import requests
url = "https://platform.ankra.app/api/v1/org/applications/{application_id}/env-secrets"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://platform.ankra.app/api/v1/org/applications/{application_id}/env-secrets', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));curl --request GET \
--url https://platform.ankra.app/api/v1/org/applications/{application_id}/env-secrets \
--header 'Authorization: Bearer <token>'{
"secret_name": "<string>",
"secret_names": [
"<string>"
],
"secrets": [
{
"key": "<string>",
"required": true,
"status": "set",
"updated_at": "<string>",
"updated_by": "<string>"
}
],
"missing_keys": [
"<string>"
],
"requirements_state": "known",
"unfilled_secrets": [
"<string>"
],
"revision": "<string>",
"apply_state": "applied",
"deployments": [
{
"installation_id": "<string>",
"cluster_id": "<string>",
"namespace": "<string>",
"deploy_status": "<string>",
"status": "applied"
}
]
}{
"detail": "<string>"
}{
"detail": [
{
"loc": [
"<string>"
],
"msg": "<string>",
"type": "<string>"
}
]
}List Application Env Secrets
List the environment-secret keys of an application: which keys its generated manifests read out of the Secrets Ankra fills for it, which of them have a stored value, when each was last set, and - in requirements_state - whether those manifests could be read at all, so an empty missing_keys is never mistaken for a fully configured application. Values are never returned - there is no reveal endpoint on this surface, because a value the platform writes into a cluster Secret has no reason to travel back out. A browser session twin is mounted at the same path without the /api/v1 prefix (cookie authentication).
import requests
url = "https://platform.ankra.app/api/v1/org/applications/{application_id}/env-secrets"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://platform.ankra.app/api/v1/org/applications/{application_id}/env-secrets', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));curl --request GET \
--url https://platform.ankra.app/api/v1/org/applications/{application_id}/env-secrets \
--header 'Authorization: Bearer <token>'{
"secret_name": "<string>",
"secret_names": [
"<string>"
],
"secrets": [
{
"key": "<string>",
"required": true,
"status": "set",
"updated_at": "<string>",
"updated_by": "<string>"
}
],
"missing_keys": [
"<string>"
],
"requirements_state": "known",
"unfilled_secrets": [
"<string>"
],
"revision": "<string>",
"apply_state": "applied",
"deployments": [
{
"installation_id": "<string>",
"cluster_id": "<string>",
"namespace": "<string>",
"deploy_status": "<string>",
"status": "applied"
}
]
}{
"detail": "<string>"
}{
"detail": [
{
"loc": [
"<string>"
],
"msg": "<string>",
"type": "<string>"
}
]
}Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
Path Parameters
Response
Successful Response
An application's environment-secret surface: the Secrets the generated manifests read, the keys that have a value, the keys still missing one, whether Ankra could establish that at all, and whether the values that are stored have reached what is running.
The application's own Kubernetes Secret ("-env"). It is the primary name; secret_names is what a deploy actually seals.
The Kubernetes Secrets the deploy renders these keys into. A monorepo's component Deployments each read a Secret named after themselves, so this carries one per component that reads one; every other application carries exactly secret_name. Empty when the manifests read none of them - including whenever requirements_state is "unknown", where it is not a claim about the application at all.
Show child attributes
Show child attributes
Keys the manifests read that have no value yet. Read requirements_state first: an empty list means "nothing is missing" only under "known".
Whether the application's committed manifests could be read for the keys they take from the Secrets Ankra fills: "known" when they were, so missing_keys is exhaustive; "unknown" when no manifest is recorded yet, or when they read an env Secret this application's catalogue does not fill (unfilled_secrets names it). Under "unknown", missing_keys and each item's required flag are not claims about the application.
known, unknown The env-shaped Secrets the manifests read that are none of this application's - the diagnosis behind an "unknown" requirements_state. Recognition is by the "-env" convention alone, because an unresolved component Secret and a Secret the repository manages itself are the same string: a self-managed "-env" is therefore listed here and holds the application at "unknown". That is the deliberate direction - Ankra declines to certify a key list it cannot verify rather than reporting a monorepo as needing nothing, which is the defect requirements_state exists to end.
Names the set of values catalogued right now. A deployment recorded as carrying this revision is running exactly these values. Derived from key names and write timestamps only - never from a value.
The rolled-up answer: "applied" when every deployment carries the current values, "pending" when at least one does not, "unknown" when none is pending but at least one was never recorded, and "not_deployed" when the application is not deployed anywhere yet.
applied, pending, unknown, not_deployed The same answer per deployment.
Show child attributes
Show child attributes