---
title: "POST /api/v4/secrets/duplicate"
method: POST
path: "/api/v4/secrets/duplicate"
tags: ["Secrets"]
---

# POST /api/v4/secrets/duplicate

`POST /api/v4/secrets/duplicate`

Duplicate one or more static secrets into another environment

## Request body

- object
  - `projectId` string, required — The ID of the project containing the secret.
  - `sourceEnvironment` string, required — The slug of the source environment.
  - `sourceSecretPath` string — The folder path of the source secret.
  - `destinationEnvironment` string, required — The slug of the destination environment.
  - `destinationSecretPath` string — The folder path where the secret will be duplicated to.
  - `secretIds` string[], required — Array of source secret IDs to duplicate. All secrets must belong to the source environment and path. Rotation and honey-token secrets cannot be duplicated. Maximum 50 secrets per request.
  - `shouldOverwrite` boolean — When true, overwrite an existing secret with the same key at the destination. When false (default), the request fails if the destination already has a secret with that key.
  - `attributesToCopy` object — Object specifying which attributes of the source secret to copy to the destination. Each key is optional and defaults to false. Available keys: value, comment, tags, metadata, skipMultilineEncoding.
    - `value` boolean
    - `comment` boolean
    - `tags` boolean
    - `metadata` boolean
    - `skipMultilineEncoding` boolean

## Response `200`

Default Response

- object
  - `results` union[], required
    - union
      - object
        - `sourceSecretId` string, required
        - `sourceSecretKey` string, required
        - `destinationSecretId` string, required
      - object — Returned when the destination has an active secret-approval policy.
        - `sourceSecretId` string, required
        - `sourceSecretKey` string, required
        - `approval` object, required
          - `id` string, uuid, required
          - `policyId` string, uuid, required
          - `hasMerged` boolean
          - `status` string
          - `conflicts` unknown
          - `slug` string, required
          - `folderId` string, uuid, required
          - `createdAt` string, date-time, required
          - `updatedAt` string, date-time, required
          - `isReplicated` boolean, nullable
          - `committerUserId` string, uuid, nullable
          - `statusChangedByUserId` string, uuid, nullable
          - `bypassReason` string, nullable
          - `commitMessage` string, nullable

## Other responses

- `400` — Default Response
- `401` — Default Response
- `403` — Default Response
- `404` — Default Response
- `422` — Default Response
- `500` — Default Response

---

[API](https://skmtc.net/infisical/apis/infisical-api.md) · [All operations](https://skmtc.net/infisical/apis/infisical-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/infisical/infisical-api/versions/885aef3e6c11/schema)