---
title: "List a function's secrets"
method: GET
path: "/functions/{id}/secrets"
tags: ["Functions"]
---

# List a function's secrets

`GET /functions/{id}/secrets`

Returns metadata for every secret bound to the function, with
managed entries (provisioned by Primitive) listed first and
user-set entries listed alphabetically after. **Values are
never returned.** Secret writes are write-only.

Managed entries (e.g. `PRIMITIVE_WEBHOOK_SECRET`,
`PRIMITIVE_API_KEY`, `PRIMITIVE_API_BASE_URL`) carry a
`description` instead of `created_at` / `updated_at`. They
cannot be created, updated, or deleted via this API.

## Response `200`

List of secrets (metadata only, no values)

- object
  - `success` true, required
  - `data` object, required
    - `items` object[], required
      - `key` string, required
      - `managed` boolean, required — True for managed system secrets, false for user-set entries.
      - `description` string, nullable — Set on managed entries only; null on user-set entries.
      - `created_at` string, date-time, nullable — Set on user-set entries only; null on managed entries.
      - `updated_at` string, date-time, nullable — Set on user-set entries only; null on managed entries.

## Other responses

- `401` — Invalid or missing API key
- `404` — Resource not found

---

[API](https://skmtc.dev/primitive/apis/primitive-api.md) · [All operations](https://skmtc.dev/primitive/apis/primitive-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/primitive/primitive-api/revisions/c2299d28022c/schema)