## List application secrets `GET /v1/applications/:id/secrets` Returns the application's secret names and the state of applying them, so you can check which names are waiting for a value and whether the application has received the current set. ## Parameters | Parameter | Type | Required | Description | |----------|-----|:-----:|---------| | `id` (path) | string | yes | Application card ID. This is not the ID of an OAuth application or a server. List: [`GET /v1/applications`](/docs/applications/list) | ## Examples ### curl — personal key ```bash curl -H "X-Api-Key: YOUR_API_KEY" \ https://vibecode.bitrix24.com/v1/applications/cmsw806qi0000tdskiw2aegii/secrets ``` ### curl — OAuth application ```bash curl -H "X-Api-Key: YOUR_APP_KEY" \ -H "Authorization: Bearer USER_SESSION_TOKEN" \ https://vibecode.bitrix24.com/v1/applications/cmsw806qi0000tdskiw2aegii/secrets ``` ### JavaScript — personal key ```javascript const id = 'cmsw806qi0000tdskiw2aegii' const res = await fetch(`https://vibecode.bitrix24.com/v1/applications/${id}/secrets`, { headers: { 'X-Api-Key': 'YOUR_API_KEY' }, }) const { data } = await res.json() const waiting = data.secrets.filter((secret) => !secret.hasValue).map((secret) => secret.name) console.log('Waiting for a value:', waiting, 'apply status:', data.state?.status ?? 'no changes yet') ``` ### JavaScript — OAuth application ```javascript const id = 'cmsw806qi0000tdskiw2aegii' const res = await fetch(`https://vibecode.bitrix24.com/v1/applications/${id}/secrets`, { headers: { 'X-Api-Key': 'YOUR_APP_KEY', 'Authorization': 'Bearer USER_SESSION_TOKEN', }, }) const { data } = await res.json() ``` ## Response fields | Field | Type | Description | |------|-----|---------| | `success` | boolean | `true` on success | | `data.secrets` | array | System secrets first, then up to 100 author names, each group in alphabetical order. Values and ciphertext are not returned | | `data.secrets[].name` | string | Secret name | | `data.secrets[].kind` | string | `user` for a secret of the application author, `system` for a platform system secret. See "Author secrets and system secrets" on [Application secrets](/docs/applications/app-secrets) | | `data.secrets[].hasValue` | boolean | Whether a value is set. `false` means the name is waiting for a value | | `data.secrets[].createdAt` | string | When the name was created, ISO 8601 | | `data.secrets[].createdBy` | string | ID of the user who created the name | | `data.secrets[].updatedAt` | string | Time of the last change, ISO 8601 | | `data.secrets[].updatedBy` | string | ID of the author of the last change | | `data.secrets[].updatedByName` | string | Name of the author of the last change | | `data.state` | object \| null | State of applying the set. `null` until a secret is created, changed or deleted for the application, or the application is deployed to a standalone machine after the feature is enabled | | `data.state.desiredRevision` | number | Number of the current set. Increases when a value is saved and when a secret is deleted. Creating a name does not change it | | `data.state.appliedRevision` | number | Number of the set the application has confirmed receiving. Equals `desiredRevision` when everything is applied | | `data.state.appliedServerId` | string \| null | ID of the server where the set is applied. Matches `server.id` in [`GET /v1/applications/:id`](/docs/applications/get) | | `data.state.status` | string | `PENDING` — waiting to be applied, including while the machine sleeps. `APPLYING` — being applied. `APPLIED` — applied. `FAILED` — failed, the reason is in `failureCode` | | `data.state.failureCode` | string \| null | Failure reason when `FAILED`. The codes are in the "Failure and retry" section of [Application secrets](/docs/applications/app-secrets) | | `data.state.deliveredNames` | array | Names the platform has already passed to the application, including deleted ones | | `data.state.serviceName` | string \| null | The application's service on a standalone machine, recorded by the platform on deploy. In Galaxy and before such a deploy — `null` | | `data.state.updatedAt` | string | Time of the last state change, ISO 8601 | ## Response example ```json { "success": true, "data": { "secrets": [ { "name": "PAYMENT_TOKEN", "kind": "user", "hasValue": false, "createdAt": "2026-10-22T13:05:39.970Z", "updatedAt": "2026-10-22T13:05:39.988Z", "createdBy": "3f6c1a52-8b1e-4c7a-9d2f-5e0b7a4c1d93", "updatedBy": "3f6c1a52-8b1e-4c7a-9d2f-5e0b7a4c1d93", "updatedByName": "Anna Smith" }, { "name": "SMTP_PASSWORD", "kind": "user", "hasValue": false, "createdAt": "2026-10-22T13:05:41.810Z", "updatedAt": "2026-10-22T13:05:42.007Z", "createdBy": "3f6c1a52-8b1e-4c7a-9d2f-5e0b7a4c1d93", "updatedBy": "3f6c1a52-8b1e-4c7a-9d2f-5e0b7a4c1d93", "updatedByName": "Anna Smith" } ], "state": { "desiredRevision": 1, "appliedRevision": 0, "appliedServerId": null, "status": "PENDING", "failureCode": null, "deliveredNames": [], "serviceName": null, "updatedAt": "2026-10-22T12:46:24.093Z" } } } ``` ## Error response example 404 — the application does not exist, there is no access to it, or secrets are not enabled for the Bitrix24 account: ```json { "success": false, "error": { "code": "APPLICATION_NOT_FOUND", "message": "APPLICATION_NOT_FOUND" } } ``` ## Errors | HTTP | Code | Description | |------|-----|---------| | 404 | `APPLICATION_NOT_FOUND` | The application does not exist or there is no access to it, including an application on a different machine than the one the development member's key is linked to. Or the feature is not enabled for the portal | | 401 | `MISSING_API_KEY` | The `X-Api-Key` header is missing | | 401 | `INVALID_API_KEY` | Key not found | | 403 | `EXTERNAL_COLLABORATOR_KEY_SERVER_MISMATCH` | The external development member's key is not linked to a machine, and the application has no machine either | | 403 | `EXTERNAL_COLLABORATOR_NOT_A_MEMBER` | Key of an external development member whose membership on the machine was revoked or has expired | | 403 | `PORTAL_COLLABORATOR_NOT_A_MEMBER` | Key of a development team member who is no longer in the machine's team or is not linked to it | | 429 | `RATE_LIMIT_EXCEEDED` | The secrets methods limit is 60 requests per minute per user within a portal, shared by the list, create and delete methods and split across replicas. A rejection by the general API request limit comes with the same code. `x-ratelimit-limit` reports the effective limit for the key | | 500 | `SECRET_OPERATION_FAILED` | The operation failed. The response does not include the original error | Full list of common API errors — [Errors](/docs/errors). ## Known specifics **Empty list and `state`.** After the last name is deleted, `data.state` stays an object and its `desiredRevision` keeps growing, so an empty `data.secrets` does not mean the state has been reset. **Applying for an application without a machine.** While the application has no machine to pass the set to, `state.status` stays `PENDING` and `appliedRevision` does not catch up with `desiredRevision`. ## See also - [Application secrets](/docs/applications/app-secrets) - [Create a secret name](/docs/applications/app-secrets/create) - [Delete a secret](/docs/applications/app-secrets/delete) - [Application card](/docs/applications/get) - [Full application deploy](/docs/infra/deploy/deploy)