---
title: "Retrieve the decrypted value of an environment variable of a project by id"
method: GET
path: "/v1/projects/{idOrName}/env/{id}"
tags: ["projects"]
---

# Retrieve the decrypted value of an environment variable of a project by id

`GET /v1/projects/{idOrName}/env/{id}`

Retrieve the environment variable for a given project.

## Path parameters

- `idOrName` string, required — The unique project identifier or the project name
- `id` string, required — The unique ID for the environment variable to get the decrypted value.

## Query parameters

- `teamId` string
- `slug` string

## Response `200`

- union
  - object
    - `decrypted` false | true, required
    - `type` 'encrypted' | 'plain' | 'secret' | 'sensitive' | 'system', required
    - `edgeConfigId` string, nullable
    - `edgeConfigTokenId` string, nullable
    - `createdAt` number
    - `updatedAt` number
    - `id` string
    - `key` string, required
    - `target` union
      - string[]
      - 'production' | 'preview' | 'development'
    - `gitBranch` string
    - `createdBy` string, nullable
    - `updatedBy` string, nullable
    - `sunsetSecretId` string — This is used to identify variables that have been migrated from type secret to sensitive.
    - `legacyValue` string — Legacy now-encryption ciphertext, present after migration swaps value/vsmValue
    - `configurationId` string, nullable
    - `visibility` 'config' | 'secret' — User-facing config/secret model. When set, authoritative for new code paths when the env-var-config-secret-ui flag is enabled. Legacy rows omit this field; legacy rows omit it and callers fall back to existing `type` behavior.
    - `contentHint` union
      - object
        - `type` 'redis-url', required
        - `storeId` string, required
      - object
        - `type` 'redis-rest-api-url', required
        - `storeId` string, required
      - object
        - `type` 'redis-rest-api-token', required
        - `storeId` string, required
      - object
        - `type` 'redis-rest-api-read-only-token', required
        - `storeId` string, required
      - object
        - `type` 'blob-read-write-token', required
        - `storeId` string, required
      - object
        - `type` 'blob-store-id', required
        - `storeId` string, required
      - object
        - `type` 'blob-webhook-public-key', required
        - `storeId` string, required
      - object
        - `type` 'postgres-url', required
        - `storeId` string, required
      - object
        - `type` 'postgres-url-non-pooling', required
        - `storeId` string, required
      - object
        - `type` 'postgres-prisma-url', required
        - `storeId` string, required
      - object
        - `type` 'postgres-user', required
        - `storeId` string, required
      - object
        - `type` 'postgres-host', required
        - `storeId` string, required
      - object
        - `type` 'postgres-password', required
        - `storeId` string, required
      - object
        - `type` 'postgres-database', required
        - `storeId` string, required
      - object
        - `type` 'postgres-url-no-ssl', required
        - `storeId` string, required
      - object
        - `type` 'integration-store-secret', required
        - `storeId` string, required
        - `integrationId` string, required
        - `integrationProductId` string, required
        - `integrationConfigurationId` string, required
      - object
        - `type` 'flags-connection-string', required
        - `projectId` string, required
    - `internalContentHint` object, nullable — Similar to `contentHints`, but should not be exposed to the user.
      - `type` 'flags-secret', required
      - `encryptedValue` string, required — Contains the `value` of the env variable, encrypted with a special key to make decryption possible in the subscriber Lambda.
    - `comment` string
    - `customEnvironmentIds` string[]
  - object
    - `type` 'encrypted' | 'plain' | 'secret' | 'sensitive' | 'system', required
    - `value` string, required
    - `edgeConfigId` string, nullable
    - `edgeConfigTokenId` string, nullable
    - `createdAt` number
    - `updatedAt` number
    - `id` string
    - `key` string, required
    - `target` union
      - string[]
      - 'production' | 'preview' | 'development'
    - `gitBranch` string
    - `createdBy` string, nullable
    - `updatedBy` string, nullable
    - `sunsetSecretId` string — This is used to identify variables that have been migrated from type secret to sensitive.
    - `legacyValue` string — Legacy now-encryption ciphertext, present after migration swaps value/vsmValue
    - `decrypted` false | true
    - `configurationId` string, nullable
    - `visibility` 'config' | 'secret' — User-facing config/secret model. When set, authoritative for new code paths when the env-var-config-secret-ui flag is enabled. Legacy rows omit this field; legacy rows omit it and callers fall back to existing `type` behavior.
    - `contentHint` union
      - object
        - `type` 'redis-url', required
        - `storeId` string, required
      - object
        - `type` 'redis-rest-api-url', required
        - `storeId` string, required
      - object
        - `type` 'redis-rest-api-token', required
        - `storeId` string, required
      - object
        - `type` 'redis-rest-api-read-only-token', required
        - `storeId` string, required
      - object
        - `type` 'blob-read-write-token', required
        - `storeId` string, required
      - object
        - `type` 'blob-store-id', required
        - `storeId` string, required
      - object
        - `type` 'blob-webhook-public-key', required
        - `storeId` string, required
      - object
        - `type` 'postgres-url', required
        - `storeId` string, required
      - object
        - `type` 'postgres-url-non-pooling', required
        - `storeId` string, required
      - object
        - `type` 'postgres-prisma-url', required
        - `storeId` string, required
      - object
        - `type` 'postgres-user', required
        - `storeId` string, required
      - object
        - `type` 'postgres-host', required
        - `storeId` string, required
      - object
        - `type` 'postgres-password', required
        - `storeId` string, required
      - object
        - `type` 'postgres-database', required
        - `storeId` string, required
      - object
        - `type` 'postgres-url-no-ssl', required
        - `storeId` string, required
      - object
        - `type` 'integration-store-secret', required
        - `storeId` string, required
        - `integrationId` string, required
        - `integrationProductId` string, required
        - `integrationConfigurationId` string, required
      - object
        - `type` 'flags-connection-string', required
        - `projectId` string, required
    - `internalContentHint` object, nullable — Similar to `contentHints`, but should not be exposed to the user.
      - `type` 'flags-secret', required
      - `encryptedValue` string, required — Contains the `value` of the env variable, encrypted with a special key to make decryption possible in the subscriber Lambda.
    - `comment` string
    - `customEnvironmentIds` string[]

## Other responses

- `400` — One of the provided values in the request query is invalid.
- `401` — The request is not authorized.
- `403` — You do not have permission to access this resource.
- `410`

---

[API](https://skmtc.net/vercel/apis/api.md) · [All operations](https://skmtc.net/vercel/apis/api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/vercel/api/versions/61d1ba3f6dac/schema)