Skip to main content
GET
List secrets
Requires the IAM action secrets:ListSecrets. See SECRETS permissions for the full list, what each one covers, and an example policy.

Authorizations

Authorization
string
header
required

An OAuth 2.0 bearer token, sent as Authorization: Bearer <token>. This is the recommended way to authenticate.

Get one by exchanging a service account's access key pair at POST /v1/oauth/token with grant_type=client_credentials. It is the standard client-credentials grant, so any OAuth-aware library will obtain and refresh it for you.

Tokens last an hour by default. The same access key pair is separately your AWS SigV4 credential for the S3-compatible object endpoint, which speaks nothing else.

Query Parameters

name
string

Exact, case-sensitive secret name in the calling account. Empty values match nothing.

crn
string

Exact secret CRN in the calling account and current region. Malformed or empty CRNs return 400; valid foreign-account, foreign-region or wrong-type CRNs return an empty page. Combined filters intersect; conflicting name and CRN filters return an empty page. With include_deleted, a reused name can match both deleted and active secrets.

include_deleted
boolean
default:false

Include secrets in the recovery window.

Example:

false

marker
string
Example:

"eyJpZCI6IjdjOWUyZjRhIn0="

limit
integer
default:50

Maximum items to return. A larger value is clamped to the maximum rather than rejected, so page until meta.has_more is false.

Required range: 1 <= x <= 200
Example:

50

Response

Paginated list of secrets.

secrets
object[]
required
meta
object