Projects
List the projects the caller may enter inside one organization. The caller must be a seated member holding read:projects; non-admin members see the org's default project plus projects where they hold an explicit membership row. Only an OIDC user JWT is admitted on this route; dtno_ organization API keys are not.
user_jwtAuthorizationBearer <token>OIDC access token of a signed-in user (the dashboard/CLI login) used on the management plane: /me, /orgs*, /projects*, /invitations*, /roles, billing, audit, API-key, and service-account routes. Every management operation documents the org/project permission the authenticated member must hold.
id*stringOrganization id
uuidProjects visible to the caller
application/json- response
projects*array<>curl -X GET 'https://example.com/orgs/497f6eca-6276-4993-bfeb-53cbbbba6f08/projects'{ "projects": [ { "created_at": "2019-08-24T14:15:22Z", "created_by": "ee824cad-d7a6-4f48-87dc-e8461a9201c4", "default": true, "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "name": "string", "org_id": "a40f5d1f-d889-42e9-94ea-b9b33585fc6b", "updated_at": "2019-08-24T14:15:22Z" } ]}Create a project inside one organization. The caller must be a seated member holding write:projects. Only an OIDC user JWT is admitted on this route; dtno_ organization API keys are not.
user_jwtAuthorizationBearer <token>OIDC access token of a signed-in user (the dashboard/CLI login) used on the management plane: /me, /orgs*, /projects*, /invitations*, /roles, billing, audit, API-key, and service-account routes. Every management operation documents the org/project permission the authenticated member must hold.
id*stringOrganization id
uuidapplication/json- body
name*stringCreated project
application/json- response
created_at*stringdate-timecreated_by?|An id, not an identity — and only for a caller who may see identities:
null unless the caller holds read:members (D5), the same rule the
key lists apply to their created_by (#942). A read:projects holder
who cannot list the org's members must not learn who created a project
from this DTO instead.
uuiddefault*booleanTrue for the org's undeletable default project.
id*stringuuidname*stringorg_id*stringuuidupdated_at*stringdate-timecurl -X POST 'https://example.com/orgs/497f6eca-6276-4993-bfeb-53cbbbba6f08/projects' \ -H 'Content-Type: application/json' \ -d '{ "name": "string"}'{ "created_at": "2019-08-24T14:15:22Z", "created_by": "ee824cad-d7a6-4f48-87dc-e8461a9201c4", "default": true, "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "name": "string", "org_id": "a40f5d1f-d889-42e9-94ea-b9b33585fc6b", "updated_at": "2019-08-24T14:15:22Z"}Read one project. The caller must be able to enter the project and hold read:projects in the owning organization. Only an OIDC user JWT is admitted on this route; dtno_ organization API keys are not.
user_jwtAuthorizationBearer <token>OIDC access token of a signed-in user (the dashboard/CLI login) used on the management plane: /me, /orgs*, /projects*, /invitations*, /roles, billing, audit, API-key, and service-account routes. Every management operation documents the org/project permission the authenticated member must hold.
id*stringProject id, or the literal default for the caller's default project alias
Project details
application/json- response
created_at*stringdate-timecreated_by?|An id, not an identity — and only for a caller who may see identities:
null unless the caller holds read:members (D5), the same rule the
key lists apply to their created_by (#942). A read:projects holder
who cannot list the org's members must not learn who created a project
from this DTO instead.
uuiddefault*booleanTrue for the org's undeletable default project.
id*stringuuidname*stringorg_id*stringuuidupdated_at*stringdate-timecurl -X GET 'https://example.com/projects/string'{ "created_at": "2019-08-24T14:15:22Z", "created_by": "ee824cad-d7a6-4f48-87dc-e8461a9201c4", "default": true, "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "name": "string", "org_id": "a40f5d1f-d889-42e9-94ea-b9b33585fc6b", "updated_at": "2019-08-24T14:15:22Z"}Rename one project. The caller must be able to enter the project and hold write:projects in the owning organization. Only an OIDC user JWT is admitted on this route; dtno_ organization API keys are not.
user_jwtAuthorizationBearer <token>OIDC access token of a signed-in user (the dashboard/CLI login) used on the management plane: /me, /orgs*, /projects*, /invitations*, /roles, billing, audit, API-key, and service-account routes. Every management operation documents the org/project permission the authenticated member must hold.
id*stringProject id, or the literal default for the caller's default project alias
application/json- body
name*stringRenamed project
application/json- response
created_at*stringdate-timecreated_by?|An id, not an identity — and only for a caller who may see identities:
null unless the caller holds read:members (D5), the same rule the
key lists apply to their created_by (#942). A read:projects holder
who cannot list the org's members must not learn who created a project
from this DTO instead.
uuiddefault*booleanTrue for the org's undeletable default project.
id*stringuuidname*stringorg_id*stringuuidupdated_at*stringdate-timecurl -X PATCH 'https://example.com/projects/string' \ -H 'Content-Type: application/json' \ -d '{ "name": "string"}'{ "created_at": "2019-08-24T14:15:22Z", "created_by": "ee824cad-d7a6-4f48-87dc-e8461a9201c4", "default": true, "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "name": "string", "org_id": "a40f5d1f-d889-42e9-94ea-b9b33585fc6b", "updated_at": "2019-08-24T14:15:22Z"}Delete one project after the guarded resource checks pass. The caller must be able to enter the project and hold delete:projects in the owning organization. Only an OIDC user JWT is admitted on this route; dtno_ organization API keys are not.
user_jwtAuthorizationBearer <token>OIDC access token of a signed-in user (the dashboard/CLI login) used on the management plane: /me, /orgs*, /projects*, /invitations*, /roles, billing, audit, API-key, and service-account routes. Every management operation documents the org/project permission the authenticated member must hold.
id*stringProject id, or the literal default for the caller's default project alias
Deleted project
application/json- response
deleted*stringuuidcurl -X DELETE 'https://example.com/projects/string'{ "deleted": "c4017980-c97c-4b78-8ba2-7006e4f556cc"}Read one project's monthly spend budget and its current state. The caller must be able to enter the project and hold read:budgets in the owning organization. Only an OIDC user JWT is admitted on this route; dtno_ organization API keys are not.
user_jwtAuthorizationBearer <token>OIDC access token of a signed-in user (the dashboard/CLI login) used on the management plane: /me, /orgs*, /projects*, /invitations*, /roles, billing, audit, API-key, and service-account routes. Every management operation documents the org/project permission the authenticated member must hold.
id*stringProject id, or the literal default for the caller's default project alias
The project's budget
application/json- response
A project's monthly spend budget and its current state.
evaluated_at?|When spend was last evaluated in the current period. null until the
first evaluation in the period.
date-timeexceeded_at?|When the project reached its budget this period. null while the
project is under its budget.
date-timemonthly_limit_cents*integerThe monthly budget, in US cents.
int64period_start*stringThe first day of the current budget period (the calendar month in
UTC), as YYYY-MM-DD.
dateproject_id*stringThe project the budget caps.
uuidspent_cents?|Month-to-date spend at list price, in US cents, from the last
evaluation in the current period. null until the first evaluation in
the period.
int64stop_at?|When running sandboxes are ended: exceeded_at plus the grace period.
On the first sweep after this time, running persistent sandboxes are
stopped and running ephemeral sandboxes are deleted; macOS sandboxes,
which run on a prepaid Mac lease, keep running. null when
exceeded_at is null, and null when this time falls on or after
the start of the next UTC month: the hold expires at the month
boundary, so no sandbox is ended this period.
date-timestop_grace_hours*integerThe organization's effective grace period, in hours.
int32curl -X GET 'https://example.com/projects/string/budget'{ "evaluated_at": "2019-08-24T14:15:22Z", "exceeded_at": "2019-08-24T14:15:22Z", "monthly_limit_cents": 0, "period_start": "2019-08-24", "project_id": "405d8375-3514-403b-8c43-83ae74cfe0e9", "spent_cents": 0, "stop_at": "2019-08-24T14:15:22Z", "stop_grace_hours": 0}Remove one project's monthly spend budget. A budget hold on the project is released; sandboxes already stopped stay stopped. The caller must be able to enter the project and hold write:budgets in the owning organization. Only an OIDC user JWT is admitted on this route; dtno_ organization API keys are not.
user_jwtAuthorizationBearer <token>OIDC access token of a signed-in user (the dashboard/CLI login) used on the management plane: /me, /orgs*, /projects*, /invitations*, /roles, billing, audit, API-key, and service-account routes. Every management operation documents the org/project permission the authenticated member must hold.
id*stringProject id, or the literal default for the caller's default project alias
Budget removed
curl -X DELETE 'https://example.com/projects/string/budget'Set one project's monthly spend budget, in US cents. When the project's month-to-date spend reaches the budget, new sandboxes in the project are refused with PROJECT_BUDGET_EXCEEDED, and after the organization's grace period running persistent sandboxes are stopped and running ephemeral sandboxes deleted. A macOS sandbox runs on a prepaid Mac lease and is exempt from both; the hold refuses buying or renewing a Mac lease the project bought instead. The caller must be able to enter the project and hold write:budgets in the owning organization; the organization needs the project_budgets entitlement (Team plan and above) where entitlement enforcement is on. Only an OIDC user JWT is admitted on this route; dtno_ organization API keys are not.
user_jwtAuthorizationBearer <token>OIDC access token of a signed-in user (the dashboard/CLI login) used on the management plane: /me, /orgs*, /projects*, /invitations*, /roles, billing, audit, API-key, and service-account routes. Every management operation documents the org/project permission the authenticated member must hold.
id*stringProject id, or the literal default for the caller's default project alias
application/json- body
PUT /projects/{id}/budget body.
monthly_limit_cents*integerThe monthly budget, in US cents: an integer from 100 ($1.00) to
100000000000 ($1 billion).
int64100 <= value <= 100000000000The project's budget after the write
application/json- response
A project's monthly spend budget and its current state.
evaluated_at?|When spend was last evaluated in the current period. null until the
first evaluation in the period.
date-timeexceeded_at?|When the project reached its budget this period. null while the
project is under its budget.
date-timemonthly_limit_cents*integerThe monthly budget, in US cents.
int64period_start*stringThe first day of the current budget period (the calendar month in
UTC), as YYYY-MM-DD.
dateproject_id*stringThe project the budget caps.
uuidspent_cents?|Month-to-date spend at list price, in US cents, from the last
evaluation in the current period. null until the first evaluation in
the period.
int64stop_at?|When running sandboxes are ended: exceeded_at plus the grace period.
On the first sweep after this time, running persistent sandboxes are
stopped and running ephemeral sandboxes are deleted; macOS sandboxes,
which run on a prepaid Mac lease, keep running. null when
exceeded_at is null, and null when this time falls on or after
the start of the next UTC month: the hold expires at the month
boundary, so no sandbox is ended this period.
date-timestop_grace_hours*integerThe organization's effective grace period, in hours.
int32curl -X PUT 'https://example.com/projects/string/budget' \ -H 'Content-Type: application/json' \ -d '{ "monthly_limit_cents": 100}'{ "evaluated_at": "2019-08-24T14:15:22Z", "exceeded_at": "2019-08-24T14:15:22Z", "monthly_limit_cents": 0, "period_start": "2019-08-24", "project_id": "405d8375-3514-403b-8c43-83ae74cfe0e9", "spent_cents": 0, "stop_at": "2019-08-24T14:15:22Z", "stop_grace_hours": 0}Read stored project lifecycle defaults and the effective policy a bare create receives for each supported sandbox class and persistence mode. The caller must be able to enter the project and hold read:projects in the owning organization. Only an OIDC user JWT is admitted.
user_jwtAuthorizationBearer <token>OIDC access token of a signed-in user (the dashboard/CLI login) used on the management plane: /me, /orgs*, /projects*, /invitations*, /roles, billing, audit, API-key, and service-account routes. Every management operation documents the org/project permission the authenticated member must hold.
id*stringProject id, or the literal default for the caller's default project alias
Stored and effective project lifecycle defaults
application/json- response
effective*max_timeout_secs*integerint64policy*curl -X GET 'https://example.com/projects/string/lifecycle-policy'{ "effective": { "gpu": { "ephemeral": { "idle_timeout_secs": 0, "on_idle_timeout": null, "on_timeout": null, "timeout_capped": true, "timeout_secs": 0, "timeout_source": "project", "wake_on_request": true } }, "linux": { "ephemeral": { "idle_timeout_secs": 0, "on_idle_timeout": null, "on_timeout": null, "timeout_capped": true, "timeout_secs": 0, "timeout_source": "project", "wake_on_request": true }, "persistent": { "idle_timeout_secs": 0, "on_idle_timeout": null, "on_timeout": null, "timeout_capped": true, "timeout_secs": 0, "timeout_source": "project", "wake_on_request": true } }, "macos": { "ephemeral": { "idle_timeout_secs": 0, "on_idle_timeout": null, "on_timeout": null, "timeout_capped": true, "timeout_secs": 0, "timeout_source": "project", "wake_on_request": true }, "persistent": { "idle_timeout_secs": 0, "on_idle_timeout": null, "on_timeout": null, "timeout_capped": true, "timeout_secs": 0, "timeout_source": "project", "wake_on_request": true } }, "windows": { "ephemeral": { "idle_timeout_secs": 0, "on_idle_timeout": null, "on_timeout": null, "timeout_capped": true, "timeout_secs": 0, "timeout_source": "project", "wake_on_request": true }, "persistent": { "idle_timeout_secs": 0, "on_idle_timeout": null, "on_timeout": null, "timeout_capped": true, "timeout_secs": 0, "timeout_source": "project", "wake_on_request": true } } }, "max_timeout_secs": 0, "policy": { "ephemeral": { "idle_timeout_secs": 0, "timeout_secs": 0 }, "persistent": { "idle_timeout_secs": 0, "on_idle_timeout": null, "on_timeout": null, "timeout_secs": 0, "wake_on_request": true } }}Update project lifecycle defaults at block granularity: a block absent from the body is kept as stored, null clears it, and an object replaces the whole block (a field missing inside it is unset). Only the blocks in the body are validated; a timeout equal to the stored value is not re-checked against a maximum lowered since it was stored. The caller must be able to enter the project and hold write:projects; changing a delete-bearing trigger additionally requires delete:sandboxes in the project. Only an OIDC user JWT is admitted.
user_jwtAuthorizationBearer <token>OIDC access token of a signed-in user (the dashboard/CLI login) used on the management plane: /me, /orgs*, /projects*, /invitations*, /roles, billing, audit, API-key, and service-account routes. Every management operation documents the org/project permission the authenticated member must hold.
id*stringProject id, or the literal default for the caller's default project alias
application/json- body
A PATCH at block granularity: an absent block is kept, null clears it,
and an object replaces the whole block (a field missing inside it is
unset). Blocks never merge field by field, so each one is validated on its
own and a pair is never split between the request and the stored row.
ephemeral?null|persistent?null|Stored and effective project lifecycle defaults after the update
application/json- response
effective*max_timeout_secs*integerint64policy*curl -X PATCH 'https://example.com/projects/string/lifecycle-policy' \ -H 'Content-Type: application/json' \ -d '{}'{ "effective": { "gpu": { "ephemeral": { "idle_timeout_secs": 0, "on_idle_timeout": null, "on_timeout": null, "timeout_capped": true, "timeout_secs": 0, "timeout_source": "project", "wake_on_request": true } }, "linux": { "ephemeral": { "idle_timeout_secs": 0, "on_idle_timeout": null, "on_timeout": null, "timeout_capped": true, "timeout_secs": 0, "timeout_source": "project", "wake_on_request": true }, "persistent": { "idle_timeout_secs": 0, "on_idle_timeout": null, "on_timeout": null, "timeout_capped": true, "timeout_secs": 0, "timeout_source": "project", "wake_on_request": true } }, "macos": { "ephemeral": { "idle_timeout_secs": 0, "on_idle_timeout": null, "on_timeout": null, "timeout_capped": true, "timeout_secs": 0, "timeout_source": "project", "wake_on_request": true }, "persistent": { "idle_timeout_secs": 0, "on_idle_timeout": null, "on_timeout": null, "timeout_capped": true, "timeout_secs": 0, "timeout_source": "project", "wake_on_request": true } }, "windows": { "ephemeral": { "idle_timeout_secs": 0, "on_idle_timeout": null, "on_timeout": null, "timeout_capped": true, "timeout_secs": 0, "timeout_source": "project", "wake_on_request": true }, "persistent": { "idle_timeout_secs": 0, "on_idle_timeout": null, "on_timeout": null, "timeout_capped": true, "timeout_secs": 0, "timeout_source": "project", "wake_on_request": true } } }, "max_timeout_secs": 0, "policy": { "ephemeral": { "idle_timeout_secs": 0, "timeout_secs": 0 }, "persistent": { "idle_timeout_secs": 0, "on_idle_timeout": null, "on_timeout": null, "timeout_secs": 0, "wake_on_request": true } }}List registry credentials metadata for one project. The caller must be able to enter the project and hold read:registries. Only an OIDC user JWT is admitted on this route; dtno_ organization API keys are not.
user_jwtAuthorizationBearer <token>OIDC access token of a signed-in user (the dashboard/CLI login) used on the management plane: /me, /orgs*, /projects*, /invitations*, /roles, billing, audit, API-key, and service-account routes. Every management operation documents the org/project permission the authenticated member must hold.
id*stringProject id, or the literal default for the caller's default project alias
Project registries
application/json- response
Response for GET /registries: metadata only, never passwords.
registries*array<>curl -X GET 'https://example.com/projects/string/registries'{ "registries": [ { "description": "string", "host": "string", "kind": "string", "updated_at": "2019-08-24T14:15:22Z", "username": "string" } ]}Create or update one registry credential for a project, naming the host in the request body instead of the path. The caller must be able to enter the project and hold write:registries. Only an OIDC user JWT is admitted on this route; dtno_ organization API keys are not.
user_jwtAuthorizationBearer <token>OIDC access token of a signed-in user (the dashboard/CLI login) used on the management plane: /me, /orgs*, /projects*, /invitations*, /roles, billing, audit, API-key, and service-account routes. Every management operation documents the org/project permission the authenticated member must hold.
id*stringProject id, or the literal default for the caller's default project alias
application/json- body
Body form for PUT /registries (host in the body instead of the path).
The password is write-only: encrypted at rest, never returned.
description?string|nullhost*stringRegistry host (host[:port], no scheme/path). Docker Hub aliases
normalize to index.docker.io.
kind?stringAuth kind: one of basic, ghcr, gcr, ecr, ecr_role. For
ecr_role the username is the IAM role ARN the platform assumes
(ExternalId = the organization id) and the password is ignored.
"basic"password?stringRegistry password/token (max 64 KiB). Write-only — never echoed back
by any public read endpoint. Required for every kind but ecr_role,
which ignores it.
username*stringRegistry upserted
curl -X PUT 'https://example.com/projects/string/registries' \ -H 'Content-Type: application/json' \ -d '{ "host": "string", "username": "string"}'Read one registry credential metadata row for a project. The caller must be able to enter the project and hold read:registries. Only an OIDC user JWT is admitted on this route; dtno_ organization API keys are not.
user_jwtAuthorizationBearer <token>OIDC access token of a signed-in user (the dashboard/CLI login) used on the management plane: /me, /orgs*, /projects*, /invitations*, /roles, billing, audit, API-key, and service-account routes. Every management operation documents the org/project permission the authenticated member must hold.
id*stringProject id, or the literal default for the caller's default project alias
host*stringRegistry host
Project registry metadata
application/json- response
Registry credential metadata as returned by every read endpoint (list and get, on both planes). Passwords are write-only: they never appear here or on any other response.
description?string|nullhost*stringNormalized registry host (Docker Hub aliases collapse to
index.docker.io).
kind*stringAuth kind (basic, ghcr, gcr, ecr, ecr_role). For ecr_role
the username is the IAM role ARN the platform assumes.
updated_at*stringdate-timeusername*stringcurl -X GET 'https://example.com/projects/string/registries/string'{ "description": "string", "host": "string", "kind": "string", "updated_at": "2019-08-24T14:15:22Z", "username": "string"}Delete one registry credential from a project. The caller must be able to enter the project and hold delete:registries. Only an OIDC user JWT is admitted on this route; dtno_ organization API keys are not.
user_jwtAuthorizationBearer <token>OIDC access token of a signed-in user (the dashboard/CLI login) used on the management plane: /me, /orgs*, /projects*, /invitations*, /roles, billing, audit, API-key, and service-account routes. Every management operation documents the org/project permission the authenticated member must hold.
id*stringProject id, or the literal default for the caller's default project alias
host*stringRegistry host
Registry deleted (idempotent: 204 even when the host was already absent)
curl -X DELETE 'https://example.com/projects/string/registries/string'Create or update one registry credential for a project. The caller must be able to enter the project and hold write:registries. Only an OIDC user JWT is admitted on this route; dtno_ organization API keys are not.
user_jwtAuthorizationBearer <token>OIDC access token of a signed-in user (the dashboard/CLI login) used on the management plane: /me, /orgs*, /projects*, /invitations*, /roles, billing, audit, API-key, and service-account routes. Every management operation documents the org/project permission the authenticated member must hold.
id*stringProject id, or the literal default for the caller's default project alias
host*stringRegistry host
application/json- body
Credential payload for PUT /registries/{host}. The password is
write-only: it is encrypted at rest and no public endpoint returns it.
description?string|nullkind?stringAuth kind: one of basic, ghcr, gcr, ecr, ecr_role. For
ecr_role the username is the IAM role ARN the platform assumes
(ExternalId = the organization id) and the password is ignored.
"basic"password?stringRegistry password/token (max 64 KiB). Write-only — never echoed back
by any public read endpoint. Required for every kind but ecr_role,
which ignores it.
username*stringRegistry upserted
curl -X PUT 'https://example.com/projects/string/registries/string' \ -H 'Content-Type: application/json' \ -d '{ "username": "string"}'List secret metadata for one project. The caller must be able to enter the project and hold read:secrets. Only an OIDC user JWT is admitted on this route; dtno_ organization API keys are not.
user_jwtAuthorizationBearer <token>OIDC access token of a signed-in user (the dashboard/CLI login) used on the management plane: /me, /orgs*, /projects*, /invitations*, /roles, billing, audit, API-key, and service-account routes. Every management operation documents the org/project permission the authenticated member must hold.
id*stringProject id, or the literal default for the caller's default project alias
Project secrets metadata
application/json- response
GET /secrets response envelope.
secrets*array<>curl -X GET 'https://example.com/projects/string/secrets'{ "secrets": [ { "allowed_domains": [ "string" ], "description": "string", "name": "string", "updated_at": "2019-08-24T14:15:22Z" } ]}Create or update one secret in a project, naming it in the request body instead of the path. The caller must be able to enter the project and hold write:secrets. Only an OIDC user JWT is admitted on this route; dtno_ organization API keys are not.
user_jwtAuthorizationBearer <token>OIDC access token of a signed-in user (the dashboard/CLI login) used on the management plane: /me, /orgs*, /projects*, /invitations*, /roles, billing, audit, API-key, and service-account routes. Every management operation documents the org/project permission the authenticated member must hold.
id*stringProject id, or the literal default for the caller's default project alias
application/json- body
allowed_domains?array<string>description?string|nullif_not_exists?booleanCreate-only mode: 409 if the name already exists (see PutSecretReq).
name*stringvalue*stringSecret upserted
curl -X PUT 'https://example.com/projects/string/secrets' \ -H 'Content-Type: application/json' \ -d '{ "name": "string", "value": "string"}'Read one secret metadata row from a project. The caller must be able to enter the project and hold read:secrets. Only an OIDC user JWT is admitted on this route; dtno_ organization API keys are not.
user_jwtAuthorizationBearer <token>OIDC access token of a signed-in user (the dashboard/CLI login) used on the management plane: /me, /orgs*, /projects*, /invitations*, /roles, billing, audit, API-key, and service-account routes. Every management operation documents the org/project permission the authenticated member must hold.
id*stringProject id, or the literal default for the caller's default project alias
name*stringSecret name
Secret metadata
application/json- response
One secret's metadata (GET /secrets/{name}). The secret value is
write-only and never present on this or any other response. Fields are
declared alphabetically: the response is serialized through
serde_json::Value, which orders keys alphabetically.
allowed_domains*array<string>Per-secret egress scope. ["*"] means any verified host; a legacy empty
list means this secret is sent nowhere.
description?string|nullname*stringupdated_at*stringdate-timecurl -X GET 'https://example.com/projects/string/secrets/string'{ "allowed_domains": [ "string" ], "description": "string", "name": "string", "updated_at": "2019-08-24T14:15:22Z"}Delete one secret from a project. The caller must be able to enter the project and hold delete:secrets. Only an OIDC user JWT is admitted on this route; dtno_ organization API keys are not.
user_jwtAuthorizationBearer <token>OIDC access token of a signed-in user (the dashboard/CLI login) used on the management plane: /me, /orgs*, /projects*, /invitations*, /roles, billing, audit, API-key, and service-account routes. Every management operation documents the org/project permission the authenticated member must hold.
id*stringProject id, or the literal default for the caller's default project alias
name*stringSecret name
Secret deleted
curl -X DELETE 'https://example.com/projects/string/secrets/string'Create or update one secret in a project. The caller must be able to enter the project and hold write:secrets. Only an OIDC user JWT is admitted on this route; dtno_ organization API keys are not.
user_jwtAuthorizationBearer <token>OIDC access token of a signed-in user (the dashboard/CLI login) used on the management plane: /me, /orgs*, /projects*, /invitations*, /roles, billing, audit, API-key, and service-account routes. Every management operation documents the org/project permission the authenticated member must hold.
id*stringProject id, or the literal default for the caller's default project alias
name*stringSecret name
application/json- body
PUT /secrets/{name} body. The secret value is write-only: it is
accepted here, AES-256-GCM encrypted at rest, and NEVER returned by any
endpoint — response DTOs carry metadata only.
allowed_domains?array<string>Required per-secret egress scope: hostnames or *. wildcards, or
["*"] for any verified host. Empty or omitted is rejected.
description?string|nullif_not_exists?booleanWhen true the write is create-only: 409 if a secret with this name already exists, instead of updating it. The existence check runs inside the same row-locked transaction as the write, so clients get an atomic "create unless taken" (a separate list/get pre-check cannot exclude a concurrent create).
value*stringThe secret value (max 64 KiB). Write-only — never echoed back.
Secret upserted
curl -X PUT 'https://example.com/projects/string/secrets/string' \ -H 'Content-Type: application/json' \ -d '{ "value": "string"}'