> ## Documentation Index > Fetch the complete documentation index at: https://hyperbrowser.ai/docs/llms.txt > Use this file to discover all available pages before exploring further. # Get secret by ID > Get a secret and its versions. See the [secrets guide](/docs/sandboxes/secrets) for SDK and CLI examples, and [credential fill](/docs/sessions/credentials) for website logins. ## OpenAPI ````yaml openapi.json GET /api/secrets/{id} openapi: 3.0.1 info: title: Hyperbrowser API version: 1.0.0 servers: - url: https://api.hyperbrowser.ai description: Production server security: [] paths: /api/secrets/{id}: get: summary: Get a secret description: >- Returns a secret and its stored versions. Values are never returned. Secrets are enabled for teams on request; please contact support to enable them (otherwise 403 SECRETS_FEATURE_DISABLED). Restricted API keys need the secrets.read scope. When you're signed in rather than using an API key, you must be a team owner or admin (otherwise 403 SECRETS_ADMIN_REQUIRED). operationId: getSecret parameters: - name: id in: path required: true schema: type: string format: uuid description: Secret ID. responses: '200': description: Success content: application/json: schema: $ref: '#/components/schemas/SecretDetail' '400': description: Invalid secret ID. content: application/json: schema: $ref: '#/components/schemas/SecretErrorResponse' '401': description: Authentication required. content: application/json: schema: $ref: '#/components/schemas/SecretErrorResponse' '403': description: >- API_KEY_SCOPE_DENIED (the API key lacks a required scope), SECRETS_FEATURE_DISABLED, or SECRETS_ADMIN_REQUIRED. content: application/json: schema: $ref: '#/components/schemas/SecretErrorResponse' '404': description: 'SECRET_NOT_FOUND: no secret with this ID in your team.' content: application/json: schema: $ref: '#/components/schemas/SecretErrorResponse' '500': description: Internal server error. content: application/json: schema: $ref: '#/components/schemas/SecretErrorResponse' security: - ApiKeyAuth: [] components: schemas: SecretDetail: allOf: - $ref: '#/components/schemas/Secret' - type: object properties: versions: type: array items: $ref: '#/components/schemas/SecretVersion' description: Stored versions, newest first. Values are never returned. required: - versions SecretErrorResponse: type: object properties: code: type: string description: Machine-readable error code, such as SECRET_NOT_FOUND. message: type: string error: type: string description: >- Set instead of `code` by authentication and API key scope errors (API_KEY_SCOPE_DENIED). requiredScopes: type: array items: type: string description: The scope the API key is missing, with API_KEY_SCOPE_DENIED. retryable: type: boolean description: >- Whether repeating the same request can succeed. Set on delivery errors. details: type: object additionalProperties: true description: >- Extra information for some codes, such as `origin` for CREDENTIAL_ORIGIN_NOT_ALLOWED or `pages` for CREDENTIAL_PAGE_AMBIGUOUS. description: >- HTTP failure. Secret errors include `code` and `message`; request validation errors include only `message`; API key scope errors include `error`, `message` and `requiredScopes`. Secret: type: object description: A secret. The API never returns its value. properties: id: type: string format: uuid name: type: string pattern: ^[a-zA-Z0-9][a-zA-Z0-9_-]{0,127}$ description: >- 1-128 letters, digits, `_` or `-`, starting with a letter or digit. Unique within your team. description: type: string maxLength: 1024 type: $ref: '#/components/schemas/SecretType' metadata: $ref: '#/components/schemas/SecretMetadata' encryptionContext: type: string description: >- Copy this verbatim into the `ctx` header of every envelope you upload for this secret. Don't build it yourself: it includes the secret's type for types other than `secret`, and an envelope sealed with another context returns 400 SECRET_ENVELOPE_INVALID. latestVersion: type: integer nullable: true description: The newest version number, or null until a value is uploaded. createdAt: type: string format: date-time updatedAt: type: string format: date-time required: - id - name - description - type - metadata - encryptionContext - latestVersion - createdAt - updatedAt SecretVersion: type: object properties: version: type: integer minimum: 1 kid: type: string description: ID of the public key the envelope was encrypted to. createdAt: type: string format: date-time required: - version - kid - createdAt SecretType: type: string enum: - secret - totp - op_token description: >- What the value is. Fixed at creation. `secret`: any string, set as an environment variable and, once it has allowed origins, typed into browser pages. `totp`: an authenticator seed (base32, or an `otpauth://totp/` URI); environment variables get the code current when the process starts, and fills type the code current at fill time. `op_token`: a 1Password service account token, used only by 1Password vaults; it's never an environment variable, a vault entry or a browser credential. Treat types you don't recognize as opaque: more may be added. SecretMetadata: type: object properties: browser: $ref: '#/components/schemas/SecretBrowserMetadata' additionalProperties: false description: >- Settings that aren't secret, returned by the API and editable without uploading a new value. A `secret` or `totp` secret can't be filled into browser pages until `browser.allowedOrigins` is set. An `op_token` secret accepts only `{}` (otherwise 400 SECRET_METADATA_INVALID). SecretBrowserMetadata: type: object properties: allowedOrigins: type: array minItems: 1 maxItems: 20 items: type: string maxLength: 512 description: >- Origins a page or frame must be on before anything is typed, as `scheme://host[:port]` with no path, such as `https://github.com`. A leading `*.` matches any subdomain but not the domain itself, and must name at least two labels (`*.example.com`); you can't use a wildcard with an IP address. Origins must use https, except `http://localhost`, `http://127.0.0.1` and `http://[::1]`. Hyperbrowser lowercases origins, drops default ports and removes duplicates. An invalid entry returns 400 SECRET_METADATA_INVALID naming it. required: - allowedOrigins additionalProperties: false description: >- Where the secret may be typed into browser pages. Allowed for `secret` and `totp`. securitySchemes: ApiKeyAuth: type: apiKey in: header name: x-api-key ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.