---
title: "Fetch Secret"
method: POST
path: "/api/v1/config/secrets/fetch"
tags: ["secrets"]
---

# Fetch Secret

`POST /api/v1/config/secrets/fetch`

## Request

- Base URL: `https://memory.kagura-ai.com` (the document declares no server; this is the origin it was published from)
- URL: `https://memory.kagura-ai.com/api/v1/config/secrets/fetch`
- Auth: none declared

Return ciphertext to a granted caller (default-deny, audit-first).

The service writes and commits a fail-closed audit entry before the
ciphertext is returned; a denied read raises 403 after logging. The returned
ciphertext is opaque — the server holds no key to decrypt it.

## Headers

- `authorization` string, nullable

## Request body

- SecretFetch: Fetch a secret's ciphertext (name carried in body to allow '/' names).
  - `name` string, required
  - `version_number` integer, nullable: Pin a version; omit for latest

## Response `200`

Successful Response

- SecretValueResponse: Opaque ciphertext returned to a granted caller. The server cannot read it.
  - `name` unknown, required
  - `version_number` unknown, required
  - `alg` unknown, required
  - `ciphertext` unknown, required
  - `blob_ref` unknown, required
  - `recipients_snapshot` unknown, required
  - `rotation_needed` unknown, required
  - `created_at` unknown, required

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/kagura-ai/apis/kagura-memory-cloud.md) · [All operations](https://skmtc.dev/kagura-ai/apis/kagura-memory-cloud/llms.txt) · [OpenAPI document](https://skmtc.dev/kagura-ai/apis/kagura-memory-cloud/revisions/aa9df1a21db9?raw)