Get a secret reference
Fetch one secret reference (ciphertext metadata only; never the plaintext).
Authentication
AuthorizationBearer
WorkOS API key (Authorization: Bearer sk_…). Scope comes from the key’s permissions: a key carrying passport:admin has admin scope (full catalog CRUD), any other key has member scope (reads + access requests). Organization-owned keys are admin by ownership and carry no associated user; keys minted for a user carry theirs, which is what access requests and createdBy are attributed to.
Path parameters
secretReferenceId
Response headers
RateLimit-Limit
Requests allowed in the current window.
RateLimit-Remaining
Requests remaining in the current window.
RateLimit-Reset
Unix epoch seconds when the window resets.
Response
OK
data
The secret’s vaultKey is encrypted server-side and never returned. name is the only identifier.
Errors
401
Unauthorized Error
404
Not Found Error
429
Too Many Requests Error
500
Internal Server Error
503
Service Unavailable Error