> ## Documentation Index
> Fetch the complete documentation index at: https://syteca.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Get Secret Credentials

> Syteca ACB REST API endpoint to retrieve a secret's actual credentials — login, password, and (for SSH secrets) the SSH private key. The most frequently called ACB endpoint.

Retrieves a secret's **actual credentials** — login, password, and (for SSH-type secrets) the SSH private key. The canonical endpoint that automation consumers call to retrieve credentials at deployment time, runtime, or scheduled-task execution. The most frequently called ACB endpoint.

<Note>
  For ACB deployments updated from a version prior to 1.2, switch to the `https://{hostname}/EkranACB` server in the Playground.
</Note>

### Permissions required

The user owning the Access Token must have at least **PAM User** role on the secret.

### Check-out and approval interactions

* If the secret is configured with [check-out](/docs/api/acb/data-models#checkout) enabled, this call **checks the secret out** — and the next caller is blocked until check-in.
* If the secret requires [approval](/docs/api/acb/data-models#requireapproval), the call returns **403** until an approver grants access.

<Warning>
  **Treat credentials returned from this endpoint as ephemeral.** Don't write them to disk, log them, or cache them beyond the lifetime of the operation that needed them. The point of using ACB is so credentials never live anywhere outside the secrets vault and the in-memory consumer context.
</Warning>

### Response shape varies by SecretType

The response includes only the fields relevant to the secret's `type` — `domain` for ADAccount, `server` for Unix/MSSQL, `computer_name` for WindowsAccount, `url` for WebAccount, `ssh_key` for UnixAccountSSH with key auth, etc.

### Rate limit

**60 requests per minute per Access Token.** This is intentionally higher than other endpoints — credential retrieval is the highest-volume API operation.

### Errors

See [Status codes](/docs/api/acb/api-reference#status-codes). Common errors:

* **403 Forbidden** — user lacks PAM User role, OR the secret requires approval and hasn't been approved.
* **404 Not Found** — secret doesn't exist.
* **409 Conflict** — secret is currently checked out by another user (when check-out is enabled).

## Related

<CardGroup cols={2}>
  <Card title="Get secret" icon="info" href="/docs/api/acb/endpoints/get-secret">Read metadata without retrieving credentials.</Card>
  <Card title="Get secret details (old)" icon="key" href="/docs/api/acb/endpoints/get-secret-details">Pre-v1.3 equivalent.</Card>
  <Card title="Rotate password" icon="refresh-ccw" href="/docs/api/acb/endpoints/rotate-secret-password">Trigger rotation after retrieval if policy requires.</Card>
  <Card title="Force check-in" icon="undo" href="/docs/api/acb/endpoints/force-checkin">Release a checked-out secret.</Card>
</CardGroup>


## OpenAPI

````yaml GET /api/secrets/{id}/password
openapi: 3.0.3
info:
  title: Application Credentials Broker API
  description: >-
    API for managing secrets and folders in the Application Credentials Broker
    system
  version: 1.4.0
  contact:
    name: API Support
    email: support@example.com
servers:
  - url: https://your-syteca-host/SytecaACB
    description: On-premises Syteca ACB service (v1.2 or later)
    variables:
      hostname:
        default: your-syteca-host.example.com
        description: Your Syteca Application Server hostname
  - url: https://your-syteca-host/EkranACB
    description: Legacy URL prefix for ACB deployments updated from pre-v1.2
    variables:
      hostname:
        default: your-syteca-host.example.com
        description: Your Syteca Application Server hostname
security:
  - AccessTokenAuth: []
paths:
  /api/secrets/{id}/password:
    get:
      tags:
        - Secrets
      summary: Get secret credentials
      description: Retrieves the credentials (password/private key) for a specific secret
      operationId: getSecretCredentials
      parameters:
        - name: id
          in: path
          required: true
          description: The ID of the secret to retrieve credentials for
          schema:
            type: integer
            format: int32
            minimum: 1
      responses:
        '200':
          description: Secret credentials retrieved successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecretResponseDto'
        '403':
          description: Access denied
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '404':
          description: Secret not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
components:
  schemas:
    SecretResponseDto:
      type: object
      properties:
        id:
          type: integer
          format: int32
          description: Unique identifier of the secret
        name:
          type: string
          description: Name of the secret
        type:
          $ref: '#/components/schemas/SecretType'
        description:
          type: string
          description: Description of the secret
        password:
          type: string
          description: The password value
        ssh_key:
          $ref: '#/components/schemas/SshKey'
        domain:
          type: string
          description: Domain for AD accounts
        computer_name:
          type: string
          description: Computer name for Windows/Unix accounts
        url:
          type: string
          description: URL for web accounts
        server:
          type: string
          description: Server for database accounts
        login:
          type: string
          description: Login username
      required:
        - id
        - name
        - type
        - login
    ErrorResponse:
      type: object
      properties:
        status:
          type: integer
          description: HTTP status code
        message:
          type: string
          description: Error message
      required:
        - status
        - message
    SecretType:
      type: string
      enum:
        - None
        - UnixAccountSSH
        - UnixAccountTelnet
        - WindowsAccount
        - ADAccount
        - WebAccount
        - MSSQLAccount
      description: Type of secret
    SshKey:
      type: object
      properties:
        private_key:
          type: string
          description: SSH private key
        pass_phrase:
          type: string
          description: Passphrase for the private key
      required:
        - private_key
  securitySchemes:
    AccessTokenAuth:
      type: apiKey
      in: header
      name: Authorization
      description: Access token for authentication

````