Show Receipt

Add MCP server to your AI tool

Allow AI tools and LLMs to interact with the API documentation portal through MCP.

MCP server URL

https://api.onetimesecret.com/doc/api-v2/mcp

Standard setup for AI tools providing an mcp.json file

mcp.json
{
  "v2 - Secrets API (stable) MCP server": {
    "url": "https://api.onetimesecret.com/doc/api-v2/mcp"
  }
}

Close
GET /api/v2/receipt/{identifier}

Retrieves the receipt (metadata) for a previously created secret. Returns the receipt's state, share and burn URLs, expiration details, and recipient information. For generated secrets viewed shortly after creation, the generated value may be included. The receipt tracks whether the associated secret has been viewed, burned, or expired.

Path parameters

  • identifier string Required

    The identifier parameter

Responses

  • 200 application/json

    Successful response

    Hide response attributes Show response attributes object
    • user_id string
    • shrimp string

      Default value is empty.

    • record object Required
      Hide record attributes Show record attributes object
      • identifier string Required
      • created number Required
      • updated number Required
      • key string | null
      • shortid string Required
      • state string Required

        Values are new, shared, revealed, burned, previewed, expired, or orphaned.

      • custid string | null
      • owner_id string | null
      • shared string | null
      • previewed string | null
      • revealed string | null
      • burned string | null
      • secret_ttl string | null
      • receipt_ttl string | null
      • lifespan string | null
      • secret_shortid string | null
      • secret_identifier string | null
      • recipients array[string] | null | string

      • recipient_name string | null
      • share_domain string | null
      • has_passphrase boolean | null
      • is_previewed string | null
      • is_revealed string | null
      • is_burned string | null
      • is_destroyed string | null
      • is_expired string | null
      • is_orphaned string | null
      • memo string | null
      • kind string | null

        Any of:

        Values are generate or conceal.

        Value is .

      • source string | null

        Values are standard or incoming.

      • received string | null
      • viewed string | null
      • is_viewed string | null
      • is_received string | null
      • secret_state string | null

        Values are new, shared, revealed, burned, previewed, expired, or orphaned.

      • natural_expiration string Required
      • expiration_in_seconds string | null
      • share_path string | null
      • burn_path string Required
      • receipt_path string Required
      • share_url string | null
      • receipt_url string Required
      • burn_url string Required
      • expiration number | null
    • details object
      Hide details attributes Show details attributes object
      • type string Required

        Value is record.

      • display_lines string | null
      • no_cache string | null
      • secret_realttl number | null
      • view_count string | null
      • first_access string | null
      • last_access string | null
      • has_passphrase string | null
      • can_decrypt string | null
      • secret_value string | null
      • show_secret string | null
      • show_receipt string | null
      • show_recipients string | null
      • is_orphaned string | null
      • is_expired string | null
  • 401 application/json

    Unauthorized - Authentication required

    Hide response attributes Show response attributes object
    • error string

      ADR-013: user-facing message (V2+). On frozen V1 this is the error type identifier.

    • error_type string

      Machine-readable error class the client branches on (ADR-013, e.g., "RecordNotFound")

    • message string

      Human-readable error message (legacy/V1 shape)

    • field string

      Field that caused the error, if applicable

    • error_id string

      Unique error tracking identifier

    • request_id string

      Request correlation id; mirrors the x-request-id response header and appears in the server request log. Quote this when reporting an error.

  • 403 application/json

    Forbidden - Insufficient permissions

    Hide response attributes Show response attributes object
    • error string

      ADR-013: user-facing message (V2+). On frozen V1 this is the error type identifier.

    • error_type string

      Machine-readable error class the client branches on (ADR-013, e.g., "RecordNotFound")

    • message string

      Human-readable error message (legacy/V1 shape)

    • field string

      Field that caused the error, if applicable

    • error_id string

      Unique error tracking identifier

    • request_id string

      Request correlation id; mirrors the x-request-id response header and appears in the server request log. Quote this when reporting an error.

  • 404 application/json

    Not Found - Resource does not exist

    Hide response attributes Show response attributes object
    • error string

      ADR-013: user-facing message (V2+). On frozen V1 this is the error type identifier.

    • error_type string

      Machine-readable error class the client branches on (ADR-013, e.g., "RecordNotFound")

    • message string

      Human-readable error message (legacy/V1 shape)

    • field string

      Field that caused the error, if applicable

    • error_id string

      Unique error tracking identifier

    • request_id string

      Request correlation id; mirrors the x-request-id response header and appears in the server request log. Quote this when reporting an error.

  • 500 application/json

    Internal Server Error - Something went wrong

    Hide response attributes Show response attributes object
    • error string

      ADR-013: user-facing message (V2+). On frozen V1 this is the error type identifier.

    • error_type string

      Machine-readable error class the client branches on (ADR-013, e.g., "RecordNotFound")

    • message string

      Human-readable error message (legacy/V1 shape)

    • field string

      Field that caused the error, if applicable

    • error_id string

      Unique error tracking identifier

    • request_id string

      Request correlation id; mirrors the x-request-id response header and appears in the server request log. Quote this when reporting an error.

GET /api/v2/receipt/{identifier}
curl \
 --request GET 'https://uk.onetimesecret.com/api/v2/receipt/{identifier}' \
 --user "username:password"
Response examples (200)
{
  "user_id": "string",
  "shrimp": "",
  "record": {
    "identifier": "string",
    "created": 42.0,
    "updated": 42.0,
    "key": "string",
    "shortid": "string",
    "state": "new",
    "custid": "string",
    "owner_id": "string",
    "shared": "string",
    "previewed": "string",
    "revealed": "string",
    "burned": "string",
    "secret_ttl": "string",
    "receipt_ttl": "string",
    "lifespan": "string",
    "secret_shortid": "string",
    "secret_identifier": "string",
    "recipients": [
      "string"
    ],
    "recipient_name": "string",
    "share_domain": "string",
    "has_passphrase": true,
    "is_previewed": "string",
    "is_revealed": "string",
    "is_burned": "string",
    "is_destroyed": "string",
    "is_expired": "string",
    "is_orphaned": "string",
    "memo": "string",
    "kind": "generate",
    "source": "standard",
    "received": "string",
    "viewed": "string",
    "is_viewed": "string",
    "is_received": "string",
    "secret_state": "new",
    "natural_expiration": "string",
    "expiration_in_seconds": "string",
    "share_path": "string",
    "burn_path": "string",
    "receipt_path": "string",
    "share_url": "string",
    "receipt_url": "string",
    "burn_url": "string",
    "expiration": 42.0
  },
  "details": {
    "type": "record",
    "display_lines": "string",
    "no_cache": "string",
    "secret_realttl": 42.0,
    "view_count": "string",
    "first_access": "string",
    "last_access": "string",
    "has_passphrase": "string",
    "can_decrypt": "string",
    "secret_value": "string",
    "show_secret": "string",
    "show_secret_link": "string",
    "show_receipt_link": "string",
    "show_receipt": "string",
    "show_recipients": "string",
    "is_orphaned": "string",
    "is_expired": "string"
  }
}
Response examples (401)
{
  "error": "string",
  "error_type": "string",
  "message": "string",
  "field": "string",
  "error_id": "string",
  "request_id": "string"
}
Response examples (403)
{
  "error": "string",
  "error_type": "string",
  "message": "string",
  "field": "string",
  "error_id": "string",
  "request_id": "string"
}
Response examples (404)
{
  "error": "string",
  "error_type": "string",
  "message": "string",
  "field": "string",
  "error_id": "string",
  "request_id": "string"
}
Response examples (500)
{
  "error": "string",
  "error_type": "string",
  "message": "string",
  "field": "string",
  "error_id": "string",
  "request_id": "string"
}