---
title: "Move the secrets of other vaults into this one [write]"
method: POST
path: "/vaults/{id}/secrets/move"
tags: ["vaults"]
---

# Move the secrets of other vaults into this one \[write\]

`POST /vaults/{id}/secrets/move`

## Request

- Base URL: `https://api.agentsky.dev/v1`
- URL: `https://api.agentsky.dev/v1/vaults/{id}/secrets/move`
- Auth: HTTP bearer

Moves every secret of the `from` vaults of the same workspace into this vault and answers what happened to each, by name; a value is never returned. A secret is copied and confirmed stored before its source copy is touched, and the source copy is removed only when no session that is not archived still uses that vault without this one (`source` says which). A name this vault already holds with another value is a `clash` and is left alone unless it is listed in `replace`. A secret past this vault's limit, or one that could not be applied together with this vault's secrets, is `blocked` with a `reason`. Calling again moves nothing twice: what is already here answers `already`. With `dry_run` nothing is written and the outcomes are what a real call would do.

## Path parameters

- `id` string, required

## Request body

- MoveVaultSecrets
  - `from` string[], required: The vaults to move out of (vlt_…)
  - `replace` object[]: Clashing names to overwrite in this vault with the named source's secret
    - `from` string, required
    - `name` string, required
  - `dry_run` boolean

## Response `200`

OK

- VaultSecretMove
  - `dry_run` boolean, required
  - `secrets` object[], required
    - `from` string, required: The vault it was in (vlt_…)
    - `name` string, required: The environment variable name, or the display name of an MCP secret
    - `auth_type` 'static_bearer' | 'mcp_oauth' | 'environment_variable', required
    - `outcome` 'moved' | 'already' | 'clash' | 'blocked', required
    - `source` 'removed' | 'kept', required: Whether the copy in the source vault was removed
    - `reason` string: Why a secret is blocked, e.g. limit_reached or egress_header_conflict

## Other responses

- `default`: Error — { error: { code, message } }

## Changes

- **2026-11-02** `e5e8f0229a99`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/agentsky/apis/agentsky-developer-api/changes/vaults/:id/secrets/move/post.md)

---

[API](https://skmtc.dev/agentsky/apis/agentsky-developer-api.md) - [All operations](https://skmtc.dev/agentsky/apis/agentsky-developer-api/llms.txt) - [OpenAPI document](https://skmtc.dev/agentsky/apis/agentsky-developer-api/revisions/0d435187cd55?raw)