List secrets API Reference

GET

/tenants/{tenant}/secrets

curl --request GET \
  --url https://api.kupe.cloud/api/v1/tenants/acme/secrets \
  --header 'Authorization: <Authorization>'

List all secrets for the tenant. Returns secret metadata and sync configuration, but not the secret values themselves (those are stored in Vault).

Authorizations

• BearerAuth

Parameters

Path Parameters

tenant

required

string

Tenant name

Responses

200

List of secrets

Media type application/json

object

items

Array<object>

object

createdAt

string

generation

The definition’s generation increments on a change; compare with status.observedGeneration.

integer

name

string

resourceVersion

string

secretPath

string

status

object

conditions

Array<object>

object

key

additional properties

observedRefresh

string

phase

string

Allowed values: Pending Active Degraded Deleting

refresh

object

observedAt

string

pending

pending is true while a requested token differs from observedAt.

boolean

requestedAt

string

syncStatuses

Array<object>

object

cluster

string

deliveredRefresh

string

lastDeliveredAt

string

message

string

namespace

string

phase

Synced confirms delivery into the cluster namespace. Withdrawing tracks a removed target until its source is withdrawn.

string

Allowed values: Pending Synced Failed Withdrawing

reason

string

secretName

string

sync

Array<object>

object

cluster

string

keys

Omitted keys means the whole entry. Selected keys must be unique, with at most 1,024 across all targets.

Array<string>

>= 1 items <= 64 items unique items

namespace

string

secretName

string

Example

{
  "items": [
    {
      "createdAt": "2026-03-10T09:15:00Z",
      "generation": 3,
      "name": "database-creds",
      "resourceVersion": "582019",
      "secretPath": "services/database/credentials",
      "status": {
        "observedRefresh": "2026-10-27T12:00:00Z",
        "phase": "Pending",
        "refresh": {
          "observedAt": "2026-10-27T12:00:00Z",
          "pending": false,
          "requestedAt": "2026-10-27T12:00:00Z"
        },
        "syncStatuses": [
          {
            "cluster": "production",
            "deliveredRefresh": "2026-10-27T12:00:00Z",
            "lastDeliveredAt": "2026-10-27T12:00:01Z",
            "namespace": "app",
            "phase": "Pending",
            "reason": "Delivered",
            "secretName": "db-credentials"
          }
        ]
      },
      "sync": [
        {
          "cluster": "production",
          "keys": [
            "username",
            "password"
          ],
          "namespace": "app",
          "secretName": "db-credentials"
        }
      ]
    }
  ]
}

400

Invalid tenant name

Media type application/json

object

code

string

error

string

field

string

message

string

severity

string

Example ^generated

{
  "code": "example",
  "error": "example",
  "field": "example",
  "message": "example",
  "severity": "example"
}

401

Missing or invalid authentication

Media type application/json

object

code

string

error

string

field

string

message

string

severity

string

Example ^generated

{
  "code": "example",
  "error": "example",
  "field": "example",
  "message": "example",
  "severity": "example"
}

403

Not a member of this tenant

Media type application/json

object

code

string

error

string

field

string

message

string

severity

string

Example ^generated

{
  "code": "example",
  "error": "example",
  "field": "example",
  "message": "example",
  "severity": "example"
}

429

Rate limit exceeded

Media type application/json

object

code

string

error

string

field

string

message

string

severity

string

Example ^generated

{
  "code": "example",
  "error": "example",
  "field": "example",
  "message": "example",
  "severity": "example"
}