# List function secrets

> Lists every secret key set on the function. Plaintext is NEVER returned — only the last 4 characters of each value, for visual confirmation.

`GET https://api.zavu.dev/v1/functions/{functionId}/secrets`

Lists every secret key set on the function. Plaintext is NEVER returned — only the last 4 characters of each value, for visual confirmation.

## Parameters

- `functionId` (path, string, required): Zavu Function ID.

## Responses

### 200

Secrets list.

- `secrets` (object[], required)
  - `id` (string, required)
  - `key` (string, required)
  - `valueLast4` (string, required)
  - `synced` (boolean): Whether the current value is in the deployed function. `false` after a set or an unset until the next deploy.
  - `createdAt` (number)
  - `updatedAt` (number)

### 401

Unauthorized.

- `code` (string, required)
- `message` (string, required)
- `details` (object)

### 404

Function not found.

- `code` (string, required)
- `message` (string, required)
- `details` (object)

## Example

```bash
curl -X GET "https://api.zavu.dev/v1/functions/function_abc123/secrets" \
  -H "Authorization: Bearer $ZAVUDEV_API_KEY"
```

```typescript
import Zavudev from "@zavudev/sdk";

const zavu = new Zavudev({ apiKey: process.env.ZAVUDEV_API_KEY });

const result = await zavu.functions.secrets.list("function_abc123");

console.log(result);
```