Reveal
Returns an existing key's secret.
Its own scope rather than part of apikeys.manage, because the two are
different acts: rotating replaces a secret you never see, while this
hands one over.
Refused with NOT_RETRIEVABLE for a key issued before this product
stored secrets recoverably - that secret was never kept, so no retry
will ever produce it. Rotate the key instead.
Authorization
BearerAuthbearer token
Authorization: Bearer <key>, with a key from the console. Keys are
default-deny: each operation names the scope it needs, and an existing
key does not gain an operation until that scope is added to it.
Scopes: apikeys.reveal
Path parameters
idrequiredstring (uuid)The key's ID, as returned by the list endpoint. Never the key itself.
Responses
200application/json
The key's secret.
rcrequiredstringkeyrequiredstringThe secret.
TypeScript type
{
rc: string;
key: string;
}401application/json
No credential was presented, or it is not valid.
rcrequiredstringThe outcome. SUCCESS on success; otherwise the reason.
TypeScript type
{
rc: string;
}403application/json
The credential does not hold the scope this endpoint requires. The missing scope is deliberately not named.
rcrequiredstringThe outcome. SUCCESS on success; otherwise the reason.
TypeScript type
{
rc: string;
}404application/json
No such key in this organization, or its secret was never stored
recoverably (NOT_RETRIEVABLE).
rcrequiredstringThe outcome. SUCCESS on success; otherwise the reason.
TypeScript type
{
rc: string;
}