List Application Env Secrets

List the environment-secret keys of an application: which keys its generated manifests read out of the Secrets Ankra fills for it, which of them have a stored value, when each was last set, and - in requirements_state - whether those manifests could be read at all, so an empty missing_keys is never mistaken for a fully configured application. Values are never returned - there is no reveal endpoint on this surface, because a value the platform writes into a cluster Secret has no reason to travel back out. A browser session twin is mounted at the same path without the /api/v1 prefix (cookie authentication).

GET /api/v1/org/applications/{application_id}/env-secrets

List Application Env Secrets

Python

import requests

url = "https://platform.ankra.app/api/v1/org/applications/{application_id}/env-secrets"

headers = {"Authorization": "Bearer <token>"}

response = requests.get(url, headers=headers)

print(response.text)

200

{
  "secret_name": "<string>",
  "secret_names": [
    "<string>"
  ],
  "secrets": [
    {
      "key": "<string>",
      "required": true,
      "status": "set",
      "updated_at": "<string>",
      "updated_by": "<string>"
    }
  ],
  "missing_keys": [
    "<string>"
  ],
  "requirements_state": "known",
  "unfilled_secrets": [
    "<string>"
  ],
  "revision": "<string>",
  "apply_state": "applied",
  "deployments": [
    {
      "installation_id": "<string>",
      "cluster_id": "<string>",
      "namespace": "<string>",
      "deploy_status": "<string>",
      "status": "applied"
    }
  ]
}

Authorizations

Authorization · string · header · required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Headers

authorization · string | null

x-ankra-organisation-id · string | null

Path Parameters

application_id · string · required

Response

200

application/json

Successful Response

An application's environment-secret surface: the Secrets the generated manifests read, the keys that have a value, the keys still missing one, whether Ankra could establish that at all, and whether the values that are stored have reached what is running.

secret_name · string · required

The application's own Kubernetes Secret ("-env"). It is the primary name; secret_names is what a deploy actually seals.

secret_names · string[] · required

The Kubernetes Secrets the deploy renders these keys into. A monorepo's component Deployments each read a Secret named after themselves, so this carries one per component that reads one; every other application carries exactly secret_name. Empty when the manifests read none of them - including whenever requirements_state is "unknown", where it is not a claim about the application at all.

secrets · ApplicationEnvSecretItem · object[] · required

Show child attributes

missing_keys · string[] · required

Keys the manifests read that have no value yet. Read requirements_state first: an empty list means "nothing is missing" only under "known".

requirements_state · enum<string> · required

Whether the application's committed manifests could be read for the keys they take from the Secrets Ankra fills: "known" when they were, so missing_keys is exhaustive; "unknown" when no manifest is recorded yet, or when they read an env Secret this application's catalogue does not fill (unfilled_secrets names it). Under "unknown", missing_keys and each item's required flag are not claims about the application.

Available options: known, unknown

unfilled_secrets · string[] · required

The env-shaped Secrets the manifests read that are none of this application's - the diagnosis behind an "unknown" requirements_state. Recognition is by the "-env" convention alone, because an unresolved component Secret and a Secret the repository manages itself are the same string: a self-managed "-env" is therefore listed here and holds the application at "unknown". That is the deliberate direction - Ankra declines to certify a key list it cannot verify rather than reporting a monorepo as needing nothing, which is the defect requirements_state exists to end.

revision · string · required

Names the set of values catalogued right now. A deployment recorded as carrying this revision is running exactly these values. Derived from key names and write timestamps only - never from a value.

apply_state · enum<string> · required

The rolled-up answer: "applied" when every deployment carries the current values, "pending" when at least one does not, "unknown" when none is pending but at least one was never recorded, and "not_deployed" when the application is not deployed anywhere yet.

Available options: applied, pending, unknown, not_deployed

deployments · ApplicationEnvSecretDeployment · object[] · required

The same answer per deployment.

Show child attributes