List the secret names this repository's workflows reference

GET/api/repos/{owner}/{repo}/ci/requested-secrets

listRepositoryRequestedSecrets

Derived from the stored workflow definitions: every `${{ secrets.NAME }}` (and bare `if: secrets.NAME`) read, with the file/job/step that reads it. Reports references only — never which secrets exist, and never a value. Secret names are workspace-admin information and this route is `repo:read`, so a client that holds both joins this against `GET /api/workspaces/{workspace_id}/ci/secrets` to show satisfied vs. missing. Names flagged `auto_provided` are minted per job by the platform and are never missing.

Authentication optional — this operation also accepts anonymous requests. When authenticating, use a bearer token or a session cookie.

curl

curl -X GET 'https://neosource.dev/api/repos/OWNER/REPO/ci/requested-secrets' \
  -H 'Authorization: Bearer $NEOSOURCE_TOKEN'

fetch

fetch("https://neosource.dev/api/repos/OWNER/REPO/ci/requested-secrets", {
  method: "GET",
  headers: {
    Authorization: "Bearer $NEOSOURCE_TOKEN",
  },
});

Path parameters

ownerrequired: Repository owner or organization slug.
string
reporequired: Repository name.
string

Responses

200Requested secrets

application/json

RepoRequestedSecretsResponse

object

Which `secrets.*` names this repository's registered workflows read. Derived from the stored workflow definitions, so it reports exactly what a reader of the YAML could work out for themselves — and deliberately **nothing about which secrets exist**. Secret names are workspace-admin information while this endpoint is `repo:read`; a client that holds both joins them (`GET /api/workspaces/{workspace_id}/ci/secrets`) to show satisfied vs. missing. Values never appear here or anywhere else.

secretsrequired

array

Sorted by name.

items

RequestedSecret

object

A secret name a repository's workflows reference, with every site that references it. Says nothing about whether the name is actually **configured** — that is workspace-scoped information behind a different authorization gate, and the caller joins the two (see [`RepoRequestedSecretsResponse`]).

auto_providedrequired: boolean
The platform mints this one per job (`GITHUB_TOKEN`) — it needs no stored secret, and must never be presented as missing.
namerequired: string
referencesrequired: array
Every reference site, in walk order: workflow-level first, then jobs in declaration order, each job's own fields before its steps.
itemsSecretReference

Standard errors

Bodies documented once for the whole API — see standard errors.

400Bad Request — one of: invalid_input
403Forbidden — one of: forbidden
404Not Found — one of: not_found
423Locked — one of: busy
429Rate limited — retry after the `Retry-After` header
500Internal server error
503Service temporarily unavailable / at capacity — retry after the `Retry-After` header
504Gateway timeout — the request exceeded the server's handling budget

Schemas

Referenced above. Listed here rather than expanded inline, so the same definition is not repeated at every level.

`SecretReference`

object

One place in a workflow file that reads a secret. `job_key: null` is a workflow-level field (`concurrency:`); a `job_key` with `step_index: null` is a job-level field.

job_key: string | null
The job's key within that file, or `null` for a workflow-level field.
step_index: integer | nullint32
Zero-based step index within the job, or `null` for a job-level field.
workflow_pathrequired: string
Repo-relative path of the workflow file, e.g. `.neosource/workflows/deploy.yml`.