OneGuard
ENAR

Quickstart

Five requests: get a key, exchange it for a token, list your vaults, list a vault's secrets, and read one value. Every example here uses curl and the real, current shapes — copy, paste, and change the ids.

1. Get an API key

In the OneGuard app: Vault → API Keys → Add. Choose read or write permission and an expiry, then copy the key. It starts with og_ and is shown only once.

2. Exchange it for an access token

The API never accepts a raw og_... key on anything but this one endpoint.

POST/v1/auth/token
curl -s https://api.oneguard.one/v1/auth/token \
  -X POST \
  -H "Authorization: Bearer og_your_key"
{
  "statusCode": 200,
  "errorCode": null,
  "message": null,
  "data": {
    "access_token": "ogt_eyJhbGciOi...",
    "token_type": "Bearer",
    "expires_in": 3600,
    "expires_at": "2026-09-23T15:04:05.000Z"
  }
}

Save data.access_token. It is valid for 60 minutes — see Authentication for what to do when it expires.

3. List your vaults

Every other request uses the access token, not the API key.

GET/v1/vaults
curl -s https://api.oneguard.one/v1/vaults \
  -H "Authorization: Bearer $TOKEN"
{
  "statusCode": 200,
  "errorCode": null,
  "message": null,
  "data": [
    {
      "id": "429110bc-...",
      "org_id": "7a1c2e3f-...",
      "name": "My API",
      "icon_index": 4,
      "color": "#4F46E5",
      "team_id": null,
      "role": "admin",
      "created_at": "2026-01-15T10:20:30.000Z"
    }
  ],
  "next_cursor": null
}

data is the array directly; next_cursor sits beside it. See Response format & pagination for how to page through more than one screen of results.

4. List a vault's secrets

GET/v1/vaults/429110bc-.../secrets
curl -s https://api.oneguard.one/v1/vaults/429110bc-.../secrets \
  -H "Authorization: Bearer $TOKEN"
{
  "statusCode": 200,
  "errorCode": null,
  "message": null,
  "data": [
    {
      "id": "3cb0cce2-...",
      "vault_id": "429110bc-...",
      "name": "production",
      "type": "env",
      "expired_at": null,
      "delete_after_expired": false,
      "is_archived": false,
      "created_at": "2026-02-01T09:00:00.000Z"
    }
  ],
  "next_cursor": null
}

This is metadata only — never a value, and never the icon/color fields the app uses for its own display.

5. Read a secret's value

GET/v1/secrets/3cb0cce2-.../value
curl -s https://api.oneguard.one/v1/secrets/3cb0cce2-.../value \
  -H "Authorization: Bearer $TOKEN"
{
  "statusCode": 200,
  "errorCode": null,
  "message": null,
  "data": {
    "id": "3cb0cce2-...",
    "vault_id": "429110bc-...",
    "name": "production",
    "type": "env",
    "expired_at": null,
    "delete_after_expired": false,
    "is_archived": false,
    "created_at": "2026-02-01T09:00:00.000Z",
    "value": {
      "DB_PASSWORD": "supersecret",
      "API_KEY": "sk_live_..."
    }
  }
}

The value is decrypted server-side for this one response and never cached (Cache-Control: no-store on every /v1 response).

Where to next