# Get

Launch stage: GA

`GET /api/2.0/secrets/get`

Gets a secret for a given key and scope. This API can only be called from the DBUtils
 interface. Users need the READ permission to make this call.

 Example response:

 .. code::

   {
        "key": "my-string-key",
        "value": <bytes of the secret value>
    }

 Note that the secret value returned is in bytes. The interpretation of the bytes
 is determined by the caller in DBUtils and the type the data is decoded into.

 Throws ``RESOURCE_DOES_NOT_EXIST`` if no such secret or secret scope exists.
 Throws ``PERMISSION_DENIED`` if the user does not have permission to make this API call.

 Note: This is explicitly an undocumented API. It also doesn't need to be supported
 for the /preview prefix, because it's not a customer-facing API (i.e. only used
 for DBUtils SecretUtils to fetch secrets).

 Throws ``RESOURCE_DOES_NOT_EXIST`` if no such secret scope or secret exists.
 Throws ``BAD_REQUEST`` if normal user calls get secret outside of a notebook.
 AKV specific errors:
 Throws ``INVALID_PARAMETER_VALUE`` if secret name is not alphanumeric or too long.
 Throws ``PERMISSION_DENIED`` if secret manager cannot access AKV with 403 error
 Throws ``MALFORMED_REQUEST`` if secret manager cannot access AKV with any other 4xx error

API scopes: secrets

## Query parameters

- `scope` (string, optional)
  The name of the scope that contains the secret.
- `key` (string, optional)
  Name of the secret to fetch value information.

## Returns

- `key` (string, optional)
  A unique name to identify the secret.
- `value` (string, optional)
  The value of the secret in its byte representation.

## Response

```json
{
  "key": "string",
  "value": "string"
}
```