# Get secrets

URL: https://docs.hanzo.ai/docs/openapi/kms/get-kms-secrets-by-wildcard1

> Reads one secret's value from your org.

`GET /v1/kms/secrets/{wildcard1}`

> [KMS →](https://docs.hanzo.ai/docs/openapi/kms) · [All API references →](https://docs.hanzo.ai/docs/openapi) · [Get started →](https://docs.hanzo.ai/docs/guides)

|               |                                                   |
| ------------- | ------------------------------------------------- |
| **Address**   | `https://api.hanzo.ai/v1/kms/secrets/{wildcard1}` |
| **Method**    | `GET`                                             |
| **Operation** | `get_kms_secrets_by_wildcard1`                    |
| **Auth**      | `Authorization: Bearer $HANZO_API_KEY`            |

Reads one secret's value from your org.

Opens one sealed secret belonging to the caller's own org and returns its
value, with the name and environment it was resolved under. This is the
broker's purpose, and the response body is the ONLY place the value appears —
it is not logged, and it is never carried in an error.

`secret` is the coordinate beneath the caller's org root, subpath and name
together, and over HTTP it is the trailing path itself. `env` selects the
environment and falls back to the default when omitted. A secret that is not
there is a plain 404 that names nothing about the store.

Scoped to the caller's own org and nothing else: there is no org in the
address, so another tenant's secret is not merely refused, it is unnameable.
Within that org the value opens only for SuperAdmin holding an access token,
audited, or for a holder a declared READ grant covers at this exact path, key
and environment; membership and org admin alone open nothing. Admission is
fail-closed and in order — a validated member, an org that is a DNS-1123
label, a store holding a master key, a well-formed address, then the grant —
401/403, 400, 503, 400 and 403, all decided before any record is touched, so
a refused caller learns nothing about whether the secret exists.

A value this deployment seals on the org's behalf — an MCP server's
credential, a repository's environment secret, a connected account's token —
is read by the app that sealed it, and never opens here for membership or org
admin, whatever the grant declaration says about enforcement. A deployed
app's or a validator's own folder also opens for the org's KMS-sync identity,
which projects it into the org's namespace.

## Request

2 fields.

| Field       | In    | Type   | Required | Description                                                                                                                                 |
| ----------- | ----- | ------ | -------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
| `wildcard1` | path  | string | yes      | Secret is the coordinate beneath the caller's own org root: an optional `/`-separated subpath and then the name, such as `ci/deploy/token`. |
| `env`       | query | string | —        | Env selects the environment to resolve the secret in.                                                                                       |

## Response

| Status    | Body            | Meaning |
| --------- | --------------- | ------- |
| `200`     | kms.kmsSecret   | ok      |
| `default` | problem-details | refused |

`200` body — 3 fields.

| Field   | In   | Type   | Always | Description                                          |
| ------- | ---- | ------ | ------ | ---------------------------------------------------- |
| `env`   | body | string | —      | Env is the environment the value was resolved under. |
| `name`  | body | string | —      | Name is the secret's name.                           |
| `value` | body | string | —      | Value is the opened plaintext.                       |

Failure carries the platform error shape — see [Errors](https://docs.hanzo.ai/docs/errors).

## Examples

**CLI**

```bash
hanzo kms secrets get <wildcard1>
```

**SDK**

**.ts**

```ts
import { Configuration, KmsApi } from 'hanzoai';

const api = new KmsApi(new Configuration({ accessToken: process.env.HANZO_API_KEY }));
const { data } = await api.getKmsSecretsByWildcard1({ wildcard1: 'wildcard1' });
```

**.py**

```python
from hanzoai.cloud import ApiClient, Configuration
from hanzoai.cloud.api import KmsApi

client = ApiClient(Configuration(access_token=os.environ["HANZO_API_KEY"]))
result = KmsApi(client).get_kms_secrets_by_wildcard1(wildcard1='wildcard1')
```

**.go**

```go
cfg := hanzoai.NewConfiguration()
cfg.AddDefaultHeader("Authorization", "Bearer "+os.Getenv("HANZO_API_KEY"))
client := hanzoai.NewAPIClient(cfg)

resp, _, err := client.KmsAPI.GetKmsSecretsByWildcard1(context.Background()).Execute()
if err != nil {
	return err
}
```

**.rs**

```rust
use hanzo_client::apis::{configuration::Configuration, kms_api};

let mut cfg = Configuration::new();
cfg.bearer_access_token = std::env::var("HANZO_API_KEY").ok();

let result = kms_api::get_kms_secrets_by_wildcard1(&cfg, Default::default()).await?;
```

**.java**

```java
import ai.hanzo.cloud.ApiClient;
import ai.hanzo.cloud.api.KmsApi;

ApiClient client = new ApiClient();
client.setBearerToken(System.getenv("HANZO_API_KEY"));

var result = new KmsApi(client).getKmsSecretsByWildcard1();
```

The method above is the one at the current release of the document. `hanzoai@8.5.914` (npm) and `hanzoai@8.5.914` (PyPI) were generated from an earlier release, where this operation carried a different id, so it spells the method differently — regenerating the clients is what makes the two agree. [SDKs →](https://docs.hanzo.ai/docs/sdks)

**HTTP**

```bash
curl https://api.hanzo.ai/v1/kms/secrets/<wildcard1> \
  -H "Authorization: Bearer $HANZO_API_KEY"
```

**MCP**

MCP reaches **kms** through the `kms` tool, which names its 2 operations with its own verbs — this one among them, under a name only MCP declares. `describe` explains any of them:

```bash
curl -X POST https://api.hanzo.ai/v1/mcp \
  -H "Content-Type: application/json" \
  -d '{
       "jsonrpc": "2.0",
       "id": 1,
       "method": "tools/call",
       "params": {
         "name": "describe",
         "arguments": {
           "op": "get_kms_config"
         }
       }
     }'
```

---

[KMS API](https://docs.hanzo.ai/docs/openapi/kms) · [All Hanzo APIs](https://docs.hanzo.ai/docs/openapi) · [Interactive reference](https://docs.hanzo.ai/docs/openapi/reference)