server.secret should not be shown in a Get Assistant request, from what I understand. The only time it should appear is while/right after setting it (in the payload to set it, and maybe (can't remember) in the response). It shouldn't show in every GET request. Correct me if I'm wrong, but that's how I thought it worked.