GET/exposed/{workspaceSlug}/{productSlug}/{projectSlug}/{environmentSlug}/versions/latest

Returns the most recently published version of an exposed environment as an encrypted bundle: every variable with its ciphertext value, plus the key-derivation parameters needed to open them with the workspace passphrase. The server never holds the passphrase, so the bundle is useless without it.

No API key: the feed is public by design and rate limited to 600 requests a minute per client. On a verified custom domain the same feed answers without the workspace slug, for example https://vars.acme.com/exposed/{productSlug}/{projectSlug}/{environmentSlug}/versions/latest.

An environment that is exposed but has nothing published yet answers 404 as well, with a message that says so.

No authentication: this endpoint is public.

curl --request GET \
  --url 'https://api.envless.cloud/exposed/<workspaceSlug>/<productSlug>/<projectSlug>/<environmentSlug>/versions/latest'

Try itGEThttps://api.envless.cloud/exposed/{workspaceSlug}/{productSlug}/{projectSlug}/{environmentSlug}/versions/latest

Path parameters

workspaceSlugstringrequired
Workspace slug.
productSlugstringrequired
Product slug. A private product never serves a feed.
projectSlugstringrequired
Project slug.
environmentSlugstringrequired
Environment slug. The environment must be exposed.

Responses

200OK

Read the latest exposed version succeeded.

successbooleanrequired
codeintegerrequired
The HTTP status of this response, repeated in the body.
messagestringrequired
errornullrequired
dataobjectrequired
One published version of an exposed environment. Every value is ciphertext that only the workspace passphrase opens.
Show child attributesHide child attributes
- formatstringrequired
- workspaceobjectrequired
  Show child attributesHide child attributes
  slugstringrequired
- productobjectrequired
  Show child attributesHide child attributes
  slugstringrequired
- projectobjectrequired
  Show child attributesHide child attributes
  slugstringrequired
- environmentobjectrequired
  Show child attributesHide child attributes
  slugstringrequired
- versionobjectrequired
  Show child attributesHide child attributes
  idstringrequired
  labelstringrequired
  notestring | nullrequired
  variableCountintegerrequired
  createdAtstringrequireddate-time
- decryptionobjectrequired
  How to turn the workspace passphrase into the AES-GCM key that opens each value.
  Show child attributesHide child attributes
  notestringrequired
  kdfobjectrequired
  Show child attributesHide child attributes
  algorithmstringrequired
  hashstringrequired
  iterationsintegerrequired
  keyLengthintegerrequired
  saltstring
  Base64 salt derived from the workspace id.
  cipherobjectrequired
  Show child attributesHide child attributes
  algorithmstringrequired
  ivLengthintegerrequired
  ciphertextFormatstringrequired
- variablesobject[]required
  Show child attributesHide child attributes
  namestringrequired
  valuestringrequired
  Ciphertext, v1: or v2: prefixed.
  typeenum<string>required
  Options: "string", "number", "boolean"
  visibilityenum<string>required
  Options: "server", "client"
  requiredbooleanrequired
_reqobject
Show child attributesHide child attributes
- reqIdstring
- resTimeinteger | null

{
    "success": true,
    "code": 200,
    "message": "OK",
    "error": null,
    "data": {
        "format": "envless.encrypted-export/v1",
        "workspace": {
            "slug": "<string>"
        },
        "product": {
            "slug": "<string>"
        },
        "project": {
            "slug": "<string>"
        },
        "environment": {
            "slug": "<string>"
        },
        "version": {
            "id": "<string>",
            "label": "v7",
            "note": "<string>",
            "variableCount": 1,
            "createdAt": "2026-05-30T10:14:22.000Z"
        },
        "decryption": {
            "note": "<string>",
            "kdf": {
                "algorithm": "PBKDF2",
                "hash": "SHA-256",
                "iterations": 200000,
                "keyLength": 256,
                "salt": "<string>"
            },
            "cipher": {
                "algorithm": "AES-GCM",
                "ivLength": 12
            },
            "ciphertextFormat": "v1:base64(iv|ciphertext)  |  v2:<iterations>:base64(iv|ciphertext)"
        },
        "variables": [
            {
                "name": "STRIPE_SECRET_KEY",
                "value": "v1:8Wm3kQ...ciphertext",
                "type": "string",
                "visibility": "server",
                "required": true
            }
        ]
    },
    "_req": {
        "reqId": "<string>",
        "resTime": 1
    }
}

Error envelope

Every failure below returns the same shape with success: false; branch on error.code, never on message.

successbooleanrequired
codeintegerrequired
The HTTP status of this response, repeated in the body.
messagestringrequired
errorobjectrequired
Machine-readable failure detail. Null on success.
Show child attributesHide child attributes
- codeenum<string>required
  Stable error code. Branch on this, never on message.
  Options: "auth.api_key_required", "auth.api_key_not_found", "auth.api_key_user_missing", "auth.api_key_owner_not_member", "auth.scope_missing", "auth.scope_ceiling_exceeded", "auth.key_project_restricted", "auth.product_restricted", "auth.permission_denied", "auth.self_mutation_forbidden", "auth.step_up_required", "auth.step_up_fresh_required", "auth.cli_token_not_accepted", "auth.two_factor_required", "auth.workspace_two_factor_required", "auth.two_factor_invalid", "auth.two_factor_replayed", "auth.two_factor_locked", "auth.two_factor_not_enabled", "auth.two_factor_already_enabled", "request.body_must_be_json", "request.body_invalid", "request.body_too_large", "request.rate_limited", "request.invalid_pagination", "workspace.not_found", "workspace.slug_conflict", "workspace.limit_reached", "workspace.delete_last", "workspace.delete_too_early", "workspace.delete_has_projects", "domain.not_configured", "domain.not_found", "domain.invalid", "domain.taken", "domain.attempt_limit", "product.not_found", "product.slug_conflict", "product.locked", "project.not_found", "project.ambiguous_product", "project.slug_conflict", "environment.not_found", "environment.slug_conflict", "environment.expose_disabled", "environment.expose_private_product", "variable.not_found", "variable.name_conflict", "variable.ciphertext_invalid", "variable.baseline_drifted", "version.not_found", "member.not_found", "member.already_exists", "member.self_invite", "member.self_mutation", "member.owner_immutable", "member.owner_cannot_leave", "member.seat_limit", "invite.already_pending", "role.owner_not_assignable", "role.limit_reached", "role.immutable", "role.in_use", "invite.not_found", "invite.expired", "role.not_found", "role.name_conflict", "key.not_found", "key.limit_reached", "webhook.not_found", "webhook.delivery_not_found", "plan.limit_reached", "plan.upgrade_required", "request.not_found", "request.method_not_allowed", "request.conflict", "auth.unauthorized", "auth.forbidden", "request.invalid", "server.error"
- resourcestring
  The resource or scope the failure relates to.
- fieldstring
  The request field that caused the failure.
dataobject | nullrequired
Null on most failures. A plan limit carries { limit, current }.
_reqobject
Show child attributesHide child attributes
- reqIdstring
- resTimeinteger | null

{
    "success": false,
    "code": 404,
    "message": "Something went wrong.",
    "error": {
        "code": "auth.api_key_required",
        "resource": "<string>",
        "field": "<string>"
    },
    "data": {},
    "_req": {
        "reqId": "<string>",
        "resTime": 1
    }
}

404Not Found

request.not_found - the URL does not resolve: an unknown workspace, product, project or environment, a private product, or an environment that is not exposed all answer this same 404, and so does an exposed environment with no published version.

429Too Many Requests

request.rate_limited - the client sent more than 600 feed requests in a minute; retry after the Retry-After seconds (60).

500Internal Server Error

server.error - an unexpected error; retry with backoff.

503Service Unavailable

server.error - the API is in maintenance mode or is missing its configuration; retry with backoff.

Path parameters#

Responses#

200OK#

Error envelope#

404Not Found#

429Too Many Requests#

500Internal Server Error#

503Service Unavailable#