> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://platform.bctrl.ai/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://platform.bctrl.ai/_mcp/server.

# Get secret metadata

> Get safe metadata for one Vault secret.

Get metadata for one Vault secret without reading its username, password, value,
or TOTP seed.

## Get metadata

```ts
const secret = await bctrl.tools.call("vault.secrets.get", {
  name: "production/github/api-token",
});

console.log(secret.type, secret.origins, secret.hasTotp);
```

## Request parameters

| Parameter | Type              | Required | Description                                                                                                      |
| --------- | ----------------- | -------- | ---------------------------------------------------------------------------------------------------------------- |
| `name`    | `VaultSecretName` | Yes      | Secret name made from slash-separated letters, numbers, `.`, `_`, `~`, and `-` segments. Maximum 256 characters. |

## Response

| Field            | Type                 | Always present | Description                               |
| ---------------- | -------------------- | -------------- | ----------------------------------------- |
| `name`           | `VaultSecretName`    | Yes            | Secret name.                              |
| `type`           | `"login" \| "value"` | Yes            | Stored secret shape.                      |
| `label`          | `string`             | No             | Display label, when set.                  |
| `origins`        | `string[]`           | No             | Exact allowed origins, when configured.   |
| `originPatterns` | `string[]`           | No             | Allowed origin patterns, when configured. |
| `hasTotp`        | `boolean`            | Yes            | Whether a TOTP seed exists.               |
| `createdAt`      | `string`             | No             | Creation timestamp, when available.       |
| `updatedAt`      | `string`             | No             | Update timestamp, when available.         |

This Tool never exposes secret values. Use [Read secret value](/sdk/tools/vault/vault-secrets-value)
only when raw reads are authorized by the Space Vault policy.

## Next

* [Read secret value](/sdk/tools/vault/vault-secrets-value) — read an authorized value
* [Update secret](/sdk/tools/vault/vault-secrets-update) — change metadata or credentials
* [Spaces](/sdk/spaces) — configure Vault access