> ## Documentation Index > Fetch the complete documentation index at: https://docs.ankra.ai/llms.txt > Use this file to discover all available pages before exploring further. # List Application Env Secrets > List the environment-secret keys of an application: which keys its generated manifests read out of the Secrets Ankra fills for it, which of them have a stored value, when each was last set, and - in requirements_state - whether those manifests could be read at all, so an empty missing_keys is never mistaken for a fully configured application. Values are never returned - there is no reveal endpoint on this surface, because a value the platform writes into a cluster Secret has no reason to travel back out. A browser session twin is mounted at the same path without the /api/v1 prefix (cookie authentication). ## OpenAPI ````yaml https://platform.ankra.app/openapi.json get /api/v1/org/applications/{application_id}/env-secrets openapi: 3.1.0 info: title: FastAPI version: 0.1.0 servers: - url: https://platform.ankra.app security: [] tags: - name: Clusters description: Create, inspect and manage clusters, and the stacks deployed on them. - name: Managed Clusters description: Provider-managed control planes, driven through one common surface. - name: Imported Clusters description: Clusters that already existed and were connected to Ankra. - name: Cluster Access description: Kubeconfigs, service-account tokens and per-cluster access grants. - name: Kubernetes description: Read and act on the Kubernetes objects inside a cluster. - name: DigitalOcean Clusters description: Provision and manage DigitalOcean Kubernetes clusters. - name: Hetzner Clusters description: Provision and manage Hetzner Kubernetes clusters. - name: OVH Clusters description: Provision and manage OVH Kubernetes clusters. - name: Scaleway Clusters description: Provision and manage Scaleway Kapsule clusters. - name: UpCloud Clusters description: Provision and manage UpCloud Kubernetes clusters. - name: Applications description: Deploy, configure and observe applications across the fleet. - name: Stack Profiles description: Reusable stack definitions, their versions and sharing. - name: Charts description: Browse the chart catalogue behind stacks and addons. - name: Helm description: Helm registries, credentials and the charts they expose. - name: Executions description: Long-running platform executions and their jobs. - name: Operations description: Cancel in-flight cluster operations and their jobs. - name: Chat description: Conversational sessions, plans and confirmable actions. - name: AI Agent Runs description: Autonomous agent runs and their outcomes. - name: AI Tickets description: The AI ticket board, its sync connections and settings. - name: AI Playbooks description: Reusable playbooks the AI lanes execute. - name: AI Conditions description: Conditions that gate AI autonomy. - name: AI Engineering Handoffs description: Work the AI lanes escalate to a human engineer. - name: AI Environment description: The environment and base stacks AI demos deploy into. - name: Security description: Findings, advisories, SBOMs, compliance and posture. - name: Cost description: Cluster and fleet cost, rate cards and cost settings. - name: Billing description: Subscription and spend caps. - name: Organisation description: Members, invitations, audit logs and organisation settings. - name: Account Tokens description: Personal access tokens for the API and CLI. - name: Credentials description: The shared credential store. - name: Azure Credentials description: Azure credentials and SSH keys. - name: DigitalOcean Credentials description: DigitalOcean credentials and SSH keys. - name: Hetzner Credentials description: Hetzner credentials and SSH keys. - name: OVH Credentials description: OVH credentials and SSH keys. - name: Scaleway Credentials description: Scaleway credentials. - name: UpCloud Credentials description: UpCloud credentials and SSH keys. - name: Data Source Credentials description: Credentials for metrics and log sources. - name: DNS Credentials description: Credentials for DNS providers. - name: DNS description: DNS zones and records, including custom organisation zones. - name: Cloudflare description: Cloudflare domains and the credentials behind them. - name: Variables description: Organisation- and cluster-scoped variables. - name: SOPS description: Encrypt and decrypt values with the organisation SOPS config. - name: Alerts description: Alert integrations and ingest credentials. - name: Notifications description: Notification routes and their delivery targets. - name: Support description: Support tickets. paths: /api/v1/org/applications/{application_id}/env-secrets: get: tags: - Applications summary: List Application Env Secrets description: >- List the environment-secret keys of an application: which keys its generated manifests read out of the Secrets Ankra fills for it, which of them have a stored value, when each was last set, and - in requirements_state - whether those manifests could be read at all, so an empty missing_keys is never mistaken for a fully configured application. Values are never returned - there is no reveal endpoint on this surface, because a value the platform writes into a cluster Secret has no reason to travel back out. A browser session twin is mounted at the same path without the /api/v1 prefix (cookie authentication). operationId: >- list_application_env_secrets_api_v1_org_applications__application_id__env_secrets_get parameters: - in: path name: application_id required: true schema: type: string title: Application Id - in: header name: authorization required: false schema: anyOf: - type: string - type: 'null' title: Authorization - in: header name: x-ankra-organisation-id required: false schema: anyOf: - type: string - type: 'null' title: X-Ankra-Organisation-Id responses: '200': content: application/json: schema: $ref: '#/components/schemas/ApplicationEnvSecrets' description: Successful Response '401': description: Unauthorized '404': content: application/json: schema: $ref: '#/components/schemas/DemoDetailError' description: Not found ("Application not found") '422': content: application/json: schema: $ref: '#/components/schemas/HTTPValidationError' description: Validation Error components: schemas: ApplicationEnvSecrets: description: >- An application's environment-secret surface: the Secrets the generated manifests read, the keys that have a value, the keys still missing one, whether Ankra could establish that at all, and whether the values that are stored have reached what is running. properties: secret_name: description: >- The application's own Kubernetes Secret ("-env"). It is the primary name; secret_names is what a deploy actually seals. title: Secret Name type: string secret_names: description: >- The Kubernetes Secrets the deploy renders these keys into. A monorepo's component Deployments each read a Secret named after themselves, so this carries one per component that reads one; every other application carries exactly secret_name. Empty when the manifests read none of them - including whenever requirements_state is "unknown", where it is not a claim about the application at all. items: type: string title: Secret Names type: array secrets: items: $ref: '#/components/schemas/ApplicationEnvSecretItem' title: Secrets type: array missing_keys: description: >- Keys the manifests read that have no value yet. Read requirements_state first: an empty list means "nothing is missing" only under "known". items: type: string title: Missing Keys type: array requirements_state: description: >- Whether the application's committed manifests could be read for the keys they take from the Secrets Ankra fills: "known" when they were, so missing_keys is exhaustive; "unknown" when no manifest is recorded yet, or when they read an env Secret this application's catalogue does not fill (unfilled_secrets names it). Under "unknown", missing_keys and each item's required flag are not claims about the application. enum: - known - unknown title: Requirements State type: string unfilled_secrets: description: >- The env-shaped Secrets the manifests read that are none of this application's - the diagnosis behind an "unknown" requirements_state. Recognition is by the "-env" convention alone, because an unresolved component Secret and a Secret the repository manages itself are the same string: a self-managed "-env" is therefore listed here and holds the application at "unknown". That is the deliberate direction - Ankra declines to certify a key list it cannot verify rather than reporting a monorepo as needing nothing, which is the defect requirements_state exists to end. items: type: string title: Unfilled Secrets type: array revision: description: >- Names the set of values catalogued right now. A deployment recorded as carrying this revision is running exactly these values. Derived from key names and write timestamps only - never from a value. title: Revision type: string apply_state: description: >- The rolled-up answer: "applied" when every deployment carries the current values, "pending" when at least one does not, "unknown" when none is pending but at least one was never recorded, and "not_deployed" when the application is not deployed anywhere yet. enum: - applied - pending - unknown - not_deployed title: Apply State type: string deployments: description: The same answer per deployment. items: $ref: '#/components/schemas/ApplicationEnvSecretDeployment' title: Deployments type: array required: - secret_name - secret_names - secrets - missing_keys - requirements_state - unfilled_secrets - revision - apply_state - deployments title: ApplicationEnvSecrets type: object DemoDetailError: description: >- The FastAPI-style detail envelope the demo routes use for 400/403/404/409/502 responses. properties: detail: type: string required: - detail type: object HTTPValidationError: properties: detail: items: $ref: '#/components/schemas/ValidationError' title: Detail type: array title: HTTPValidationError type: object ApplicationEnvSecretItem: description: >- One key of an application's -env Secret. The stored value is never part of this model - no endpoint on this surface returns one. properties: key: type: string title: Key required: description: >- True when the application's committed manifests read this key through a secretKeyRef. title: Required type: boolean status: description: >- "set" when the secret store holds a value for this key, "value_missing" when the value was removed out of band. enum: - set - value_missing title: Status type: string updated_at: title: Updated At type: string updated_by: anyOf: - type: string - type: 'null' title: Updated By required: - key - required - status - updated_at - updated_by title: ApplicationEnvSecretItem type: object ApplicationEnvSecretDeployment: description: >- One deployment of an application, and whether it is running the environment-secret values that are stored now. properties: installation_id: title: Installation Id type: string cluster_id: type: string title: Cluster Id namespace: title: Namespace type: string deploy_status: description: >- The installation's own deploy status (pending, deploying, healthy, degraded, failed). title: Deploy Status type: string status: description: >- Whether this deployment DECLARES the values the catalogue holds now (the cluster reconcile rolls the workload onto them from there). "applied" - the recorded revision is the current one. "pending" - a value was set, rotated or cleared since this deployment last sealed them, so it is running something else. "unknown" - nothing was ever recorded for this deployment, because it was deployed before the platform tracked the revision; that is not the same as "out of date" and is not reported as it. enum: - applied - pending - unknown title: Status type: string required: - installation_id - cluster_id - namespace - deploy_status - status title: ApplicationEnvSecretDeployment type: object ValidationError: properties: loc: items: anyOf: - type: string - type: integer title: Location type: array msg: title: Message type: string type: title: Error Type type: string required: - loc - msg - type title: ValidationError type: object ````