Skip to main content
GET
Get secret by ID
Retrieves a secret’s full metadata — type, target, configuration, last-rotation status, heartbeat status, permissions. Does NOT return the actual password value — use GET /api/secrets/{id}/password for credentials.
For ACB deployments updated from a version prior to 1.2, switch to the https://{hostname}/EkranACB server in the Playground.

Where to get the Secret ID

The Secret ID is visible on the Automation tab of the Edit Secret page — see Find the Secret ID.

Permissions required

The user owning the Access Token must have at least PAM User role on the secret.

New fields in v1.4

The response now includes five password-status fields beyond the v1.3 baseline:
  • check_password — heartbeat configuration (CheckPassword)
  • check_password_status — last heartbeat result (PasswordCheckStatus)
  • last_password_check_utc — when the last heartbeat ran
  • password_rotation_status — current rotation state (PasswordRotationStatus)
  • last_password_rotation_utc — when the password was last rotated

Errors

See Status codes. Common errors:
  • 403 Forbidden — user lacks at least PAM User role.
  • 404 Not Found — secret doesn’t exist or isn’t visible.

Get secret credentials

Retrieve the actual password value.

Add secret

Create a new secret.

Heartbeat

Trigger a password validity check.

Data models

SecretPasswordlessResponseDto schema.

Authorizations

Authorization
string
header
required

Access token for authentication

Path Parameters

id
integer<int32>
required

The ID of the secret to retrieve

Required range: x >= 1

Response

Secret retrieved successfully

id
integer<int32>
required

Unique identifier of the secret

name
string
required

Name of the secret

type
enum<string>
required

Type of secret

Available options:
None,
UnixAccountSSH,
UnixAccountTelnet,
WindowsAccount,
ADAccount,
WebAccount,
MSSQLAccount
login
string
required

Login username

description
string

Description of the secret

parent_folder_id
integer<int32>

ID of the parent folder

domain
string

Domain for AD accounts

computer_name
string

Computer name for Windows/Unix accounts

url
string

URL for web accounts

server
string

Server for database accounts

computers
string[]

List of computers

file_transfer
object
rotation
object
record_activities
boolean

Whether to record activities for this secret

check_out
object
require_approval
object
permissions
object
check_password
object
check_password_status
enum<string>

Status of the last password check (heartbeat)

Available options:
None,
Valid,
Invalid,
Failed
last_password_check_utc
string<date-time> | null

UTC timestamp of the last password check

password_rotation_status
enum<string>

Status of password rotation

Available options:
Disabled,
Enabled,
Failed
last_password_rotation_utc
string<date-time> | null

UTC timestamp of the last password rotation