---
title: "List the organization secrets linked to a project"
method: GET
path: "/v1/orgs/{orgId}/projects/{projectId}/org-secrets"
tags: ["Secrets"]
---

# List the organization secrets linked to a project

`GET /v1/orgs/{orgId}/projects/{projectId}/org-secrets`

## Request

- Base URL: `https://api.spice.ai`
- URL: `https://api.spice.ai/v1/orgs/{orgId}/projects/{projectId}/org-secrets`
- Auth: HTTP bearer

The org is `orgId` in the path. Returns the organization secrets this project receives at deploy time. Values are always masked. `shadowed` is true when a project secret has the same name; the project secret is the one delivered.

## Path parameters

- `orgId` integer, required
- `projectId` integer, required

## Headers

- `X-Org-Name` string

## Response `200`

The linked organization secrets, masked

- object
  - `org_secrets` object[]
    - `id` integer: Unique identifier for the secret
    - `name` string: Name of the secret
    - `value` string: Always masked with asterisks
    - `created_at` string, date-time: Timestamp when the secret was created
    - `updated_at` string, date-time: Timestamp when the secret was last updated
    - `shadowed` boolean

## Other responses

- `400`: Invalid project ID. orgId is not a valid org id (`invalid_org_id`), or X-Org-Name does not name that org (`org_path_mismatch`).
- `401`: Unauthorized
- `403`: Insufficient scope (requires secrets:read) or the viewer role. The caller is not a member of the org (`org_forbidden`). A machine credential named a different org (`org_assertion_mismatch`). The org is deleted (`org_deleted`).
- `404`: Project not found
- `500`: Internal server error

---

[API](https://skmtc.dev/spice/apis/spice-cloud-control-plane-api.md) - [All operations](https://skmtc.dev/spice/apis/spice-cloud-control-plane-api/llms.txt) - [OpenAPI document](https://skmtc.dev/spice/apis/spice-cloud-control-plane-api/revisions/5f3b75dd847d?raw)