Skip to content

Secrets

List secrets

List workspace secrets visible to the caller and caller-owned personal secrets. Only workspace secrets marked `unredacted` can include values; every other entry contains metadata only. Requires workspace read access. Personal secrets belong to the caller across workspaces. Workspace API keys return `403`; use a personal API key or scoped OAuth token. OAuth scope: `api:read`.

GET/api/v2/secrets

List workspace secrets visible to the caller and caller-owned personal secrets. Only workspace secrets marked unredacted can include values; every other entry contains metadata only. Requires workspace read access. Personal secrets belong to the caller across workspaces. Workspace API keys return 403; use a personal API key or scoped OAuth token.

OAuth scope: api:read.

Authentication

Send a personal or workspace API key in X-API-Key. See key types and access; operations that reject workspace keys say so in their description.

Send X-API-Key in the request header.

Alternatively

Send a Sim OAuth access token in Authorization: Bearer. See OAuth authentication and scopes.

Authorization: Bearer YOUR_ACCESS_TOKEN

Required scopes: api:read

OAuth flows
json
{
  "authorizationCode": {
    "authorizationUrl": "https://www.sim.ai/api/auth/oauth2/authorize",
    "tokenUrl": "https://www.sim.ai/api/auth/oauth2/token",
    "refreshUrl": "https://www.sim.ai/api/auth/oauth2/token",
    "scopes": {
      "api:read": "Read your workspaces, workflows, files, tables, and logs",
      "api:write": "Read, create, change, run, and delete resources in your workspaces",
      "offline_access": "Stay signed in without asking again"
    }
  }
}

OAuth scope: api:read.

Query parameters

workspaceIdstringRequired

Workspace whose secret metadata should be listed.

minLength
1
maxLength
128
scopestring

Restrict results to one ownership scope.

enum
["workspace","personal"]
searchstring

Case-insensitive substring match against the secret name.

minLength
1
maxLength
200
sortBystring

Field used to sort the result. Do not rely on case-insensitive ordering when sorting by name.

default
name
enum
["name","createdAt","updatedAt"]
sortOrderstring

Sort direction.

default
asc
enum
["asc","desc"]
limitinteger

Maximum secrets to return per page. Must be a whole number from 1 to 100. Defaults to 50.

default
50
minimum
1
maximum
100
cursorstring

Opaque cursor from the previous page. Send it back with the same sort and filters; only limit may change. Change anything else and pagination must restart without a cursor.

minLength
1

Responses

200

Secret metadata visible to the caller.

object

Secret metadata visible to the caller; visible (unredacted) workspace secrets carry their value.

2 fields
dataarrayRequired

Items in the current page.

Schema details
Array itemobject

Secret metadata; the stored value is included only for a workspace secret marked visible (unredacted).

8 fields
namestringRequired

Secret name containing only letters, numbers, and underscores.

minLength
1
maxLength
255
pattern
^[A-Za-z0-9_]+$
scopestringRequired

Whether the secret belongs to the workspace or to the caller. A personal secret belongs to the caller across every workspace, not to one workspace.

enum
["workspace","personal"]
descriptionvalueRequired

What the secret is for, as set on the workspace secret. Always null for a personal secret, which has no shared audience.

Schema details

Any of

Option 1string
Option 2null
unredactedbooleanRequired

Whether the workspace secret opts out of redaction, so its value appears in plaintext in run logs and model-visible content. Always false for a personal secret.

rolestringRequired

Caller role for the secret.

enum
["admin","member"]
createdAtstringRequired

ISO 8601 timestamp when the secret was created.

format
date-time
pattern
^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
updatedAtstringRequired

ISO 8601 timestamp when the secret was last updated.

format
date-time
pattern
^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
valuestring

The stored secret value. Present only when the workspace secret is marked visible (unredacted); omitted for every other secret.

Additional properties are not allowed.

nextCursorvalueRequired

Opaque cursor for the next page. Send it back as cursor; null means there are no more pages. Do not construct a cursor yourself.

Schema details

Any of

Option 1string
Option 2null

Additional properties are not allowed.

Response example 1

json
{
  "data": [
    {
      "name": "STRIPE_API_KEY",
      "scope": "workspace",
      "description": "Production billing key — rotate quarterly.",
      "unredacted": false,
      "role": "admin",
      "createdAt": "2026-06-01T09:14:00.000Z",
      "updatedAt": "2026-06-20T14:02:11.000Z"
    },
    {
      "name": "STAGING_BASE_URL",
      "scope": "workspace",
      "description": "Staging environment base URL.",
      "unredacted": true,
      "role": "member",
      "createdAt": "2026-06-03T11:30:00.000Z",
      "updatedAt": "2026-06-21T08:45:09.000Z",
      "value": "https://staging.example.com"
    }
  ],
  "nextCursor": null
}

Response headers

X-RateLimit-Limitinteger

Maximum requests allowed in the current window.

minimum
0
maximum
9007199254740991
X-RateLimit-Remaininginteger

Requests remaining in the current window.

minimum
0
maximum
9007199254740991
X-RateLimit-Resetstring

ISO 8601 timestamp when the current rate-limit window resets.

format
date-time
pattern
^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
Was this helpful?
Suggest an edit