Documentation

Read a secret from your app

The HTTP API reads through the access rules on the secret, so a value is shaped for whoever asked.

Over HTTP

Everything lives under /api and needs a credential; see Authentication. The examples below send it in $AKER_AUTH. Set X-Aker-Channel when a caller is not the web app, so rules can tell them apart.

Endpoint	What it does
`GET /api/me`	Your details, organisations, and roles.
`GET /api/actionsets`	Installed integrations and their actions.
`GET /api/orgs/:orgId/directory`	Teams, roles, and members for pickers.
`POST /api/stashes`	Create a stash.
`GET /api/stashes?organizationId=`	List the stashes in an organisation.
`GET\|PATCH\|DELETE /api/stashes/:stashId`	Read a stash, change its roles, or delete it with its secrets.
`POST /api/stashes/:stashId/secrets`	Create a secret (the name goes in the body).
`GET /api/stashes/:stashId/secrets`	List secrets. Metadata only.
`POST /api/stashes/:stashId/secrets/lookup`	Look up a secret by name (also in the body).
`GET /api/stashes/:stashId/secrets/:secretId`	Read the value through the access rules.
`PATCH\|DELETE …/secrets/:secretId`	Replace the rules, or delete the secret.
`GET …/secrets/:secretId/config`	The full rule list with parameters (needs write access).
`GET …/secrets/:secretId/versions`	Rotation history: who, and when.
`GET …/secrets/:secretId/grants`	Values handed out, and whether they are still active.
`POST …/secrets/:secretId/grants/:grantId/revoke`	Revoke one issued value.
`POST …/secrets/:secretId/rotate`	Run the matched integration's rotate step.

Asking for less

Two optional query parameters shape a single read. request can only narrow what the matched rule allows, such as a shorter lifetime or fewer permissions; a malformed or wider request is refused. context is what rules match on with their context key.

curl -s -G https://app.aker.tech/api/stashes/<stashId>/secrets/<secretId> \
  -H "$AKER_AUTH" \
  -H 'X-Aker-Channel: deploy-bot' \
  --data-urlencode 'request={"ttlMinutes":"15"}' \
  --data-urlencode 'context={"region":"eu"}'

Agents and MCP

A dedicated MCP server and API keys for machines are not available yet. Until they are, an agent or MCP client calls Aker with a credential and says which channel it is:

curl -s https://app.aker.tech/api/stashes/<stashId>/secrets/<secretId> \
  -H "$AKER_AUTH" \
  -H 'X-Aker-Channel: mcp'

Rules can then match on { "channel": ["mcp"] } and give an agent less than a person would get: read-only tables, shorter lifetimes, or generated decoys. A channel is reported by the caller, so treat it as a label for shaping and audit, not as proof of who is calling.