Reveal Item Value

GET /admin/migrations/:id/items/:itemId/value

Reveal the plaintext (or obfuscated) value of a discovered migration item. Auth: migration_reviewer permission + a recent step-up verification (5-minute window) By default returns an obfuscated value (first4••••last4 format). Append ?full=1 to receive the full plaintext — this is logged separately in the critical audit chain. Every call to this endpoint writes a migration.item.reveal entry to audit_log_critical (throwing — the reveal is refused if the audit write fails). The tenant owner receives an email notification when the reviewer is a different user.

Response

{
  "id": "item-uuid",
  "value": "sk_live_••••••••••••••••••••••••••••••••Xz4q",
  "value_length": 51,
  "value_sha256_prefix": "a3f8c2e1b9d7f4a1",
  "mode": "obfuscated"
}

With ?full=1:

{
  "id": "item-uuid",
  "value": "sk_live_AbCdEfGhIjKlMnOpQrStUvWxYzAbCdEfGhIjKlMnOpQrStXz4q",
  "value_length": 51,
  "value_sha256_prefix": "a3f8c2e1b9d7f4a1",
  "mode": "full"
}

Cancel Migration

Approve Migration Item

Overview

Routes

Secrets

Clients

Environments

API Keys

Webhooks

Ephemeral Proxy

AI Gateway

Audit Logs

Account

Tenant KMS

Secret Store Migrations

GET /admin/migrations/:id/items/:itemId/value

Response

​GET /admin/migrations/:id/items/:itemId/value

​Response

GET /admin/migrations/:id/items/:itemId/value

Response