SecretMeta

class SecretMeta(BaseModel)

One secret's metadata (GET /secrets/{name}). The secret value is write-only and never present on this or any other response. Fields are declared alphabetically: the response is serialized through serde_json::Value, which orders keys alphabetically.

Attributes:

• allowed_domains List[StrictStr] = Field(description='Per-secret egress scope. ["*"] means any verified host; a legacy empty list means this secret is sent nowhere.')
• description Optional[StrictStr] = None
• name StrictStr
• updated_at datetime
• additional_properties Dict[str, Any] = {}

model_config

model_config = ConfigDict(populate_by_name=True, validate_assignment=True, protected_namespaces=())

SecretMeta.to_str

def to_str() -> str

Returns the string representation of the model using alias

SecretMeta.to_json

def to_json() -> str

Returns the JSON representation of the model using alias

SecretMeta.from_json

@classmethod
def from_json(json_str: str) -> Optional[Self]

Create an instance of SecretMeta from a JSON string

SecretMeta.to_dict

def to_dict() -> Dict[str, Any]

Return the dictionary representation of the model using alias.

This has the following differences from calling pydantic's self.model_dump(by_alias=True):

• None is only added to the output dict for nullable fields that were set at model initialization. Other fields with value None are ignored.
• Fields in self.additional_properties are added to the output dict.

SecretMeta.from_dict

@classmethod
def from_dict(obj: Optional[Dict[str, Any]]) -> Optional[Self]

Create an instance of SecretMeta from a dict

SecretService

class SecretService()

Project secret namespace.

Project-scoped secrets (PLAN-SECRETS.md): named key/value pairs stored encrypted in the project. Attach one or more to a sandbox at creation via the secrets create parameter (a list of names); the sandbox receives an opaque per-VM PLACEHOLDER as an environment variable, and the platform's egress proxy substitutes the real value into outbound HTTPS requests (a plain http:// request carries the placeholder unchanged). The real value NEVER enters the sandbox and is never returned by the API (write-only).

SecretService.__init__

def __init__(transport: AsyncTransport) -> None

SecretService.list

async def list() -> ListResult[SecretDto]

List secret metadata.

SecretService.iter

async def iter() -> AsyncIterator[SecretDto]

SecretService.get

async def get(name: str) -> SecretMeta

Fetch one secret's metadata (never its value).

SecretService.set

async def set(name: str,
              value: str,
              *,
              allowed_domains: Sequence[str],
              description: Optional[str] = None,
              if_not_exists: bool = False) -> None

Create or update a write-only secret.

allowed_domains: The hosts where this secret's value may be sent (exact or *. wildcard), or ["*"] for any verified host. "*" lets the value reach any HTTPS host, including one a compromised sandbox controls.

SecretService.delete

async def delete(name: str) -> None

Delete a secret.

SyncSecretService

class SyncSecretService()

Project secret namespace.

SyncSecretService.__init__

def __init__(impl: SecretService, bridge: SyncBridge) -> None

SyncSecretService.delete

def delete(name: str) -> None

Delete a secret.

SyncSecretService.get

def get(name: str) -> SecretMeta

Fetch one secret's metadata (never its value).

SyncSecretService.iter

def iter() -> Iterator[SecretDto]

SyncSecretService.list

def list() -> ListResult[SecretDto]

List secret metadata.

SyncSecretService.set

def set(name: str,
        value: str,
        *,
        allowed_domains: Sequence[str],
        description: Optional[str] = None,
        if_not_exists: bool = False) -> None

Create or update a write-only secret.

SecretDto

SecretDto = _gen.api.SecretListItem