Describe one version (metadata; never the value).

GET

/v1/projects/{projectId}/secrets/{secretId}/versions/{versionId}

Code sample: Shell / cURL

curl --request GET \
  --url https://stratum.example.com/v1/projects/example/secrets/example/versions/example \
  --header 'Authorization: Bearer <token>'

• A Stratum cluster endpoint.

The version’s stage labels, kind, size and readability. Cedar-gated on secrets:ListSecretVersions (a version’s metadata is a subset of the listing). The value is GET.../value?version_id=.

Authorizations

• bearerAuth

Parameters

Path Parameters

projectId

required

string

/^p-[a-z0-9-]+$/

secretId

required

string

/^s-[a-z0-9]+$/

versionId

required

string

/^sv-[a-z0-9]+$/

Responses

200

The version.

Media typeapplication/json

One immutable version of a secret: which stage labels point at it, its kind and size. Never the value, never where the ciphertext lives.

object

id

required

sv-<base32>.

string

secretId

required

string

valueKind

required

string

Allowed values: string key_value_json

valueBytes

required

Plaintext length; the size the secrets.versions quota and the 64 KiB ceiling count.

integer

versionStages

required

CURRENT, PENDING, PREVIOUS (at most one version each per secret) plus any customer labels. An unlabeled version is the only kind that can be deleted.

Array<string>

unreadable

True when the drift pass (or a read) found the ciphertext missing or undecryptable. The version is kept — an unreadable value is not an absent one — and GET.../value answers 409 for it.

boolean

unreadableAt

string format: date-time

createdBy

string

createdAt

required

string format: date-time

Example

{
  "valueKind": "string"
}

403

Authenticated but not authorized.

Media typeapplication/problem+json

object

type

required

string format: uri

title

required

string

status

required

integer

>= 400 <= 599

detail

string

instance

string format: uri-reference

requestId

required

string

code

required

string

issues

The findings of a rejected IAM policy document (custom and resource policies).

Array<object>

One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.

object

code

required

The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.

string

statement

required

Index of the statement at fault; -1 for the document as a whole.

integer

>= -1

detail

required

string

action

The offending action, where one is at fault (ACTION_NOT_APPLICABLE).

string

errors

Field errors, for codes that carry them: each problem at its field (see FieldError). Documented on the responses that set it, e.g. approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED. Absent otherwise.

Array<object>

One field’s problem, the stage-2 installer API’s shape. field is the field’s path, message what is wrong with it.

object

field

required

The field’s path, e.g. links[0].interface, disks[1].confirm, mgmt.address or role; empty for the whole request.

string

message

required

string

details

Structured facts about the refusal, for codes that carry them. The shape is fixed per code and documented on the response that answers it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and IMAGE_IN_USE. Absent for codes that carry none.

object

key

additional properties

any

Example

{
  "issues": [
    {
      "code": "ACTION_NOT_APPLICABLE",
      "action": "compute:CreateVpc"
    }
  ]
}

404

Resource not found.

Media typeapplication/problem+json

object

type

required

string format: uri

title

required

string

status

required

integer

>= 400 <= 599

detail

string

instance

string format: uri-reference

requestId

required

string

code

required

string

issues

The findings of a rejected IAM policy document (custom and resource policies).

Array<object>

One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.

object

code

required

The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.

string

statement

required

Index of the statement at fault; -1 for the document as a whole.

integer

>= -1

detail

required

string

action

The offending action, where one is at fault (ACTION_NOT_APPLICABLE).

string

errors

Field errors, for codes that carry them: each problem at its field (see FieldError). Documented on the responses that set it, e.g. approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED. Absent otherwise.

Array<object>

One field’s problem, the stage-2 installer API’s shape. field is the field’s path, message what is wrong with it.

object

field

required

The field’s path, e.g. links[0].interface, disks[1].confirm, mgmt.address or role; empty for the whole request.

string

message

required

string

details

Structured facts about the refusal, for codes that carry them. The shape is fixed per code and documented on the response that answers it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and IMAGE_IN_USE. Absent for codes that carry none.

object

key

additional properties

any

Example

{
  "issues": [
    {
      "code": "ACTION_NOT_APPLICABLE",
      "action": "compute:CreateVpc"
    }
  ]
}