A platform engineer is auditing secrets across an organization. They need to programmatically retrieve the list of secrets that are scoped to a specific deployment environment named 'production' within the repository 'web-app', without exposing the secret values. Which REST API endpoint should they call?