---
title: "GET /api/v1/projects/{projectId}/secret-validation-rules"
method: GET
path: "/api/v1/projects/{projectId}/secret-validation-rules"
tags: ["Secret Validation Rules"]
---

# GET /api/v1/projects/{projectId}/secret-validation-rules

`GET /api/v1/projects/{projectId}/secret-validation-rules`

List Secret Validation Rules

## Path parameters

- `projectId` string, required

## Response `200`

Default Response

- object
  - `rules` union[], required
    - union
      - object
        - `id` string, uuid, required
        - `name` string, required
        - `description` string, nullable
        - `projectId` string, required
        - `envId` string, uuid, nullable
        - `secretPath` string, required
        - `isActive` boolean
        - `createdAt` string, date-time, required
        - `updatedAt` string, date-time, required
        - `type` 'static-secrets', required — The kind of secret the rule applies to. Determines which fields the rule accepts and where the constraints are enforced: `static-secrets` constraints run on write, while `dynamic-secrets` and `secret-rotations` constraints shape the generated credential.
        - `constraints` object[], required — The constraints enforced by this rule. Each constraint names what it checks (`type`), what it applies to (`appliesTo`), and its `value`, e.g. the minimum character count for `min-length` or the pattern for `regex-pattern`.
          - `type` 'min-length' | 'max-length' | 'regex-pattern' | 'required-prefix' | 'required-suffix' | 'prevent-value-reuse', required — The kind of check this constraint performs, e.g. `min-length`, `regex-pattern`, `required-prefix`, or `prevent-value-reuse`.
          - `appliesTo` 'key' | 'value', required — What the constraint checks: the secret key or the secret value.
          - `value` string, required — The value the constraint is checked against, e.g. the minimum length, the regex pattern, or the required prefix/suffix string.
      - object
        - `id` string, uuid, required
        - `name` string, required
        - `description` string, nullable
        - `projectId` string, required
        - `envId` string, uuid, nullable
        - `secretPath` string, required
        - `isActive` boolean
        - `createdAt` string, date-time, required
        - `updatedAt` string, date-time, required
        - `type` 'dynamic-secrets', required — The kind of secret the rule applies to. Determines which fields the rule accepts and where the constraints are enforced: `static-secrets` constraints run on write, while `dynamic-secrets` and `secret-rotations` constraints shape the generated credential.
        - `providers` string[], required — The dynamic secret providers this rule applies to. A lease is only constrained when its provider is listed here.
        - `constraints` object[], required — The constraints enforced by this rule. Each constraint names what it checks (`type`), what it applies to (`appliesTo`), and its `value`, e.g. the minimum character count for `min-length` or the pattern for `regex-pattern`.
          - `type` 'min-length' | 'max-length' | 'regex-pattern' | 'required-prefix' | 'required-suffix', required — The kind of check this constraint performs, e.g. `min-length`, `regex-pattern`, or `required-prefix`.
          - `appliesTo` 'password', required — What the constraint checks: the generated credential.
          - `value` string, required — The value the constraint is checked against, e.g. the minimum length, the regex pattern, or the required prefix/suffix string.
      - object
        - `id` string, uuid, required
        - `name` string, required
        - `description` string, nullable
        - `projectId` string, required
        - `envId` string, uuid, nullable
        - `secretPath` string, required
        - `isActive` boolean
        - `createdAt` string, date-time, required
        - `updatedAt` string, date-time, required
        - `type` 'secret-rotations', required — The kind of secret the rule applies to. Determines which fields the rule accepts and where the constraints are enforced: `static-secrets` constraints run on write, while `dynamic-secrets` and `secret-rotations` constraints shape the generated credential.
        - `providers` string[], required — The secret rotation providers this rule applies to. A rotation is only constrained when its provider is listed here.
        - `constraints` object[], required — The constraints enforced by this rule. Each constraint names what it checks (`type`), what it applies to (`appliesTo`), and its `value`, e.g. the minimum character count for `min-length` or the pattern for `regex-pattern`.
          - `type` 'min-length' | 'max-length' | 'regex-pattern' | 'required-prefix' | 'required-suffix', required — The kind of check this constraint performs, e.g. `min-length`, `regex-pattern`, or `required-prefix`.
          - `appliesTo` 'password', required — What the constraint checks: the generated credential.
          - `value` string, required — The value the constraint is checked against, e.g. the minimum length, the regex pattern, or the required prefix/suffix string.

## Other responses

- `400` — Default Response
- `401` — Default Response
- `403` — Default Response
- `404` — Default Response
- `422` — Default Response
- `500` — Default Response

---

[API](https://skmtc.net/infisical/apis/infisical-api.md) · [All operations](https://skmtc.net/infisical/apis/infisical-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/infisical/infisical-api/revisions/1f23b433474e/schema)