---
title: "Get Secret By Name"
method: GET
path: "/workspaces/{workspace_id}/secrets/{secret_name}"
tags: ["secrets"]
---

# Get Secret By Name

`GET /workspaces/{workspace_id}/secrets/{secret_name}`

## Request

- Base URL: `https://platform.tracecat.com/api`
- URL: `https://platform.tracecat.com/api/workspaces/{workspace_id}/secrets/{secret_name}`
- Auth: one of:
  - API key in cookie `fastapiusersauth`
  - HTTP bearer

Get a secret.

## Path parameters

- `secret_name` string, required
- `workspace_id` string, uuid, required

## Response `200`

Successful Response

- SecretRead: Read schema for workspace-scoped secrets.
  - `id` string, uuid, required
  - `type` 'custom' | 'ssh_key' | 'mtls' | 'ca_cert' | 'github_app', required: The type of a secret.
  - `name` string, required
  - `description` string, nullable
  - `encrypted_keys` string, binary, required
  - `environment` string, required
  - `tags` object, nullable
  - `created_at` string, date-time, required
  - `updated_at` string, date-time, required
  - `workspace_id` string, uuid, required
  - `source` 'local' | 'aws_secrets_manager': Where a workspace secret's values live.
  - `store_id` string, uuid, nullable
  - `remote_reference` string, nullable
  - `remote_key_mapping` AwsSecretKeyMapping: Declares how a remote AWS secret value maps onto output keys. ``whole_string`` maps the entire ``SecretString`` onto exactly one key. ``json`` maps selected top-level string fields onto declared keys.
    - `mode` 'whole_string' | 'json', required: How an AWS Secrets Manager value maps onto declared secret keys.
    - `keys` string[]
    - `fields` AwsSecretJsonField[]
      - `key` string, required
      - `field` string, required

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/tracecat/apis/tracecat-api.md) - [All operations](https://skmtc.dev/tracecat/apis/tracecat-api/llms.txt) - [OpenAPI document](https://skmtc.dev/tracecat/apis/tracecat-api/revisions/2efdda25045f?raw)