🔐SecretServer/Docs
Get Started

API Reference

REST API for SecretServer.io. All endpoints are under https://api.secretserver.io/api/v1.

Authentication: Pass your API key as a Bearer token or via the X-API-Key header.

Authorization: Bearer sk_live_...
# or
X-API-Key: sk_live_...

Generate an API key in account settings. Full OpenAPI spec: openapi.yaml.

Sections

Path-based access (universal)ContainersGeneric SecretsPasswords & CredentialsKeys & CertificatesVersion HistorySharingTemp AccessAuthentication

Path-based access

Resolve any secret by its container path — no need to know the secret type in advance.

GET
/api/v1/s/:container/:key

Get current value of a secret by container + key name

GET
/api/v1/s/:container/:key/:version

Get a specific historical version (2=previous, 3=two back…)

GET
/api/v1/t/:token

Public — redeem a temp access token (no auth required)

# Request
GET /api/v1/s/production/postgres-password

# Response
{
  "id": "uuid",
  "name": "postgres-password",
  "secret_type": "computer_credential",
  "data": {
    "hostname": "db.example.com",
    "admin_user": "postgres",
    "password": "s3cur3P@ssw0rd!"
  },
  "created_at": "2026-02-15T10:00:00Z"
}

Containers

Containers are namespaces for organising secrets. Each has a URL-safe slug used in path-based access.

GET
/api/v1/containers

List containers

POST
/api/v1/containers

Create a container

GET
/api/v1/containers/:id

Get container

PUT
/api/v1/containers/:id

Update container

DELETE
/api/v1/containers/:id

Delete container

POST /api/v1/containers
{
  "name": "Production",
  "slug": "production",
  "description": "Production environment secrets"
}

Generic Secrets

GET
/api/v1/secrets

List secrets

POST
/api/v1/secrets

Create secret

GET
/api/v1/secrets/:id

Get secret + value

PUT
/api/v1/secrets/:id

Update secret

DELETE
/api/v1/secrets/:id

Delete secret

Passwords & Credentials

All credential endpoints follow the same CRUD pattern. Replace :type with the type name.

GETPOSTPUTDELETE/api/v1/passwords[/:id]

Username + password entries

GETPOSTPUTDELETE/api/v1/computer-credentials[/:id]

Hostnames, IP addresses, OS credentials

GETPOSTPUTDELETE/api/v1/wifi-credentials[/:id]

SSID, WPA2/3/WEP, band, hidden flag

GETPOSTPUTDELETE/api/v1/windows-credentials[/:id]

Domain accounts, local accounts, MSA

GETPOSTPUTDELETE/api/v1/social-credentials[/:id]

Social network accounts with 2FA flag

GETPOSTPUTDELETE/api/v1/root-credentials[/:id]

Root / su credentials with sudo flag

GETPOSTPUTDELETE/api/v1/ldap-bind-credentials[/:id]

LDAP bind DN + password

GETPOSTPUTDELETE/api/v1/integrations[/:id]

Third-party service tokens (bearer, API key, OAuth2)

GETPOSTPUTDELETE/api/v1/disk-credentials[/:id]

LUKS, BitLocker, FileVault, VeraCrypt passphrases

GETPOSTPUTDELETE/api/v1/service-config[/:id]

Service config file values

POST /api/v1/computer-credentials
{
  "name": "DB Server",
  "container_id": "uuid-of-container",   // optional
  "hostname": "db.example.com",
  "ip_address": "10.0.1.50",
  "os_type": "linux",
  "admin_user": "root",
  "password": "s3cur3P@ssw0rd!"          // stored in Vault, never in DB
}

Keys & Certificates

GETPOSTPUTDELETE/api/v1/ssh-keys[/:id]

SSH key pairs (Ed25519, RSA, ECDSA)

GETPOSTPUTDELETE/api/v1/gpg-keys[/:id]

GPG / PGP key pairs

GETPOSTPUTDELETE/api/v1/certificates[/:id]

X.509 TLS certificates

GETPOSTPUTDELETE/api/v1/api-tokens[/:id]

API tokens for external services

GETPOSTPUTDELETE/api/v1/openssl-keys[/:id]

RSA, ECDSA, Ed25519 keys

GETPOSTPUTDELETE/api/v1/ntlm[/:id]

NTLM hash credentials

GETPOSTPUTDELETE/api/v1/code-signing-keys[/:id]

Apple, Authenticode, Android, GPG, Maven signing keys

Version History

Available on all secret types. Enable per-secret with configurable max (1–12 versions).

GET
/api/v1/:type/:id/history-settings

Get history settings (enabled, max_versions)

PUT
/api/v1/:type/:id/history-settings

Update history settings

GET
/api/v1/:type/:id/history

List version metadata (no secret values)

GET
/api/v1/:type/:id/history/:version

Get a specific historical version value

PUT /api/v1/computer-credentials/:id/history-settings
{ "history_enabled": true, "max_versions": 6 }

GET /api/v1/computer-credentials/:id/history
{
  "versions": [
    { "version_num": 1, "created_by": "alice@example.com", "created_at": "..." },
    { "version_num": 2, "created_by": "bob@example.com",   "created_at": "..." }
  ]
}

Sharing

Share any secret with other users in your organisation. Permissions: read or manage.

POST
/api/v1/:type/:id/shares

Share a secret with a user

GET
/api/v1/:type/:id/shares

List shares for a secret

DELETE
/api/v1/shares/:share_id

Revoke a share

GET
/api/v1/shared-with-me

List secrets shared with the current user

POST /api/v1/computer-credentials/:id/shares
{
  "shared_with_email": "bob@example.com",
  "permission": "read",
  "expires_at": "2026-02-24T00:00:00Z"   // optional
}

Temp Access

Generate time-limited tokens for unauthenticated access. Tokens are SHA-256 hashed at rest. Useful for CI/CD pipelines, external scripts, and ephemeral services.

POST
/api/v1/:type/:id/temp-access

Create a temp access token

GET
/api/v1/:type/:id/temp-access

List active (non-expired) grants

DELETE
/api/v1/temp-access/:grant_id

Revoke a grant

GET
/api/v1/t/:token

Public — redeem token, returns secret value

POST /api/v1/computer-credentials/:id/temp-access
{ "duration_seconds": 900 }

// Response
{
  "token": "a3f8c2e1d4b7...",   // shown ONCE, store it
  "expires_at": "2026-02-17T12:15:00Z"
}

// Redeem (no API key required)
GET /api/v1/t/a3f8c2e1d4b7...
{
  "id": "uuid", "name": "postgres-password",
  "secret_type": "computer_credential",
  "data": { "password": "s3cur3P@ssw0rd!" }
}

Authentication

GET
/api/v1/auth/oidc/login

Initiate OIDC/SSO login

GET
/api/v1/auth/oidc/callback

OIDC callback

POST
/api/v1/auth/device/code

Device code flow (CLI / headless)

POST
/api/v1/auth/device/token

Poll for device code token

POST
/api/v1/auth/api-keys

Create an API key

GET
/api/v1/auth/api-keys

List API keys

DELETE
/api/v1/auth/api-keys/:id

Revoke an API key

Download OpenAPI spec (YAML) →← CLI Reference