List vault secrets

⚠️
Preview — this feature is being built; the design below is the spec.
GET https://app.syntic.ai/v1/vaults/{vault_id}/secrets

Return the names and metadata of the secrets in a vault. Values are write-only and never appear in any response.

For how this fits into a full workflow, see Vaults.

Headers

HeaderRequiredValue
AuthorizationYesBearer <key>: a private inference key (sk_live_...). See Authentication.
syntic-betaYes, while in previewagents-2026-11-01. Without it the call fails with 400 beta_required. See Versioning.

Path parameters

ParameterTypeDescription
vault_idstringThe vault id, starting with vlt_.

Query parameters

ParameterTypeDefaultDescription
unused_sincestringRFC 3339 time; only secrets not used since then. Handy for clean-up.
limitinteger201 to 100.
after_idstringNext page: the previous page’s last_id.
before_idstringPrevious page: the previous page’s first_id.

Response

200 OK, Content-Type: application/json

{
  "data": [
    {
      "name": "crm-token",
      "hint": "…9f2a",
      "allowed_destinations": [
        "mcp.example.com"
      ],
      "created_at": "2026-11-03T09:00:00Z",
      "updated_at": "2026-11-05T09:00:00Z",
      "last_used_at": "2026-11-05T10:00:03Z"
    },
    {
      "name": "git-read-token",
      "hint": "…c41d",
      "allowed_destinations": [
        "git.example.com"
      ],
      "created_at": "2026-11-03T09:00:00Z",
      "updated_at": "2026-11-05T09:00:00Z",
      "last_used_at": null
    }
  ],
  "has_more": false,
  "first_id": "crm-token",
  "last_id": "git-read-token"
}
FieldTypeDescription
namestringThe secret’s name inside the vault.
hintstringThe last four characters, for recognition. The value itself is never returned.
allowed_destinationsarrayHosts the secret may be sent to. Empty means any host the session can reach.
last_used_atstring or nullWhen a tool or MCP call last used it.
has_morebooleantrue when another page exists after this one.
first_idstring or nullPass as before_id to go back a page.
last_idstring or nullPass as after_id to get the next page.

Examples

curl -sS "https://app.syntic.ai/v1/vaults/vlt_01JC2B4D6F8H0K2M4P6R/secrets" \
  -H "Authorization: Bearer $SYNTIC_API_KEY" \
  -H "syntic-beta: agents-2026-11-01"

Errors

Errors use the error envelope and carry a request_id. Codes specific to this operation:

StatustypecodeWhen
400invalid_request_errorbeta_requiredThe syntic-beta header is missing.
404not_found_errorvault_not_foundNo vault with this id in the key’s workspace.
401authentication_errorinvalid_api_keyThe key is missing, unknown, revoked or expired.
429rate_limit_errorrate_limitedToo many requests; wait for Retry-After. See Rate-limit headers.
Was this page helpful?