> ## Documentation Index > Fetch the complete documentation index at: https://docs.ankra.ai/llms.txt > Use this file to discover all available pages before exploring further. # List application environment secrets > List the environment-secret keys of an application: which keys its generated manifests read out of the Secrets Ankra fills for it, which of them have a stored value, when each was last set, and - in requirements_state - whether those manifests could be read at all, so an empty missing_keys is never mistaken for a fully configured application. Values are never returned - there is no reveal endpoint on this surface, because a value the platform writes into a cluster Secret has no reason to travel back out. A browser session twin is mounted at the same path without the /api/v1 prefix (cookie authentication). With environment_id, resolve or modify only that environment; deletion suppresses a shared default locally, and apply never changes another target. Without it, existing shared catalogue behaviour is retained; all-target apply still preserves environment overrides. ## OpenAPI ````yaml https://platform.ankra.app/openapi.json get /api/v1/org/applications/{application_id}/env-secrets openapi: 3.1.0 info: title: Ankra Platform API version: v1 description: >- The Ankra platform HTTP contract. The /api/v1 surface is the public, bearer-authenticated API used by the Ankra CLI, MCP clients and automation; send a personal or service API token as `Authorization: Bearer `. Browser routes under /org and /chat are served on api.platform.ankra.app (each declares that server); they and /oauth/access authenticate with the ankra_session cookie, and mutations also require the X-Ankra-CSRF header. Every operation declares the credential it accepts, and no operation is served without one. This document is published deliberately: it describes the contract only and carries no organisation data or credentials. Report security issues to security@ankra.ai (see /.well-known/security.txt). servers: - url: https://platform.ankra.app security: - BearerAuth: [] tags: - name: Onboarding description: >- Generate a first website from a prompt and deploy it to a new organisation's cluster. - name: Access Gate description: >- Private service sign-in and membership checks for trusted Ankra proxy relays. - name: Canvas Datasets description: >- Read the fixed, named datasets canvas dashboards bind their charts, tables and stats to. - name: Canvases description: >- Keep dashboards and pages in the organisation's canvas library, with revision history, undo and pins. - name: Canvas Pages description: >- Publish a chat canvas artifact at a public pages address and take it down again. - name: Cloud Delegation description: >- Platform browser consent and organisation-bound connections for Ankra Cloud. - name: Organisation IAM description: >- Custom organisation roles and scoped role assignments for member and service-account identities. - name: Clusters description: Create, inspect and manage clusters, and the stacks deployed on them. - name: Managed Clusters description: Provider-managed control planes, driven through one common surface. - name: Imported Clusters description: Clusters that already existed and were connected to Ankra. - name: Cluster Access description: Kubeconfigs, service-account tokens and per-cluster access grants. - name: Kubernetes description: Read and act on the Kubernetes objects inside a cluster. - name: AWS Clusters description: >- Provision and manage self-managed k3s / kubeadm clusters on AWS EC2 in your own VPC. - name: Ankra Cloud Clusters description: >- Provision and manage self-managed kubeadm / k3s clusters on Ankra Cloud servers: a private network, a NAT router and a bastion per cluster. - name: DigitalOcean Clusters description: Provision and manage DigitalOcean Kubernetes clusters. - name: Hetzner Clusters description: Provision and manage Hetzner Kubernetes clusters. - name: OVH Clusters description: Provision and manage OVH Kubernetes clusters. - name: Scaleway Clusters description: Provision and manage Scaleway Kapsule clusters. - name: UpCloud Clusters description: Provision and manage UpCloud Kubernetes clusters. - name: Applications description: Deploy, configure and observe applications across the fleet. - name: Pipelines description: >- Pipeline definitions, the approval of the authority they declare, and the caches pipelines keep between runs. - name: Workspaces description: >- Personal workspaces on the organisation's CI pool where a repository's heavy commands run, and the repository profiles they are built from. - name: Deploy Targets description: >- Environments, the hosts registered to receive deployments, and the releases deployed to them. - name: Deploy Provenance description: >- Whether an application's deploys verify signed provenance from the organisation's own pipeline, the keys that provenance is signed with, and a dry-run that verifies images without deploying. - name: Backups description: >- Backup vaults, restore points, protection posture and captures for stacks and application deployments; a completed capture is not a verified restore. - name: Stack Profiles description: Reusable stack definitions, their versions and sharing. - name: Services description: >- Versioned service packages and explicit sharing. Runtime admission is separate from publication. - name: Charts description: Browse the chart catalogue behind stacks and addons. - name: Helm description: Helm registries, credentials and the charts they expose. - name: Executions description: Long-running platform executions and their jobs. - name: Operations description: Cancel in-flight cluster operations and their jobs. - name: Chat description: Conversational sessions, plans and confirmable actions. - name: AI Management description: >- Customer agent lifecycle, authenticated identity and organisation automation controls. - name: AI Agent Runs description: Autonomous agent runs and their outcomes. - name: AI Tickets description: The AI ticket board, its sync connections and settings. - name: AI Playbooks description: Reusable playbooks the AI lanes execute. - name: AI Conditions description: Conditions that gate AI autonomy. - name: AI Remediation description: >- The organisation's auto-remediation policy: what the AI lanes may fix by themselves, and who approves the rest. - name: AI Engineering Handoffs description: Work the AI lanes escalate to a human engineer. - name: AI Environment description: The environment and base stacks AI demos deploy into. - name: AI Memory description: >- What the assistant has learned about you: your cross-session memories and learned profile. - name: MCP Servers description: >- Register the MCP servers the organisation's AI agents can call, choose their tools and grant them to roles. - name: Security description: Findings, advisories, SBOMs, compliance and posture. - name: Cost description: Cluster and fleet cost, rate cards and cost settings. - name: Decisions description: >- The decision ledger behind the Security and Cost queues: proposals a surface computed, the approve and set-aside decisions people took on them, and the receipts of running them. - name: Usage description: >- What your organisation used of Ankra - vCPU-hours, playgrounds, managed services, hosted logs and metrics, and AI - per meter and period, with how completely it was measured and whether a published rate applies. - name: Billing description: Subscription and spend caps. - name: Organisation description: Members, invitations, audit logs and organisation settings. - name: Account description: >- Your own account: the contact email Ankra mails when it differs from your sign-in address. - name: Account Tokens description: Personal access tokens for the API and CLI. - name: Credentials description: The shared credential store. - name: AWS Credentials description: >- AWS credentials: access keys or CloudFormation-onboarded STS roles for cost, EKS and self-managed provisioning. - name: Ankra Cloud Credentials description: >- Ankra Cloud API tokens, shared by the self-managed and managed Ankra Cloud lanes. - name: Azure Credentials description: Azure credentials and SSH keys. - name: DigitalOcean Credentials description: DigitalOcean credentials and SSH keys. - name: Hetzner Credentials description: Hetzner credentials and SSH keys. - name: HPE Morpheus Credentials description: HPE Morpheus credentials and the capacity and quotas behind them. - name: OVH Credentials description: OVH credentials and SSH keys. - name: Proxmox Credentials description: Proxmox VE credentials and the capacity and quotas behind them. - name: Scaleway Credentials description: Scaleway credentials. - name: UpCloud Credentials description: UpCloud credentials and SSH keys. - name: Data Source Credentials description: Credentials for metrics and log sources. - name: DNS Credentials description: Credentials for DNS providers. - name: Object Storage Buckets description: >- Buckets Ankra creates and manages on an organisation's own provider credentials. - name: DNS description: DNS zones and records, including custom organisation zones. - name: Cloudflare description: Cloudflare domains and the credentials behind them. - name: Avura description: >- The linked Avura organization, the domains it shares with Ankra Platform, and their DNS records. - name: Variables description: Organisation- and cluster-scoped variables. - name: Secret Slots description: >- Store secrets in Vault and reference them by ${SECRET_SLOT:} sentinel instead of by value. - name: SOPS description: Encrypt and decrypt values with the organisation SOPS config. - name: Alerts description: Alert integrations and ingest credentials. - name: Notifications description: Notification routes and their delivery targets. - name: Support description: Support tickets. - name: AI Settings description: Organisation AI provider, model catalog and per-function model settings paths: /api/v1/org/applications/{application_id}/env-secrets: get: tags: - Applications summary: List application environment secrets description: >- List the environment-secret keys of an application: which keys its generated manifests read out of the Secrets Ankra fills for it, which of them have a stored value, when each was last set, and - in requirements_state - whether those manifests could be read at all, so an empty missing_keys is never mistaken for a fully configured application. Values are never returned - there is no reveal endpoint on this surface, because a value the platform writes into a cluster Secret has no reason to travel back out. A browser session twin is mounted at the same path without the /api/v1 prefix (cookie authentication). With environment_id, resolve or modify only that environment; deletion suppresses a shared default locally, and apply never changes another target. Without it, existing shared catalogue behaviour is retained; all-target apply still preserves environment overrides. operationId: >- list_application_env_secrets_api_v1_org_applications__application_id__env_secrets_get parameters: - in: path name: application_id required: true schema: type: string title: Application Id - in: header name: authorization required: false schema: anyOf: - type: string - type: 'null' title: Authorization - in: header name: x-ankra-organisation-id required: false schema: anyOf: - type: string - type: 'null' title: X-Ankra-Organisation-Id - name: environment_id in: query required: false schema: type: string format: uuid description: >- Select an owned canonical application environment, including a planned environment. A legacy cluster ID is accepted only when it identifies one complete environment, or an unassigned legacy cluster. Mixed or partial aliases return 409; refresh and select the canonical ID. Empty or repeated values are refused. Omit only for shared catalogue management or application-wide apply. responses: '200': content: application/json: schema: $ref: '#/components/schemas/ApplicationEnvSecrets' description: Successful Response '400': description: >- Invalid secret key, value or environment_id; empty and repeated environment selections are refused. '401': description: Unauthorized '404': content: application/json: schema: $ref: '#/components/schemas/DemoDetailError' description: >- Application or selected environment not found. A legacy shared deletion may also report an unknown secret key. '409': description: >- The legacy cluster alias is ambiguous or changed while preparing the write; refresh and select the canonical environment. content: application/json: schema: $ref: '#/components/schemas/DemoDetailError' '422': content: application/json: schema: $ref: '#/components/schemas/HTTPValidationError' description: Validation Error security: - BearerAuth: [] components: schemas: ApplicationEnvSecrets: description: >- An application's environment-secret surface: the Secrets the generated manifests read, the keys that have a value, the keys still missing one, whether Ankra could establish that at all, and whether the values that are stored have reached what is running. properties: secret_name: description: >- The application's own Kubernetes Secret ("-env"). It is the primary name; secret_names is what a deploy actually seals. title: Secret Name type: string secret_names: description: >- The Kubernetes Secrets the deploy renders these keys into. A monorepo's component Deployments each read a Secret named after themselves, so this carries one per component that reads one; every other application carries exactly secret_name. Empty when the manifests read none of them - including whenever requirements_state is "unknown", where it is not a claim about the application at all. items: type: string title: Secret Names type: array secrets: items: $ref: '#/components/schemas/ApplicationEnvSecretItem' title: Secrets type: array missing_keys: description: >- Keys the manifests read that have no value yet. Read requirements_state first: an empty list means "nothing is missing" only under "known". items: type: string title: Missing Keys type: array optional_missing_keys: description: >- Keys the manifests read only through optional secretKeyRefs that have no value yet. The workload starts without them, with whatever they enable left off. Same requirements_state caveat as missing_keys. items: type: string title: Optional Missing Keys type: array keys: description: >- Every key of the application's environment contract: each key the manifests read from the Secrets Ankra fills, required or optional, plus each stored key no manifest reads. Required keys first, then optional, then unreferenced (or unknown), each group in key order. Carries no value. Under requirements_state "unknown" the list is not exhaustive: the required and optional roles are references actually seen, but keys the scan could not read are absent. items: $ref: '#/components/schemas/ApplicationEnvSecretKey' title: Keys type: array requirements_state: description: >- Whether the application's committed manifests could be read for the keys they take from the Secrets Ankra fills: "known" when they were, so missing_keys is exhaustive; "unknown" when no manifest is recorded yet, or when they read an env Secret this application's catalogue does not fill (unfilled_secrets names it). Under "unknown", missing_keys and each item's required flag are not claims about the application. enum: - known - unknown title: Requirements State type: string unfilled_secrets: description: >- The env-shaped Secrets the manifests read that are none of this application's - the diagnosis behind an "unknown" requirements_state. Recognition is by the "-env" convention alone, because an unresolved component Secret and a Secret the repository manages itself are the same string: a self-managed "-env" is therefore listed here and holds the application at "unknown". That is the deliberate direction - Ankra declines to certify a key list it cannot verify rather than reporting a monorepo as needing nothing, which is the defect requirements_state exists to end. items: type: string title: Unfilled Secrets type: array revision: description: >- Revision of the returned effective catalogue, derived from key names and write timestamps. Deployment configuration and runtime readiness are separate observations. title: Revision type: string apply_state: description: >- The rolled-up answer: "applied" when every deployment carries the current values, "pending" when at least one does not, "unknown" when none is pending but at least one was never recorded, and "not_deployed" when the application is not deployed anywhere yet. enum: - applied - pending - unknown - not_deployed title: Apply State type: string deployments: description: The same answer per deployment. items: $ref: '#/components/schemas/ApplicationEnvSecretDeployment' title: Deployments type: array environment_id: type: string format: uuid description: >- The selected environment (cluster) identity; absent for the legacy shared catalogue. tearing_down_count: type: integer minimum: 0 description: >- Scoped installations currently being removed. Omitted when zero or for the legacy shared view. required: - secret_name - secret_names - secrets - missing_keys - requirements_state - unfilled_secrets - revision - apply_state - deployments title: ApplicationEnvSecrets type: object DemoDetailError: description: >- The FastAPI-style detail envelope the demo routes use for 400/403/404/409/502 responses. properties: detail: type: string required: - detail type: object HTTPValidationError: properties: detail: items: $ref: '#/components/schemas/ValidationError' title: Detail type: array title: HTTPValidationError type: object ApplicationEnvSecretItem: description: >- One key of an application's -env Secret. The stored value is never part of this model - no endpoint on this surface returns one. properties: key: type: string title: Key required: description: >- True when the application's committed manifests read this key through a secretKeyRef. title: Required type: boolean optional: description: >- True when the application's committed manifests read this key only through optional secretKeyRefs: the workload starts without it. Never true together with required. title: Optional type: boolean status: description: >- Configured, missing from secret storage, explicitly disabled in this environment, or unverified because storage could not be read. Scoped reads never turn a store outage into configured. enum: - set - value_missing - disabled - unknown title: Status type: string updated_at: title: Updated At type: string updated_by: anyOf: - type: string - type: 'null' title: Updated By source: type: string enum: - shared - environment description: >- Present on environment-scoped reads and writes. Shared values are inherited; environment values override only this target. required: - key - required - status - updated_at - updated_by title: ApplicationEnvSecretItem type: object ApplicationEnvSecretKey: description: >- One key of an application's environment contract, with the role it plays in the manifests, whether it has a value, and where it is read. The stored value is never part of this model. properties: key: type: string title: Key role: description: >- "required" when at least one manifest reads the key through a non-optional secretKeyRef, "optional" when every reference is optional, "unreferenced" for a stored key no manifest reads, "unknown" for a stored key the scan did not find while requirements_state is "unknown" (the manifests could not be read in full, so it is not a claim that nothing reads it). enum: - required - optional - unreferenced - unknown title: Role type: string state: description: '"unset" when no value is stored; otherwise the stored key''s status.' enum: - set - unset - value_missing - disabled - unknown title: State type: string usages: description: >- Every place the manifests read the key. Empty for an unreferenced key. items: $ref: '#/components/schemas/ApplicationEnvSecretKeyUsage' title: Usages type: array required: - key - role - state - usages title: ApplicationEnvSecretKey type: object ApplicationEnvSecretDeployment: description: >- One deployment of an application, and whether it is running the environment-secret values that are stored now. properties: installation_id: type: string title: Installation Id cluster_id: type: string title: Cluster Id namespace: title: Namespace type: string deploy_status: description: >- The installation's own deploy status (pending, deploying, healthy, degraded, failed). title: Deploy Status type: string status: description: >- Whether this deployment DECLARES the values the catalogue holds now (the cluster reconcile rolls the workload onto them from there). "applied" - the recorded revision is the current one. "pending" - a value was set, rotated or cleared since this deployment last sealed them, so it is running something else. "unknown" - nothing was ever recorded for this deployment, because it was deployed before the platform tracked the revision; that is not the same as "out of date" and is not reported as it. enum: - applied - pending - unknown title: Status type: string required: - installation_id - cluster_id - namespace - deploy_status - status title: ApplicationEnvSecretDeployment type: object ValidationError: properties: loc: items: anyOf: - type: string - type: integer title: Location type: array msg: title: Message type: string type: title: Error Type type: string required: - loc - msg - type title: ValidationError type: object ApplicationEnvSecretKeyUsage: description: One secretKeyRef that reads a key. properties: secret_name: description: The Kubernetes Secret the key is read from. title: Secret Name type: string container: description: >- The container whose environment reads the key. Omitted when the manifest does not nest the reference in a named container's env list. title: Container type: string environment_variable: description: >- The environment variable the key is read into. Omitted when the reference is not in a named env entry. title: Environment Variable type: string optional: description: True when this reference is marked optional. title: Optional type: boolean required: - secret_name - optional title: ApplicationEnvSecretKeyUsage type: object securitySchemes: BearerAuth: bearerFormat: PAT scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.