# List secrets

URL: https://docs.hanzo.ai/docs/openapi/kms/get-kms-secrets

> Lists the secrets your org holds, without their values.

`GET /v1/kms/secrets`

> [KMS →](https://docs.hanzo.ai/docs/openapi/kms) · [All API references →](https://docs.hanzo.ai/docs/openapi) · [Get started →](https://docs.hanzo.ai/docs/guides)

|               |                                        |
| ------------- | -------------------------------------- |
| **Address**   | `https://api.hanzo.ai/v1/kms/secrets`  |
| **Method**    | `GET`                                  |
| **Operation** | `get_kms_secrets`                      |
| **Auth**      | `Authorization: Bearer $HANZO_API_KEY` |

Lists the secrets your org holds, without their values.

Returns the METADATA of the caller's own secrets: each one's name, path,
environment and sealing scheme. No value and no ciphertext is included — this
operation exists to enumerate what is held, and reading a value is a separate,
per-secret call.

Scoped to the caller's own org and nothing else, structurally: there is no org
in the path, the store root is derived from the validated org claim, and a
caller therefore has no way to name another tenant's namespace. `path` narrows
to a subpath and `env` selects the environment; both are also accepted under
the operator's spellings, `secretPath` and `environment`. An omitted `env`
means every environment and an omitted `path` means the whole org, because a
default here reported a populated store as empty.

Admission is fail-closed and in order: a validated member, an org that is a
DNS-1123 label, and a store holding a master key — 403, 400 and 503
respectively, all decided before any record is touched.

## Request

4 fields.

| Field         | In    | Type   | Required | Description                                                                                                      |
| ------------- | ----- | ------ | -------- | ---------------------------------------------------------------------------------------------------------------- |
| `env`         | query | string | —        | Env selects the environment, which is part of a secret's storage key.                                            |
| `environment` | query | string | —        | Environment is the KMS operator's spelling of Env, accepted so one caller need not learn the other's vocabulary. |
| `path`        | query | string | —        | Path narrows the listing to one subtree beneath the caller's org root, as a `/`-separated path such as `/ci`.    |
| `secretPath`  | query | string | —        | SecretPath is the KMS operator's spelling of Path.                                                               |

## Response

| Status    | Body            | Meaning |
| --------- | --------------- | ------- |
| `200`     | kms.kmsSecrets  | ok      |
| `default` | problem-details | refused |

`200` body — 7 fields.

| Field              | In   | Type              | Always | Description                                                                                                                 |
| ------------------ | ---- | ----------------- | ------ | --------------------------------------------------------------------------------------------------------------------------- |
| `names`            | body | string\[]         | —      | Names is the same listing reduced to bare names, which is the shape the KMS operator reads.                                 |
| `secrets`          | body | kms.SecretMeta\[] | —      | Secrets are the descriptors: name, path, environment and sealing scheme.                                                    |
| `secrets[].env`    | body | string            | —      | Env is the environment the secret belongs to.                                                                               |
| `secrets[].name`   | body | string            | —      | Name is the secret's name within its path and environment.                                                                  |
| `secrets[].path`   | body | string            | —      | Path is the subpath the secret is stored under, beneath the org root.                                                       |
| `secrets[].scheme` | body | string            | —      | Scheme names how the value is sealed at rest, so a caller can tell a migrated record from a current one without opening it. |
| `total`            | body | integer (int64)   | —      | Total is how many descriptors this listing carries.                                                                         |

Failure carries the platform error shape — see [Errors](https://docs.hanzo.ai/docs/errors).

## Examples

**CLI**

```bash
hanzo kms secrets get
```

**SDK**

**.ts**

```ts
import { Configuration, KmsApi } from 'hanzoai';

const api = new KmsApi(new Configuration({ accessToken: process.env.HANZO_API_KEY }));
const { data } = await api.getKmsSecrets();
```

**.py**

```python
from hanzoai.cloud import ApiClient, Configuration
from hanzoai.cloud.api import KmsApi

client = ApiClient(Configuration(access_token=os.environ["HANZO_API_KEY"]))
result = KmsApi(client).get_kms_secrets()
```

**.go**

```go
cfg := hanzoai.NewConfiguration()
cfg.AddDefaultHeader("Authorization", "Bearer "+os.Getenv("HANZO_API_KEY"))
client := hanzoai.NewAPIClient(cfg)

resp, _, err := client.KmsAPI.GetKmsSecrets(context.Background()).Execute()
if err != nil {
	return err
}
```

**.rs**

```rust
use hanzo_client::apis::{configuration::Configuration, kms_api};

let mut cfg = Configuration::new();
cfg.bearer_access_token = std::env::var("HANZO_API_KEY").ok();

let result = kms_api::get_kms_secrets(&cfg, Default::default()).await?;
```

**.java**

```java
import ai.hanzo.cloud.ApiClient;
import ai.hanzo.cloud.api.KmsApi;

ApiClient client = new ApiClient();
client.setBearerToken(System.getenv("HANZO_API_KEY"));

var result = new KmsApi(client).getKmsSecrets();
```

**HTTP**

```bash
curl https://api.hanzo.ai/v1/kms/secrets \
  -H "Authorization: Bearer $HANZO_API_KEY"
```

**MCP**

MCP reaches **kms** through the `kms` tool, which names its 2 operations with its own verbs — this one among them, under a name only MCP declares. `describe` explains any of them:

```bash
curl -X POST https://api.hanzo.ai/v1/mcp \
  -H "Content-Type: application/json" \
  -d '{
       "jsonrpc": "2.0",
       "id": 1,
       "method": "tools/call",
       "params": {
         "name": "describe",
         "arguments": {
           "op": "get_kms_config"
         }
       }
     }'
```

---

[KMS API](https://docs.hanzo.ai/docs/openapi/kms) · [All Hanzo APIs](https://docs.hanzo.ai/docs/openapi) · [Interactive reference](https://docs.hanzo.ai/docs/openapi/reference)