--- title: "POST /v1/{+parent}/secrets" method: POST path: "/v1/{+parent}/secrets" tags: ["projects"] --- # POST /v1/{+parent}/secrets `POST /v1/{+parent}/secrets` Creates a new Secret containing no SecretVersions. ## Path parameters - `parent` string, required ## Query parameters - `secretId` string ## Request body - Secret — A Secret is a logical secret whose value and versions can be accessed. A Secret is made up of zero or more SecretVersions that represent the secret data. - `policyMember` ResourcePolicyMember — Output-only policy member strings of a Google Cloud resource's built-in identity. - `iamPolicyNamePrincipal` string — Output only. IAM policy binding member referring to a Google Cloud resource by user-assigned name (https://google.aip.dev/122). If a resource is deleted and recreated with the same name, the binding will be applicable to the new resource. Example: `principal://parametermanager.googleapis.com/projects/12345/name/locations/us-central1-a/parameters/my-parameter` - `iamPolicyUidPrincipal` string — Output only. IAM policy binding member referring to a Google Cloud resource by system-assigned unique identifier (https://google.aip.dev/148#uid). If a resource is deleted and recreated with the same name, the binding will not be applicable to the new resource Example: `principal://parametermanager.googleapis.com/projects/12345/uid/locations/us-central1-a/parameters/a918fed5` - `tags` object — Optional. Input only. Immutable. Mapping of Tag keys/values directly bound to this resource. For example: "123/environment": "production", "123/costCenter": "marketing" Tags are used to organize and group resources. Tags can be used to control policy evaluation for the resource. - `topics` Topic[] — Optional. A list of up to 10 Pub/Sub topics to which messages are published when control plane operations are called on the secret or its versions. - `name` string — Identifier. The resource name of the Pub/Sub topic that will be published to, in the following format: `projects/*/topics/*`. For publication to succeed, the Secret Manager service agent must have the `pubsub.topic.publish` permission on the topic. The Pub/Sub Publisher role (`roles/pubsub.publisher`) includes this permission. - `expireTime` string, google-datetime — Optional. Timestamp in UTC when the Secret is scheduled to expire. This is always provided on output, regardless of what was sent on input. - `customerManagedEncryption` CustomerManagedEncryption — Configuration for encrypting secret payloads using customer-managed encryption keys (CMEK). - `kmsKeyName` string — Required. The resource name of the Cloud KMS CryptoKey used to encrypt secret payloads. For secrets using the UserManaged replication policy type, Cloud KMS CryptoKeys must reside in the same location as the replica location. For secrets using the Automatic replication policy type, Cloud KMS CryptoKeys must reside in `global`. The expected format is `projects/*/locations/*/keyRings/*/cryptoKeys/*`. - `etag` string — Optional. Etag of the currently stored Secret. - `versionDestroyTtl` string, google-duration — Optional. Secret Version TTL after destruction request This is a part of the Delayed secret version destroy feature. For secret with TTL>0, version destruction doesn't happen immediately on calling destroy instead the version goes to a disabled state and destruction happens after the TTL expires. - `annotations` object — Optional. Custom metadata about the secret. Annotations are distinct from various forms of labels. Annotations exist to allow client tools to store their own state information without requiring a database. Annotation keys must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes, begin and end with an alphanumeric character ([a-z0-9A-Z]), and may have dashes (-), underscores (_), dots (.), and alphanumerics in between these symbols. The total size of annotation keys and values must be less than 16KiB. - `rotation` Rotation — The rotation time and period for a Secret. At next_rotation_time, Secret Manager will send a Pub/Sub notification to the topics configured on the Secret. Secret.topics must be set to configure rotation. - `rotationPeriod` string, google-duration — Input only. The Duration between rotation notifications. Must be in seconds and at least 3600s (1h) and at most 3153600000s (100 years). If rotation_period is set, next_rotation_time must be set. next_rotation_time will be advanced by this period when the service automatically sends rotation notifications. - `managedRotationStatus` ManagedRotationStatus — Represents the status of a managed rotation. This is applicable only to Typed Secrets. It indicates whether the rotation is active and any errors that may have occurred during the asynchronous managed rotation. - `error` Status — The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors). - `message` string — A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client. - `details` object[] — A list of messages that carry the error details. There is a common set of message types for APIs to use. - `code` integer — The status code, which should be an enum value of google.rpc.Code. - `state` 'STATE_UNSPECIFIED' | 'ACTIVE' | 'INACTIVE' — Output only. Indicates whether the Managed Rotation is active or not. - `nextRotationTime` string, google-datetime — Optional. Timestamp in UTC at which the Secret is scheduled to rotate. Cannot be set to less than 300s (5 min) in the future and at most 3153600000s (100 years). next_rotation_time MUST be set if rotation_period is set. - `versionAliases` object — Optional. Mapping from version alias to version name. A version alias is a string with a maximum length of 63 characters and can contain uppercase and lowercase letters, numerals, and the hyphen (`-`) and underscore ('_') characters. An alias string must start with a letter and cannot be the string 'latest' or 'NEW'. No more than 50 aliases can be assigned to a given secret. Version-Alias pairs will be viewable via GetSecret and modifiable via UpdateSecret. Access by alias is only be supported on GetSecretVersion and AccessSecretVersion. - `labels` object — The labels assigned to this Secret. Label keys must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes, and must conform to the following PCRE regular expression: `\p{Ll}\p{Lo}{0,62}` Label values must be between 0 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes, and must conform to the following PCRE regular expression: `[\p{Ll}\p{Lo}\p{N}_-]{0,63}` No more than 64 labels can be assigned to a given resource. - `ttl` string, google-duration — Input only. The TTL for the Secret. - `name` string — Output only. The resource name of the Secret in the format `projects/*/secrets/*`. - `createTime` string, google-datetime — Output only. The time at which the Secret was created. - `secretType` 'SECRET_TYPE_UNSPECIFIED' | 'CLOUD_SQL_DB_CREDENTIALS' | 'ACCESS_KEY' | 'CERTIFICATE' | 'OTHER_DB_CREDENTIALS' | 'OTHER' — Optional. Immutable. This defines the type of the secret. Enforces certain structural requirements on the SecretVersions. For secret of type UNSPECIFIED, the SecretVersions can be of any type. - `replication` Replication — A policy that defines the replication and encryption configuration of data. - `userManaged` UserManaged — A replication policy that replicates the Secret payload into the locations specified in Replication.UserManaged.replicas - `replicas` Replica[] — Required. The list of Replicas for this Secret. Cannot be empty. - `location` string — The canonical IDs of the location to replicate data. For example: `"us-east1"`. - `customerManagedEncryption` CustomerManagedEncryption — Configuration for encrypting secret payloads using customer-managed encryption keys (CMEK). - `kmsKeyName` string — Required. The resource name of the Cloud KMS CryptoKey used to encrypt secret payloads. For secrets using the UserManaged replication policy type, Cloud KMS CryptoKeys must reside in the same location as the replica location. For secrets using the Automatic replication policy type, Cloud KMS CryptoKeys must reside in `global`. The expected format is `projects/*/locations/*/keyRings/*/cryptoKeys/*`. - `automatic` Automatic — A replication policy that replicates the Secret payload without any restrictions. - `customerManagedEncryption` CustomerManagedEncryption — Configuration for encrypting secret payloads using customer-managed encryption keys (CMEK). - `kmsKeyName` string — Required. The resource name of the Cloud KMS CryptoKey used to encrypt secret payloads. For secrets using the UserManaged replication policy type, Cloud KMS CryptoKeys must reside in the same location as the replica location. For secrets using the Automatic replication policy type, Cloud KMS CryptoKeys must reside in `global`. The expected format is `projects/*/locations/*/keyRings/*/cryptoKeys/*`. ## Response `200` Successful response --- [API](https://skmtc.dev/google/apis/secretmanager.md) · [All operations](https://skmtc.dev/google/apis/secretmanager/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/google/secretmanager/revisions/7d97d4a1afab/schema)