diff --git a/backend/src/controllers/secretController.ts b/backend/src/controllers/secretController.ts
index d1cf5f65d..350375e28 100644
--- a/backend/src/controllers/secretController.ts
+++ b/backend/src/controllers/secretController.ts
@@ -1,6 +1,6 @@
 import { Request, Response } from 'express';
 import * as Sentry from '@sentry/node';
-import { Key } from '../models';
+import { Key, Secret, SecretVersion } from '../models';
 import {
 	pushSecrets as push,
 	pullSecrets as pull,
@@ -160,9 +160,6 @@ export const pullSecrets = async (req: Request, res: Response) => {
  * @returns
  */
 export const pullSecretsServiceToken = async (req: Request, res: Response) => {
-	// get (encrypted) secrets from workspace with id [workspaceId]
-	// service token route
-
 	let secrets;
 	let key;
 	try {
@@ -217,3 +214,35 @@ export const pullSecretsServiceToken = async (req: Request, res: Response) => {
 		key
 	});
 };
+
+/**
+ * Return secret versions for secret with id [secretId]
+ * @param req 
+ * @param res 
+ */
+export const getSecretVersions = async (req: Request, res: Response) => {
+	let secretVersions;
+	try {
+		const { secretId } = req.params;
+
+		const offset: number = parseInt(req.query.offset as string);
+		const limit: number = parseInt(req.query.limit as string);
+		
+		secretVersions = await SecretVersion.find({
+			secret: secretId
+		})
+		.skip(offset)
+		.limit(limit);
+
+	} catch (err) {
+		Sentry.setUser({ email: req.serviceToken.user.email });
+		Sentry.captureException(err);
+		return res.status(400).send({
+			message: 'Failed to get secret versions'
+		});
+	}
+	
+	return res.status(200).send({
+		secretVersions
+	});
+}
\ No newline at end of file
diff --git a/backend/src/routes/secret.ts b/backend/src/routes/secret.ts
index 98b3009de..073384129 100644
--- a/backend/src/routes/secret.ts
+++ b/backend/src/routes/secret.ts
@@ -50,4 +50,18 @@ router.get(
 	secretController.pullSecretsServiceToken
 );
 
+router.get(
+	'/:secretId/secret-versions',
+	requireAuth,
+	requireWorkspaceAuth({
+		acceptedRoles: [ADMIN, MEMBER],
+		acceptedStatuses: [COMPLETED, GRANTED]
+	}),
+	param('secretId').exists().trim(),
+	query('offset').exists().isInt(),
+	query('limit').exists().isInt(),
+	validateRequest,
+	secretController.getSecretVersions
+);
+
 export default router;