---
title: "List workspace secrets"
method: GET
path: "/vault/secrets"
tags: ["Vault"]
---

# List workspace secrets

`GET /vault/secrets`

Lists secret metadata for the workspace of the authenticated API key. Responses contain names, bound hosts, fingerprints and creation times, never secret values. Results are ordered by name and paginated with `limit` and `offset`. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.

## Query parameters

- `limit` integer — Page size, 1 to 100. Defaults to 100.
- `offset` integer — Number of secrets to skip, 0 to 10000. Defaults to 0.

## Response `200`

One page of secret metadata.

- VaultSecretListResponse — One page of secret metadata for the selected scope.
  - `data` VaultSecret[], required
    - `created_at` string, date-time, required
    - `fingerprint` string, nullable, required
    - `hosts` string[], nullable, required
    - `name` string, required
  - `has_more` boolean, required — True when more secrets exist beyond this page. Request the next page with `offset` increased by the number of returned entries.

## Other responses

- `400` — Bad Request - The secret name, path, query or JSON body failed validation. The vault returns 400 for a malformed request as well.
- `401` — Unauthorized - Missing or unknown API key. Provisioning keys cannot call vault routes.
- `403` — Forbidden - The key has no usable workspace scope, or the request arrived on a regional hostname.
- `404` — Not Found - The intern is not in the selected workspace, the secret does not exist in the selected scope, or the caller is outside the intern programme.
- `408` — Request Timeout - The route deadline passed before the request completed, or the request body stopped arriving.
- `429` — Too Many Requests - The vault rate limit was reached.
- `500` — Internal Server Error - Scope lookup failed.
- `502` — Bad Gateway - The vault could not be reached or returned an unexpected response.
- `503` — Service Unavailable - Vault writes are disabled for the caller, or the vault is not configured.
- `504` — Gateway Timeout - The vault did not answer in time.

## Changes

- **2026-09-16** `1e05e5f6495c` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/openrouterteam/apis/openrouter-api/changes/vault/secrets/get.md)

---

[API](https://skmtc.dev/openrouterteam/apis/openrouter-api.md) · [All operations](https://skmtc.dev/openrouterteam/apis/openrouter-api/llms.txt) · [OpenAPI document](https://skmtc.dev/openrouterteam/apis/openrouter-api/revisions/a14f20a270fd?raw)