Check an external secret

Enterprise. Read an external secret once from its store, drop the value, and record whether it could be read on the secret’s health. The value is never returned. A store that refuses or has nothing there is an answer, not an error: 200 with health.status: unreachable and a reason. Anlyon also runs this check on its own, once a day per external secret, and records the answer whenever a dispatch reads one. A secret that is not external answers 400.

POST/api/v2/secrets/{name}/check

Authorization

AuthorizationBearer token (Anlyon API key) · headerrequired

Workspace API key sent as Authorization: Bearer <key>.

better-auth.session_tokenAPI key · cookierequired

Browser session used by dashboard-only operations.

Path parameters

namestringrequired

The external secret's name.

min length 1 · max length 100 · matches ^[A-Z0-9_]+$

Header parameters

X-Request-Idstring

Optional caller correlation ID. Unsafe or oversized values are replaced.

max length 128

Responses

200

Secret metadata returned; the value is never exposed.

successbooleanrequired

Allowed:true

dataSecretrequired

Secret metadata. The encrypted value is never exposed by any API.

Show properties

idstringrequired

namestringrequired

matches ^[A-Z0-9_]+$

descriptionstring | nullrequired

allowedHostsstring[] | nullrequired

Hosts this secret may be sent to. Null means any public host.

allowedPlacementsstring[] | nullrequired

Where in the request this secret may appear. Null means anywhere.

kindstringrequired

static holds a value you stored. connection is a connected account: its value is an access token fetched at dispatch, its hosts come from the integration, and it may only appear in a header. external (Enterprise) is read at dispatch from one of the environment's secret stores and is not stored by Anlyon. PUT cannot change a secret's kind.

Allowed:staticconnectionexternal

connectionobject | nullrequired

For a signed-in account, which integration it is and whether it still works. status mirrors health.status, which is the one record of it for both kinds of connected account. Null for a static secret, including one connected with an API key.

Show properties

integrationIdstringrequired

statusstringrequired

The same value as health.status. Reconnect the account to use it again.

Allowed:activeneeds_reauth

healthobject | nullrequired

Whether the connected account still works, whichever way it was connected. active, or needs_reauth with a reason once the provider refused the credential or the connector service could not refresh it. A dispatch that uses a needs_reauth account fails before anything is sent. Reconnect it with POST /api/v2/connections/{secretName}/reconnect. For an external secret, whether its store could last produce it: active, or unreachable with a reason. Null for a secret you stored directly, which Anlyon cannot check.

Show properties

statusstringrequired

Allowed:activeneeds_reauthunreachable

checkedAtstring<date-time> | nullrequired

When Anlyon last asked the provider whether the credential works. Null when it never has.

reasonstring | nullrequired

Set while status is needs_reauth or unreachable. key_rejected: the provider refused the stored key. access_revoked: the provider no longer honours the signed-in account's grant. refresh_failed: the connector service could not refresh its token. store_unreachable: the secret store did not answer. store_denied: the store refused Anlyon's credential for this path. reference_not_found: the store has no secret at that path, version or key.

Allowed:key_rejectedaccess_revokedrefresh_failedstore_unreachablestore_deniedreference_not_foundnull

integrationIdstring | nullrequired

The integration this secret was connected for, by signing in or with an API key. Null for a secret you stored directly. A secret connected with an API key is static with this set.

externalobject | nullrequired

For an external secret, the store and where in it. Never a value. Null otherwise.

Show properties

storestringrequired

storeTypestringrequired

Allowed:aws_secrets_managerhashicorp_vault

pathstringrequired

keystring | nullrequired

versionstring | nullrequired

lastUsedAtstring<date-time> | nullrequired

createdAtstring<date-time>required

updatedAtstring<date-time>required

400

Bad Request - Invalid input data

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

fixErrorFix

How to get past this error, for a person or an agent. Present on refusals with a known next step, such as a missing scope or role, a plan or billing limit, a halted environment, or a missing secret, connected account, OAuth app or end-user header. Absent when there is no fix to give. Kept in production responses, unlike details.

Show properties

summarystringrequired

One sentence that says what to do.

commandstring

An exact anlyon CLI command that fixes it. Absent when no command does.

urlstring<uri>

An absolute console link where a person fixes it.

docsstring<uri>

A docs page that explains it.

401

Unauthorized - Invalid or missing API key

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

fixErrorFix

Show properties

summarystringrequired

One sentence that says what to do.

commandstring

An exact anlyon CLI command that fixes it. Absent when no command does.

urlstring<uri>

An absolute console link where a person fixes it.

docsstring<uri>

A docs page that explains it.

403

Authenticated credential lacks the required scope or workspace access.

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

fixErrorFix

Show properties

summarystringrequired

One sentence that says what to do.

commandstring

An exact anlyon CLI command that fixes it. Absent when no command does.

urlstring<uri>

An absolute console link where a person fixes it.

docsstring<uri>

A docs page that explains it.

404

Not Found - Resource does not exist

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

fixErrorFix

Show properties

summarystringrequired

One sentence that says what to do.

commandstring

An exact anlyon CLI command that fixes it. Absent when no command does.

urlstring<uri>

An absolute console link where a person fixes it.

docsstring<uri>

A docs page that explains it.

429

Too Many Requests - Rate limit exceeded. A workspace's API requests are limited per minute and per UTC clock hour by plan; Retry-After says when to try again, and an hourly refusal names the limit and when the count resets. Successful responses carry the same limits in X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset (the minute) and X-RateLimit-Limit-Hour, X-RateLimit-Remaining-Hour, X-RateLimit-Reset-Hour (the hour).

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

fixErrorFix

Show properties

summarystringrequired

One sentence that says what to do.

commandstring

An exact anlyon CLI command that fixes it. Absent when no command does.

urlstring<uri>

An absolute console link where a person fixes it.

docsstring<uri>

A docs page that explains it.

501

This edition does not include secret stores (SECRET_STORES_UNAVAILABLE).

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

fixErrorFix

Show properties

summarystringrequired

One sentence that says what to do.

commandstring

An exact anlyon CLI command that fixes it. Absent when no command does.

urlstring<uri>

An absolute console link where a person fixes it.

docsstring<uri>

A docs page that explains it.

Try it

Server

Base URLCustom base URLOverrides the selected server when set.

Authorization

Bearer token (Anlyon API key)Remember on this deviceInclude my values in samples

Parameters

X-Request-IdheaderOptional caller correlation ID. Unsafe or oversized values are replaced.namepath*The external secret's name.

Request

curl -X POST 'https://api.anlyon.com/api/v2/secrets/string/check' \
  -H 'Authorization: Bearer YOUR_TOKEN'

const response = await fetch("https://api.anlyon.com/api/v2/secrets/string/check", {
  method: "POST",
  headers: {
    "Authorization": "Bearer YOUR_TOKEN"
  }
});

import requests

response = requests.post(
    "https://api.anlyon.com/api/v2/secrets/string/check",
    headers={
        "Authorization": "Bearer YOUR_TOKEN"
    },
)

Response

{
  "success": true,
  "data": {
    "id": "sec_01JABCDEF",
    "name": "string",
    "description": "string",
    "allowedHosts": [
      "string"
    ],
    "allowedPlacements": [
      "url"
    ],
    "kind": "static",
    "connection": {
      "integrationId": "hubspot",
      "status": "active"
    },
    "health": {
      "status": "active",
      "checkedAt": "2019-08-24T14:15:22Z",
      "reason": "key_rejected"
    },
    "integrationId": "github",
    "external": {
      "store": "prod-vault",
      "storeType": "aws_secrets_manager",
      "path": "payments/stripe",
      "key": "apiKey",
      "version": "string"
    },
    "lastUsedAt": "2019-08-24T14:15:22Z",
    "createdAt": "2019-08-24T14:15:22Z",
    "updatedAt": "2019-08-24T14:15:22Z"
  }
}

{
  "success": false,
  "error": {
    "code": "VALIDATION_ERROR",
    "message": "Invalid request data",
    "details": {
      "url": "Invalid URL format"
    }
  }
}

{
  "success": false,
  "error": {
    "code": "AUTHENTICATION_ERROR",
    "message": "Invalid or missing API key"
  }
}

{
  "success": false,
  "requestId": "req_0123456789abcdef0123456789abcdef",
  "error": {
    "code": "VALIDATION_ERROR",
    "message": "Invalid request data",
    "details": {},
    "fix": {
      "summary": "Log in again and approve the anlyon:secrets consent group, which grants secrets:write.",
      "command": "anlyon auth login --scope anlyon:secrets",
      "url": "https://console.anlyon.com/settings/api-keys",
      "docs": "https://docs.anlyon.com/cli/authentication"
    }
  }
}

{
  "success": false,
  "error": {
    "code": "NOT_FOUND",
    "message": "Resource not found"
  }
}

{
  "success": false,
  "error": {
    "code": "RATE_LIMIT_EXCEEDED",
    "message": "Rate limit exceeded. Please try again later."
  }
}

{
  "success": false,
  "requestId": "req_0123456789abcdef0123456789abcdef",
  "error": {
    "code": "VALIDATION_ERROR",
    "message": "Invalid request data",
    "details": {},
    "fix": {
      "summary": "Log in again and approve the anlyon:secrets consent group, which grants secrets:write.",
      "command": "anlyon auth login --scope anlyon:secrets",
      "url": "https://console.anlyon.com/settings/api-keys",
      "docs": "https://docs.anlyon.com/cli/authentication"
    }
  }
}