Share feedback
Answers are generated based on the documentation.

Experimental

Product manualDownload OpenAPI specificationMarkdown

Schema

Secret

Type: object

Secret is returned metadata and never includes secret material. uid must equal the immutable resource ID in name
createdAt · required

Schema: Timestamp

created_at is the creation timestamp.
All schema constraints and annotations
{
  "$ref": "#/components/schemas/Timestamp",
  "description": "created_at is the creation timestamp."
}
displayName

Type: string

display_name is a scoped label and never selects the resource.
All schema constraints and annotations
{
  "description": "display_name is a scoped label and never selects the resource.",
  "type": "string"
}
etag · required · response only

Type: string

etag identifies the observed version of this resource. It is opaque and strong, changes on every visible change, and is what a mutation sends as its precondition.
All schema constraints and annotations
{
  "description": "etag identifies the observed version of this resource. It is opaque and strong,\nchanges on every visible change, and is what a mutation sends as its precondition.",
  "minLength": 1,
  "pattern": "^\"[^\"\\x00-\\x20\\x7f]*\"$",
  "readOnly": true,
  "type": "string"
}
injection

Schema: CustomInjection

injection is returned only for custom-shaped secrets.
All schema constraints and annotations
{
  "$ref": "#/components/schemas/CustomInjection",
  "description": "injection is returned only for custom-shaped secrets."
}
name · required

Type: string

(IDENTIFIER) name ends in the immutable backing ID and never changes with display_name.
All schema constraints and annotations
{
  "description": "(IDENTIFIER) name ends in the immutable backing ID and never changes with display_name.",
  "pattern": "^secrets/[^/]+$",
  "type": "string"
}
oauthConfig

Schema: OAuthConfig

oauth_config is returned only for OAuth-shaped secrets.
All schema constraints and annotations
{
  "$ref": "#/components/schemas/OAuthConfig",
  "description": "oauth_config is returned only for OAuth-shaped secrets."
}
placeholder

Type: string

placeholder is server-generated per custom secret and stable across value rotation; it is not secret material. A client presents it where the credential would go; for the configured hosts the backend replaces the configured header's value at egress regardless of what was sent.
All schema constraints and annotations
{
  "description": "placeholder is server-generated per custom secret and stable across value\nrotation; it is not secret material. A client presents it where the\ncredential would go; for the configured hosts the backend replaces the\nconfigured header's value at egress regardless of what was sent.",
  "type": "string"
}
scopes

Type: array

scopes are non-secret OAuth scopes.
Array item

Type: string

All schema constraints and annotations
{
  "type": "string"
}
All schema constraints and annotations
{
  "description": "scopes are non-secret OAuth scopes.",
  "items": {
    "type": "string"
  },
  "type": "array"
}
serviceType

Type: string

service_type identifies the consuming service.
All schema constraints and annotations
{
  "description": "service_type identifies the consuming service.",
  "type": "string"
}
type

Schema: SecretType

type identifies the stored material shape.
All schema constraints and annotations
{
  "$ref": "#/components/schemas/SecretType",
  "description": "type identifies the stored material shape."
}
uid · required · response only

Type: string

(IMMUTABLE) uid is the existing backing ID, equal to the resource name's terminal segment.
All schema constraints and annotations
{
  "description": "(IMMUTABLE) uid is the existing backing ID, equal to the resource name's terminal segment.",
  "minLength": 1,
  "readOnly": true,
  "type": [
    "string"
  ]
}
updatedAt · required

Schema: Timestamp

updated_at is the last update timestamp.
All schema constraints and annotations
{
  "$ref": "#/components/schemas/Timestamp",
  "description": "updated_at is the last update timestamp."
}
All schema constraints and annotations
{
  "description": "Secret is returned metadata and never includes secret material.\nuid must equal the immutable resource ID in name",
  "properties": {
    "createdAt": {
      "$ref": "#/components/schemas/Timestamp",
      "description": "created_at is the creation timestamp."
    },
    "displayName": {
      "description": "display_name is a scoped label and never selects the resource.",
      "type": "string"
    },
    "etag": {
      "description": "etag identifies the observed version of this resource. It is opaque and strong,\nchanges on every visible change, and is what a mutation sends as its precondition.",
      "minLength": 1,
      "pattern": "^\"[^\"\\x00-\\x20\\x7f]*\"$",
      "readOnly": true,
      "type": "string"
    },
    "injection": {
      "$ref": "#/components/schemas/CustomInjection",
      "description": "injection is returned only for custom-shaped secrets."
    },
    "name": {
      "description": "(IDENTIFIER) name ends in the immutable backing ID and never changes with display_name.",
      "pattern": "^secrets/[^/]+$",
      "type": "string"
    },
    "oauthConfig": {
      "$ref": "#/components/schemas/OAuthConfig",
      "description": "oauth_config is returned only for OAuth-shaped secrets."
    },
    "placeholder": {
      "description": "placeholder is server-generated per custom secret and stable across value\nrotation; it is not secret material. A client presents it where the\ncredential would go; for the configured hosts the backend replaces the\nconfigured header's value at egress regardless of what was sent.",
      "type": "string"
    },
    "scopes": {
      "description": "scopes are non-secret OAuth scopes.",
      "items": {
        "type": "string"
      },
      "type": "array"
    },
    "serviceType": {
      "description": "service_type identifies the consuming service.",
      "type": "string"
    },
    "type": {
      "$ref": "#/components/schemas/SecretType",
      "description": "type identifies the stored material shape."
    },
    "uid": {
      "description": "(IMMUTABLE) uid is the existing backing ID, equal to the resource name's terminal segment.",
      "minLength": 1,
      "readOnly": true,
      "type": [
        "string"
      ]
    },
    "updatedAt": {
      "$ref": "#/components/schemas/Timestamp",
      "description": "updated_at is the last update timestamp."
    }
  },
  "required": [
    "uid",
    "name",
    "createdAt",
    "updatedAt",
    "etag"
  ],
  "title": "Secret",
  "type": "object"
}