Infisical Sync Expert Knowledge

1. Infisical API Reference

Base URL

All requests go to $INFISICAL_URL. This is the self-hosted instance base URL, e.g. https://infisical.example.com.

Authentication, Universal Auth

Infisical uses Machine Identities with Universal Auth for agent-to-agent communication.

Endpoint: POST /api/v1/auth/universal-auth/login

Request:

{
  "clientId": "<INFISICAL_CLIENT_ID>",
  "clientSecret": "<INFISICAL_CLIENT_SECRET>"
}

Response (success):

{
  "accessToken": "eyJ...",
  "expiresIn": 7200,
  "accessTokenMaxTTL": 43200,
  "tokenType": "Bearer"
}

curl example:

RESPONSE=$(curl -s -X POST "$INFISICAL_URL/api/v1/auth/universal-auth/login" \
  -H "Content-Type: application/json" \
  -d "{\"clientId\":\"$INFISICAL_CLIENT_ID\",\"clientSecret\":\"$INFISICAL_CLIENT_SECRET\"}")

ACCESS_TOKEN=$(echo "$RESPONSE" | python3 -c "import sys,json; print(json.load(sys.stdin)['accessToken'])")

Token lifetime: expiresIn seconds (usually 7200 = 2 hours). Re-authenticate when expired.

---

List Secrets

Endpoint: GET /api/v4/secrets

Query parameters:

Param	Required	Description
projectId	Yes	Infisical project ID
environment	Yes	Environment slug (e.g. prod, staging, dev)
secretPath	No	Path prefix, default /
includeImports	No	Include imported secrets, default false
recursive	No	Include secrets in sub-paths, default false

curl example:

curl -s -X GET \
  "$INFISICAL_URL/api/v4/secrets?projectId=$PROJECT_ID&environment=$ENVIRONMENT&secretPath=/" \
  -H "Authorization: Bearer $ACCESS_TOKEN"