Secrets
AuthorizationBearer <token>Bearer project API key.
Scope: read:secrets
limit?integerMaximum number of items to return, 1–200 (default 100)
int641 <= value <= 200100cursor?stringOpaque continuation token returned as next_cursor by a previous request
The page of secrets
application/json- response
GET /secrets response envelope.
next_cursor?|The opaque continuation token, or null on the last page.
secrets*array<>The secrets in this page.
curl -X GET 'https://example.com/secrets'{ "next_cursor": "string", "secrets": [ { "allowed_domains": [ "string" ], "created_at": "2019-08-24T14:15:22Z", "description": "string", "name": "string", "updated_at": "2019-08-24T14:15:22Z" } ]}AuthorizationBearer <token>Bearer project API key.
Scope: read:secrets
name*stringThe secret name
The secret metadata
application/json- response
Secret metadata. The value is write-only.
allowed_domains*array<string>The hosts the secret's value may be sent to. ["*"] means any host
the platform has verified; an empty list means the secret is sent
nowhere.
created_at*stringWhen the secret was created.
date-timedescription?|The user-facing description, or null when absent.
name*stringThe secret name.
updated_at*stringWhen the secret was last updated.
date-timecurl -X GET 'https://example.com/secrets/string'{ "allowed_domains": [ "string" ], "created_at": "2019-08-24T14:15:22Z", "description": "string", "name": "string", "updated_at": "2019-08-24T14:15:22Z"}Refused while a sandbox or bucket volume still references the secret.
AuthorizationBearer <token>Bearer project API key.
Scope: delete:secrets
name*stringThe secret name
Secret deleted
curl -X DELETE 'https://example.com/secrets/string'Values are encrypted at rest and are write-only.
AuthorizationBearer <token>Bearer project API key.
Scope: write:secrets
name*stringThe secret name
If-None-Match?|Set to * to create only when the secret is absent
application/json- body
A secret value and its metadata. Values are encrypted at rest and are write-only.
allowed_domains?array<string>Required per-secret egress scope: hostnames or *. wildcards, or
["*"] for any verified host. Hostnames must be ASCII with at least two
LDH labels (1..63 characters each, no leading/trailing hyphen; at most
253 characters total). IP literals and public-suffix wildcards are
rejected. Entries are lowercased, one trailing dot is removed, and
duplicates are removed in input order on create and update.
Empty or omitted is rejected. Existing stored rows are not migrated.
description?|An optional user-facing description.
value*stringThe secret value (max 64 KiB). Write-only — never echoed back.
The secret metadata, updated
application/json- response
Secret metadata. The value is write-only.
allowed_domains*array<string>The hosts the secret's value may be sent to. ["*"] means any host
the platform has verified; an empty list means the secret is sent
nowhere.
created_at*stringWhen the secret was created.
date-timedescription?|The user-facing description, or null when absent.
name*stringThe secret name.
updated_at*stringWhen the secret was last updated.
date-timecurl -X PUT 'https://example.com/secrets/string' \ -H 'Content-Type: application/json' \ -d '{ "value": "string"}'{ "allowed_domains": [ "string" ], "created_at": "2019-08-24T14:15:22Z", "description": "string", "name": "string", "updated_at": "2019-08-24T14:15:22Z"}