List
List all secrets in a Nairi vault. Names and metadata are returned; secret values are never exposed - fetch the value with a runtime injection instead.
GET /api/public/v1/vaults/{vault_id}/secretsExample
curl -X GET https://api.nairi.ai/api/public/v1/vaults/VAULT_ID/secrets \
-H "Authorization: Bearer $NAIRI_API_KEY"const res = await fetch(
`https://api.nairi.ai/api/public/v1/vaults/${vaultId}/secrets`,
{
headers: {
Authorization: `Bearer ${process.env.NAIRI_API_KEY}`,
},
},
);
const secrets = (await res.json()) as Array<{ id: string; env_key: string }>;require "net/http"
require "json"
require "uri"
uri = URI("https://api.nairi.ai/api/public/v1/vaults/#{vault_id}/secrets")
req = Net::HTTP::Get.new(uri)
req["Authorization"] = "Bearer #{ENV['NAIRI_API_KEY']}"
res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |h| h.request(req) }
secrets = JSON.parse(res.body)import os
import requests
res = requests.get(
f"https://api.nairi.ai/api/public/v1/vaults/{vault_id}/secrets",
headers={"Authorization": f"Bearer {os.environ['NAIRI_API_KEY']}"},
)
secrets = res.json()package main
import (
"encoding/json"
"fmt"
"io"
"net/http"
"os"
)
func main() {
vaultID := os.Getenv("VAULT_ID")
req, _ := http.NewRequest("GET", "https://api.nairi.ai/api/public/v1/vaults/"+vaultID+"/secrets", nil)
req.Header.Set("Authorization", "Bearer "+os.Getenv("NAIRI_API_KEY"))
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
raw, _ := io.ReadAll(res.Body)
var secrets []map[string]any
json.Unmarshal(raw, &secrets)
fmt.Println(secrets)
}Response
[
{
"id": "sec_01KQ27AQH800XQTQPJZ0DH14SJ",
"env_key": "DATABASE_URL",
"allowed_domains": [],
"created_at": "2026-04-25T11:45:19.000Z",
"updated_at": "2026-04-25T11:45:19.000Z"
}
]allowed_domains defaults to [] when not set. An empty array means no domain restriction is applied.
Overview
What vault secrets are and how they are encrypted, stored, and injected into agent environments at runtime through the Nairi REST API endpoints.
Create
Add a new secret to an existing Nairi vault. Supply the key, the value, and the list of destination domains the secret is allowed to be injected into.