Share feedback
Answers are generated based on the documentation.

Experimental

Product manualDownload OpenAPI specificationMarkdown

Schema

CustomInjection

Type: object

CustomInjection is caller-authored, non-secret metadata for a custom secret: which exact hosts receive the value, in which header and format, and how the placeholder is shaped and delivered. Unlike secret material, reads return it.
envVar

Type: string

env_var optionally names a sandbox environment variable that carries the secret's placeholder (never the value) as a delivery convenience.
All schema constraints and annotations
{
  "description": "env_var optionally names a sandbox environment variable that carries the\nsecret's placeholder (never the value) as a delivery convenience.",
  "type": "string"
}
format

Type: string

format renders the value with exactly one %s; %% escapes a literal percent, and any other % sequence is rejected. Empty means "%s".
All schema constraints and annotations
{
  "description": "format renders the value with exactly one %s; %% escapes a literal\npercent, and any other % sequence is rejected. Empty means \"%s\".",
  "type": "string"
}
header · required

Type: string

header is the HTTP header the value is written to. Routing, framing, and cookie headers are rejected.
All schema constraints and annotations
{
  "description": "header is the HTTP header the value is written to. Routing, framing,\nand cookie headers are rejected.",
  "minLength": 1,
  "type": "string"
}
hosts · required

Type: array

hosts are exact lowercase DNS names. Wildcards, IP literals, ports, schemes, paths, and hosts a managed integration already serves are rejected.
Array item

Type: string

All schema constraints and annotations
{
  "minLength": 1,
  "type": "string"
}
All schema constraints and annotations
{
  "description": "hosts are exact lowercase DNS names. Wildcards, IP literals, ports,\nschemes, paths, and hosts a managed integration already serves are\nrejected.",
  "items": {
    "minLength": 1,
    "type": "string"
  },
  "maxItems": 10,
  "minItems": 1,
  "type": "array"
}
placeholderTemplate

Type: string

placeholder_template optionally shapes the placeholder for clients that validate credential shape before sending (e.g. "sk-corp-{rand}"). Each {rand} token is expanded server-side; {rand} is the only token. Empty uses the backend default ("sbx-cs-{rand}").
All schema constraints and annotations
{
  "description": "placeholder_template optionally shapes the placeholder for clients that\nvalidate credential shape before sending (e.g. \"sk-corp-{rand}\"). Each\n{rand} token is expanded server-side; {rand} is the only token. Empty\nuses the backend default (\"sbx-cs-{rand}\").",
  "type": "string"
}
All schema constraints and annotations
{
  "additionalProperties": false,
  "description": "CustomInjection is caller-authored, non-secret metadata for a custom\nsecret: which exact hosts receive the value, in which header and format,\nand how the placeholder is shaped and delivered. Unlike secret material,\nreads return it.",
  "properties": {
    "envVar": {
      "description": "env_var optionally names a sandbox environment variable that carries the\nsecret's placeholder (never the value) as a delivery convenience.",
      "type": "string"
    },
    "format": {
      "description": "format renders the value with exactly one %s; %% escapes a literal\npercent, and any other % sequence is rejected. Empty means \"%s\".",
      "type": "string"
    },
    "header": {
      "description": "header is the HTTP header the value is written to. Routing, framing,\nand cookie headers are rejected.",
      "minLength": 1,
      "type": "string"
    },
    "hosts": {
      "description": "hosts are exact lowercase DNS names. Wildcards, IP literals, ports,\nschemes, paths, and hosts a managed integration already serves are\nrejected.",
      "items": {
        "minLength": 1,
        "type": "string"
      },
      "maxItems": 10,
      "minItems": 1,
      "type": "array"
    },
    "placeholderTemplate": {
      "description": "placeholder_template optionally shapes the placeholder for clients that\nvalidate credential shape before sending (e.g. \"sk-corp-{rand}\"). Each\n{rand} token is expanded server-side; {rand} is the only token. Empty\nuses the backend default (\"sbx-cs-{rand}\").",
      "type": "string"
    }
  },
  "required": [
    "hosts",
    "header"
  ],
  "title": "CustomInjection",
  "type": "object"
}