---
title: "Read a secret or variable"
method: GET
path: "/workflows/config/{id}"
tags: ["Workflow secrets and variables"]
---

# Read a secret or variable

`GET /workflows/config/{id}`

## Request

- Base URL: `https://api.nullplatform.com`
- URL: `https://api.nullplatform.com/workflows/config/{id}`
- Auth: HTTP bearer

Returns one entry by id. `value` is only present for non-secret entries.

## Path parameters

- `id` string, required

## Response `200`

The entry.

- ConfigEntry: A secret or variable. Exactly one of `path` or `workflow` identifies the place it lives. Secret values are write-only: they are never returned by any read.
  - `id` string, required
  - `name` string, required: Referenced in definitions as `${{ secrets.NAME }}` or `${{ vars.NAME }}`.
  - `secret` boolean, required: Immutable. `true` makes the value write-only and redacted everywhere.
  - `path` string: Folder place (`/` is the organization root). Present when the entry lives on a folder.
  - `workflow` string: Workflow reference. Present when the entry lives on one workflow.
  - `value` string, nullable: Only returned for non-secret entries.
  - `effective` boolean: Only with `ancestors=true`: whether this row wins precedence for its name.
  - `mode` 'created' | 'updated': Write responses only: whether the entry was created or its value rotated.
  - `createdBy` string
  - `createdAt` string, date-time, required
  - `updatedAt` string, date-time, required

## Other responses

- `4XX`: Client error, as plain JSON.
- `5XX`: Unexpected server error.

## Changes

- **2026-09-17** `43b3c1ecdfd8`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/nullplatform/apis/nullplatform-api/changes/workflows/config/:id/get.md)

---

[API](https://skmtc.dev/nullplatform/apis/nullplatform-api.md) - [All operations](https://skmtc.dev/nullplatform/apis/nullplatform-api/llms.txt) - [OpenAPI document](https://skmtc.dev/nullplatform/apis/nullplatform-api/revisions/d3f66bc633d4?raw)