# dev.knotless.listSecrets

> The secrets dev.knotless.putSecret left for a repository, by name. Its owner, and an admin who joined the organization that owns it, sees every one, with the value only of those sealed to it, as a runner that logs in as the owner or that admin. A runner sees those sealed to it, with the sealed value, to open with its key; anyone else, none. Requires a service token from the caller's PDS, audience the appview's DID, for this method, or the appview's own pages' login, as their writes take it.

- Kind: query
- Authority: knotless.dev
- Lexicon: 1
- Published by [lexicons.knotless.dev](https://lexicon.garden/identity/did:plc:yqsg7znbbhfmj3a2nrpnaerk), the NSID's authority

## Links

- [Documentation](https://lexicon.garden/lexicon/did:plc:yqsg7znbbhfmj3a2nrpnaerk/dev.knotless.listSecrets)
- [Schema JSON](https://lexicon.garden/lexicon/did:plc:yqsg7znbbhfmj3a2nrpnaerk/dev.knotless.listSecrets/schema.json)
- [Analytics](https://lexicon.garden/lexicon/did:plc:yqsg7znbbhfmj3a2nrpnaerk/dev.knotless.listSecrets/analytics)

## Query (`dev.knotless.listSecrets`)

Type: query · GET

### Parameters (query string)

- `owner` (string · did, required): The repository's owner.
- `repo` (string, required): The repository's key, as its dev.knotless.repo record holds it.
  - Constraints: maxLength: 32

### Output (application/json)

- `secrets` (array, required)
  - `items` (ref)
    - Reference: `#secret`

## #refPattern (`dev.knotless.listSecrets#refPattern`)

Type: object

Refs a secret reaches: a ref, or a prefix ending in *.

### Properties

- `pattern` (string, required): As a trigger's `refs` match: refs/heads/main, or refs/tags/v*.
  - Constraints: maxLength: 256

## #secret (`dev.knotless.listSecrets#secret`)

Type: object

A secret left for a repository with one runner.

### Properties

- `key` (string · did, required): The runner's key it is sealed to, a did:key.
- `name` (string, required): The secret's name, as a workflow's `secrets` lists it.
  - Constraints: maxLength: 64
- `refs` (array): The refs whose pushes it reaches; absent for every push.
  - Constraints: maxLength: 16
  - `items` (ref)
    - Reference: `#refPattern`
- `runner` (string · did, required): The runner it is sealed to.
- `sealed` (bytes): The sealed value: only to the runner it is sealed to.
  - Constraints: maxLength: 16465
- `updatedAt` (string · datetime, required): When it was last put.

## Schema

```json
{
  "$type": "com.atproto.lexicon.schema",
  "defs": {
    "main": {
      "description": "The secrets dev.knotless.putSecret left for a repository, by name. Its owner, and an admin who joined the organization that owns it, sees every one, with the value only of those sealed to it, as a runner that logs in as the owner or that admin. A runner sees those sealed to it, with the sealed value, to open with its key; anyone else, none. Requires a service token from the caller's PDS, audience the appview's DID, for this method, or the appview's own pages' login, as their writes take it.",
      "output": {
        "encoding": "application/json",
        "schema": {
          "properties": {
            "secrets": {
              "items": {
                "ref": "#secret",
                "type": "ref"
              },
              "type": "array"
            }
          },
          "required": [
            "secrets"
          ],
          "type": "object"
        }
      },
      "parameters": {
        "properties": {
          "owner": {
            "description": "The repository's owner.",
            "format": "did",
            "type": "string"
          },
          "repo": {
            "description": "The repository's key, as its dev.knotless.repo record holds it.",
            "maxLength": 32,
            "type": "string"
          }
        },
        "required": [
          "owner",
          "repo"
        ],
        "type": "params"
      },
      "type": "query"
    },
    "refPattern": {
      "description": "Refs a secret reaches: a ref, or a prefix ending in *.",
      "properties": {
        "pattern": {
          "description": "As a trigger's `refs` match: refs/heads/main, or refs/tags/v*.",
          "maxLength": 256,
          "type": "string"
        }
      },
      "required": [
        "pattern"
      ],
      "type": "object"
    },
    "secret": {
      "description": "A secret left for a repository with one runner.",
      "properties": {
        "key": {
          "description": "The runner's key it is sealed to, a did:key.",
          "format": "did",
          "type": "string"
        },
        "name": {
          "description": "The secret's name, as a workflow's `secrets` lists it.",
          "maxLength": 64,
          "type": "string"
        },
        "refs": {
          "description": "The refs whose pushes it reaches; absent for every push.",
          "items": {
            "ref": "#refPattern",
            "type": "ref"
          },
          "maxLength": 16,
          "type": "array"
        },
        "runner": {
          "description": "The runner it is sealed to.",
          "format": "did",
          "type": "string"
        },
        "sealed": {
          "description": "The sealed value: only to the runner it is sealed to.",
          "maxLength": 16465,
          "type": "bytes"
        },
        "updatedAt": {
          "description": "When it was last put.",
          "format": "datetime",
          "type": "string"
        }
      },
      "required": [
        "name",
        "runner",
        "key",
        "updatedAt"
      ],
      "type": "object"
    }
  },
  "id": "dev.knotless.listSecrets",
  "lexicon": 1
}
```