List organization secrets

curl --request GET \
  --url https://api.onecli.sh/v1/org/secrets \
  --header 'Authorization: Bearer <token>'

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://api.onecli.sh/v1/org/secrets', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.onecli.sh/v1/org/secrets",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.onecli.sh/v1/org/secrets"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.onecli.sh/v1/org/secrets")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

[
  {
    "id": "<string>",
    "name": "<string>",
    "type": "anthropic",
    "valueSource": "inline",
    "opRef": "<string>",
    "hostPattern": "<string>",
    "pathPattern": "<string>",
    "injectionConfig": {
      "headerName": "<string>",
      "valueFormat": "<string>"
    },
    "metadata": {},
    "scope": "workspace",
    "typeLabel": "<string>",
    "lastError": {
      "status": 123,
      "at": "2023-11-07T05:31:56Z"
    },
    "createdAt": "2023-11-07T05:31:56Z"
  }
]

GET

org

secrets

List organization secrets

curl --request GET \
  --url https://api.onecli.sh/v1/org/secrets \
  --header 'Authorization: Bearer <token>'

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://api.onecli.sh/v1/org/secrets', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.onecli.sh/v1/org/secrets",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.onecli.sh/v1/org/secrets"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.onecli.sh/v1/org/secrets")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

[
  {
    "id": "<string>",
    "name": "<string>",
    "type": "anthropic",
    "valueSource": "inline",
    "opRef": "<string>",
    "hostPattern": "<string>",
    "pathPattern": "<string>",
    "injectionConfig": {
      "headerName": "<string>",
      "valueFormat": "<string>"
    },
    "metadata": {},
    "scope": "workspace",
    "typeLabel": "<string>",
    "lastError": {
      "status": 123,
      "at": "2023-11-07T05:31:56Z"
    },
    "createdAt": "2023-11-07T05:31:56Z"
  }
]

Returns the secrets an admin has shared with the whole organization. Use it to audit which shared credentials exist before you grant one to an agent. Secret values are never included in the response. Admin or owner.

Availability: Cloud · Community (self-hosted) · Enterprise (self-hosted)

Authorizations

Authorization

string

header

required

A workspace API key (oc_…) or organization API key (oc_org_…). Workspace-scoped endpoints called with an organization key also need X-Workspace-Id.

Response

200 - application/json

Secrets

string

name

string

type

enum<string>

Available options:

anthropic,

openai,

generic

valueSource

enum<string>

Where the secret value lives — stored encrypted (inline) or resolved from 1Password at request time (onepassword).

Available options:

inline,

onepassword

opRef

string | null

1Password secret reference (op://vault/item/field). Only set when valueSource is onepassword.

hostPattern

string

pathPattern

string | null

injectionConfig

Header injection · object

How the gateway injects this secret into matching outbound requests (generic secrets only). Exactly one variant:

Header — { "headerName": "Authorization", "valueFormat": "Bearer {value}" }
Query parameter — { "paramName": "key", "paramFormat": "{value}" }
URL path template — { "pathTemplate": "/bot{value}" } (must start with / and contain {value} exactly once)
URL path regex — { "pathRegex": "^/bot([^/]+)", "pathReplacement": "/bot{value}" } (replacement must contain {value})

Unknown or mixed keys are rejected.

Header injection
Query parameter injection
URL path template injection
URL path regex injection

Show child attributes

metadata

object | null

Type-specific metadata (for example authMode for anthropic/openai secrets, 1Password display labels).

scope

enum<string>

Workspace lists include inherited organization secrets; use this to tell them apart.

Available options:

workspace,

organization

typeLabel

string

lastError

object | null

LLM keys only. The most recent upstream response that indicts the key itself (401, 402, 403, 429) inside the recent window, or null when the last injected call succeeded.

Show child attributes

createdAt

string<date-time>

Workspace

Organization

Enterprise

Platform

List organization secrets

Authorizations

Response