Variables

Parameters#

curl "https://www.envpilot.dev/api/v1/projects/backend/variables?environment=production&prefix=NEXT_PUBLIC_" \
  -H "Authorization: Bearer envpk_..."

{
  "environment": "production",
  "variables": [
    {
      "key": "NEXT_PUBLIC_API_URL",
      "value": "https://api.acme.com",
      "updatedAt": 1752192000000
    }
  ]
}

With format=env the same response is dotenv text, ready to redirect into a file.

Filter before you pull#

keys and prefix are not conveniences — they narrow what gets decrypted, which narrows what appears in the audit log and what a compromised process could scrape. A build that needs three variables should ask for three.

metadata_only=true is the right call whenever you are checking whether something exists: it never touches the vault, uses the cheaper rate bucket, and is not audited individually.

Legacy endpoint#

The original single-project endpoint used by the GitHub Action. It still works and is not going anywhere, but new integrations should use /v1/projects/{slug}/variables.

Limits#

• Requires the variables resource, and the project and environment must be in the key's scope.
• Rate: metadata reads use the 120/min bucket; value pulls use the 30/min bucket.
• 422 if more than 1000 variables match — refused, never truncated.
• 503 if any variable in the response fails to decrypt — the whole request aborts, with no partial result and no sentinel values.
• Values are current. There is no version-history endpoint; history lives in the dashboard.
• Read-only. There is no write endpoint at any version.

Next#

• Accounts · Files · Errors