Sign in

v32

latestOpenAPI 3.1.0raw.githubusercontent.com2026-05-224341,4072.0 MB
Secrets

Get Content

GetContent retrieves the encrypted secret content for an authorized recipient. Caller must be in the secret's allowed_user_ids list (for INTERNAL secrets). Returns content re-encrypted to caller's ephemeral public key.

post/api/v1/secrets/{vault_id}/view

Path parameters

vault_idstring required

The vaultId field.

Request body

readerRecipientstring

Client's ephemeral Age recipient (age1...) for re-encryption Server re-encrypts the content to this recipient

Response

Successful response

createdAtstring date-time
creatorUserIdstring

The creatorUserId field.

downloadUrlstring nullable

For file secrets: presigned S3 download URL (5 minute expiry) File is still E2E encrypted - client must decrypt after download This field is part of the content oneof. See the documentation for c1.api.secrets.v1.PaperSecretServiceGetContentResponse for more details.

encryptedContentstring base64 nullable

For text secrets: Age-encrypted content (encrypted to reader's recipient) This field is part of the content oneof. See the documentation for c1.api.secrets.v1.PaperSecretServiceGetContentResponse for more details.

filenamestring

Original filename (file secrets only)

inputFormat'SECRET_INPUT_FORMAT_UNSPECIFIED' | 'SECRET_INPUT_FORMAT_PLAINTEXT' | 'SECRET_INPUT_FORMAT_JSON' | 'SECRET_INPUT_FORMAT_YAML' | 'SECRET_INPUT_FORMAT_KEY_VALUE'

Input format hint for rendering (text secrets only)

secretType'SECRET_TYPE_UNSPECIFIED' | 'SECRET_TYPE_TEXT' | 'SECRET_TYPE_FILE'

Secret metadata

viewsRemaininginteger

Views remaining after this view (-1 = unlimited)