Skip to the content

Read the state of the Organization's tool signing secret

GET /v1/tool-signing-secret

Property	Value
Operation	`get_tool_signing_secret`
Group	Tools
Scope	`tools:read`
Route class	`read`
Idempotency	No `Idempotency-Key`
Audit	Not audited: A configuration read that never answers the secret.
Released in	1.50.0
Phase 0 host	Served (the hosted api pins 1.65.0)

Answers whether a tool signing secret exists, its hint, when it was minted and last rotated, and until when the previous secret keeps signing (1.50.0). It never answers a secret: only the rotation does, once.

Request

Set VOCAL_API to the base URL of your API and VOCAL_API_KEY to an API key with the tools:read scope (Authentication and keys). Replace each placeholder, such as agt_... or <name>, with your own value.

curl "$VOCAL_API/v1/tool-signing-secret" \
  -H "Authorization: Bearer $VOCAL_API_KEY"

const response = await fetch(`${process.env.VOCAL_API}/v1/tool-signing-secret`, {
  headers: {
    Authorization: `Bearer ${process.env.VOCAL_API_KEY}`,
  },
});
console.log(response.status, await response.text());

import os

import requests

response = requests.get(
    f"{os.environ['VOCAL_API']}/v1/tool-signing-secret",
    headers={
        "Authorization": f"Bearer {os.environ['VOCAL_API_KEY']}",
    },
)
print(response.status_code, response.text)

Responses

Status	Content type	Shape	Error codes
`200`	`application/json`	ToolSigningSecretState
`400`	`application/json`	ErrorEnvelope	`invalid_request`
`401`	`application/json`	ErrorEnvelope	`unauthenticated`
`403`	`application/json`	ErrorEnvelope	`forbidden`
`429`	`application/json`	ErrorEnvelope	`rate_limited`
`500`	`application/json`	ErrorEnvelope	`internal_error`

Fields of the `200` answer

The shape is ToolSigningSecretState.

Field	Type	Required	Description
`created_at`	Timestamp or null	yes	When the current secret was minted, by the api or a rotation; null when none exists.
`exists`	boolean	yes	Whether the Organization has a tool signing secret yet; the api mints the first when it first needs one (the first `http` Tool create, test or Call), so a new Organization has none.
`object`	`"tool_signing_secret"`	yes
`previous_secret_expires_at`	Timestamp or null	yes	When the previous secret stops signing, or null when none does.
`previous_secret_hint`	string or null	yes	The last four characters of the secret that keeps signing through the rotation window, or null when none does.
`rotated_at`	Timestamp or null	yes	When POST `/v1/tool-signing-secret/rotate` last rotated it; null when it was never rotated, so the current secret is the one the api minted and never showed.
`secret_hint`	string or null	yes	The last four characters of the current secret; null when none exists.