List secrets
curl --request GET \
--url https://api.onecli.sh/v1/secrets \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.onecli.sh/v1/secrets"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.onecli.sh/v1/secrets', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.onecli.sh/v1/secrets",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.onecli.sh/v1/secrets"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.onecli.sh/v1/secrets")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.onecli.sh/v1/secrets")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body[
{
"id": "<string>",
"name": "<string>",
"type": "anthropic",
"valueSource": "inline",
"opRef": "<string>",
"hostPattern": "<string>",
"pathPattern": "<string>",
"injectionConfig": {
"headerName": "<string>",
"valueFormat": "<string>"
},
"metadata": {},
"scope": "workspace",
"typeLabel": "<string>",
"lastError": {
"status": 123,
"at": "2023-11-07T05:31:56Z"
},
"createdAt": "2023-11-07T05:31:56Z"
}
]Secrets
List secrets in the current workspace
Returns workspace secrets plus organization secrets shared into the workspace, newest first. Values are never returned, and LLM keys carry a health marker.
GET
/
secrets
List secrets
curl --request GET \
--url https://api.onecli.sh/v1/secrets \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.onecli.sh/v1/secrets"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.onecli.sh/v1/secrets', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.onecli.sh/v1/secrets",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.onecli.sh/v1/secrets"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.onecli.sh/v1/secrets")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.onecli.sh/v1/secrets")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body[
{
"id": "<string>",
"name": "<string>",
"type": "anthropic",
"valueSource": "inline",
"opRef": "<string>",
"hostPattern": "<string>",
"pathPattern": "<string>",
"injectionConfig": {
"headerName": "<string>",
"valueFormat": "<string>"
},
"metadata": {},
"scope": "workspace",
"typeLabel": "<string>",
"lastError": {
"status": 123,
"at": "2023-11-07T05:31:56Z"
},
"createdAt": "2023-11-07T05:31:56Z"
}
]Returns both scopes, told apart by the
scope field. LLM keys carry a lastError health marker so you can spot a broken key. See How it works for how secrets are injected.
Returns the workspace’s secrets plus the organization secrets shared into it (scope tells them apart), newest first. Secret values are never returned. LLM keys carry a lastError health marker.
Availability: Cloud · Community (self-hosted) · Enterprise (self-hosted)
Authorizations
A workspace API key (oc_…) or organization API key (oc_org_…). Workspace-scoped endpoints called with an organization key also need X-Workspace-Id.
Response
200 - application/json
List of secrets
Available options:
anthropic, openai, generic Where the secret value lives — stored encrypted (inline) or resolved from 1Password at request time (onepassword).
Available options:
inline, onepassword 1Password secret reference (op://vault/item/field). Only set when valueSource is onepassword.
How the gateway injects this secret into matching outbound requests (generic secrets only). Exactly one variant:
- Header —
{ "headerName": "Authorization", "valueFormat": "Bearer {value}" } - Query parameter —
{ "paramName": "key", "paramFormat": "{value}" } - URL path template —
{ "pathTemplate": "/bot{value}" }(must start with/and contain{value}exactly once) - URL path regex —
{ "pathRegex": "^/bot([^/]+)", "pathReplacement": "/bot{value}" }(replacement must contain{value})
Unknown or mixed keys are rejected.
- Header injection
- Query parameter injection
- URL path template injection
- URL path regex injection
Show child attributes
Show child attributes
Type-specific metadata (for example authMode for anthropic/openai secrets, 1Password display labels).
Workspace lists include inherited organization secrets; use this to tell them apart.
Available options:
workspace, organization LLM keys only. The most recent upstream response that indicts the key itself (401, 402, 403, 429) inside the recent window, or null when the last injected call succeeded.
Show child attributes
Show child attributes