Launchpad Service - Client Secret

I have a requirement to build admin utility apps for the Launchpad Service - think /ui2/flia, the ability to find apps by semantic link

The Launchpad Site Manager - Content Manager uses Semantic Services to get the Site Content

https://<subaccount>.dt.launchpad.cfapps.ap10.hana.ondemand.com/sites?#Content-Manage

you can find the code in /infra/services/cdm/SemanticService.js

    allEntities: {
        mock: "model/mock/entities.json",
        local: "model/mock/entities.json",
        prod: "/semantic/entity"
    },
    entities: {
        mock: "model/mock/{type}.json",
        local: "model/mock/{type}.json",
        prod: "/semantic/entity/{type}"
    },
    entity: {
        mock: "model/mock/{type}/{id}.json",
        local: "model/mock/{type}/{id}.json",
        prod: "/semantic/entity/{type}/{id}"

the following URL returns everything in the site, all catalogs, roles, businessapps etc

https://<Site Manager Host>/semantic/entity?contextId=SUB_ACCOUNT&contextType=SUB_ACCOUNT

now i want to consume this URL in my own approuter

I have an app which is deployed through the "Managed Application Router provided by SAP Launchpad",

The app is also deployed on our Launchpad service as a tile, I have the roles to Manage the Site, and I have tried to call the URL above with the JWT Token the Launchpad provides.

However instead of JSON i am redirected to the following URL to login

https://<subaccount>.authentication.ap10.hana.ondemand.com/oauth/authorize?response_type=code&client_id=sb-launchpad-dt-approuter!t70&redirect_uri=https://<subaccount>.dt.launchpad.cfapps.ap10.hana.ondemand.com/login/callback

I am guessing it needs the Authorization Code, so now investigating getting this via a destination, using OAuth2UserTokenExchange but i am missing the client_secret

Does any one know how to get the client secret for Lauchpad service instance?

this doesn't help

 btp get security/app launchpad-dt-approuter!t70<br>

Else open any other suggestions on how i can access the above SemanticService URL in my App?

AJAX fails cause of CORS even though the launchpad and content manager are practically the same domains .dt. difference, hence why i want to proxy in own approuter