API Reference · Secrets
Read a granted secret's value (workspace agents only)
**Agent-only.** The one endpoint that returns a stored value — the deliberate, tightly-scoped exception to the write-only rule, for VM daemons that can't mount the workspace Secret. The caller must authenticate as the workspace's `agent-sa` ServiceAccount (the projected token every daemon/master pod mounts); human sessions and `llc_` API keys get 403 — humans consume secrets through workload env instead. The path must additionally be GRANTED: some workload in the workspace must reference it via `pod.secretEnv`. Ungranted paths are 403 even for agents.
GET/v1/tenants/{name}/secrets/value
Authorization
x-api-keystringrequired
Your per-workspace API key, e.g. llc_AbC123…. Also accepted as Authorization: Bearer <key>. Mint keys on your workspace's API keys page — each key belongs to one workspace.
Path parameters
namestringrequired
Workspace (tenant) name.
Response
200 — The granted secret's value.
pathstring
valuestring
curl https://api.live-llm.com/v1/tenants/acme/secrets/value \ -H "x-api-key: $LIVELLM_KEY"
Try itGEThttps://api.live-llm.com/v1/tenants/{name}/secrets/value
Fill required path param: name.
Example response200
{
"path": "/prod/tg-bot-token",
"value": "7301234567:AAFxDummyTokenValue"
}