Secrets
AuthorizationBearer <token>Project API key (dtn_…) as a Bearer token. Mint via the management API (POST /projects/:id/api-keys) or this deployment's key-mint CLI. Every key carries an explicit set of verb:resource project permissions chosen at mint time (PLAN-API-KEY-PERMISSIONS.md); each operation lists the project permission it requires in its security requirement, and a key lacking it is answered 403 missing required project permission: <project-permission>. Some operations require an additional permission depending on the request body, stated in the operation's description. Holding a mutating verb (write:/delete:/invoke:) implies the resource's read: permission. Operations whose api_key project-permission list is empty need no specific project permission — any live project key works (the global catalogs and the artifact-cache read).
Scope: read:secrets
The project's secrets (metadata only — never values)
application/json- response
GET /secrets response envelope.
secrets*array<>curl -X GET 'https://example.com/secrets'{ "secrets": [ { "allowed_domains": [ "string" ], "description": "string", "name": "string", "updated_at": "2019-08-24T14:15:22Z" } ]}AuthorizationBearer <token>Project API key (dtn_…) as a Bearer token. Mint via the management API (POST /projects/:id/api-keys) or this deployment's key-mint CLI. Every key carries an explicit set of verb:resource project permissions chosen at mint time (PLAN-API-KEY-PERMISSIONS.md); each operation lists the project permission it requires in its security requirement, and a key lacking it is answered 403 missing required project permission: <project-permission>. Some operations require an additional permission depending on the request body, stated in the operation's description. Holding a mutating verb (write:/delete:/invoke:) implies the resource's read: permission. Operations whose api_key project-permission list is empty need no specific project permission — any live project key works (the global catalogs and the artifact-cache read).
Scope: read:secrets
name*stringsecret name
Secret metadata (never the value)
application/json- response
One secret's metadata (GET /secrets/{name}). The secret value is
write-only and never present on this or any other response. Fields are
declared alphabetically: the response is serialized through
serde_json::Value, which orders keys alphabetically.
allowed_domains*array<string>Per-secret egress scope. ["*"] means any verified host; a legacy empty
list means this secret is sent nowhere.
description?string|nullname*stringupdated_at*stringdate-timecurl -X GET 'https://example.com/secrets/string'{ "allowed_domains": [ "string" ], "description": "string", "name": "string", "updated_at": "2019-08-24T14:15:22Z"}AuthorizationBearer <token>Project API key (dtn_…) as a Bearer token. Mint via the management API (POST /projects/:id/api-keys) or this deployment's key-mint CLI. Every key carries an explicit set of verb:resource project permissions chosen at mint time (PLAN-API-KEY-PERMISSIONS.md); each operation lists the project permission it requires in its security requirement, and a key lacking it is answered 403 missing required project permission: <project-permission>. Some operations require an additional permission depending on the request body, stated in the operation's description. Holding a mutating verb (write:/delete:/invoke:) implies the resource's read: permission. Operations whose api_key project-permission list is empty need no specific project permission — any live project key works (the global catalogs and the artifact-cache read).
Scope: delete:secrets
name*stringsecret name
Secret deleted (or did not exist — idempotent)
curl -X DELETE 'https://example.com/secrets/string'AuthorizationBearer <token>Project API key (dtn_…) as a Bearer token. Mint via the management API (POST /projects/:id/api-keys) or this deployment's key-mint CLI. Every key carries an explicit set of verb:resource project permissions chosen at mint time (PLAN-API-KEY-PERMISSIONS.md); each operation lists the project permission it requires in its security requirement, and a key lacking it is answered 403 missing required project permission: <project-permission>. Some operations require an additional permission depending on the request body, stated in the operation's description. Holding a mutating verb (write:/delete:/invoke:) implies the resource's read: permission. Operations whose api_key project-permission list is empty need no specific project permission — any live project key works (the global catalogs and the artifact-cache read).
Scope: write:secrets
name*stringsecret name — doubles as the injected env var name ([A-Za-z_][A-Za-z0-9_]*)
application/json- body
PUT /secrets/{name} body. The secret value is write-only: it is
accepted here, AES-256-GCM encrypted at rest, and NEVER returned by any
endpoint — response DTOs carry metadata only.
allowed_domains?array<string>Required per-secret egress scope: hostnames or *. wildcards, or
["*"] for any verified host. Empty or omitted is rejected.
description?string|nullif_not_exists?booleanWhen true the write is create-only: 409 if a secret with this name already exists, instead of updating it. The existence check runs inside the same row-locked transaction as the write, so clients get an atomic "create unless taken" (a separate list/get pre-check cannot exclude a concurrent create).
value*stringThe secret value (max 64 KiB). Write-only — never echoed back.
Secret stored (created or updated)
curl -X PUT 'https://example.com/secrets/string' \ -H 'Content-Type: application/json' \ -d '{ "value": "string"}'