# List all identity verification secrets

Returns the identity verification secrets configured for your workspace.

Each entry includes metadata only — the HMAC signing material itself is never returned by this endpoint. The raw secret is only available once, in the response to POST /secure_mode_secrets. Persist it at that moment.

Endpoint: GET /secure_mode_secrets
Version: Preview
Security: bearerAuth

## Header parameters:

  - `Intercom-Version` (string)
    Intercom API version.By default, it's equal to the version set in the app package.
    Enum: "1.0", "1.1", "1.2", "1.3", "1.4", "2.0", "2.1", "2.2", "2.3", "2.4", "2.5", "2.6", "2.7", "2.8", "2.9", "2.10", "2.11", "2.12", "2.13", "2.14", "Preview"

## Response 200 fields (application/json):

  - `type` (string)
    The type of the object
    Enum: "list"

  - `data` (array)
    The identity verification secrets configured for the workspace.

  - `data.type` (string)
    value is "identity_verification_secret"
    Example: "identity_verification_secret"

  - `data.id` (string)
    The id of the secret
    Example: "102"

  - `data.name` (string)
    Human-readable name for the secret, used to identify it in rotation flows
    Example: "Production Web"

  - `data.supports_android` (boolean)
    Whether the secret is enabled for the Android SDK

  - `data.supports_ios` (boolean)
    Whether the secret is enabled for the iOS SDK

  - `data.supports_web` (boolean)
    Whether the secret is enabled for the Messenger on web
    Example: true

  - `data.created_at` (integer)
    The time the secret was created, as a Unix timestamp
    Example: 1734537243

## Response 401 fields (application/json):

  - `type` (string, required)
    The type is error.list
    Example: "error.list"

  - `request_id` (string,null)
    Example: "f93ecfa8-d08a-4325-8694-89aeb89c8f85"

  - `errors` (array, required)
    An array of one or more error objects

  - `errors.code` (string, required)
    A string indicating the kind of error, used to further qualify the HTTP response code
    Example: "unauthorized"

  - `errors.message` (string,null)
    Optional. Human readable description of the error.
    Example: "Access Token Invalid"

  - `errors.field` (string,null)
    Optional. Used to identify a particular field or query parameter that was in error.
    Example: "email"