---
title: "Create a new tool set secret"
method: POST
path: "/v1/workspaces/{workspaceId}/tool_sets/{toolSetId}/secrets"
tags: ["ToolService", "Tool Set Secrets"]
---

# Create a new tool set secret

`POST /v1/workspaces/{workspaceId}/tool_sets/{toolSetId}/secrets`

Creates a new secret scoped to the tool set

## Path parameters

- `workspaceId` string, required
- `toolSetId` string, required

## Request body

- CreateToolSetSecretRequest
  - `workspaceId` string — The workspace that owns the tool set.
  - `toolSetId` string — The tool set that will own this secret. Accepts the canonical ts_… form or the external_id:<value> form.
  - `metadata` CreateResourceMetadata, required — CreateResourceMetadata contains the user-provided fields for creating a workspace-scoped resource. Read-only fields (id, account_id, workspace_id, profile_id, created_at) are excluded since they are set by the server.
    - `name` string, required — Human-readable name for the resource (e.g., "Customer Support Agent", "Email Tool")
    - `externalId` string — External ID for the resource (e.g., a workflow ID from an external system)
    - `labels` object — Key-value pairs for categorization and filtering. Values are 0-63 alphanumeric characters with "-", "_", or "." allowed between; keys follow the same shape and additionally accept an optional DNS-subdomain prefix (e.g. "cadenya.com/") of at most 253 characters. Examples: {"environment": "production", "team": "platform", "version": "v2"}
  - `spec` ToolSetSecretSpec, required
    - `value` string

## Response `200`

OK

- ToolSetSecret
  - `metadata` ResourceMetadata, required — Standard metadata for persistent, named resources (e.g., agents, tools, prompts)
    - `id` string, required — Unique identifier for the resource (prefixed ULID, e.g., "agent_01HXK...")
    - `accountId` string, required — Account this resource belongs to for multi-tenant isolation (prefixed ULID)
    - `workspaceId` string, required — Workspace this resource belongs to for organizational grouping (prefixed ULID)
    - `name` string, required — Human-readable name for the resource (e.g., "Customer Support Agent", "Email Tool") Required for resources that users interact with directly
    - `externalId` string — External ID for the resource (e.g., a workflow ID from an external system)
    - `labels` object — Key-value pairs for categorization and filtering. Values are 0-63 alphanumeric characters with "-", "_", or "." allowed between; keys follow the same shape and additionally accept an optional DNS-subdomain prefix (e.g. "cadenya.com/") of at most 253 characters. Examples: {"environment": "production", "team": "platform", "version": "v2"}
    - `profileId` string, required — ID of the actor (user or service account) that created this resource
    - `createdAt` string, date-time, required — Timestamp when this resource was created
    - `updatedAt` string, date-time — Timestamp when this resource was last updated
  - `spec` ToolSetSecretSpec, required
    - `value` string
  - `info` ToolSetSecretInfo
    - `lastUsedAt` string, date-time
    - `createdBy` Profile — A profile identifies a user or non-human principal (such as an API key) at the account level. Profiles are account-scoped and can be granted access to multiple workspaces.
      - `metadata` AccountResourceMetadata, required — AccountResourceMetadata is used to represent a resource that is associated to an account but not to a workspace.
        - `id` string, required — Unique identifier for the resource (prefixed ULID, e.g., "apikey_01HXK...")
        - `accountId` string, required — Account this resource belongs to for multi-tenant isolation (prefixed ULID)
        - `name` string, required — Human-readable name for the resource (e.g., "Customer Support Agent", "Email Tool") Required for resources that users interact with directly
        - `externalId` string — External ID for the resource (e.g., a workflow ID from an external system)
        - `labels` object — Key-value pairs for categorization and filtering. Values are 0-63 alphanumeric characters with "-", "_", or "." allowed between; keys follow the same shape and additionally accept an optional DNS-subdomain prefix (e.g. "cadenya.com/") of at most 253 characters. Examples: {"environment": "production", "team": "platform", "version": "v2"}
        - `profileId` string, required
        - `createdAt` string, date-time
      - `spec` ProfileSpec, required — Configuration for a profile.
        - `email` string — Email address of the profile. Required and unique within an account for user profiles.
        - `name` string — Display name (e.g., "Bobby Tables").
        - `type` 'PROFILE_TYPE_UNSPECIFIED' | 'PROFILE_TYPE_USER' | 'PROFILE_TYPE_API_KEY' | 'PROFILE_TYPE_SYSTEM', enum, required — Whether this profile represents a human user, an API key, or a system principal.

## Other responses

- `default` — Default error response

## Changes

- **2026-07-02** `06e0e37c1499` — 2 warning, 1 info
  - removed the request property `metadata/bundleKey`
  - removed the optional property `metadata/bundleKey` from the response with the `200` status
  - added the optional property `info/allOf[#/components/schemas/ToolSetSecretInfo]/createdBy/metadata/createdAt` to the response with the `200` status
- **2026-06-14** `a5462daf43c8` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/cadenya/apis/cadenya-api/changes/v1/workspaces/:workspaceId/tool_sets/:toolSetId/secrets/post.md)

---

[API](https://skmtc.dev/cadenya/apis/cadenya-api.md) · [All operations](https://skmtc.dev/cadenya/apis/cadenya-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/cadenya/cadenya-api/revisions/ac1a7f084068/schema)