Skip to main content

Reveal Workspace Secret

POST 
/workspaces/:workspace_id/secrets/:secret_id/reveal

Return a secret's decrypted value. The only route in the service that does.

Break-glass, not a read path. Op delivery resolves values server-side and never comes through here, so the ordinary life of a secret involves this route zero times — it is for the cases where a human needs the value back: confirming what was stored against the provider that issued it, or recovering the only copy.

platform_admin_bypass=False, like the writes. The platform-admin flag is not a substitute for membership here: a platform admin reaches a workspace's secrets only by joining it as an admin, which leaves a row in its member list. That is the point — the control is an audit trail rather than a wall, since a platform admin can add themselves to any workspace, but doing so is visible to the tenant where bypassing the check silently would not be.

POST, not GET: a GET puts a retrievable-value URL into access logs and browser history, and makes the route reachable by cross-site form navigation.

secrets.reveal_enabled: false refuses every caller regardless of role, for a deployment that wants secrets to be strictly write-once.

Request​

Responses​

Successful Response