GET /workspaces/{id}/secret-rotation — read the register (owner/admin).

GET

/api/workspaces/{id}/secret-rotation

curl --request GET \
  --url https://example.com/api/workspaces/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/secret-rotation \
  --cookie supacloud_session=<supacloud_session>

Authorizations

• cookie_auth

Parameters

Path Parameters

id

required

string format: uuid

Workspace ID whose rotation register to read

Responses

200

The workspace’s rotation register (names, paths and due dates; never a value)

Media typeapplication/json

Array<object>

object

created_at

required

string format: date-time

excluded

required

Deny-wins: an excluded entry is never due.

boolean

excluded_reason

string | null

id

required

string format: uuid

interval_days

required

Rotation cadence in days (1..=3650).

integer format: int32

key

required

The secret’s NAME, never its value.

string

last_pr_url

The last dispatch trail (the PR URL), never a diff or content.

string | null

last_rotated_at

string | null format: date-time

next_due_at

required

string format: date-time

origin

required

Where the secret comes from: sops | openbao | stripe | gcp | b2 | approle | mailcow.

string

overlap_required

required

Whether the new value must overlap the old one during the roll.

boolean

target_ref

required

A PATH, never a value (e.g. pharmhub/platform/runtime/*).

string

updated_at

required

string format: date-time

workspace_id

required

string format: uuid

Example^generated

[
  {
    "created_at": "2026-04-15T12:00:00Z",
    "excluded": true,
    "excluded_reason": "example",
    "id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
    "interval_days": 1,
    "key": "example",
    "last_pr_url": "example",
    "last_rotated_at": "2026-04-15T12:00:00Z",
    "next_due_at": "2026-04-15T12:00:00Z",
    "origin": "example",
    "overlap_required": true,
    "target_ref": "example",
    "updated_at": "2026-04-15T12:00:00Z",
    "workspace_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0"
  }
]

401

Authentication required

Media typeapplication/json

The canonical JSON body of every error response — the single source of truth the frontend binds to. Every AppError serializes as this exact shape, and the generated OpenAPI component ApiErrorBody (with its ErrorCode enum) is what the frontend error schema is generated from, so there is no hand-written error schema on either end.

object

code

required

Machine-readable, stable error code.

string

Allowed values: not_found unauthorized forbidden license_required license_expired bad_request unprocessable precondition_failed conflict method_not_allowed rate_limited too_many_requests quota_exceeded database_error docker_error vault_error internal_error

details

One of:

null

null

object

Present only on a quota-exceeded 403 — the inline upgrade-CTA payload.

object

key

required

The entitlement feature key that was hit, e.g. apps.max_count.

string

limit

required

The plan’s limit for this key.

integer format: int64

upgrade_url

required

Where to send the user to upgrade.

string

used

required

Current usage (count or bytes, per the key).

integer format: int64

error

required

Human-readable message (the server’s English text; the client may localize by code).

string

Example

{
  "code": "not_found"
}

403

Permission denied

Media typeapplication/json

The canonical JSON body of every error response — the single source of truth the frontend binds to. Every AppError serializes as this exact shape, and the generated OpenAPI component ApiErrorBody (with its ErrorCode enum) is what the frontend error schema is generated from, so there is no hand-written error schema on either end.

object

code

required

Machine-readable, stable error code.

string

Allowed values: not_found unauthorized forbidden license_required license_expired bad_request unprocessable precondition_failed conflict method_not_allowed rate_limited too_many_requests quota_exceeded database_error docker_error vault_error internal_error

details

One of:

null

null

object

Present only on a quota-exceeded 403 — the inline upgrade-CTA payload.

object

key

required

The entitlement feature key that was hit, e.g. apps.max_count.

string

limit

required

The plan’s limit for this key.

integer format: int64

upgrade_url

required

Where to send the user to upgrade.

string

used

required

Current usage (count or bytes, per the key).

integer format: int64

error

required

Human-readable message (the server’s English text; the client may localize by code).

string

Example

{
  "code": "not_found"
}

500

Structured server error

Media typeapplication/json

The canonical JSON body of every error response — the single source of truth the frontend binds to. Every AppError serializes as this exact shape, and the generated OpenAPI component ApiErrorBody (with its ErrorCode enum) is what the frontend error schema is generated from, so there is no hand-written error schema on either end.

object

code

required

Machine-readable, stable error code.

string

Allowed values: not_found unauthorized forbidden license_required license_expired bad_request unprocessable precondition_failed conflict method_not_allowed rate_limited too_many_requests quota_exceeded database_error docker_error vault_error internal_error

details

One of:

null

null

object

Present only on a quota-exceeded 403 — the inline upgrade-CTA payload.

object

key

required

The entitlement feature key that was hit, e.g. apps.max_count.

string

limit

required

The plan’s limit for this key.

integer format: int64

upgrade_url

required

Where to send the user to upgrade.

string

used

required

Current usage (count or bytes, per the key).

integer format: int64

error

required

Human-readable message (the server’s English text; the client may localize by code).

string

Example

{
  "code": "not_found"
}