> ## Documentation Index > Fetch the complete documentation index at: https://docs.lusor.ai/llms.txt > Use this file to discover all available pages before exploring further. # List the secrets saved in a workspace > Lists the secrets saved in the workspace, names only. Reference them by `.` in a session's `secrets`. Secret values are never returned. With an API key, no field values are returned at all. Secrets are added, changed and deleted in the Lusor app's Vault, not with an API key. ## OpenAPI ````yaml /api-reference/openapi.yaml get /v1/workspaces/{workspaceId}/vault openapi: 3.1.0 info: title: Lusor API version: 0.1.0 description: | Run AI agents on real phones, or drive a phone directly with deterministic actions. ## Authentication Every `/v1/*` endpoint except `GET /v1/health` requires an API key. Create one in the Lusor dashboard under **Settings → API Keys**. A key is shown once and is bound to one workspace. Revoking it there stops it working immediately. Send it in either header: - `X-Api-Key: ` - `Authorization: Bearer ` Because a key is bound to its workspace, `workspaceId` query and body parameters are optional for API-key callers. A request that names a different workspace returns an opaque `404`. ## Runs Use `POST /v1/agents/{id}/turns` to start or continue an agent run. Read the run under `/v1/sessions/{id}`; poll `GET /v1/sessions/{id}/status` or `GET /v1/sessions/{id}/events` for progress. ## Errors Errors are JSON: `{ "error": "", "message": "" }`. A request that fails validation returns `400` in one of two shapes, depending on the endpoint: `{ "error": "validation_error", "details": { ... } }` (direct phone control actions, for example), or `{ "error": "bad_request", "message": "" }` (agent endpoints, for example). Branch on `error`. contact: name: Lusor url: https://lusor.ai license: name: Proprietary url: https://lusor.ai/terms servers: - url: https://api.lusor.ai description: Production security: - ApiKey: [] - BearerAuth: [] tags: - name: Agents description: Persistent agents, the phone each one uses, and their turns (runs). - name: Secrets description: | Secrets saved in a workspace (passwords, sign-in details). A run uses them by name through `secrets`; values never travel in a request. - name: Sessions description: | Run records: list, inspect, stop, and read events and artifacts. Start a run with `POST /v1/agents/{id}/turns`, or without an agent through `POST /v1/workspaces/{workspaceId}/devices/{deviceId}/sessions`. - name: LiveView description: | View-only WebRTC live view of a session's phone: signaling, ICE servers, and stream control. API keys get live view only on the customer's own phone, not on a Lusor Phone. - name: Devices description: | The phones in your workspace, and reads of their current screen and UI tree. - name: DeviceVerbs description: | Direct phone control: deterministic actions (tap, swipe, type, key, clear, back, home, recent, screenshot, apps/start, apps/stop) and chains of them. On a Lusor Phone, API-key calls meter phone minutes. - name: Shell description: | Restricted shell escape hatch. Commands are checked against a denylist and audit-logged. No command output is returned. - name: Datasets description: Lists a run produced, saved as reusable Datasets. - name: Skills description: Reusable automation skills (Markdown documents). - name: PhoneNumbers description: | Workspace phone numbers and their stored SMS messages. Read-only for API keys. - name: Emails description: | Workspace Agent Mail addresses and stored inbound mail. Read-only: there is no compose, reply, or send endpoint, and message bodies are returned as raw plain text without HTML execution, remote asset fetches, or code extraction. - name: Workspaces description: The workspace an API key is bound to. - name: Catalog description: The catalog of apps that can be installed on a Lusor Phone. - name: Health description: Service health check. paths: /v1/workspaces/{workspaceId}/vault: get: tags: - Secrets summary: List the secrets saved in a workspace description: | Lists the secrets saved in the workspace, names only. Reference them by `.` in a session's `secrets`. Secret values are never returned. With an API key, no field values are returned at all. Secrets are added, changed and deleted in the Lusor app's Vault, not with an API key. operationId: listWorkspaceSecrets parameters: - $ref: '#/components/parameters/WorkspaceIdPath' responses: '200': description: The workspace's saved secrets. content: application/json: schema: $ref: '#/components/schemas/WorkspaceSecretListResponse' '401': $ref: '#/components/responses/Unauthorized' '404': $ref: '#/components/responses/NotFound' components: parameters: WorkspaceIdPath: name: workspaceId in: path required: true schema: type: string format: uuid description: Workspace UUID. Caller must have access. schemas: WorkspaceSecretListResponse: type: object required: - data properties: data: type: array items: $ref: '#/components/schemas/WorkspaceSecret' WorkspaceSecret: type: object required: - id - slug - label - kind - fields - created_at - updated_at properties: id: type: string slug: type: string description: The name used before the dot in `secrets`, for example `gmail`. label: type: string kind: type: string fields: type: object description: | The item's fields by name: `gmail.password` is the field `password` of the item `gmail`. `secret: true` fields never carry a value. additionalProperties: type: object required: - secret properties: secret: type: boolean value: type: string description: >- Present only for a non-secret field, and never for an API-key request. allowed_packages: type: - array - 'null' items: type: string description: Apps this secret may be typed into. Null or empty means any app. created_at: type: string format: date-time updated_at: type: string format: date-time ErrorResponse: type: object required: - error - message properties: error: type: string message: type: string responses: Unauthorized: description: Authentication required or invalid credentials. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' NotFound: description: Resource not found. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' securitySchemes: ApiKey: type: apiKey in: header name: X-Api-Key description: Workspace API key, created in the dashboard under Settings → API Keys. BearerAuth: type: http scheme: bearer description: >- The same workspace API key, sent as `Authorization: Bearer `. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.