---
title: "Fetch Secret For Server"
method: POST
path: "/secrets/fetch"
tags: ["Secrets"]
---

# Fetch Secret For Server

`POST /secrets/fetch`

Return a secret wrapped as JWE for the requesting server.

Auth: The caller must present a **delegation JWT** (RFC 8693) issued by
Core.  ``sub`` is the user whose secret is being fetched; ``act.sub`` is
the ``client_id`` of the server requesting the secret.  The JWE envelope
is encrypted with the server's registered RSA public key so only that
server can decrypt it.  Plaintext never leaves Core unencrypted.

## Request body

- SecretFetchRequest — Filter criteria for fetching a secret via delegation JWT.
  - `type` string, nullable — Filter by secret type
  - `provider` string, nullable — Filter by provider
  - `authorizer_id` string, nullable — Filter by authorizer artifact ID
  - `secret_id` string, nullable — Exact secret ID

## Response `200`

Successful Response

- SecretFetchResponse — Secret wrapped as JWE for the requesting server.
  - `id` string, required
  - `type` string, required
  - `jwe` object, required

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.net/agience/apis/agience-platform-api.md) · [All operations](https://skmtc.net/agience/apis/agience-platform-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/agience/agience-platform-api/revisions/187bad270c94/schema)