Conceal Secret

Add MCP server to your AI tool

Allow AI tools and LLMs to interact with the API documentation portal through MCP.

MCP server URL

https://api.onetimesecret.com/doc/v3-api/mcp

Standard setup for AI tools providing an mcp.json file

mcp.json 
{
  "v3 - Secrets API (preview) MCP server": {
    "url": "https://api.onetimesecret.com/doc/v3-api/mcp"
  }
}
Close
POST /api/v3/secret/conceal
Session auth

Store a user-provided secret value and return share metadata including a secret link for the recipient and a receipt link for the creator. The secret can only be retrieved once before it is permanently destroyed.

application/json

Body Required

  • secret object Required
    Hide secret attributes Show secret attributes object
    • kind string Required

      Value is conceal.

    • share_domain string Required
    • recipient string
    • passphrase string

    • ttl string | integer

      Any of:
      string-1 string integer-2 integer

      Format should match the following pattern: ^\d+$.

      Minimum value is -9007199254740991, maximum value is 9007199254740991.

    • secret string Required

      Minimum length is 1.

Responses

  • 200 application/json

    Successful response

    Hide response attributes Show response attributes object
    • user_id string
    • shrimp string

      Default value is empty.

    • record object Required
      Hide record attributes Show record attributes object
      • receipt object Required
        Hide receipt attributes Show receipt attributes object
        • identifier string Required
        • key string Required
        • shortid string Required
        • state string Required

          Values are new, shared, revealed, burned, previewed, expired, or orphaned.

        • owner_id string | null
        • created number Required
        • updated number Required
        • shared number | null
        • previewed number | null
        • revealed number | null
        • burned number | null
        • secret_ttl number Required
        • receipt_ttl number Required
        • lifespan number Required
        • secret_shortid string
        • secret_identifier string | null

        • recipients array[string] | null | string

          Any of:
          array-1 array[string] | null string-2 string | null
        • recipient_name string | null
        • share_domain string | null
        • has_passphrase boolean | null
        • is_previewed boolean Required
        • is_revealed boolean Required
        • is_burned boolean Required
        • is_destroyed boolean Required
        • is_expired boolean Required
        • is_orphaned boolean Required
        • memo string | null

        • kind string | null

          Any of:
          string-1 string | null string-2 string | null

          Values are generate or conceal.

          Value is .

        • source string | null

          Values are standard or incoming.

      • secret object Required
        Hide secret attributes Show secret attributes object
        • identifier string Required
        • key string Required
        • shortid string Required
        • state string Required

          Values are new, revealed, burned, or previewed.

        • has_passphrase boolean Required
        • verification boolean Required
        • secret_value string
        • is_previewed boolean Required
        • is_revealed boolean Required
        • secret_ttl number Required
        • lifespan number Required
        • created number Required
        • updated number Required
      • share_domain string | null
    • details object

      Additional properties are allowed.
  • 400 application/json

    Bad Request - Invalid request parameters or body

    Hide response attributes Show response attributes object
    • error string

      ADR-013: user-facing message (V2+). On frozen V1 this is the error type identifier.

    • error_type string

      Machine-readable error class the client branches on (ADR-013, e.g., "RecordNotFound")

    • message string

      Human-readable error message (legacy/V1 shape)

    • field string

      Field that caused the error, if applicable

    • error_id string

      Unique error tracking identifier

    • request_id string

      Request correlation id; mirrors the x-request-id response header and appears in the server request log. Quote this when reporting an error.
  • 401 application/json

    Unauthorized - Authentication required

    Hide response attributes Show response attributes object
    • error string

      ADR-013: user-facing message (V2+). On frozen V1 this is the error type identifier.

    • error_type string

      Machine-readable error class the client branches on (ADR-013, e.g., "RecordNotFound")

    • message string

      Human-readable error message (legacy/V1 shape)

    • field string

      Field that caused the error, if applicable

    • error_id string

      Unique error tracking identifier

    • request_id string

      Request correlation id; mirrors the x-request-id response header and appears in the server request log. Quote this when reporting an error.
  • 403 application/json

    Forbidden - Insufficient permissions

    Hide response attributes Show response attributes object
    • error string

      ADR-013: user-facing message (V2+). On frozen V1 this is the error type identifier.

    • error_type string

      Machine-readable error class the client branches on (ADR-013, e.g., "RecordNotFound")

    • message string

      Human-readable error message (legacy/V1 shape)

    • field string

      Field that caused the error, if applicable

    • error_id string

      Unique error tracking identifier

    • request_id string

      Request correlation id; mirrors the x-request-id response header and appears in the server request log. Quote this when reporting an error.
  • 404 application/json

    Not Found - Resource does not exist

    Hide response attributes Show response attributes object
    • error string

      ADR-013: user-facing message (V2+). On frozen V1 this is the error type identifier.

    • error_type string

      Machine-readable error class the client branches on (ADR-013, e.g., "RecordNotFound")

    • message string

      Human-readable error message (legacy/V1 shape)

    • field string

      Field that caused the error, if applicable

    • error_id string

      Unique error tracking identifier

    • request_id string

      Request correlation id; mirrors the x-request-id response header and appears in the server request log. Quote this when reporting an error.
  • 422 application/json

    Unprocessable Entity - Validation failed

    Hide response attributes Show response attributes object
    • error string

      ADR-013: user-facing message (V2+). On frozen V1 this is the error type identifier.

    • error_type string

      Machine-readable error class the client branches on (ADR-013, e.g., "RecordNotFound")

    • message string

      Human-readable error message (legacy/V1 shape)

    • field string

      Field that caused the error, if applicable

    • error_id string

      Unique error tracking identifier

    • request_id string

      Request correlation id; mirrors the x-request-id response header and appears in the server request log. Quote this when reporting an error.
  • 429 application/json

    Too Many Requests - Rate limit exceeded

    Hide response attributes Show response attributes object
    • error string

      ADR-013: user-facing message (V2+). On frozen V1 this is the error type identifier.

    • error_type string

      Machine-readable error class the client branches on (ADR-013, e.g., "RecordNotFound")

    • message string

      Human-readable error message (legacy/V1 shape)

    • field string

      Field that caused the error, if applicable

    • error_id string

      Unique error tracking identifier

    • request_id string

      Request correlation id; mirrors the x-request-id response header and appears in the server request log. Quote this when reporting an error.
  • 500 application/json

    Internal Server Error - Something went wrong

    Hide response attributes Show response attributes object
    • error string

      ADR-013: user-facing message (V2+). On frozen V1 this is the error type identifier.

    • error_type string

      Machine-readable error class the client branches on (ADR-013, e.g., "RecordNotFound")

    • message string

      Human-readable error message (legacy/V1 shape)

    • field string

      Field that caused the error, if applicable

    • error_id string

      Unique error tracking identifier

    • request_id string

      Request correlation id; mirrors the x-request-id response header and appears in the server request log. Quote this when reporting an error.
POST /api/v3/secret/conceal 
curl \
 --request POST 'https://uk.onetimesecret.com/api/v3/secret/conceal' \
 --cookie "rack.session=$API_KEY" \
 --header "Content-Type: application/json" \
 --data '{"secret":{"kind":"conceal","share_domain":"string","recipient":"string","passphrase":"string","ttl":"string","secret":"string"}}'
Request examples 
{
  "secret": {
    "kind": "conceal",
    "share_domain": "string",
    "recipient": "string",
    "passphrase": "string",
    "ttl": "string",
    "secret": "string"
  }
}
Response examples (200) 
{
  "user_id": "string",
  "shrimp": "",
  "record": {
    "receipt": {
      "identifier": "string",
      "key": "string",
      "shortid": "string",
      "state": "new",
      "owner_id": "string",
      "created": 42.0,
      "updated": 42.0,
      "shared": 42.0,
      "previewed": 42.0,
      "revealed": 42.0,
      "burned": 42.0,
      "secret_ttl": 42.0,
      "receipt_ttl": 42.0,
      "lifespan": 42.0,
      "secret_shortid": "string",
      "secret_identifier": "string",
      "recipients": [
        "string"
      ],
      "recipient_name": "string",
      "share_domain": "string",
      "has_passphrase": true,
      "is_previewed": true,
      "is_revealed": true,
      "is_burned": true,
      "is_destroyed": true,
      "is_expired": true,
      "is_orphaned": true,
      "memo": "string",
      "kind": "generate",
      "source": "standard"
    },
    "secret": {
      "identifier": "string",
      "key": "string",
      "shortid": "string",
      "state": "new",
      "has_passphrase": true,
      "verification": true,
      "secret_value": "string",
      "is_previewed": true,
      "is_revealed": true,
      "secret_ttl": 42.0,
      "lifespan": 42.0,
      "created": 42.0,
      "updated": 42.0
    },
    "share_domain": "string"
  },
  "details": {}
}
Response examples (400) 
{
  "error": "string",
  "error_type": "string",
  "message": "string",
  "field": "string",
  "error_id": "string",
  "request_id": "string"
}
Response examples (401) 
{
  "error": "string",
  "error_type": "string",
  "message": "string",
  "field": "string",
  "error_id": "string",
  "request_id": "string"
}
Response examples (403) 
{
  "error": "string",
  "error_type": "string",
  "message": "string",
  "field": "string",
  "error_id": "string",
  "request_id": "string"
}
Response examples (404) 
{
  "error": "string",
  "error_type": "string",
  "message": "string",
  "field": "string",
  "error_id": "string",
  "request_id": "string"
}
Response examples (422) 
{
  "error": "string",
  "error_type": "string",
  "message": "string",
  "field": "string",
  "error_id": "string",
  "request_id": "string"
}
Response examples (429) 
{
  "error": "string",
  "error_type": "string",
  "message": "string",
  "field": "string",
  "error_id": "string",
  "request_id": "string"
}
Response examples (500) 
{
  "error": "string",
  "error_type": "string",
  "message": "string",
  "field": "string",
  "error_id": "string",
  "request_id": "string"
}