Xeonr Developer Docs
UplApiuplim.api.v1.InternalPipelineRunsService

Returns the requested integration secrets as CIPHERTEXT ONLY + the key id (kid) each was encrypted under. The pipeline coordinator decrypts locally using its private-key bundle — the api never holds the private key in this trust split.

POST
/uplim.api.v1.InternalPipelineRunsService/GetIntegrationSecretsCiphertext

Plan-locked: "upl-im-api holds only the public key (encrypt on write), upl-im-pipeline holds the private key (decrypt at run time when materializing the declared subset into the step pod). API can never read secret values back, only overwrite."

Names are declared by the step manifest's required_secrets; the dispatcher batch-fetches only what's referenced by ${{ secrets.<name> }}. Names with no row are omitted from the response.

Authorization

AuthorizationBearer <token>

JWT access token obtained via OAuth2 flow or service account

In: header

Header Parameters

Connect-Protocol-Version*number

Define the version of the Connect protocol

Value in1
Connect-Timeout-Ms?number

Define the timeout, in ms

Request Body

application/json

integrationId?string
Formatuuid
names?names

Subset of secret names the calling step has declared in its manifest's required_secrets. Empty list returns empty response.

[key: string]?never

Response Body

application/json

application/json

curl -X POST "https://uploads-api.xeonr.io/uplim.api.v1.InternalPipelineRunsService/GetIntegrationSecretsCiphertext" \  -H "Connect-Protocol-Version: 1" \  -H "Content-Type: application/json" \  -d '{}'
{
  "secrets": [
    {
      "name": "string",
      "kid": "string",
      "ciphertext": "string"
    }
  ]
}
{
  "code": "not_found",
  "message": "string",
  "details": [
    {
      "type": "string",
      "value": "string",
      "debug": {}
    }
  ]
}