---
title: "List function secrets"
method: GET
path: "/projects/v1/admin/{project_id}/secrets"
tags: ["Functions"]
---

# List function secrets

`GET /projects/v1/admin/{project_id}/secrets`

## Request

- Base URL: `https://api.run402.com`
- URL: `https://api.run402.com/projects/v1/admin/{project_id}/secrets`
- Auth: HTTP bearer

Lists secret key names (not values).

## Path parameters

- `project_id` string, required: Run402 project ID. Public IDs are not UUIDs.

## Response `200`

Secret keys

- object
  - `secrets` string[]

## Other responses

- `401`: Missing or invalid authentication. Run402-originated JSON bodies use the canonical ErrorEnvelope.
- `403`: PROJECT_SCOPE_MISMATCH — a valid project_admin JWT issued for a different project (decided before any project lookup, so the answer never reveals whether the addressed project exists), or FORBIDDEN — a valid JWT of another class. Both carry next_actions; neither is a 401.

---

[API](https://skmtc.dev/run402/apis/run402-api.md) · [All operations](https://skmtc.dev/run402/apis/run402-api/llms.txt) · [OpenAPI document](https://skmtc.dev/run402/apis/run402-api/revisions/893607557f50?raw)