Management APIs / Secrets

List organization secrets

GEThttps://api.spice.ai/v1/orgs/{orgId}/secrets

Returns the organization's secrets. Values are always masked. Platform-managed secrets are not listed. An organization secret reaches a project only through a link (see /v1/projects/{projectId}/org-secrets).

Authorizations

  • AuthorizationstringRequired

    Bearer <token>. Authentication lists the tokens it accepts.

Path parameters

  • orgIdintegerRequired

    The org id from GET /v1/orgs

    • Minimum: 1

Header parameters

  • X-Org-Namestring

    When present, X-Org-Name must name the same org as orgId. Otherwise the request returns org_path_mismatch (400).

    • Pattern: ^[A-Za-z0-9._-]{1,255}$

Responses

200The organization's secrets, maskedapplication/json

  • secretsarray of object

    5 properties

    • idinteger

      Unique identifier for the secret

    • namestring

      Name of the secret

    • valuestring

      Always masked with asterisks

    • created_atstring (date-time)

      Timestamp when the secret was created

    • updated_atstring (date-time)

      Timestamp when the secret was last updated

400Bad Request

orgId is not a valid org id (invalid_org_id), or X-Org-Name does not name that org (org_path_mismatch)

401Unauthorized

403Forbidden

Insufficient scope (requires secrets:read), the viewer role, or the caller is not a member of the organization (org_forbidden), a machine credential named an organization other than its own (org_assertion_mismatch), or the organization a machine credential is bound to has been deleted (org_deleted)

500Internal server error

OpenAPIapi.spice.ai/openapi.json

curl "https://api.spice.ai/v1/orgs/<orgId>/secrets" \
  -H "Authorization: Bearer <token>"
{
  "secrets": [
    {
      "id": 0,
      "name": "string",
      "value": "string",
      "created_at": "2026-01-01T00:00:00Z",
      "updated_at": "2026-01-01T00:00:00Z"
    }
  ]
}

application/json