Sign in
Secrets

Get a secret

One secret's metadata: delivery mode, host binding, sharing, and when it was last handed to a run. Never its value. A secret from another project — and another member's personal secret — both read as 404.

get/projects/{projectId}/secrets/{secretId}

Response

The secret, as metadata.

idstring required
projectIdstring required
namestring required

The environment-variable name (^[A-Z_][A-Z0-9_]*$). This IS the secret's identity: what a materialized delivery exports, what a workflow references, and what stays stable across a rotation. Immutable.

descriptionstring nullable required
delivery'brokered' | 'materialized' required

brokered — the sandbox's egress proxy injects the value as a request header OUTSIDE the VM, so the box never holds it. Prevents EXTRACTION, not USE: any process in the box can call the bound host while the policy is live, and it works for HTTPS APIs only (domain rules bind on ports 80/443). materialized — a real environment variable inside the box, which is the only thing a CLI can read; EXTRACTABLE BY DESIGN.

brokerHostsstring[]

Brokered only: the exact hostnames the header is injected on.

brokerHeaderstring

Brokered only: the header name.

brokerTemplatestring

Brokered only: the header value, with {} where the secret goes.

sharing'user' | 'project' required

project — admin-managed, delivered to every member's sessions. user — personal, delivered ONLY in sessions its owner starts and silently absent from anyone else's run of the same environment. Immutable.

ownerUserIdstring

Personal secrets only. Project-shared rows have no owner.

lastDeliveredAtinteger nullable required

When this secret was last HANDED TO a run — not when it was last used. Brokered use is unobservable by construction (the proxy injects the header; the request is never seen here), so used would be a number nobody can honestly produce. null means nothing has been recorded, which is not the same as never delivered.

createdAtinteger required
updatedAtinteger required
createdByUserIdstring required
updatedByUserIdstring required

Changes

Changed in 1 of the 80 revisions of this API.1