---
title: "Tell the agent where you put it"
method: POST
path: "/v1/secret-requests/{id}/fulfil"
tags: ["Secrets"]
---

# Tell the agent where you put it

`POST /v1/secret-requests/{id}/fulfil`

## Request

- Base URL: `https://api.1claw.co`
- URL: `https://api.1claw.co/v1/secret-requests/{id}/fulfil`
- Auth: HTTP bearer

User-authenticated. Takes a **location, never a value** — by the time this is called the secret is already in the vault, written by the browser with `PUT /v1/vaults/{vault_id}/secrets/{path}` over the user's own session. There is no field here that could carry a plaintext credential, and there should never be one.

Fulfilment also grants the asking agent read on exactly that path, and binds the vault to it if the agent has an explicit vault list. Without both, the user hands over a credential and the agent still gets a 403 — the failure this whole flow exists to remove.

## Path parameters

- `id` string, uuid, required

## Request body

- object
  - `vault_id` string, uuid, required
  - `path` string, required

## Response `200`

Fulfilled

- object
  - `status` string, required
  - `path` string, required
  - `vault_id` string, uuid, required
  - `granted_read` boolean, required: False when the secret was stored but the read grant could not be written — the agent will need access granted by hand.
  - `bound_new_vault` boolean: True when the agent had to be bound to a vault it was not bound to before. Its access is correct from now on, but a JWT carries the `vault_ids` it was minted with, so a token the agent already holds is refused until it re-mints. Answering into a vault the agent already reaches avoids this.

## Other responses

- `400`: Already answered, expired, an invalid path, or nothing is stored at that path — the location the agent is sent to has to be real.
- `403`: Called by an agent
- `404`: No such request, or no such vault in this org

---

[API](https://skmtc.dev/1claw/apis/1claw-api.md) · [All operations](https://skmtc.dev/1claw/apis/1claw-api/llms.txt) · [OpenAPI document](https://skmtc.dev/1claw/apis/1claw-api/revisions/5fa0918f3b41?raw)