Changelog

Secrets redacted in API responses

    Security
    Aiven API
    Aiven CLI
    Aiven Terraform provider
    Aiven Operator for Kubernetes

Aiven is moving to a consistent secret redaction policy across all its APIs. Starting 1 March 2027, service user passwords, service user_config fields, and integration endpoint secrets in API responses will be redacted by default.

This change ensures a more secure and consistent platform experience for all users. The following endpoints are impacted by this change. Their responses redact secrets by default:

  • GET /project/{project}/service/{service_name}/user/{service_username}
  • GET /project/{project}/service/{service_name}
  • GET /project/{project}/service
  • POST /project/{project}/service
  • PUT /project/{project}/service/{service_name}
  • PUT /project/{project}/service/{service_name}/user/{service_username}/credentials/reset
  • PUT /project/{project}/service/{service_name}/user/{service_username}
  • PATCH /project/{project}/service/{service_name}/service_type
  • GET /project/{project}/integration_endpoint/{integration_endpoint_id}
  • GET /project/{project}/integration_endpoint
  • POST /project/{project}/integration_endpoint
  • PUT /project/{project}/integration_endpoint/{integration_endpoint_id}

The following GET endpoints can return secrets in plaintext when you include the include_secrets=true query parameter:

  • GET /project/{project}/service/{service_name}/user/{service_username}
  • GET /project/{project}/service/{service_name}
  • GET /project/{project}/service
  • GET /project/{project}/integration_endpoint/{integration_endpoint_id}

The listed write endpoints redact secrets, except POST /project/{project}/service/{service_name}/user, which returns newly generated credentials in plaintext.

What you need to do

If you have integrations that require access to secrets, use the include_secrets=true query parameter to return secrets in plaintext. Only GET endpoints can reveal secrets. The caller must have the required permissions:

  • Service user passwords: admin, operator, developer, service:secrets:read, or service:users:write.
  • Service user_config secrets: admin, operator, or service:secrets:read.
  • Integration endpoint secrets: admin or project:integrations:write.

The organization-level role role:organization:adminalso grants some of these permissions. See the permissions documentation for details.

More information is available in the documentation for API secret redaction and the Aiven API.