Get secret API Reference

GET

/tenants/{tenant}/secrets/{name}

curl --request GET \
  --url https://api.kupe.cloud/api/v1/tenants/acme/secrets/database-creds \
  --header 'Authorization: <Authorization>'

Authorizations

• BearerAuth

Parameters

Path Parameters

tenant

required

string

Tenant name

name

required

string

Secret name

Responses

200

Secret details

Media type application/json

object

createdAt

string

generation

The definition’s generation increments on a change; compare with status.observedGeneration.

integer

name

string

resourceVersion

string

secretPath

string

status

object

conditions

Array<object>

object

key

additional properties

observedRefresh

string

phase

string

Allowed values: Pending Active Degraded Deleting

refresh

object

observedAt

string

pending

pending is true while a requested token differs from observedAt.

boolean

requestedAt

string

syncStatuses

Array<object>

object

cluster

string

deliveredRefresh

string

lastDeliveredAt

string

message

string

namespace

string

phase

Synced confirms delivery into the cluster namespace. Withdrawing tracks a removed target until its source is withdrawn.

string

Allowed values: Pending Synced Failed Withdrawing

reason

string

secretName

string

sync

Array<object>

object

cluster

string

keys

Omitted keys means the whole entry. Selected keys must be unique, with at most 1,024 across all targets.

Array<string>

>= 1 items <= 64 items unique items

namespace

string

secretName

string

Example

{
  "createdAt": "2026-03-10T09:15:00Z",
  "generation": 3,
  "name": "database-creds",
  "resourceVersion": "582019",
  "secretPath": "services/database/credentials",
  "status": {
    "observedRefresh": "2026-10-27T12:00:00Z",
    "phase": "Pending",
    "refresh": {
      "observedAt": "2026-10-27T12:00:00Z",
      "pending": false,
      "requestedAt": "2026-10-27T12:00:00Z"
    },
    "syncStatuses": [
      {
        "cluster": "production",
        "deliveredRefresh": "2026-10-27T12:00:00Z",
        "lastDeliveredAt": "2026-10-27T12:00:01Z",
        "namespace": "app",
        "phase": "Pending",
        "reason": "Delivered",
        "secretName": "db-credentials"
      }
    ]
  },
  "sync": [
    {
      "cluster": "production",
      "keys": [
        "username",
        "password"
      ],
      "namespace": "app",
      "secretName": "db-credentials"
    }
  ]
}

Headers

ETag

string

Resource version for optimistic locking

400

Invalid name

Media type application/json

object

code

string

error

string

field

string

message

string

severity

string

Example ^generated

{
  "code": "example",
  "error": "example",
  "field": "example",
  "message": "example",
  "severity": "example"
}

401

Missing or invalid authentication

Media type application/json

object

code

string

error

string

field

string

message

string

severity

string

Example ^generated

{
  "code": "example",
  "error": "example",
  "field": "example",
  "message": "example",
  "severity": "example"
}

403

Not a member of this tenant

Media type application/json

object

code

string

error

string

field

string

message

string

severity

string

Example ^generated

{
  "code": "example",
  "error": "example",
  "field": "example",
  "message": "example",
  "severity": "example"
}

404

Secret not found

Media type application/json

object

code

string

error

string

field

string

message

string

severity

string

Example ^generated

{
  "code": "example",
  "error": "example",
  "field": "example",
  "message": "example",
  "severity": "example"
}

429

Rate limit exceeded

Media type application/json

object

code

string

error

string

field

string

message

string

severity

string

Example ^generated

{
  "code": "example",
  "error": "example",
  "field": "example",
  "message": "example",
  "severity": "example"
}