# List all identity verification secrets

Returns the identity verification secrets configured for your workspace.
Each entry includes metadata only — the HMAC signing material itself is **never** returned by this endpoint. The raw secret is only available once, in the response to `POST /secure_mode_secrets`. Persist it at that moment.

Endpoint: GET /secure_mode_secrets
Version: Preview
Security: bearerAuth

## Header parameters:

  - `Intercom-Version` (string)

## Response 200 fields (application/json):

  - `type` (string)
    The type of the object
    Enum: "list"

  - `data` (array)
    The identity verification secrets configured for the workspace.

  - `data.type` (string)
    value is "identity_verification_secret"
    Example: identity_verification_secret

  - `data.id` (string)
    The id of the secret
    Example: 102

  - `data.name` (string)
    Human-readable name for the secret, used to identify it in rotation flows
    Example: Production Web

  - `data.supports_android` (boolean)
    Whether the secret is enabled for the Android SDK
    Example: false

  - `data.supports_ios` (boolean)
    Whether the secret is enabled for the iOS SDK
    Example: false

  - `data.supports_web` (boolean)
    Whether the secret is enabled for the Messenger on web
    Example: true

  - `data.created_at` (integer)
    The time the secret was created, as a Unix timestamp
    Example: 1734537243

  - `data.environment_id` (string)
    The `messenger_environment` value of the environment the secret is limited to, or `null` if the secret works in every environment
    Example: k3x9q2m7pa

## Response 401 fields (application/json):

  - `type` (string, required)
    The type is error.list
    Example: error.list

  - `request_id` (string)
    Example: f93ecfa8-d08a-4325-8694-89aeb89c8f85

  - `errors` (array, required)
    An array of one or more error objects

  - `errors.code` (string, required)
    A string indicating the kind of error, used to further qualify the HTTP response code
    Example: unauthorized

  - `errors.message` (string)
    Optional. Human readable description of the error.
    Example: Access Token Invalid

  - `errors.field` (string)
    Optional. Used to identify a particular field or query parameter that was in error.
    Example: email