For AI agents: markdown of this page — /docs-content-en/applications/app-secrets/list.md documentation index — /llms.txt

List application secrets

GET /v1/applications/:id/secrets

Returns the application's secret names and the state of applying them, so you can check which names are waiting for a value and whether the application has received the current set.

Parameters

Parameter Type Required Description
Parameterid (path) Typestring Requiredyes DescriptionApplication card ID. This is not the ID of an OAuth application or a server. List: GET /v1/applications

Examples

curl — personal key

Terminal 
curl -H "X-Api-Key: YOUR_API_KEY" \
  https://vibecode.bitrix24.com/v1/applications/cmsw806qi0000tdskiw2aegii/secrets

curl — OAuth application

Terminal 
curl -H "X-Api-Key: YOUR_APP_KEY" \
  -H "Authorization: Bearer USER_SESSION_TOKEN" \
  https://vibecode.bitrix24.com/v1/applications/cmsw806qi0000tdskiw2aegii/secrets

JavaScript — personal key

javascript 
const id = 'cmsw806qi0000tdskiw2aegii'
const res = await fetch(`https://vibecode.bitrix24.com/v1/applications/${id}/secrets`, {
  headers: { 'X-Api-Key': 'YOUR_API_KEY' },
})
const { data } = await res.json()

const waiting = data.secrets.filter((secret) => !secret.hasValue).map((secret) => secret.name)
console.log('Waiting for a value:', waiting, 'apply status:', data.state?.status ?? 'no changes yet')

JavaScript — OAuth application

javascript 
const id = 'cmsw806qi0000tdskiw2aegii'
const res = await fetch(`https://vibecode.bitrix24.com/v1/applications/${id}/secrets`, {
  headers: {
    'X-Api-Key': 'YOUR_APP_KEY',
    'Authorization': 'Bearer USER_SESSION_TOKEN',
  },
})
const { data } = await res.json()

Response fields

Field Type Description
Fieldsuccess Typeboolean Descriptiontrue on success
Fielddata.secrets Typearray DescriptionSystem secrets first, then up to 100 author names, each group in alphabetical order. Values and ciphertext are not returned
Fielddata.secrets[].name Typestring DescriptionSecret name
Fielddata.secrets[].kind Typestring Descriptionuser for a secret of the application author, system for a platform system secret. See "Author secrets and system secrets" on Application secrets
Fielddata.secrets[].hasValue Typeboolean DescriptionWhether a value is set. false means the name is waiting for a value
Fielddata.secrets[].createdAt Typestring DescriptionWhen the name was created, ISO 8601
Fielddata.secrets[].createdBy Typestring DescriptionID of the user who created the name
Fielddata.secrets[].updatedAt Typestring DescriptionTime of the last change, ISO 8601
Fielddata.secrets[].updatedBy Typestring DescriptionID of the author of the last change
Fielddata.secrets[].updatedByName Typestring DescriptionName of the author of the last change
Fielddata.state Typeobject | null DescriptionState of applying the set. null until a secret is created, changed or deleted for the application, or the application is deployed to a standalone machine after the feature is enabled
Fielddata.state.desiredRevision Typenumber DescriptionNumber of the current set. Increases when a value is saved and when a secret is deleted. Creating a name does not change it
Fielddata.state.appliedRevision Typenumber DescriptionNumber of the set the application has confirmed receiving. Equals desiredRevision when everything is applied
Fielddata.state.appliedServerId Typestring | null DescriptionID of the server where the set is applied. Matches server.id in GET /v1/applications/:id
Fielddata.state.status Typestring DescriptionPENDING — waiting to be applied, including while the machine sleeps. APPLYING — being applied. APPLIED — applied. FAILED — failed, the reason is in failureCode
Fielddata.state.failureCode Typestring | null DescriptionFailure reason when FAILED. The codes are in the "Failure and retry" section of Application secrets
Fielddata.state.deliveredNames Typearray DescriptionNames the platform has already passed to the application, including deleted ones
Fielddata.state.serviceName Typestring | null DescriptionThe application's service on a standalone machine, recorded by the platform on deploy. In Galaxy and before such a deploy — null
Fielddata.state.updatedAt Typestring DescriptionTime of the last state change, ISO 8601

Response example

JSON 
{
  "success": true,
  "data": {
    "secrets": [
      {
        "name": "PAYMENT_TOKEN",
        "kind": "user",
        "hasValue": false,
        "createdAt": "2026-10-22T13:05:39.970Z",
        "updatedAt": "2026-10-22T13:05:39.988Z",
        "createdBy": "3f6c1a52-8b1e-4c7a-9d2f-5e0b7a4c1d93",
        "updatedBy": "3f6c1a52-8b1e-4c7a-9d2f-5e0b7a4c1d93",
        "updatedByName": "Anna Smith"
      },
      {
        "name": "SMTP_PASSWORD",
        "kind": "user",
        "hasValue": false,
        "createdAt": "2026-10-22T13:05:41.810Z",
        "updatedAt": "2026-10-22T13:05:42.007Z",
        "createdBy": "3f6c1a52-8b1e-4c7a-9d2f-5e0b7a4c1d93",
        "updatedBy": "3f6c1a52-8b1e-4c7a-9d2f-5e0b7a4c1d93",
        "updatedByName": "Anna Smith"
      }
    ],
    "state": {
      "desiredRevision": 1,
      "appliedRevision": 0,
      "appliedServerId": null,
      "status": "PENDING",
      "failureCode": null,
      "deliveredNames": [],
      "serviceName": null,
      "updatedAt": "2026-10-22T12:46:24.093Z"
    }
  }
}

Error response example

404 — the application does not exist, there is no access to it, or secrets are not enabled for the Bitrix24 account:

JSON 
{
  "success": false,
  "error": {
    "code": "APPLICATION_NOT_FOUND",
    "message": "APPLICATION_NOT_FOUND"
  }
}

Errors

HTTP Code Description
HTTP404 CodeAPPLICATION_NOT_FOUND DescriptionThe application does not exist or there is no access to it, including an application on a different machine than the one the development member's key is linked to. Or the feature is not enabled for the portal
HTTP401 CodeMISSING_API_KEY DescriptionThe X-Api-Key header is missing
HTTP401 CodeINVALID_API_KEY DescriptionKey not found
HTTP403 CodeEXTERNAL_COLLABORATOR_KEY_SERVER_MISMATCH DescriptionThe external development member's key is not linked to a machine, and the application has no machine either
HTTP403 CodeEXTERNAL_COLLABORATOR_NOT_A_MEMBER DescriptionKey of an external development member whose membership on the machine was revoked or has expired
HTTP403 CodePORTAL_COLLABORATOR_NOT_A_MEMBER DescriptionKey of a development team member who is no longer in the machine's team or is not linked to it
HTTP429 CodeRATE_LIMIT_EXCEEDED DescriptionThe secrets methods limit is 60 requests per minute per user within a portal, shared by the list, create and delete methods and split across replicas. A rejection by the general API request limit comes with the same code. x-ratelimit-limit reports the effective limit for the key
HTTP500 CodeSECRET_OPERATION_FAILED DescriptionThe operation failed. The response does not include the original error

Full list of common API errors — Errors.

Known specifics

Empty list and state. After the last name is deleted, data.state stays an object and its desiredRevision keeps growing, so an empty data.secrets does not mean the state has been reset.

Applying for an application without a machine. While the application has no machine to pass the set to, state.status stays PENDING and appliedRevision does not catch up with desiredRevision.

See also