> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://platform.bctrl.ai/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://platform.bctrl.ai/_mcp/server.

# List secrets

> List safe metadata for Vault secrets without reading secret values.

List Vault secret metadata. This Tool never returns usernames, passwords,
values, or TOTP seeds.

## List secrets

```ts
const result = await bctrl.tools.call("vault.secrets.list", {
  prefix: "production/",
  hasTotp: true,
  limit: 50,
});

for (const secret of result.secrets) {
  console.log(secret.name, secret.type, secret.hasTotp);
}
```

Secret names use slash-separated segments made from letters, numbers, `.`, `_`,
`~`, and `-`.

## Request parameters

| Parameter | Type      | Required | Description                                        |
| --------- | --------- | -------- | -------------------------------------------------- |
| `prefix`  | `string`  | No       | Return names beginning with this prefix.           |
| `origin`  | `string`  | No       | Return secrets authorized for this exact origin.   |
| `hasTotp` | `boolean` | No       | Filter by whether a login has a TOTP seed.         |
| `cursor`  | `string`  | No       | Cursor returned by the previous page.              |
| `limit`   | `integer` | No       | Results per page. Defaults to `50`; maximum `200`. |

## Response

The result is `{ secrets, nextCursor }`:

| Field                      | Type                 | Always present | Description                                        |
| -------------------------- | -------------------- | -------------- | -------------------------------------------------- |
| `secrets[].name`           | `VaultSecretName`    | Yes            | Secret name.                                       |
| `secrets[].type`           | `"login" \| "value"` | Yes            | Stored secret shape.                               |
| `secrets[].label`          | `string`             | No             | Display label, when set.                           |
| `secrets[].origins`        | `string[]`           | No             | Exact allowed origins, when configured.            |
| `secrets[].originPatterns` | `string[]`           | No             | Allowed origin patterns, when configured.          |
| `secrets[].hasTotp`        | `boolean`            | Yes            | Whether a TOTP seed exists.                        |
| `secrets[].createdAt`      | `string`             | No             | Creation timestamp, when available.                |
| `secrets[].updatedAt`      | `string`             | No             | Update timestamp, when available.                  |
| `nextCursor`               | `string \| null`     | Yes            | Cursor for the next page, or `null` when complete. |

The Space's Vault access policy controls which secrets the caller can use. See
[Spaces](/sdk/spaces) for the allow and deny rules.

## Next

* [Get secret metadata](/sdk/tools/vault/vault-secrets-get) — inspect one secret
* [Set secret](/sdk/tools/vault/vault-secrets-set) — create or replace a secret
* [Spaces](/sdk/spaces) — configure Vault access