List application environment secrets

List the environment-secret keys of an application: which keys its generated manifests read out of the Secrets Ankra fills for it, which of them have a stored value, when each was last set, and - in requirements_state - whether those manifests could be read at all, so an empty missing_keys is never mistaken for a fully configured application. Values are never returned - there is no reveal endpoint on this surface, because a value the platform writes into a cluster Secret has no reason to travel back out. A browser session twin is mounted at the same path without the /api/v1 prefix (cookie authentication). With environment_id, resolve or modify only that environment; deletion suppresses a shared default locally, and apply never changes another target. Without it, existing shared catalogue behaviour is retained; all-target apply still preserves environment overrides.

GET /api/v1/org/applications/{application_id}/env-secrets

List application environment secrets

Python

import requests

url = "https://platform.ankra.app/api/v1/org/applications/{application_id}/env-secrets"

headers = {"Authorization": "Bearer <token>"}

response = requests.get(url, headers=headers)

print(response.text)

200

{
  "secret_name": "<string>",
  "secret_names": [
    "<string>"
  ],
  "secrets": [
    {
      "key": "<string>",
      "required": true,
      "status": "set",
      "updated_at": "<string>",
      "updated_by": "<string>",
      "optional": true,
      "source": "shared"
    }
  ],
  "missing_keys": [
    "<string>"
  ],
  "requirements_state": "known",
  "unfilled_secrets": [
    "<string>"
  ],
  "revision": "<string>",
  "apply_state": "applied",
  "deployments": [
    {
      "installation_id": "<string>",
      "cluster_id": "<string>",
      "namespace": "<string>",
      "deploy_status": "<string>",
      "status": "applied"
    }
  ],
  "optional_missing_keys": [
    "<string>"
  ],
  "keys": [
    {
      "key": "<string>",
      "role": "required",
      "state": "set",
      "usages": [
        {
          "secret_name": "<string>",
          "optional": true,
          "container": "<string>",
          "environment_variable": "<string>"
        }
      ]
    }
  ],
  "environment_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "tearing_down_count": 1
}

Authorizations

Authorization · string · header · required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Headers

authorization · string | null

x-ankra-organisation-id · string | null

Path Parameters

application_id · string · required

Query Parameters

environment_id · string<uuid>

Select an owned canonical application environment, including a planned environment. A legacy cluster ID is accepted only when it identifies one complete environment, or an unassigned legacy cluster. Mixed or partial aliases return 409; refresh and select the canonical ID. Empty or repeated values are refused. Omit only for shared catalogue management or application-wide apply.

Response

200

application/json

Successful Response

An application's environment-secret surface: the Secrets the generated manifests read, the keys that have a value, the keys still missing one, whether Ankra could establish that at all, and whether the values that are stored have reached what is running.

secret_name · string · required

The application's own Kubernetes Secret ("-env"). It is the primary name; secret_names is what a deploy actually seals.

secret_names · string[] · required

The Kubernetes Secrets the deploy renders these keys into. A monorepo's component Deployments each read a Secret named after themselves, so this carries one per component that reads one; every other application carries exactly secret_name. Empty when the manifests read none of them - including whenever requirements_state is "unknown", where it is not a claim about the application at all.

secrets · ApplicationEnvSecretItem · object[] · required

Show child attributes

missing_keys · string[] · required

Keys the manifests read that have no value yet. Read requirements_state first: an empty list means "nothing is missing" only under "known".

requirements_state · enum<string> · required

Whether the application's committed manifests could be read for the keys they take from the Secrets Ankra fills: "known" when they were, so missing_keys is exhaustive; "unknown" when no manifest is recorded yet, or when they read an env Secret this application's catalogue does not fill (unfilled_secrets names it). Under "unknown", missing_keys and each item's required flag are not claims about the application.

Available options: known, unknown

unfilled_secrets · string[] · required

The env-shaped Secrets the manifests read that are none of this application's - the diagnosis behind an "unknown" requirements_state. Recognition is by the "-env" convention alone, because an unresolved component Secret and a Secret the repository manages itself are the same string: a self-managed "-env" is therefore listed here and holds the application at "unknown". That is the deliberate direction - Ankra declines to certify a key list it cannot verify rather than reporting a monorepo as needing nothing, which is the defect requirements_state exists to end.

revision · string · required

Revision of the returned effective catalogue, derived from key names and write timestamps. Deployment configuration and runtime readiness are separate observations.

apply_state · enum<string> · required

The rolled-up answer: "applied" when every deployment carries the current values, "pending" when at least one does not, "unknown" when none is pending but at least one was never recorded, and "not_deployed" when the application is not deployed anywhere yet.

Available options: applied, pending, unknown, not_deployed

deployments · ApplicationEnvSecretDeployment · object[] · required

The same answer per deployment.

Show child attributes

optional_missing_keys · string[]

Keys the manifests read only through optional secretKeyRefs that have no value yet. The workload starts without them, with whatever they enable left off. Same requirements_state caveat as missing_keys.

keys · ApplicationEnvSecretKey · object[]

Every key of the application's environment contract: each key the manifests read from the Secrets Ankra fills, required or optional, plus each stored key no manifest reads. Required keys first, then optional, then unreferenced (or unknown), each group in key order. Carries no value. Under requirements_state "unknown" the list is not exhaustive: the required and optional roles are references actually seen, but keys the scan could not read are absent.

Show child attributes

environment_id · string<uuid>

The selected environment (cluster) identity; absent for the legacy shared catalogue.

tearing_down_count · integer

Scoped installations currently being removed. Omitted when zero or for the legacy shared view.

Required range: x >= 0