# List organization secrets

`GET /v1/orgs/{orgId}/secrets`

Returns the organization's secrets. Values are always masked. Platform-managed secrets are not listed. An organization secret reaches a project only through a link (see /v1/projects/{projectId}/org-secrets).

## Path parameters

- `orgId` (integer, required): The org id from GET /v1/orgs. Minimum: `1`.

## Header parameters

- `Authorization` (string, required): `Bearer <token>`. [Authentication](https://spice.ai/docs/cloud/api/management#authentication) lists the tokens it accepts.
- `X-Org-Name` (string, optional): When present, X-Org-Name must name the same org as orgId. Otherwise the request returns org\_path\_mismatch (400). Pattern: `^[A-Za-z0-9._-]{1,255}$`.

## Example request

```bash
curl "https://api.spice.ai/v1/orgs/<orgId>/secrets" \
  -H "Authorization: Bearer <token>"
```

```http
GET /v1/orgs/<orgId>/secrets HTTP/1.1
Host: api.spice.ai
Authorization: Bearer <token>
```

## Responses

**200 OK**

The organization's secrets, masked

Content type: `application/json`

- `secrets` (array of object)
  - `id` (integer): Unique identifier for the secret
  - `name` (string): Name of the secret
  - `value` (string): Always masked with asterisks
  - `created_at` (string (date-time)): Timestamp when the secret was created
  - `updated_at` (string (date-time)): Timestamp when the secret was last updated

**400 Bad Request**

orgId is not a valid org id (`invalid_org_id`), or X-Org-Name does not name that org (`org_path_mismatch`)

**401 Unauthorized**

Unauthorized

**403 Forbidden**

Insufficient scope (requires secrets:read), the viewer role, or the caller is not a member of the organization (`org_forbidden`), a machine credential named an organization other than its own (`org_assertion_mismatch`), or the organization a machine credential is bound to has been deleted (`org_deleted`)

**500 Internal Server Error**

Internal server error

OpenAPI: [api.spice.ai/openapi.json](https://api.spice.ai/openapi.json)