# List

List all secrets in a vault. Values are never returned.





<Callout type="warn">
  Secret **values are never returned** in any response. Only the `env_key` and metadata come back. To rotate a secret, use [Update](/api/vault-secrets/update).
</Callout>

```http
GET /api/public/v1/vaults/{vault_id}/secrets
```

## Example [#example]

<Tabs items="[&#x22;bash&#x22;, &#x22;TypeScript&#x22;, &#x22;Ruby&#x22;, &#x22;Python&#x22;, &#x22;Go&#x22;]">
  <Tab value="bash">
    ```bash
    curl -X GET https://api.nairi.ai/api/public/v1/vaults/VAULT_ID/secrets \
      -H "Authorization: Bearer $NAIRI_API_KEY"
    ```
  </Tab>

  <Tab value="TypeScript">
    ```ts
    const res = await fetch(
      `https://api.nairi.ai/api/public/v1/vaults/${vaultId}/secrets`,
      {
        headers: {
          Authorization: `Bearer ${process.env.NAIRI_API_KEY}`,
        },
      },
    );
    const secrets = (await res.json()) as Array<{ id: string; env_key: string }>;
    ```
  </Tab>

  <Tab value="Ruby">
    ```ruby
    require "net/http"
    require "json"
    require "uri"

    uri = URI("https://api.nairi.ai/api/public/v1/vaults/#{vault_id}/secrets")
    req = Net::HTTP::Get.new(uri)
    req["Authorization"] = "Bearer #{ENV['NAIRI_API_KEY']}"

    res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |h| h.request(req) }
    secrets = JSON.parse(res.body)
    ```
  </Tab>

  <Tab value="Python">
    ```python
    import os
    import requests

    res = requests.get(
        f"https://api.nairi.ai/api/public/v1/vaults/{vault_id}/secrets",
        headers={"Authorization": f"Bearer {os.environ['NAIRI_API_KEY']}"},
    )
    secrets = res.json()
    ```
  </Tab>

  <Tab value="Go">
    ```go
    package main

    import (
    	"encoding/json"
    	"fmt"
    	"io"
    	"net/http"
    	"os"
    )

    func main() {
    	vaultID := os.Getenv("VAULT_ID")
    	req, _ := http.NewRequest("GET", "https://api.nairi.ai/api/public/v1/vaults/"+vaultID+"/secrets", nil)
    	req.Header.Set("Authorization", "Bearer "+os.Getenv("NAIRI_API_KEY"))
    	res, _ := http.DefaultClient.Do(req)
    	defer res.Body.Close()
    	raw, _ := io.ReadAll(res.Body)
    	var secrets []map[string]any
    	json.Unmarshal(raw, &secrets)
    	fmt.Println(secrets)
    }
    ```
  </Tab>
</Tabs>

## Response [#response]

```json
[
  {
    "id": "sec_01KQ27AQH800XQTQPJZ0DH14SJ",
    "env_key": "DATABASE_URL",
    "allowed_domains": [],
    "created_at": "2026-04-25T11:45:19.000Z",
    "updated_at": "2026-04-25T11:45:19.000Z"
  }
]
```

`allowed_domains` defaults to `[]` when not set. An empty array means no domain restriction is applied.