---
title: "Get Variables"
method: GET
path: "/api/apps/{name}/variables"
tags: ["deploy"]
---

# Get Variables

`GET /api/apps/{name}/variables`

## Request

- Base URL: `https://softkiln.com` (the document declares no server; this is the origin it was published from)
- URL: `https://softkiln.com/api/apps/{name}/variables`
- Auth: none declared

List env vars, with the values of the caller's own vars.

The browser gets its values here, not one reveal at a time: this page is the
only interface a human has for setting a secret now that MCP can't, so it has
to be usable. The masking is client-side again, as it was before.

Filtering is still server-side: Railway-injected vars never leave the backend,
and platform-managed ones (DATABASE_URL, BACKUP_HMAC_SECRET, ...) are listed
only to super-admins — and even for them, only as metadata. Their values stay
on /variables/reveal, one key at a time.

## Path parameters

- `name` string, required

## Query parameters

- `env` string

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/softkiln/apis/app-manager-api.md) · [All operations](https://skmtc.dev/softkiln/apis/app-manager-api/llms.txt) · [OpenAPI document](https://skmtc.dev/softkiln/apis/app-manager-api/revisions/8e293a417e4a?raw)