---
title: "Put App Secret"
method: PUT
path: "/apps/{app_id}/secrets/{secret_key}"
tags: ["Apps"]
---

# Put App Secret

`PUT /apps/{app_id}/secrets/{secret_key}`

## Request

- Base URL: `https://be.graph8.com/api/v1`
- URL: `https://be.graph8.com/api/v1/apps/{app_id}/secrets/{secret_key}`
- Auth: HTTP bearer

Declare a secret, or rotate where an existing one lives.

UPSERT, not create. Re-declaring a key is a rotation rather than a 409: the
builder is saying the value moved, and refusing would make the common case an
error and push them towards delete-then-create, which loses `created_at` and
briefly leaves the app declaring nothing.

`provider_ref` is a POINTER. The DTO refuses the obvious credential shapes,
which is a guardrail against the honest mistake rather than a security
control: nothing can reliably tell a path from a secret, but someone pasting a
value because the field sits next to the key is the likely error, and this
turns a silent unrecoverable leak into a 422 they read.

## Path parameters

- `app_id` string, required
- `secret_key` string, required

## Headers

- `Authorization` string, nullable
- `X-Org-Id` string, nullable

## Request body

- PutAppSecretRequest: Declare (or rotate) one secret. `provider_ref` is the ONLY writable field, and it is a pointer. A `value` field here would make every backup of the control plane a place credentials leak from, which is why the table has no column for one.
  - `provider_ref` string, nullable: Secret-manager PATH for the value. Never the value itself.

## Response `200`

Successful Response

- ApiResponseAppSecretResponse
  - `data` AppSecretResponse, required: One declared secret. A POINTER and two timestamps, never a value. There is no `value` field and there must never be one. The control plane stores WHICH secrets an app declares and where they live, so a build can be rendered without the platform ever holding what the build will read.
    - `secret_key` string, required
    - `provider_ref` string, nullable: Where the value lives, e.g. a secret-manager path. Never the value.
    - `created_at` string, date-time, nullable
    - `rotated_at` string, date-time, nullable: Last time this declaration was rewritten. Moves on every write, including one that repeats the same pointer: the pointer is not the secret, so an unchanged path does not mean an unchanged value.
  - `pagination` PaginationMeta
    - `page` integer, required: Current page number (1-indexed)
    - `limit` integer, required: Items per page
    - `total` integer, required: Total number of items
    - `has_next` boolean, required: Whether there are more pages
    - `next_cursor` string, nullable: Opaque cursor for the next page; null when there are no more items. Pass it back as the `cursor` query param to fetch the following page without computing page numbers.
    - `total_available` integer, nullable: Search endpoints only: how many records really match, when known. Can be larger than `total`, which is capped at the 10,000 results that can be paged. For company search this is a distinct-company estimate. Null when unknown; absent outside search.
    - `total_is_lower_bound` boolean, nullable: Search endpoints only: true when more records match than `total` shows (the result set is larger than the 10,000 results that can be paged). Absent outside search.
    - `notes` string[], nullable: Search endpoints only: plain-language notes about the result, e.g. that more records match than can be paged, or that a reversed `between` range was put in order.

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/graph8/apis/graph8-developer-api.md) · [All operations](https://skmtc.dev/graph8/apis/graph8-developer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/graph8/apis/graph8-developer-api/revisions/89fc11143b70?raw)