---
title: "Get a single secret's metadata"
method: GET
path: "/secrets/{secretId}"
tags: ["Secrets"]
---

# Get a single secret's metadata

`GET /secrets/{secretId}`

## Request

- Base URL: `https://api.marboba.com/v1`
- URL: `https://api.marboba.com/v1/secrets/{secretId}`
- Auth: HTTP bearer

Same admin-only access posture as the list endpoint.

## Response `200`

The requested secret's metadata

- object
  - `secret` Secret: Vault item metadata. The encrypted `value` is **never** returned by /v1 — this surface is metadata-only. `admin` scope (PAT only) is required because even the names of secrets are sensitive.
    - `id` string, required
    - `name` string, required
    - `type` string, required: Vault item type (`text`, `file`, `keystore`, etc.).
    - `category` string, nullable
    - `keyword` string, nullable
    - `deploymentOnly` boolean, required
    - `maskedPreview` string, nullable: First few characters of the secret followed by `…`. Safe to log; useful for spotting the right secret without unsealing it.
    - `fileName` string, nullable
    - `fileSize` integer, nullable
    - `appId` string, nullable: Owning project (component) id, or null if org-wide.
    - `createdAt` string, date-time, nullable
    - `updatedAt` string, date-time, nullable

## Other responses

- `403` (unresolved $ref)
- `404` (unresolved $ref)

---

[API](https://skmtc.dev/marboba/apis/marboba-public-rest-api.md) · [All operations](https://skmtc.dev/marboba/apis/marboba-public-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/marboba/apis/marboba-public-rest-api/revisions/5b96d525d88d?raw)