET /api/v1/projects/{projectId}/secret-validation-rules"
method: GET
path: "/api/v1/projects/{projectId}/secret-validation-rules"
tags: ["Secret Validation Rules"]
---

# GET /api/v1/projects/{projectId}/secret-validation-rules

`GET /api/v1/projects/{projectId}/secret-validation-rules`

List Secret Validation Rules

## Path parameters

- `projectId` string, required

## Response `200`

Default Response

- object
  - `rules` union[], required
    - union
      - object
        - `id` string, uuid, required
        - `name` string, required
        - `description` string, nullable
        - `projectId` string, required
        - `envId` string, uuid, nullable
        - `secretPath` string, required
        - `isActive` boolean
        - `createdAt` string, date-time, required
        - `updatedAt` string, date-time, required
        - `type` 'static-secrets', required — The kind of secret the rule applies to. Determines which fields the rule accepts and where the constraints are enforced: `static-secrets` constraints run on write, while `dynamic-secrets` and `secret-rotations` constraints shape the generated credential.
        - `constraints` object[], required — The constraints enforced by this rule. Each constraint names what it checks (`type`), what it applies to (`appliesTo`), and its `value`, e.g. the minimum character count for `min-length` or the pattern for `regex-pattern`.
          - `type` 'min-length' | 'max-length' | 'regex-pattern' | 'required-prefix' | 'required-suffix' | 'prevent-value-reuse', required — The kind of check this constraint performs, e.g. `min-length`, `regex-pattern`, `required-prefix`, or `prevent-value-reuse`.
          - `appliesTo` 'key' | 'value', required — What the constraint checks: the secret key or the secret value.
          - `value` string, required — The value the constraint is checked against, e.g. the minimum length, the regex pattern, or the required prefix/suffix string.
      - object
        - `id` string, uuid, required
        - `name` string, required
        - `description` string, nullable
        - `projectId` string, required
        - `envId` string, uuid, nullable
        - `secretPath` string, required
        - `isActive` boolean
        - `createdAt` string, date-time, required
        - `updatedAt` string, date-time, required
        - `type` 'dynamic-secrets', required — The kind of secret the rule applies to. Determines which fields the rule accepts and where the constraints are enforced: `static-secrets` constraints run on write, while `dynamic-secrets` and `secret-rotations` constraints shape the generated credential.
        - `providers` string[], required — The dynamic secret providers this rule applies to. A lease is only constrained when its provider is listed here.
        - `constraints` object[], required — The constraints enforced by this rule. Each constraint names what it checks (`type`), what it applies to (`appliesTo`), and its `value`, e.g. the minimum character count for `min-length` or the pattern for `regex-pattern`.
          - `type` 'min-length' | 'max-length' | 'regex-pattern' | 'required-prefix' | 'required-suffix', required — The kind of check this constraint performs, e.g. `min-length`, `regex-pattern`, or `required-prefix`.
          - `appliesTo` 'password', required — What the constraint checks: the generated credential.
          - `value` string, required — The value the constraint is checked against, e.g. the minimum length, the regex pattern, or the required prefix/suffix string.
      - object
        - `id` string, uuid, required
        - `name` string, required
        - `description` string, nullable
        - `projectId` string, required
        - `envId` string, uuid, nullable
        - `secretPath` string, required
        - `isActive` boolean
        - `createdAt` string, date-time, required
        - `updatedAt` string, date-time, required
        - `type` 'secret-rotations', required — The kind of secret the rule applies to. Determines which fields the rule accepts and where the constraints are enforced: `static-secrets` constraints run on write, while `dynamic-secrets` and `secret-rotations` constraints shape the generated credential.
        - `providers` string[], required — The secret rotation providers this rule applies to. A rotation is only constrained when its provider is listed here.
        - `constraints` object[], required — The constraints enforced by this rule. Each constraint names what it checks (`type`), what it applies to (`appliesTo`), and its `value`, e.g. the minimum character count for `min-length` or the pattern for `regex-pattern`.
          - `type` 'min-length' | 'max-length' | 'regex-pattern' | 'required-prefix' | 'required-suffix', required — The kind of check this constraint performs, e.g. `min-length`, `regex-pattern`, or `required-prefix`.
          - `appliesTo` 'password', required — What the constraint checks: the generated credential.
          - `value` string, required — The value the constraint is checked against, e.g. the minimum length, the regex pattern, or the required prefix/suffix string.

## Other responses

- `400` — Default Response
- `401` — Default Response
- `403` — Default Response
- `404` — Default Response
- `422` — Default Response
- `500` — Default Response

## Changes

- **2026-08-27** `e15904efcbcd` — 5 warning
  - added the new `ldap-password` enum value to the `rules/items/allOf[subschema #2]/anyOf[subschema #3]/providers/items/` response property for the response status `200`
  - added the new `mssql-credentials` enum value to the `rules/items/allOf[subschema #2]/anyOf[subschema #3]/providers/items/` response property for the response status `200`
  - added the new `mysql-credentials` enum value to the `rules/items/allOf[subschema #2]/anyOf[subschema #3]/providers/items/` response property for the response status `200`
  - added the new `oracledb-credentials` enum value to the `rules/items/allOf[subschema #2]/anyOf[subschema #3]/providers/items/` response property for the response status `200`
  - …1 more
- **2026-08-18** `e2a4b9a05251` — 4 info
  - api operation id `listSecretValidationRules` was added
  - api tag `Secret Validation Rules` added
  - added `subschema #1, subschema #2, subschema #3` to the `rules/items/allOf[subschema #2]/` response property `anyOf` list for the response status `200`
  - removed `subschema #1, subschema #2, subschema #3` from the `rules/items/allOf[subschema #2]/` response property `anyOf` list for the response status `200`

[Change history](https://skmtc.dev/infisical/apis/infisical-api/changes/api/v1/projects/:projectId/secret-validation-rules/get.md)

---

[API](https://skmtc.dev/infisical/apis/infisical-api.md) · [All operations](https://skmtc.dev/infisical/apis/infisical-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/infisical/infisical-api/revisions/763e38e78337/schema)