# seekrit-dev reference API

**Canonical:** https://apis.io/apis/seekrit-dev/reference-api/  
**Provider:** seekrit-dev — https://apis.io/providers/seekrit-dev/  
**Base URL:** https://api.seekrit.dev  
**Documentation:** https://seekrit.dev/docs/reference

seekrit-dev reference API is one of 4 APIs that [seekrit-dev](https://apis.io/providers/seekrit-dev/) publishes on the [APIs.io](https://apis.io/) network, described by a machine-readable OpenAPI specification. This API exposes 6 JSON Schema definitions. The published artifact set on APIs.io includes an OpenAPI specification and 6 JSON Schemas.

seekrit-dev reference API as documented publicly: 100 operations. Contract generated from the documentation by API Evangelist (2026-10-30); not the provider's own document.

## Operations (60 of 100)

| Method | Path | Summary |
|---|---|---|
| GET | `/.well-known/seekrit-export-signing-key` | The public half of the key that signs export archives (no auth). |
| POST | `/connect/browser/start` | Start a browser session capture for the Connect page. |
| POST | `/connect/oauth/start` | Start an OAuth flow for the Connect page. |
| GET | `/health` | Liveness check (no auth). |
| GET | `/oauth/callback` | OAuth callback endpoint. |
| POST | `/sync/bindings` | Enable sync for one environment. |
| POST | `/v1/browser/open` | Open a browser session for capture. |
| POST | `/v1/cli-login` | Open a sign-in request. |
| GET | `/v1/cli-login/{code}` | The request's details, for the approval screen. |
| POST | `/v1/cli-login/{code}/approve` | Authorize the device; the registered hash becomes a usable credential (90 days). |
| POST | `/v1/cli-login/{code}/deny` | Decline the request. |
| POST | `/v1/cli-login/poll` | Ask whether the request was authorized. |
| GET | `/v1/me` | The current user and their organizations. |
| GET | `/v1/me/cli-sessions` | Devices authorized with seekrit login. |
| DELETE | `/v1/me/cli-sessions/{sessionid}` | Revoke a CLI session — it stops authenticating on its next request. |
| GET | `/v1/me/keys` | Your public key and passphrase-encrypted private key. |
| PUT | `/v1/me/keys` | Upload your keys (one-time key setup). |
| GET | `/v1/me/notifications` | Your email notification preferences (all types, defaults applied). |
| PUT | `/v1/me/notifications` | Update notification preferences. |
| GET | `/v1/me/passkeys` | Passkeys enrolled to unlock your keyring. |
| POST | `/v1/me/passkeys` | Enroll a passkey. |
| DELETE | `/v1/me/passkeys/{passkeyid}` | Stop a passkey unlocking your keyring. |
| GET | `/v1/orgs` | List organizations you can access. |
| POST | `/v1/orgs` | Create an organization (creator becomes owner). |
| GET | `/v1/orgs/{orgid}` | Get one organization and your role. |
| PATCH | `/v1/orgs/{orgid}` | Rename an organization: {name} (display name only — the slug is fixed). |
| GET | `/v1/orgs/{orgid}/apps` | List applications. |
| POST | `/v1/orgs/{orgid}/apps` | Create an application. |
| DELETE | `/v1/orgs/{orgid}/apps/{appid}` | Delete an application. |
| GET | `/v1/orgs/{orgid}/apps/{appid}` | Get an application and its environments. |
| PATCH | `/v1/orgs/{orgid}/apps/{appid}` | Rename an application (display name only — the slug is fixed). |
| GET | `/v1/orgs/{orgid}/apps/{appid}/branches` | Every branch in an application. |
| GET | `/v1/orgs/{orgid}/apps/{appid}/envs` | List environments. |
| POST | `/v1/orgs/{orgid}/apps/{appid}/envs` | Create an environment (body includes the wrapped DEK). |
| GET | `/v1/orgs/{orgid}/change-requests` | List change requests, newest first. |
| GET | `/v1/orgs/{orgid}/change-requests/{id}` | Get a change request and its reviews. |
| POST | `/v1/orgs/{orgid}/change-requests/{id}/approve` | Approve a change request. |
| POST | `/v1/orgs/{orgid}/change-requests/{id}/reject` | Reject a change request. |
| POST | `/v1/orgs/{orgid}/change-requests/{id}/withdraw` | Take a proposal off the queue. |
| GET | `/v1/orgs/{orgid}/envs/{envid}` | Get an environment. |
| PATCH | `/v1/orgs/{orgid}/envs/{envid}` | Rename an environment: {name} (display name only — the slug is fixed, since composition and resolve match on it). |
| GET | `/v1/orgs/{orgid}/envs/{envid}/branches` | List branches of an environment. |
| POST | `/v1/orgs/{orgid}/envs/{envid}/branches` | Fork this environment: { slug, name?, ttlSeconds?, wrappedDek, recoveryWrappedDek?, grants? }. |
| GET | `/v1/orgs/{orgid}/envs/{envid}/grantees` | The public keys of this environment's grant-holders, for wrapping a new key to them. |
| GET | `/v1/orgs/{orgid}/envs/{envid}/groups` | List composed groups (slug, name, position). |
| POST | `/v1/orgs/{orgid}/envs/{envid}/groups` | Compose a group { groupId, position? }. |
| DELETE | `/v1/orgs/{orgid}/envs/{envid}/groups/{groupid}` | Remove a composed group. |
| GET | `/v1/orgs/{orgid}/envs/{envid}/key` | Get the calling principal's own wrapped DEK. |
| GET | `/v1/orgs/{orgid}/envs/{envid}/keys` | List all grants for the environment. |
| POST | `/v1/orgs/{orgid}/envs/{envid}/keys` | Grant a wrapped DEK to a principal. |
| DELETE | `/v1/orgs/{orgid}/envs/{envid}/keys/{grantid}` | Revoke a grant. |
| DELETE | `/v1/orgs/{orgid}/envs/{envid}/protection` | Stop requiring approval for an environment. |
| GET | `/v1/orgs/{orgid}/envs/{envid}/protection` | Get the environment's protection status and open change requests. |
| PUT | `/v1/orgs/{orgid}/envs/{envid}/protection` | Protect an environment or update its protection settings. |
| GET | `/v1/orgs/{orgid}/envs/{envid}/secrets` | List secrets (with ciphertext). |
| DELETE | `/v1/orgs/{orgid}/envs/{envid}/secrets/{name}` | Delete a secret and its whole version history. |
| PUT | `/v1/orgs/{orgid}/envs/{envid}/secrets/{name}` | Create or update a secret (appends a version). |
| POST | `/v1/orgs/{orgid}/envs/{envid}/secrets/{name}/restore` | Roll back to an earlier version. |
| GET | `/v1/orgs/{orgid}/envs/{envid}/secrets/{name}/versions` | The secret's history, newest first. |
| GET | `/v1/orgs/{orgid}/groups` | List groups. |

…and 40 more operations. They are listed in full on the page.

## Machine-readable artifacts (7)

- **OpenAPI** — https://artifacts.apis.io/seekrit-dev/openapi/_ae-authored/seekrit-dev-reference-openapi-generated.yml
- **JSONSchema** — https://artifacts.apis.io/seekrit-dev/json-schema/seekrit-dev-post-sync-bindings-request-schema.json
- **JSONSchema** — https://artifacts.apis.io/seekrit-dev/json-schema/seekrit-dev-post-v1-orgs-orgid-envs-envid-branches-request-schema.json
- **JSONSchema** — https://artifacts.apis.io/seekrit-dev/json-schema/seekrit-dev-post-v1-orgs-orgid-kms-keys-request-schema.json
- **JSONSchema** — https://artifacts.apis.io/seekrit-dev/json-schema/seekrit-dev-post-v1-cli-login-request-schema.json
- **JSONSchema** — https://artifacts.apis.io/seekrit-dev/json-schema/seekrit-dev-post-v1-cli-login-poll-response-schema.json
- **JSONSchema** — https://artifacts.apis.io/seekrit-dev/json-schema/seekrit-dev-post-v1-cli-login-response-schema.json

## Other seekrit-dev APIs (3)

- [Seekrit API](https://apis.io/apis/seekrit-dev/seekrit-api/)
- [seekrit-dev docs API](https://apis.io/apis/seekrit-dev/docs-api/)
- [seekrit-dev guides API](https://apis.io/apis/seekrit-dev/guides-api/)

---

Profiled by [API Evangelist](https://apievangelist.com) and published on [APIs.io](https://apis.io/apis/seekrit-dev/reference-api/). The API's provider profile, Kin Score and agent-readiness rating are at https://apis.io/providers/seekrit-dev/.