Get a secret

GET

projects

{projectId}

secrets

{secretId}

Get a secret

curl --request GET \
  --url https://app.mcpjam.com/api/v1/projects/{projectId}/secrets/{secretId} \
  --header 'Authorization: Bearer <token>'

import requests

url = "https://app.mcpjam.com/api/v1/projects/{projectId}/secrets/{secretId}"

headers = {"Authorization": "Bearer <token>"}

response = requests.get(url, headers=headers)

print(response.text)

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://app.mcpjam.com/api/v1/projects/{projectId}/secrets/{secretId}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://app.mcpjam.com/api/v1/projects/{projectId}/secrets/{secretId}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://app.mcpjam.com/api/v1/projects/{projectId}/secrets/{secretId}"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://app.mcpjam.com/api/v1/projects/{projectId}/secrets/{secretId}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "id": "<string>",
  "projectId": "<string>",
  "name": "<string>",
  "description": "<string>",
  "delivery": "brokered",
  "sharing": "user",
  "lastDeliveredAt": 123,
  "createdAt": 123,
  "updatedAt": 123,
  "createdByUserId": "<string>",
  "updatedByUserId": "<string>",
  "brokerHosts": [
    "<string>"
  ],
  "brokerHeader": "<string>",
  "brokerTemplate": "<string>",
  "ownerUserId": "<string>"
}

Authorizations

Authorization

string

header

required

MCPJam API key (sk_…). Create one at Settings → API keys. Guest sessions cannot use the API, and API keys cannot manage other API keys.

Path Parameters

projectId

string

required

ID of the hosted project that contains the server.

secretId

string

required

Secret ID, as returned by the project's secret list.

Response

The secret, as metadata.

A project credential — METADATA ONLY, always. There is no value field on this schema and no route that returns one: a secret is written and delivered into a run, never read back.

string

required

projectId

string

required

name

string

required

The environment-variable name (^[A-Z_][A-Z0-9_]*$). This IS the secret's identity: what a materialized delivery exports, what a workflow references, and what stays stable across a rotation. Immutable.

description

string | null

required

delivery

enum<string>

required

brokered — the sandbox's egress proxy injects the value as a request header OUTSIDE the VM, so the box never holds it. Prevents EXTRACTION, not USE: any process in the box can call the bound host while the policy is live, and it works for HTTPS APIs only (domain rules bind on ports 80/443). materialized — a real environment variable inside the box, which is the only thing a CLI can read; EXTRACTABLE BY DESIGN.

Available options:

brokered,

materialized

project — admin-managed, delivered to every member's sessions. user — personal, delivered ONLY in sessions its owner starts and silently absent from anyone else's run of the same environment. Immutable.

Available options:

user,

project

lastDeliveredAt

integer | null

required

When this secret was last HANDED TO a run — not when it was last used. Brokered use is unobservable by construction (the proxy injects the header; the request is never seen here), so used would be a number nobody can honestly produce. null means nothing has been recorded, which is not the same as never delivered.

createdAt

integer

required

updatedAt

integer

required

createdByUserId

string

required

updatedByUserId

string

required

brokerHosts

string[]

Brokered only: the exact hostnames the header is injected on.

brokerHeader

string

Brokered only: the header name.

brokerTemplate

string

Brokered only: the header value, with {} where the secret goes.

ownerUserId

string

Personal secrets only. Project-shared rows have no owner.

⌘I

Get a secret

curl --request GET \
  --url https://app.mcpjam.com/api/v1/projects/{projectId}/secrets/{secretId} \
  --header 'Authorization: Bearer <token>'

import requests

url = "https://app.mcpjam.com/api/v1/projects/{projectId}/secrets/{secretId}"

headers = {"Authorization": "Bearer <token>"}

response = requests.get(url, headers=headers)

print(response.text)

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://app.mcpjam.com/api/v1/projects/{projectId}/secrets/{secretId}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://app.mcpjam.com/api/v1/projects/{projectId}/secrets/{secretId}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://app.mcpjam.com/api/v1/projects/{projectId}/secrets/{secretId}"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://app.mcpjam.com/api/v1/projects/{projectId}/secrets/{secretId}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "id": "<string>",
  "projectId": "<string>",
  "name": "<string>",
  "description": "<string>",
  "delivery": "brokered",
  "sharing": "user",
  "lastDeliveredAt": 123,
  "createdAt": 123,
  "updatedAt": 123,
  "createdByUserId": "<string>",
  "updatedByUserId": "<string>",
  "brokerHosts": [
    "<string>"
  ],
  "brokerHeader": "<string>",
  "brokerTemplate": "<string>",
  "ownerUserId": "<string>"
}

API Guides

Endpoints

Authorizations

Path Parameters

Response