Skip to main content
GET
Get a secret
See the secrets guide for SDK and CLI examples, and credential fill for website logins.

Authorizations

x-api-key
string
header
required

Path Parameters

id
string<uuid>
required

Secret ID.

Response

Success

A secret. The API never returns its value.

id
string<uuid>
required
name
string
required

1-128 letters, digits, _ or -, starting with a letter or digit. Unique within your team.

Pattern: ^[a-zA-Z0-9][a-zA-Z0-9_-]{0,127}$
description
string
required
Maximum string length: 1024
type
enum<string>
required

What the value is. Fixed at creation. secret: any string, set as an environment variable and, once it has allowed origins, typed into browser pages. totp: an authenticator seed (base32, or an otpauth://totp/ URI); environment variables get the code current when the process starts, and fills type the code current at fill time. op_token: a 1Password service account token, used only by 1Password vaults; it's never an environment variable, a vault entry or a browser credential. Treat types you don't recognize as opaque: more may be added.

Available options:
secret,
totp,
op_token
metadata
object
required

Settings that aren't secret, returned by the API and editable without uploading a new value. A secret or totp secret can't be filled into browser pages until browser.allowedOrigins is set. An op_token secret accepts only {} (otherwise 400 SECRET_METADATA_INVALID).

encryptionContext
string
required

Copy this verbatim into the ctx header of every envelope you upload for this secret. Don't build it yourself: it includes the secret's type for types other than secret, and an envelope sealed with another context returns 400 SECRET_ENVELOPE_INVALID.

latestVersion
integer | null
required

The newest version number, or null until a value is uploaded.

createdAt
string<date-time>
required
updatedAt
string<date-time>
required
versions
object[]
required

Stored versions, newest first. Values are never returned.