Secrets
AuthorizationBearer <token>Bearer project API key.
Scope: read:secrets
limit?integerMaximum number of items to return, 1–200 (default 100)
int641 <= value <= 200100cursor?stringOpaque continuation token returned as next_cursor by a previous request
The page of secrets
application/json- response
GET /secrets response envelope.
next_cursor?|The opaque continuation token, or null on the last page.
secrets*array<>The secrets in this page.
curl -X GET 'https://example.com/secrets'{ "next_cursor": "string", "secrets": [ { "allowed_domains": [ "string" ], "created_at": "2019-08-24T14:15:22Z", "description": "string", "name": "string", "updated_at": "2019-08-24T14:15:22Z" } ]}AuthorizationBearer <token>Bearer project API key.
Scope: read:secrets
name*stringThe secret name
The secret metadata
application/json- response
Secret metadata. The value is write-only.
allowed_domains*array<string>The hosts the secret's value may be sent to. ["*"] means any host
the platform has verified; an empty list means the secret is sent
nowhere.
created_at*stringWhen the secret was created.
date-timedescription?|The user-facing description, or null when absent.
name*stringThe secret name.
updated_at*stringWhen the secret was last updated.
date-timecurl -X GET 'https://example.com/secrets/string'{ "allowed_domains": [ "string" ], "created_at": "2019-08-24T14:15:22Z", "description": "string", "name": "string", "updated_at": "2019-08-24T14:15:22Z"}Refused while a sandbox, a bucket volume, or a sandbox detach that is not yet confirmed still references the secret.
AuthorizationBearer <token>Bearer project API key.
Scope: delete:secrets
name*stringThe secret name
Secret deleted
curl -X DELETE 'https://example.com/secrets/string'Values are encrypted at rest and are write-only.
AuthorizationBearer <token>Bearer project API key.
Scope: write:secrets
name*stringThe secret name
If-None-Match?|Set to * to create only when the secret is absent
application/json- body
A secret value and its metadata. Values are encrypted at rest and are write-only.
allowed_domains?array<string>Required per-secret egress scope: hostnames or *. wildcards, or
["*"] for any verified host. Empty or omitted is rejected.
description?|An optional user-facing description.
value*stringThe secret value (max 64 KiB). Write-only — never echoed back.
The secret metadata, updated
application/json- response
Secret metadata. The value is write-only.
allowed_domains*array<string>The hosts the secret's value may be sent to. ["*"] means any host
the platform has verified; an empty list means the secret is sent
nowhere.
created_at*stringWhen the secret was created.
date-timedescription?|The user-facing description, or null when absent.
name*stringThe secret name.
updated_at*stringWhen the secret was last updated.
date-timecurl -X PUT 'https://example.com/secrets/string' \ -H 'Content-Type: application/json' \ -d '{ "value": "string"}'{ "allowed_domains": [ "string" ], "created_at": "2019-08-24T14:15:22Z", "description": "string", "name": "string", "updated_at": "2019-08-24T14:15:22Z"}