GET /admin/migrations/:id/items/:itemId/value
Reveal the plaintext (or obfuscated) value of a discovered migration item. Auth:migration_reviewer permission + a recent step-up verification (5-minute window) made with a second factor and "action_scope": "secret.migration" (an authenticator-app code via POST /auth/2fa/verify-step-up, a passkey via POST /auth/passkey/verify-step-up, or a security key via POST /auth/2fa/webauthn/step-up-options then POST /auth/2fa/webauthn/verify-step-up). An emailed code does not count, and a verification made for another action does not satisfy this gate; a missing one answers 403 with "requires_step_up": true, "action_scope": "secret.migration" and "allowed_methods": ["passkey", "2fa"].
Class B reveal (since 2026-10-05). This action also passes the reveal chokepoint: the caller’s own membership must be Owner or Admin (an Admin also needs the Owner-granted migration_reviewer delegation, checked first), the ONE secret.migration verification is consumed by the chokepoint itself (one verification per action), the per-person reveal budget is charged (60 per 5 minutes: 429 reveal_budget_exceeded, or 503 reveal_budget_unavailable when it cannot be counted), and a plaintext.reveal audit entry is written before anything is decrypted or changed (503 reveal_audit_unavailable if it cannot be). A missing verification answers 403 with "code": "reveal_step_up_required", "requires_step_up": true, "action_scope": "secret.migration" and "allowed_methods": ["passkey", "2fa"].
By default returns an obfuscated value (first4••••last4 format). Append ?full=1 to receive the full plaintext — this is logged separately in the critical audit chain.
Every call to this endpoint writes a migration.item.reveal entry to audit_log_critical (throwing — the reveal is refused if the audit write fails). The tenant owner receives an email notification when the reviewer is a different user.
Response
?full=1: