Get Secret Version

GET

/vault/v1/workspaces/{workspace}/engines/{engine}/secrets/{secret}/versions/{id}

curl --request GET \
  --url https://example.com/vault/v1/workspaces/example/engines/example/secrets/example/versions/example

Returns a version’s metadata and payload bytes. Clients that only need metadata can filter on state via ListSecretVersions instead.

Parameters

Path Parameters

workspace

required

string

The workspace the secret belongs to.

engine

required

string

secret

required

string

The parent secret.

id

required

string

The version id (UUID) to retrieve.

Responses

200

OK

Media type application/json

Response payload from Get Secret Version

Carries the output produced by getting a secret version.

object

version

The version metadata.

object

id

The unique identifier of this version (UUID)

stringOutput only

secret_id

The parent secret that owns this version (UUID)

stringOutput only

workspace_id

The workspace that owns this version (UUID, denormalised from the parent secret).

stringOutput only

state

Current lifecycle state of this version.

string format: enum Output only

Allowed values: SECRET_VERSION_STATE_UNSPECIFIED SECRET_VERSION_STATE_ENABLED SECRET_VERSION_STATE_DISABLED SECRET_VERSION_STATE_DESTROYED

checksum

Vault-specific content checksum (etag) of the payload.

stringOutput only

create_time

Timestamp when this version was created (server-managed).

string format: date-time Output only

update_time

Timestamp when this version’s state last changed (server-managed).

string format: date-time Output only

engine

The provider holding this version. Always its parent secret’s — a version cannot be held by a different provider than the secret it belongs to, and the database enforces that rather than trusting the application to maintain it.

string format: enum Output only

Allowed values: VAULT_ENGINE_UNSPECIFIED VAULT_ENGINE_QIBDO VAULT_ENGINE_AWS VAULT_ENGINE_GCP VAULT_ENGINE_AZURE

identity

How the holding provider identifies this version. See VaultVersionIdentity: address a version by id, and use this to correlate it with what the provider reports.

object

engine_resource_id

The provider’s own handle for this version, verbatim and unparsed: “3” for a monotonic provider, a UUID or an opaque string for the others. Compare it for equality; do not parse it, and do not assume it sorts meaningfully.

stringOutput only

ordinal

The version’s position in the sequence, when the provider genuinely orders its versions. ABSENT means this provider does not — not that the version is first or unknown. Never compare an absent ordinal against a present one.

stringOutput only

payload

The version’s payload bytes (server-returned).

string format: bytes Output only

Example

{
  "version": {
    "state": "SECRET_VERSION_STATE_UNSPECIFIED",
    "engine": "VAULT_ENGINE_UNSPECIFIED"
  }
}

default

Default error response

Media type application/json

The Status type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by gRPC. Each Status message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the API Design Guide.

object

code

The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code].

integer format: int32

message

A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client.

string

details

A list of messages that carry the error details. There is a common set of message types for APIs to use.

Array<object>

Contains an arbitrary serialized message along with a @type that describes the type of the serialized message.

object

@type

The type of the serialized message.

string

key

additional properties

any

Example ^generated

{
  "code": 1,
  "message": "example",
  "details": [
    {
      "@type": "example"
    }
  ]
}