All Products
Search

This Product

    Key Management Service:DescribeSecret

    Document Center

    Key Management Service:DescribeSecret

    Last Updated:Aug 28, 2026

    Queries the metadata of a secret.

    Operation description

    Returns the metadata of a secret, excluding the secret value.

    This example queries the metadata of a secret named secret001.

    Try it now

    Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

    Test

    RAM authorization

    No authorization for this operation. If you encounter issues with this operation, contact technical support.

    Request parameters

    Parameter

    Type

    Required

    Description

    Example
    SecretName

    string

    Yes

    The name of the secret.

    secret001
    FetchTags

    string

    No

    Whether to return resource tags. Valid values:

    • true: Returns resource tags.

    • false (default): Does not return resource tags.

    true

    This operation also uses Common parameters.

    Response elements

    Element

    Type

    Description

    Example

    object

    UpdateTime

    string

    The time when the secret was updated.

    2022-02-21T15:39:26Z
    CreateTime

    string

    The time when the secret was created.

    2022-02-21T15:39:26Z
    NextRotationDate

    string

    The next scheduled rotation time.

    Note

    Returned only when automatic rotation is enabled.

    2022-07-06T18:22:03Z
    EncryptionKeyId

    string

    The ID of the customer master key (CMK) used to encrypt the secret value.

    00aa68af-2c02-4f68-95fe-3435d330****
    RotationInterval

    string

    The interval for automatic rotation.

    Format: integer[unit]. The unit is fixed to s (seconds). For example, 604800s means 7 days.

    Note

    Returned only when automatic rotation is enabled.

    3153600s
    Arn

    string

    The Alibaba Cloud Resource Name (ARN) of the secret.

    acs:kms:cn-hangzhou:154035569884****:secret/secret001
    ExtendedConfig

    string

    The extended configuration of the secret.

    Note

    Returned only for managed ApsaraDB RDS, Resource Access Management (RAM), or Elastic Compute Service (ECS) secrets.

    {\"SecretSubType\":\"SingleUser\", \"DBInstanceId\":\"rm-uf667446pc955****\", \"CustomData\":{} }
    LastRotationDate

    string

    The last rotation time.

    Note

    Returned only if the secret was rotated.

    2022-07-05T08:22:03Z
    RequestId

    string

    The request ID.

    93348dfb-3627-4417-8d90-487a76a909c9
    Description

    string

    The description of the secret.

    userinfo
    SecretName

    string

    The name of the secret.

    secret001
    AutomaticRotation

    string

    Whether automatic rotation is enabled. Valid values:

    • Enabled: automatic rotation is enabled.

    • Disabled: automatic rotation is disabled.

    • Invalid: Secrets Manager cannot rotate the secret.

    Note

    Returned only for managed ApsaraDB RDS, RAM, or ECS secrets.

    Enabled
    SecretType

    string

    The type of the secret. Valid values:

    • Generic: a generic secret.

    • Rds: a managed ApsaraDB RDS secret.

    • RAMCredentials: a managed RAM secret.

    • ECS: a managed ECS secret.

    Rds
    PlannedDeleteTime

    string

    The scheduled deletion time.

    2022-03-21T15:45:12Z
    DKMSInstanceId

    string

    The ID of the dedicated KMS instance.

    kst-bjj62d8f5e0sgtx8h****
    Tags

    object

    Tag

    array<object>

    The resource tags of the secret.

    Not returned if FetchTags is false or not specified.

    object

    TagValue

    string

    The tag value.

    val1
    TagKey

    string

    The tag key.

    key1

    Examples

    Success response

    JSON format

    {
  "UpdateTime": "2022-02-21T15:39:26Z",
  "CreateTime": "2022-02-21T15:39:26Z",
  "NextRotationDate": "2022-07-06T18:22:03Z",
  "EncryptionKeyId": "00aa68af-2c02-4f68-95fe-3435d330****",
  "RotationInterval": "3153600s",
  "Arn": "acs:kms:cn-hangzhou:154035569884****:secret/secret001",
  "ExtendedConfig": "{\\\"SecretSubType\\\":\\\"SingleUser\\\", \\\"DBInstanceId\\\":\\\"rm-uf667446pc955****\\\",  \\\"CustomData\\\":{} }",
  "LastRotationDate": "2022-07-05T08:22:03Z",
  "RequestId": "93348dfb-3627-4417-8d90-487a76a909c9",
  "Description": "userinfo",
  "SecretName": "secret001",
  "AutomaticRotation": "Enabled",
  "SecretType": "Rds",
  "PlannedDeleteTime": "2022-03-21T15:45:12Z",
  "DKMSInstanceId": "kst-bjj62d8f5e0sgtx8h****",
  "Tags": {
    "Tag": [
      {
        "TagValue": "val1",
        "TagKey": "key1"
      }
    ]
  }
}

    Error codes

    HTTP status code

    Error code

    Error message

    Description
    400 IllegalTimestamp The input parameter Timestamp that is mandatory for processing this request is not supplied. The input parameter timestamp indicates that the request is outside the processing time range.
    400 InvalidParameter The specified parameter is not valid. An invalid value is specified for the parameter.
    403 Forbidden.NoPermission You are not authorized to perform the operation. You are not authorized to perform the operation.
    404 Forbidden.ResourceNotFound Resource not found
    404 InvalidAccessKeyId.NotFound The Access Key ID provided does not exist in our records.

    See Error Codes for a complete list.

    Release notes

    See Release Notes for a complete list.