The secret coverage matrix (ADR-0037) - names + status, never values

GET

/v1/repos/{org}/{repo}/secrets/matrix

Names + status only, never values — the same Administer capability as listing secrets. This is the read model behind the Project Secrets editor, which writes through the scoped /v1/secrets endpoints.

Responses

200

Media typeapplication/json

GET /v1/repos/{org}/{repo}/secrets/matrix body: the advisory coverage view (ADR-0037 D) and — since ADR-0060 — the model behind the editor for repo- and environment-scoped values. For each key, its effective status per column after inheritance; never a value.

object

columns

required

Column ids in render order: [REPO_DEFAULT_COLUMN] first (the repo-scope default that the environments fall through to), then each environment.

Array<string>

environments

required

The repo’s environments, in column order. A subset of columns — kept separate so a client can tell an environment column from the repo one without reasoning about the reserved id.

Array<string>

keys

required

Array<object>

object

inherited_from

required

For each inherited cell, the scope it resolves from — "repo" or "org". Lets a cell say what it would be overriding, so an edit reads as “override the repo default” rather than an unexplained write.

object

key

additional properties

string

key

required

string

status

required

column id -> "set" | "inherited" | "unset" | "silenced".

set = a value lives at exactly that scope · inherited = none here, but it resolves from a broader scope · unset = resolves to nothing · silenced = unset on purpose (an ADR-0037 marker). Only a genuinely unset cell can be silenced: a marker never hides a real value.

object

key

additional properties

string

Example^generated

{
  "columns": [
    "example"
  ],
  "environments": [
    "example"
  ],
  "keys": [
    {
      "inherited_from": {
        "additionalProperty": "example"
      },
      "key": "example",
      "status": {
        "additionalProperty": "example"
      }
    }
  ]
}