---
title: "Replace a secret's value or note, or a sign-in's site."
method: PATCH
path: "/o/{org}/secrets/{secret}"
tags: ["Secrets"]
---

# Replace a secret's value or note, or a sign-in's site.

`PATCH /o/{org}/secrets/{secret}`

## Request

- Base URL: `https://api.prix.dev`
- URL: `https://api.prix.dev/o/{org}/secrets/{secret}`
- Auth: HTTP bearer

Only its creator or an org admin. A sign-in's value is `username`, `password` and an optional `totp_secret`, replaced together; any other secret's is `value`. A sign-in's `targets` (its one https site) can change on its own, keeping the stored username and password, but only by the person who added it, signed in as themselves. Any other field but `description` is refused with `SECRET_FIELD_IMMUTABLE`.

## Request body

- object
  - `value` string
  - `username` string
  - `password` string
  - `totp_secret` string
  - `targets` string[]: A sign-in's new site
  - `description` string

## Response `200`

Updated.

- object
  - `data` Secret, required: A secret without its value.
    - `id` string, uuid, required
    - `name` string, required
    - `kind` 'env' | 'header' | 'login', required
    - `source` 'rush' | 'onepassword', required: Where the value lives; a 1Password secret holds only its reference.
    - `description` string, required
    - `project_id` string, uuid, required
    - `targets` string[], required: Hosts (header) or one origin (login); empty for env.
    - `header_name` string, nullable
    - `header_format` string, nullable
    - `has_totp` boolean, required
    - `created_by` string, uuid, nullable, required: Null once the member who added it has deleted their account; the secret stays with the Project.
    - `created_at` string, date-time, required
    - `value_updated_at` string, date-time, required
    - `last_used_at` string, date-time, nullable

## Other responses

- `403`: Not its creator or an org admin, or a new site from anyone but the person who added the sign-in.
- `404`: `SECRET_NOT_FOUND`: no such secret the caller can see.
- `409`: `SECRET_CHANGED`: a site-only move found the value replaced since it was read; read it again.
- `422`: `SECRET_FIELD_IMMUTABLE`, `SECRET_VALUE_INVALID` or `SECRET_DESCRIPTION_INVALID`.

## Changes

- **2026-10-20** `9fe798354562`: 2 info
  - added the new optional request property `targets`
  - added the non-success response with the status `409`

[Operation history](https://skmtc.dev/getrush/apis/rush-api/changes/o/:org/secrets/:secret/patch.md)

---

[API](https://skmtc.dev/getrush/apis/rush-api.md) · [All operations](https://skmtc.dev/getrush/apis/rush-api/llms.txt) · [OpenAPI document](https://skmtc.dev/getrush/apis/rush-api/revisions/05fb36ca864f?raw)