---
title: "Get the tenant's selected secret provider"
method: GET
path: "/tenants/{tenantId}/secrets/provider"
tags: ["SecretProviders"]
---

# Get the tenant's selected secret provider

`GET /tenants/{tenantId}/secrets/provider`

Returns the secret provider selected for the tenant, identified by its type. When no tenant provider is selected the tenant inherits the application default and ultimately the read-only environment floor. Plaintext secrets and credential references are never returned; the response reports only the credential mode together with the partition strategy and instance id that determine how addresses are sharded.

## Parameters

- `./platform-config-components.yml#/components/parameters/TenantId` — unresolved $ref

## Response `200`

Selected secret provider.

- SecretProvider — unresolved $ref

## Other responses

- `401` — unresolved $ref
- `403` — unresolved $ref

## Changes

- **2026-06-17** `f39de1a395fb` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/sphereon-opensource/apis/platform-config-api/changes/tenants/:tenantId/secrets/provider/get.md)

---

[API](https://skmtc.dev/sphereon-opensource/apis/platform-config-api.md) · [All operations](https://skmtc.dev/sphereon-opensource/apis/platform-config-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/sphereon-opensource/platform-config-api/revisions/f0066c61ebdb/schema)