---
title: "Get Env Value"
method: GET
path: "/apps/{app_id}/env/{key}/value"
---

# Get Env Value

`GET /apps/{app_id}/env/{key}/value`

## Request

- Base URL: `https://api.xhostd.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.xhostd.com/apps/{app_id}/env/{key}/value`
- Auth: none declared

Reveal one env value — the only read path for ``kind='secret'``.

``channel_id`` given: that channel's row, falling back to the
app-level row when the channel has no override (resolved
semantics). No ``channel_id``: the app-level row only. Every call
records an ``env.reveal`` journal event before the value is
returned (blob-credentials precedent, ``routes/blob.py``).

A protected action: the gate runs at the top of the worker, before
``crypto.decrypt``, so the route never decrypts a secret it then
refuses.

## Path parameters

- `app_id` string, uuid, required
- `key` string, required

## Query parameters

- `channel_id` string, uuid, nullable

## Headers

- `authorization` string, nullable

## Response `200`

Successful Response

- EnvValueResponse
  - `key` string, required
  - `kind` 'env' | 'secret', required
  - `scope` 'app' | 'channel', required
  - `value` string, required

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/xhostd/apis/xhostd-public.md) · [All operations](https://skmtc.dev/xhostd/apis/xhostd-public/llms.txt) · [OpenAPI document](https://skmtc.dev/xhostd/apis/xhostd-public/revisions/bf439c4d1789?raw)