> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.
# Secret insights
> Monitor the health of secrets in your projects and organization.
Secret Insights is a paid feature.
On Infisical Cloud it's available on the Pro and Enterprise plans. If you're self-hosting Infisical, contact [sales@infisical.com](mailto:sales@infisical.com) to acquire a license.
Secret Insights are dashboards that show the health of your Secrets Management secrets and how they're being read. Infisical builds them from data it already collects (rotation schedules, reminders, secret modification times, and audit logs), so apart from duplicate detection there's nothing to set up.
Insights come at two scopes:
* Organization-level insights cover every Secrets Management project in the organization, rank projects by their outstanding issues, and find secrets that share a value across projects
* Project-level insights cover one project in more detail, with upcoming rotations and reminders, stale secrets, and access patterns for that project
Choose a scope at the top of the page to see how its insights work.
## Open organization insights
In your organization, go to **Secrets Management** > **Insights**.
To view the page, your organization role needs the **Read** permission under **Secrets Management Insights**. The built-in **Admin** role has it. To grant it to another role, see [organization role-based access controls](/docs/documentation/platform/access-controls/role-based-access-controls#organization-level-access-controls).
## Summary
The three cards at the top of the page count:
* **Dynamic Secrets in Use**: [dynamic secret](/docs/documentation/platform/dynamic-secrets/overview) leases currently issued across all projects
* **Users**: members with access to Secrets Management projects
* **Machine Identities**: [machine identities](/docs/documentation/platform/identities/machine-identities) with access to Secrets Management projects
## Projects with issues
The **Insights** card lists the organization's Secrets Management projects, ordered by how serious their issues are. Each row shows the project's issues, its number of stale secrets (secrets not modified in more than 90 days), and its total number of secrets.
The issues, from most to least serious, are:
* Failed rotations: [secret rotations](/docs/documentation/platform/secret-rotation/overview) currently in a failed state
* Failed syncs: [secret syncs](/docs/integrations/secret-syncs/overview) currently in a failed state
* Orphaned leases: dynamic secret leases that Infisical failed to revoke, so the credential may still exist in the external system
* Duplicated: secrets that share a value with another secret in the same project
The **Needs Attention** tab shows only projects with at least one of these issues. Stale secrets alone don't put a project on this tab. To see every project, select **All Projects**. To find a project by name or slug, use the search box.
Select a project to open that project's Insights page.
## Duplicated secrets across projects
The **Duplicated Secrets** card groups secrets that share the same value, across every project in the organization. Each group shows how many secrets share the value and how many projects and locations (an environment and path) they're stored in. Groups that span more than one project are marked with the number of projects.
Expand a group to see each secret's project, key, environment, and path. To open a secret, hover over its row and select the arrow icon. If you aren't a member of a secret's project, the arrow icon is disabled.
Infisical finds duplicates by comparing hashes of secret values, the same hashes [secret value search](/docs/documentation/platform/secret-value-search#how-values-are-compared) uses, so it never compares plain text values.
To see the card, you need the **Search All Secret Values** permission under **Secrets Management Insights**, because the card shows secrets in projects you might not be a member of. The built-in **Admin** role has it.
If your organization was created before secret value search was released, the card shows an **Enable** button until someone turns it on.
Viewing the card is recorded in the organization's [audit logs](/docs/documentation/platform/audit-logs) as a **View Org Secrets Duplication Insights** event.
## Secret activity
The remaining cards show how secrets are created and read across all projects:
* **Auth Methods Used to Fetch Secrets**: the share of secret fetches made with each machine identity [authentication method](/docs/documentation/platform/identities/machine-identities#authentication-methods) over the past 7 days
* **New Secrets Created**: the number of secrets created each week over the past 12 weeks, with a badge that says whether the trend is increasing, decreasing, or steady
* **Secret Access Volume**: the number of secret read requests each day over the past 7 days, with the busiest day called out
If you self-host Infisical, **Auth Methods Used to Fetch Secrets** and **Secret Access Volume** appear only if your audit logs are stored in [ClickHouse](/docs/documentation/platform/audit-logs-clickhouse-setup).
## Generate an organization report
An organization report is a snapshot of the organization's insights, emailed as CSV attachments (one file per report type). The header of the Insights page shows when the last report was sent.
To generate an organization report:
On the Insights page, select **Generate Report**.
Under **Reports**, select one or more report types:
* **Usage Summary**: organization-wide counts of active leases, users, and machine identities
* **Needs Attention**: projects ranked by their issues
* **Auth Methods (Past 7 Days)**: how often each machine identity authentication method was used to read a secret value
* **Static Secret Usage (Past 12 Weeks)**: the number of static secrets created each week
* **Secret Access Volume (Past 7 Days)**: the number of secret access events each day
If you self-host Infisical without ClickHouse audit logs, the auth methods and access volume reports aren't available.
Optionally, enter comma-separated **Email recipients**. If you leave it blank, the report is sent to your own email.
Select **Generate Report**.
Generating a report requires the **Generate Report** permission under **Secrets Management Insights**. An organization can have one report generating at a time, so **Generate Report** is disabled until the current report finishes.
## Open project insights
In a Secrets Management project, select **Insights** in the project sidebar.
To view the page, your project role needs the **Read** permission on **Insights**. To grant it, see [project role-based access controls](/docs/documentation/platform/access-controls/role-based-access-controls#project-level-access-controls).
The page header counts the project's secrets, environments, folders, rotations, dynamic secrets, and honey tokens (honey tokens appear only if your plan includes them and you can read them).
## Summary
The three cards at the top of the page show what needs attention. Each card opens a table of the items it counts. Select a row to open that secret in the project's secrets overview, filtered to the matching environment.
### Upcoming rotations
Counts [secret rotations](/docs/documentation/platform/secret-rotation/overview) scheduled to run in the next 7 days.
The card's badge reads **No failed rotations**, or **{N} failed** if one or more rotations are in a failed state. Select **View Rotations** (or **View Failed Rotations**) to see each rotation's name, environment, path, and status. Failed rotations are listed first.
### Upcoming reminders
Counts secret reminders due in the next 7 days.
The card's badge reads **No overdue reminders**, or **{N} overdue** if reminders have passed their due date. Select **View Upcoming Reminders** (or **View Overdue Reminders**) to see each reminder's secret, environment, path, and due time. Overdue reminders are listed first.
### Stale secrets
Counts secrets that haven't been modified in more than 90 days.
The card's badge reads **All secrets up to date**, or **{N} need(s) review** if there are stale secrets. Select **View Stale Secrets** to see each secret's key, environment, path, and last modified time, 10 at a time.
A stale secret isn't necessarily a problem, because some configuration values rarely change. Use the list to decide whether a secret should be rotated, removed, or updated.
## Reports
A report is a snapshot of the project's insights that you can give to an auditor, attach to a ticket, or keep as compliance evidence for audits such as SOC 2 or ISO 27001. Infisical emails each report as CSV attachments, one file per report type.
Reports can contain sensitive metadata, such as secret keys, paths, and who accessed which secret. Send reports only to recipients you trust, and treat the CSV files as confidential.
### Generate a report
To generate a report:
On the **Reports** card, select **Generate Report**.
Under **Reports**, select one or more [report types](#report-types).
Optionally, enter comma-separated **Email recipients**, up to 20. Each recipient must be a member of the organization with the **Read** permission on the project's **Insights**. If you leave it blank, the report is sent to your own email.
Select **Generate Report**.
Infisical generates the report in the background and emails it to every recipient when it's done. A project can have one report generating at a time.
Generating a report requires the **Generate Report** permission on **Insights**.
### Report types
| Report | What it contains |
| - | - |
| **Stale Secrets** | Secrets not updated in the last 90 days, with when each was last updated and how many days ago |
| **Duplicate Secrets** | Secrets that share the same value across environments and paths, grouped together (empty unless [duplicate detection](#duplicated-secrets) is on) |
| **Secret Validation Compliance Violations** | Secrets that break a [secret validation rule](/docs/documentation/platform/secret-validation-rules) that covers them, such as a secret created before the rule existed |
| **Upcoming Rotations** | Secret rotations scheduled in the next 7 days |
| **Failed Rotations** | Secret rotations currently in a failed state |
| **Upcoming Reminders** | Secret reminders due in the next 7 days |
| **Secret Access Log** | Who accessed secrets over the last 30 days, with the actor, event, secret, environment, path, IP address, and time |
Each report type is limited to 100,000 rows.
### Report history
The **Reports** card lists earlier reports, newest first. Each row shows the report types, the recipients, the status, and when the report was requested.
| Status | Meaning |
| - | - |
| **Pending** | Queued, not started yet |
| **Generating** | Being generated |
| **Completed** | Generated and emailed |
| **Partial** | Emailed, but at least one report type reached the row limit and was cut short |
| **Failed** | Not generated (hover over the badge to see the error) |
To remove a report from the history, hover over its row and select the trash icon. Deleting a report requires the **Delete Report** permission on **Insights**.
## Duplicated secrets
The **Duplicated Secrets** card groups secrets in the project that share the same value, across environments and paths. Expand a group to see each secret's key, environment, and path. To open a secret's folder, hover over its row and select the arrow icon.
Secrets whose values contain [secret references](/docs/documentation/platform/secret-reference) aren't included.
Duplicate detection is on by default. If the project was created before it was released, select **Enable Detection** on the card to turn it on, which requires permission to edit the project's settings.
## Rotation and reminder calendar
The **Rotation & Reminder Calendar** card shows every upcoming rotation and reminder on a month grid. Use the arrows in the card header to move between months.
Each day shows up to two events. If a day has more, the second slot becomes a **+N more** link that lists the rest. Rotations are blue with a refresh icon and show the rotation's name. Reminders are orange with a bell icon and show the secret's key.
Select an event to see its date, environment, and path. For a rotation, the details also show its interval, status, and secret keys. For a reminder, they show its message and how often it repeats. To open the secret in the project's secrets overview, select **View in Overview**.
## Secret access volume
The **Secret Access Volume** card shows how many times secrets in the project were read each day over the past 7 days.
Reads count whether they come from the dashboard, CLI, SDKs, API, or an agent, and include reading a previous version of a secret, reading rotated credentials, and creating a dynamic secret lease.
Below the chart, **Top actors** lists the five users and identities that made the most reads over the same 7 days, with the number of reads each made.
Use the card to spot unusual spikes and to check which workloads read your secrets most.
## Authentication methods
The **Authentication Methods** card shows which authentication methods were used to read secrets over the past 30 days, as a chart with each method's share and number of reads.
Methods include user login methods (such as Email, Google, or a SAML provider), machine identity [authentication methods](/docs/documentation/platform/identities/machine-identities#authentication-methods) (such as Universal Auth or Kubernetes), and service tokens.
Reads made before Infisical started recording the authentication method appear as **Unknown**. The **Unknown** share shrinks as those reads fall outside the 30-day window.
Use the card to see how your workloads authenticate, find identities still using a method you want to retire, and check that a move to a new method is taking effect.
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.