import requests
url = "https://platform.ankra.app/org/applications/{application_id}/env-secrets"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://platform.ankra.app/org/applications/{application_id}/env-secrets', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));curl --request GET \
--url https://platform.ankra.app/org/applications/{application_id}/env-secrets \
--header 'Authorization: Bearer <token>'{
"secret_name": "<string>",
"secret_names": [
"<string>"
],
"secrets": [
{
"key": "<string>",
"required": true,
"status": "set",
"updated_at": "<string>",
"updated_by": "<string>",
"source": "shared"
}
],
"missing_keys": [
"<string>"
],
"requirements_state": "known",
"unfilled_secrets": [
"<string>"
],
"revision": "<string>",
"apply_state": "applied",
"deployments": [
{
"installation_id": "<string>",
"cluster_id": "<string>",
"namespace": "<string>",
"deploy_status": "<string>",
"status": "applied"
}
],
"environment_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"tearing_down_count": 1
}{
"detail": "<string>"
}{
"detail": [
{
"loc": [
"<string>"
],
"msg": "<string>",
"type": "<string>"
}
]
}List Application Env Secrets
List the environment-secret keys of an application: which keys its generated manifests read out of the Secrets Ankra fills for it, which of them have a stored value, when each was last set, and - in requirements_state - whether those manifests could be read at all, so an empty missing_keys is never mistaken for a fully configured application. Values are never returned - there is no reveal endpoint on this surface, because a value the platform writes into a cluster Secret has no reason to travel back out. A browser session twin is mounted at the same path without the /api/v1 prefix (cookie authentication). With environment_id, resolve or modify only that environment; deletion suppresses a shared default locally, and apply never changes another target. Without it, existing shared catalogue behaviour is retained; all-target apply still preserves environment overrides.
import requests
url = "https://platform.ankra.app/org/applications/{application_id}/env-secrets"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://platform.ankra.app/org/applications/{application_id}/env-secrets', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));curl --request GET \
--url https://platform.ankra.app/org/applications/{application_id}/env-secrets \
--header 'Authorization: Bearer <token>'{
"secret_name": "<string>",
"secret_names": [
"<string>"
],
"secrets": [
{
"key": "<string>",
"required": true,
"status": "set",
"updated_at": "<string>",
"updated_by": "<string>",
"source": "shared"
}
],
"missing_keys": [
"<string>"
],
"requirements_state": "known",
"unfilled_secrets": [
"<string>"
],
"revision": "<string>",
"apply_state": "applied",
"deployments": [
{
"installation_id": "<string>",
"cluster_id": "<string>",
"namespace": "<string>",
"deploy_status": "<string>",
"status": "applied"
}
],
"environment_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"tearing_down_count": 1
}{
"detail": "<string>"
}{
"detail": [
{
"loc": [
"<string>"
],
"msg": "<string>",
"type": "<string>"
}
]
}Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
Path Parameters
Query Parameters
Select exactly one organisation-owned environment. Omit only for legacy shared catalogue management or application-wide apply. Empty or repeated values are refused.
Response
Successful Response
An application's environment-secret surface: the Secrets the generated manifests read, the keys that have a value, the keys still missing one, whether Ankra could establish that at all, and whether the values that are stored have reached what is running.
The application's own Kubernetes Secret ("-env"). It is the primary name; secret_names is what a deploy actually seals.
The Kubernetes Secrets the deploy renders these keys into. A monorepo's component Deployments each read a Secret named after themselves, so this carries one per component that reads one; every other application carries exactly secret_name. Empty when the manifests read none of them - including whenever requirements_state is "unknown", where it is not a claim about the application at all.
Show child attributes
Show child attributes
Keys the manifests read that have no value yet. Read requirements_state first: an empty list means "nothing is missing" only under "known".
Whether the application's committed manifests could be read for the keys they take from the Secrets Ankra fills: "known" when they were, so missing_keys is exhaustive; "unknown" when no manifest is recorded yet, or when they read an env Secret this application's catalogue does not fill (unfilled_secrets names it). Under "unknown", missing_keys and each item's required flag are not claims about the application.
known, unknown The env-shaped Secrets the manifests read that are none of this application's - the diagnosis behind an "unknown" requirements_state. Recognition is by the "-env" convention alone, because an unresolved component Secret and a Secret the repository manages itself are the same string: a self-managed "-env" is therefore listed here and holds the application at "unknown". That is the deliberate direction - Ankra declines to certify a key list it cannot verify rather than reporting a monorepo as needing nothing, which is the defect requirements_state exists to end.
Revision of the returned effective catalogue, derived from key names and write timestamps. Deployment configuration and runtime readiness are separate observations.
The rolled-up answer: "applied" when every deployment carries the current values, "pending" when at least one does not, "unknown" when none is pending but at least one was never recorded, and "not_deployed" when the application is not deployed anywhere yet.
applied, pending, unknown, not_deployed The same answer per deployment.
Show child attributes
Show child attributes
The selected environment (cluster) identity; absent for the legacy shared catalogue.
Scoped installations currently being removed. Omitted when zero or for the legacy shared view.
x >= 0