# Litmus Edge Manager 3.0.x - Admin Console: Marketplace Secrets

## Get Marketplace Secret

**GET** `{{LEM_adminURL}}/admin/v1/mpc-secrets/{{mpc_secret_key}}`

> **New in 2.35.**

# Get Marketplace Secret

Returns a secret value stored under a key in LEM's secret store for Marketplace content (MPC).
## Endpoint

```http
GET {{LEM_adminURL}}/admin/v1/mpc-secrets/{{mpc_secret_key}}
```
## Authentication

API key in a request header (case sensitive). The value is the LEM admin API token.

| URL prefix | Auth header |
|---|---|
| `{{LEM_URL}}/api/v1/...` (main fleet API) | `X-AuthToken: <token>` |
| `{{LEM_adminURL}}/admin/v1/...` (admin console, port 8446) | `X-AuthToken: <token>` |
| `{{LEM_URL}}/mpcs/...` (Marketplace Catalog) | `Authorization: <token>` (3.0.x also accepts `X-AuthToken`) |
## Parameters

| Parameter | In | Notes |
|---|---|---|
| `key` | path | **Required.** Secret key. |
| `Authorization` | header | Declared by the API, see the note below. |

> **Note:** on LEM 3.0.0-rc.2 this route answers `401` with the admin API token, sent as `X-AuthToken`, as a raw `Authorization` value or as a Bearer token. The API declares its own `Authorization` header, so it is meant for a caller holding a different credential (the Marketplace Catalog service); this page records the route and shape only.
## Errors

| HTTP status         | When it happens                                                                |
|---------------------|--------------------------------------------------------------------------------|
| `400 Bad Request`   | Missing or malformed query/body parameter.                                     |
| `401 Unauthorized`  | Missing or invalid credentials.                                                |
| `403 Forbidden`     | Token lacks permission for this operation.                                     |
| `404 Not Found`     | Target entity does not exist.                                                  |
| `5xx`               | Service is unreachable, restarting, or internally errored. Inspect device logs under `System > Support`. |

> **TLS note**: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.


---

## Set Marketplace Secret

**POST** `{{LEM_adminURL}}/admin/v1/mpc-secrets/{{mpc_secret_key}}`

> **New in 2.35.**

# Set Marketplace Secret

Stores a secret value under a key.
## Endpoint

```http
POST {{LEM_adminURL}}/admin/v1/mpc-secrets/{{mpc_secret_key}}
```
## Authentication

API key in a request header (case sensitive). The value is the LEM admin API token.

| URL prefix | Auth header |
|---|---|
| `{{LEM_URL}}/api/v1/...` (main fleet API) | `X-AuthToken: <token>` |
| `{{LEM_adminURL}}/admin/v1/...` (admin console, port 8446) | `X-AuthToken: <token>` |
| `{{LEM_URL}}/mpcs/...` (Marketplace Catalog) | `Authorization: <token>` (3.0.x also accepts `X-AuthToken`) |
## Parameters

| Parameter | In | Notes |
|---|---|---|
| `key` | path | **Required.** Secret key. |
| `Authorization` | header | Declared by the API, see the note below. |

## Request body

`{ "value": "<secret>" }`. `value` is required.
> **Note:** on LEM 3.0.0-rc.2 this route answers `401` with the admin API token, sent as `X-AuthToken`, as a raw `Authorization` value or as a Bearer token. The API declares its own `Authorization` header, so it is meant for a caller holding a different credential (the Marketplace Catalog service); this page records the route and shape only.
## Errors

| HTTP status         | When it happens                                                                |
|---------------------|--------------------------------------------------------------------------------|
| `400 Bad Request`   | Missing or malformed query/body parameter.                                     |
| `401 Unauthorized`  | Missing or invalid credentials.                                                |
| `403 Forbidden`     | Token lacks permission for this operation.                                     |
| `404 Not Found`     | Target entity does not exist.                                                  |
| `5xx`               | Service is unreachable, restarting, or internally errored. Inspect device logs under `System > Support`. |

> **TLS note**: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.


### Request Body

```json
{
  "value": "string"
}
```

---

## Delete Marketplace Secret

**DELETE** `{{LEM_adminURL}}/admin/v1/mpc-secrets/{{mpc_secret_key}}`

> **New in 2.35.**

# Delete Marketplace Secret

Deletes the secret stored under a key.
## Endpoint

```http
DELETE {{LEM_adminURL}}/admin/v1/mpc-secrets/{{mpc_secret_key}}
```
## Authentication

API key in a request header (case sensitive). The value is the LEM admin API token.

| URL prefix | Auth header |
|---|---|
| `{{LEM_URL}}/api/v1/...` (main fleet API) | `X-AuthToken: <token>` |
| `{{LEM_adminURL}}/admin/v1/...` (admin console, port 8446) | `X-AuthToken: <token>` |
| `{{LEM_URL}}/mpcs/...` (Marketplace Catalog) | `Authorization: <token>` (3.0.x also accepts `X-AuthToken`) |
## Parameters

| Parameter | In | Notes |
|---|---|---|
| `key` | path | **Required.** Secret key. |
| `Authorization` | header | Declared by the API, see the note below. |

> **Note:** on LEM 3.0.0-rc.2 this route answers `401` with the admin API token, sent as `X-AuthToken`, as a raw `Authorization` value or as a Bearer token. The API declares its own `Authorization` header, so it is meant for a caller holding a different credential (the Marketplace Catalog service); this page records the route and shape only.
## Errors

| HTTP status         | When it happens                                                                |
|---------------------|--------------------------------------------------------------------------------|
| `400 Bad Request`   | Missing or malformed query/body parameter.                                     |
| `401 Unauthorized`  | Missing or invalid credentials.                                                |
| `403 Forbidden`     | Token lacks permission for this operation.                                     |
| `404 Not Found`     | Target entity does not exist.                                                  |
| `5xx`               | Service is unreachable, restarting, or internally errored. Inspect device logs under `System > Support`. |

> **TLS note**: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.


---