Get secrets

GET /v1/kms/secrets/{wildcard1}

Reads one secret's value from your org.

Opens one sealed secret belonging to the caller's own org and returns its value, with the name and environment it was resolved under. This is the broker's purpose, and the response body is the ONLY place the value appears — it is not logged, and it is never carried in an error.

secret is the coordinate beneath the caller's org root, subpath and name together, and over HTTP it is the trailing path itself. env selects the environment and falls back to the default when omitted. A secret that is not there is a plain 404 that names nothing about the store.

Scoped to the caller's own org and nothing else: there is no org in the address, so another tenant's secret is not merely refused, it is unnameable. Within that org the value opens only for SuperAdmin holding an access token, audited, or for a holder a declared READ grant covers at this exact path, key and environment; membership and org admin alone open nothing. Admission is fail-closed and in order — a validated member, an org that is a DNS-1123 label, a store holding a master key, a well-formed address, then the grant — 401/403, 400, 503, 400 and 403, all decided before any record is touched, so a refused caller learns nothing about whether the secret exists.

A value this deployment seals on the org's behalf — an MCP server's credential, a repository's environment secret, a connected account's token — is read by the app that sealed it, and never opens here for membership or org admin, whatever the grant declaration says about enforcement. A deployed app's or a validator's own folder also opens for the org's KMS-sync identity, which projects it into the org's namespace.

Request

2 fields.

Response

200 body — 3 fields.

Failure carries the platform error shape — see Errors.

Examples

hanzo kms secrets get <wildcard1>

import { Configuration, KmsApi } from 'hanzoai';

const api = new KmsApi(new Configuration({ accessToken: process.env.HANZO_API_KEY }));
const { data } = await api.getKmsSecretsByWildcard1({ wildcard1: 'wildcard1' });

from hanzoai.cloud import ApiClient, Configuration
from hanzoai.cloud.api import KmsApi

client = ApiClient(Configuration(access_token=os.environ["HANZO_API_KEY"]))
result = KmsApi(client).get_kms_secrets_by_wildcard1(wildcard1='wildcard1')

cfg := hanzoai.NewConfiguration()
cfg.AddDefaultHeader("Authorization", "Bearer "+os.Getenv("HANZO_API_KEY"))
client := hanzoai.NewAPIClient(cfg)

resp, _, err := client.KmsAPI.GetKmsSecretsByWildcard1(context.Background()).Execute()
if err != nil {
	return err
}

use hanzo_client::apis::{configuration::Configuration, kms_api};

let mut cfg = Configuration::new();
cfg.bearer_access_token = std::env::var("HANZO_API_KEY").ok();

let result = kms_api::get_kms_secrets_by_wildcard1(&cfg, Default::default()).await?;

import ai.hanzo.cloud.ApiClient;
import ai.hanzo.cloud.api.KmsApi;

ApiClient client = new ApiClient();
client.setBearerToken(System.getenv("HANZO_API_KEY"));

var result = new KmsApi(client).getKmsSecretsByWildcard1();

curl https://api.hanzo.ai/v1/kms/secrets/<wildcard1> \
  -H "Authorization: Bearer $HANZO_API_KEY"

curl -X POST https://api.hanzo.ai/v1/mcp \
  -H "Content-Type: application/json" \
  -d '{
       "jsonrpc": "2.0",
       "id": 1,
       "method": "tools/call",
       "params": {
         "name": "describe",
         "arguments": {
           "op": "get_kms_config"
         }
       }
     }'

KMS API · All Hanzo APIs · Interactive reference