---
title: "List Secrets"
method: GET
path: "/cloud/v2/universes/{universeId}/secrets"
tags: ["Universes"]
---

# List Secrets

`GET /cloud/v2/universes/{universeId}/secrets`

Lists all secrets defined for a universe.
Secret content is not returned for security reasons - only metadata such as ID, domain, creation and update timestamps are included.

Only the owner of the universe can list secrets. For group-owned universes, only the group owner or authorized
members can list secrets.

## Path parameters

- `universeId` integer, required

## Query parameters

- `limit` integer
- `cursor` string

## Response `200`

OK

- SecretPaginatedList — Wrapper for the paginated collection output. Complies with the REST conventions, containing next/previous page, and a data field containing the actual list. Needed only to simplify JSON serialization, and can technically be AutoMapper-ed from the EaaS or any other data provider.
  - `secrets` Secret[], nullable — Gets the actual list of items to return
    - `id` string, nullable — The user-specified secret name. Examples: "aws", "gcp", "discord". Static when getting the public key for a universe. Must be alphanumeric or underscore, 1-64 characters, not starting with a number.
    - `secret` string, byte, nullable — The binary secret content. Examples: API key content (text), private keys. When created, the secret must be encrypted using LibSodium sealed box and encoded in base64 with the universe's public key. Contains the public key when getting the public key for a universe.
    - `key_id` string, nullable — Encryption key identifier. Identifies the key that was used to encrypt the secret content.
    - `domain` string, nullable — The domain wildcard that restricts the purpose of the key. You can restrict the URLs callable via HttpService to a specific domain, e.g. "api.example.com" or "*.myservice.org". An empty or null domain means that the secret is a private key and cannot be transformed with addPrefix/addSuffix or sent as a header or URL. In order to make the secret accessible for all domains, use "*"
    - `create_time` string, nullable — Date and time when the secret was originally created.
    - `update_time` string, nullable — Date and time when the secret was last updated
  - `nextPageCursor` string, nullable — Gets the cursor where the pagination stopped after fetching `data`. `null` if there is no more data available.
  - `previousPageCursor` string, nullable — Gets the cursor pointing at the previous page. `null` when it's the first page.

## Other responses

- `400` — Bad Request
- `403` — Forbidden

---

[API](https://skmtc.net/roblox/apis/roblox-api.md) · [All operations](https://skmtc.net/roblox/apis/roblox-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/roblox/roblox-api/revisions/756260310407/schema)