Reveals a secret value from H2O Secure Store and writes it to a file.

Retrieves a secret version from the secure store and writes its value to the specified path in the sandbox filesystem. The caller must be authorized to reveal the specified secret version.

Files are created with secure 0600 permissions (owner read/write only) to protect sensitive data.

The secret version name can use the "latest" alias to retrieve the most recently created version: "workspaces/{workspace}/secrets/{secret}/versions/latest" (-- api-linter: core::0136::prepositions=disabled aip.dev/not-precedent: The preposition "to" clearly indicates the destination format (file) and is essential for clarity. Alternative names like "RevealSecretAsFile" would be ambiguous. --)

post/v1/{name}/h2oSecureStore:revealSecretToFile

Request

Base URL
https://docs.h2o.ai (the document declares no server; this is the origin it was published from)
Auth
none declared
TypeScript
https://skmtc.dev/h2o/apis/ai-h2o-engine-sandbox-v1-filesystem-proto/docs/v1/:name/h2oSecureStore:revealSecretToFile/post.ts
A function with typed inputs. Its response is checked against the schema.

Path parameters

namestring required

Required. The name of the sandbox engine. Format: workspaces/{workspace}/sandboxEngines/{sandbox_engine}

Request body

secretVersionstring required

The version segment can be a specific version ID or "latest" to retrieve the most recently created SecretVersion.

Example: "workspaces/my-workspace/secrets/api-key/versions/latest"

pathstring required

Required. The absolute path in the sandbox filesystem where the secret value should be written. Must start with a forward slash (e.g., "/home/sandbox/.credentials/token"). If the file exists, it will be overwritten. Parent directories will be created automatically if they don't exist for security convenience (unlike other file operations which require explicit opt-in via create_parent_directories parameter). The file will be created with 0600 permissions (owner read/write only).

Response

A successful response.

secretVersionstring

Output only. The resource name of the SecretVersion that was revealed. Format: "workspaces/{workspace}/secrets/{secret}/versions/{version}" If "latest" was used in the request, this will contain the actual version ID.

Changes

No recorded changes to this operation across all 1 revision of this API.