[{"data":1,"prerenderedAt":7},["ShallowReactive",2],{"docs-applications\u002Fapp-secrets\u002Flist":3,"docs-tabs-applications\u002Fapp-secrets\u002Flist":6},{"content":4,"lastmod":5},"## List application secrets\n\n`GET \u002Fv1\u002Fapplications\u002F:id\u002Fsecrets`\n\nReturns the application's secret names and the state of applying them, so you can check which names are waiting for a value and whether the application has received the current set.\n\n## Parameters\n\n| Parameter | Type | Required | Description |\n|----------|-----|:-----:|---------|\n| `id` (path) | string | yes | Application card ID. This is not the ID of an OAuth application or a server. List: [`GET \u002Fv1\u002Fapplications`](\u002Fdocs\u002Fapplications\u002Flist) |\n\n## Examples\n\n### curl — personal key\n\n```bash\ncurl -H \"X-Api-Key: YOUR_API_KEY\" \\\n  https:\u002F\u002Fvibecode.bitrix24.com\u002Fv1\u002Fapplications\u002Fcmsw806qi0000tdskiw2aegii\u002Fsecrets\n```\n\n### curl — OAuth application\n\n```bash\ncurl -H \"X-Api-Key: YOUR_APP_KEY\" \\\n  -H \"Authorization: Bearer USER_SESSION_TOKEN\" \\\n  https:\u002F\u002Fvibecode.bitrix24.com\u002Fv1\u002Fapplications\u002Fcmsw806qi0000tdskiw2aegii\u002Fsecrets\n```\n\n### JavaScript — personal key\n\n```javascript\nconst id = 'cmsw806qi0000tdskiw2aegii'\nconst res = await fetch(`https:\u002F\u002Fvibecode.bitrix24.com\u002Fv1\u002Fapplications\u002F${id}\u002Fsecrets`, {\n  headers: { 'X-Api-Key': 'YOUR_API_KEY' },\n})\nconst { data } = await res.json()\n\nconst waiting = data.secrets.filter((secret) => !secret.hasValue).map((secret) => secret.name)\nconsole.log('Waiting for a value:', waiting, 'apply status:', data.state?.status ?? 'no changes yet')\n```\n\n### JavaScript — OAuth application\n\n```javascript\nconst id = 'cmsw806qi0000tdskiw2aegii'\nconst res = await fetch(`https:\u002F\u002Fvibecode.bitrix24.com\u002Fv1\u002Fapplications\u002F${id}\u002Fsecrets`, {\n  headers: {\n    'X-Api-Key': 'YOUR_APP_KEY',\n    'Authorization': 'Bearer USER_SESSION_TOKEN',\n  },\n})\nconst { data } = await res.json()\n```\n\n## Response fields\n\n| Field | Type | Description |\n|------|-----|---------|\n| `success` | boolean | `true` on success |\n| `data.secrets` | array | System secrets first, then up to 100 author names, each group in alphabetical order. Values and ciphertext are not returned |\n| `data.secrets[].name` | string | Secret name |\n| `data.secrets[].kind` | string | `user` for a secret of the application author, `system` for a platform system secret. See \"Author secrets and system secrets\" on [Application secrets](\u002Fdocs\u002Fapplications\u002Fapp-secrets) |\n| `data.secrets[].hasValue` | boolean | Whether a value is set. `false` means the name is waiting for a value |\n| `data.secrets[].createdAt` | string | When the name was created, ISO 8601 |\n| `data.secrets[].createdBy` | string | ID of the user who created the name |\n| `data.secrets[].updatedAt` | string | Time of the last change, ISO 8601 |\n| `data.secrets[].updatedBy` | string | ID of the author of the last change |\n| `data.secrets[].updatedByName` | string | Name of the author of the last change |\n| `data.state` | object \\| null | State of applying the set. `null` until a secret is created, changed or deleted for the application, or the application is deployed to a standalone machine after the feature is enabled |\n| `data.state.desiredRevision` | number | Number of the current set. Increases when a value is saved and when a secret is deleted. Creating a name does not change it |\n| `data.state.appliedRevision` | number | Number of the set the application has confirmed receiving. Equals `desiredRevision` when everything is applied |\n| `data.state.appliedServerId` | string \\| null | ID of the server where the set is applied. Matches `server.id` in [`GET \u002Fv1\u002Fapplications\u002F:id`](\u002Fdocs\u002Fapplications\u002Fget) |\n| `data.state.status` | string | `PENDING` — waiting to be applied, including while the machine sleeps. `APPLYING` — being applied. `APPLIED` — applied. `FAILED` — failed, the reason is in `failureCode` |\n| `data.state.failureCode` | string \\| null | Failure reason when `FAILED`. The codes are in the \"Failure and retry\" section of [Application secrets](\u002Fdocs\u002Fapplications\u002Fapp-secrets) |\n| `data.state.deliveredNames` | array | Names the platform has already passed to the application, including deleted ones |\n| `data.state.serviceName` | string \\| null | The application's service on a standalone machine, recorded by the platform on deploy. In Galaxy and before such a deploy — `null` |\n| `data.state.updatedAt` | string | Time of the last state change, ISO 8601 |\n\n## Response example\n\n```json\n{\n  \"success\": true,\n  \"data\": {\n    \"secrets\": [\n      {\n        \"name\": \"PAYMENT_TOKEN\",\n        \"kind\": \"user\",\n        \"hasValue\": false,\n        \"createdAt\": \"2026-10-22T13:05:39.970Z\",\n        \"updatedAt\": \"2026-10-22T13:05:39.988Z\",\n        \"createdBy\": \"3f6c1a52-8b1e-4c7a-9d2f-5e0b7a4c1d93\",\n        \"updatedBy\": \"3f6c1a52-8b1e-4c7a-9d2f-5e0b7a4c1d93\",\n        \"updatedByName\": \"Anna Smith\"\n      },\n      {\n        \"name\": \"SMTP_PASSWORD\",\n        \"kind\": \"user\",\n        \"hasValue\": false,\n        \"createdAt\": \"2026-10-22T13:05:41.810Z\",\n        \"updatedAt\": \"2026-10-22T13:05:42.007Z\",\n        \"createdBy\": \"3f6c1a52-8b1e-4c7a-9d2f-5e0b7a4c1d93\",\n        \"updatedBy\": \"3f6c1a52-8b1e-4c7a-9d2f-5e0b7a4c1d93\",\n        \"updatedByName\": \"Anna Smith\"\n      }\n    ],\n    \"state\": {\n      \"desiredRevision\": 1,\n      \"appliedRevision\": 0,\n      \"appliedServerId\": null,\n      \"status\": \"PENDING\",\n      \"failureCode\": null,\n      \"deliveredNames\": [],\n      \"serviceName\": null,\n      \"updatedAt\": \"2026-10-22T12:46:24.093Z\"\n    }\n  }\n}\n```\n\n## Error response example\n\n404 — the application does not exist, there is no access to it, or secrets are not enabled for the Bitrix24 account:\n\n```json\n{\n  \"success\": false,\n  \"error\": {\n    \"code\": \"APPLICATION_NOT_FOUND\",\n    \"message\": \"APPLICATION_NOT_FOUND\"\n  }\n}\n```\n\n## Errors\n\n| HTTP | Code | Description |\n|------|-----|---------|\n| 404 | `APPLICATION_NOT_FOUND` | The application does not exist or there is no access to it, including an application on a different machine than the one the development member's key is linked to. Or the feature is not enabled for the portal |\n| 401 | `MISSING_API_KEY` | The `X-Api-Key` header is missing |\n| 401 | `INVALID_API_KEY` | Key not found |\n| 403 | `EXTERNAL_COLLABORATOR_KEY_SERVER_MISMATCH` | The external development member's key is not linked to a machine, and the application has no machine either |\n| 403 | `EXTERNAL_COLLABORATOR_NOT_A_MEMBER` | Key of an external development member whose membership on the machine was revoked or has expired |\n| 403 | `PORTAL_COLLABORATOR_NOT_A_MEMBER` | Key of a development team member who is no longer in the machine's team or is not linked to it |\n| 429 | `RATE_LIMIT_EXCEEDED` | The secrets methods limit is 60 requests per minute per user within a portal, shared by the list, create and delete methods and split across replicas. A rejection by the general API request limit comes with the same code. `x-ratelimit-limit` reports the effective limit for the key |\n| 500 | `SECRET_OPERATION_FAILED` | The operation failed. The response does not include the original error |\n\nFull list of common API errors — [Errors](\u002Fdocs\u002Ferrors).\n\n## Known specifics\n\n**Empty list and `state`.** After the last name is deleted, `data.state` stays an object and its `desiredRevision` keeps growing, so an empty `data.secrets` does not mean the state has been reset.\n\n**Applying for an application without a machine.** While the application has no machine to pass the set to, `state.status` stays `PENDING` and `appliedRevision` does not catch up with `desiredRevision`.\n\n## See also\n\n- [Application secrets](\u002Fdocs\u002Fapplications\u002Fapp-secrets)\n- [Create a secret name](\u002Fdocs\u002Fapplications\u002Fapp-secrets\u002Fcreate)\n- [Delete a secret](\u002Fdocs\u002Fapplications\u002Fapp-secrets\u002Fdelete)\n- [Application card](\u002Fdocs\u002Fapplications\u002Fget)\n- [Full application deploy](\u002Fdocs\u002Finfra\u002Fdeploy\u002Fdeploy)\n","2026-11-02",{},1794739459231]