---
title: "List credential injection routes"
method: GET
path: "/secrets/routes"
tags: ["Secrets"]
---

# List credential injection routes

`GET /secrets/routes`

Requires an owner/admin browser session with recent MFA. Returns metadata only; secret values are never included in responses. Tenant API keys and agent tokens cannot read this inventory. Credential injection routes bind a secret to one tenant agent and an explicit allowlisted upstream host/path/method/header. Broad host, path, method, internal-host, line-break, and unsafe header injection patterns are rejected by the API.

## Query parameters

- `secretId` string

## Response `200`

JSON response

- object
  - `ok` true, required
  - `data` object[], required
    - `id` string, required
    - `tenantId` string, required
    - `agentId` string, required
    - `secretId` string, required
    - `hostPattern` string, required
    - `pathPattern` string, required
    - `method` '*' | 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE' | 'HEAD', required
    - `injectAs` 'header', required
    - `injectKey` string, required
    - `injectFormat` string, nullable
    - `injectionStrategy` 'header' | 'sigv4', required
    - `injectionConfig` object, required
      - `service` 'ec2'
      - `region` string
    - `priority` integer
    - `enabled` boolean, required
    - `createdAt` string, date-time

## Other responses

- `400` — JSON response
- `401` — JSON response
- `403` — JSON response
- `404` — JSON response
- `409` — JSON response

## Changes

- **2026-08-18** `0397c6d8e684` — 2 info
  - added the required property `data/items/injectionConfig` to the response with the `200` status
  - added the required property `data/items/injectionStrategy` to the response with the `200` status
- **2026-08-17** `261a7c8070b2` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/steward-fi/apis/steward-api/changes/secrets/routes/get.md)

---

[API](https://skmtc.dev/steward-fi/apis/steward-api.md) · [All operations](https://skmtc.dev/steward-fi/apis/steward-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/steward-fi/steward-api/revisions/b88b4b97a664/schema)