---
title: "Secret names bound to a workspace, with per-name status (never values)"
method: GET
path: "/v1/workspaces/{workspace_id}/secrets"
tags: ["Workspaces"]
---

# Secret names bound to a workspace, with per-name status (never values)

`GET /v1/workspaces/{workspace_id}/secrets`

## Request

- Base URL: `https://api.shardflux.dev`
- URL: `https://api.shardflux.dev/v1/workspaces/{workspace_id}/secrets`
- Auth: HTTP bearer

Bound secrets are injected into every exec and PTY start of the workspace together with the call’s `secret_refs`. status: available | not_allowed | deleted. Deleted workspaces stay readable.

## Path parameters

- `workspace_id` string, uuid, required

## Response `200`

Secret names bound to a workspace and their current status. Never values.

- object: Secret names bound to a workspace and their current status. Never values.
  - `workspace_id` string, uuid, required: UUIDv7, lowercase canonical form.
  - `names` string[], required: The bound names, in the order they were given.
  - `secrets` object[], required
    - `name` string, required
    - `status` union, required: available: injected at the next exec/PTY start. not_allowed: a live secret exists but its permissions no longer allow this workspace (project, workspace id, or exec+pty); exec/PTY starts are refused with 403 secret_not_available until fixed. deleted: no live secret of this name is visible to the workspace.
      - 'available'
      - 'not_allowed'
      - 'deleted'
    - `secret_id` string, uuid, nullable, required: UUIDv7, lowercase canonical form.
    - `scope` union, required
      - 'organization'
      - 'project'

## Other responses

- `4XX`: Default Response
- `5XX`: Default Response

---

[API](https://skmtc.dev/shardflux/apis/shardflux-api.md) · [All operations](https://skmtc.dev/shardflux/apis/shardflux-api/llms.txt) · [OpenAPI document](https://skmtc.dev/shardflux/apis/shardflux-api/revisions/ea685f7b39c4?raw)