Hanzo
OpenapiKms

Lists the secrets your org holds, without their values.

Lists the secrets your org holds, without their values.

GET /v1/kms/secrets

Addresshttps://api.hanzo.ai/v1/kms/secrets
MethodGET
Operationget_kms_secrets
AuthAuthorization: Bearer $HANZO_API_KEY

Lists the secrets your org holds, without their values.

Returns the METADATA of the caller's own secrets: each one's name, path, environment and sealing scheme. No value and no ciphertext is included — this operation exists to enumerate what is held, and reading a value is a separate, per-secret call.

Scoped to the caller's own org and nothing else, structurally: there is no org in the path, the store root is derived from the validated org claim, and a caller therefore has no way to name another tenant's namespace. path narrows to a subpath and env selects the environment; both are also accepted under the operator's spellings, secretPath and environment. An omitted env means every environment and an omitted path means the whole org, because a default here reported a populated store as empty.

Admission is fail-closed and in order: a validated member, an org that is a DNS-1123 label, and a store holding a master key — 403, 400 and 503 respectively, all decided before any record is touched.

Request

4 fields.

FieldInTypeRequiredDescription
envquerystring
environmentquerystring
pathquerystring
secretPathquerystring

Response

StatusBodyMeaning
200kmsSecretsok

200 body — 7 fields.

FieldInTypeAlwaysDescription
namesbodystring[]Names is the same listing reduced to bare names, which is the shape the KMS operator reads.
secretsbodySecretMeta[]Secrets are the descriptors: name, path, environment and sealing scheme.
secrets[].envbodystringEnv is the environment the secret belongs to.
secrets[].namebodystringName is the secret's name within its path and environment.
secrets[].pathbodystringPath is the subpath the secret is stored under, beneath the org root.
secrets[].schemebodystringScheme names how the value is sealed at rest, so a caller can tell a migrated record from a current one without opening it.
totalbodyintegerTotal is how many descriptors this listing carries.

Failure carries the platform error shape — see Errors.

Examples

hanzo kms secrets list

KMS API · All Hanzo APIs · Interactive reference

How is this guide?

On this page