Skip to content
This page View Markdown Open in ChatGPT Open in Claude

Get secret

Reads values of a secret by their path : common.encryptionAlgorithm, stripe.apiKey… One key gives its value, several give an array in the same order.
Method POST
URL /api/system-api/admin/get-secret-by-name : admin is the user path of your account
Body { keys } ; from code also fromSecretName
Answer data : the value, or an array of values
From code g.sys.system.getSecret

The call

Body : one key
{ "keys": "stripe.apiKey" }
Answer
{ "success": true, "statusCode": 200, "data": "sk_live_…" }
Body : several keys
{ "keys": [ "stripe.apiKey", "common.connectionString.mysql_8" ] }
Answer
{ "success": true, "statusCode": 200, "data": [ "sk_live_…", "mysql://…" ] }
  • keys is the full path in the secret object, with dots. A path to an object gives the object.
  • Over HTTP the default secret of the account answers. From code, fromSecretName reads another secret of the account by its name ; over HTTP that key is ignored.

From code

const key = await g.sys.system.getSecret('stripe.apiKey');
const [ key2, cs ] = await g.sys.system.getSecret([ 'stripe.apiKey', 'common.connectionString.mysql_8' ]);
const staging = await g.sys.system.getSecret('stripe.apiKey', 'staging');   // from the secret named staging

Good to know

  • Secrets are never in Git and never in the answer of another API : this API is the way to read them, and it is a sensitive one. Grant it to the groups which need it, or read the secret from your code only (NO_ACCESS custom APIs).

Access and settings

  • Over HTTP, a system API answers once its settings give it apiAccessType: TOKEN_ACCESS (the token of an API user whose group grants this system API, in x-am-authorization) or IS_PUBLIC. Without settings it is NO_ACCESS : your code calls it through g.sys, the admin panel tests it, and an HTTP call is refused.
  • The settings can also cache the answer or require person tokens (authProviders) ; pre and post hooks run around it like around any API.
  • The request headers apply : x-am-response-case, x-am-content-type-response, x-am-internationalization, x-am-tenant-username…

Errors

Code When
400 The body is wrong : the message names the missing or invalid key.
401 No valid API user token, or the API is NO_ACCESS : You are not authorized to access this API.
403 No group grants this system API.