HYhyperbrowser

Create a secret

Changed on

Creates a secret without a value. Then upload its value with POST /api/secrets/{id}/versions, encrypted with the encryptionContext this returns. A team can have at most 100 secrets. Secrets are enabled for teams on request; please contact support to enable them (otherwise 403 SECRETS_FEATURE_DISABLED). Restricted API keys need the secrets.manage scope. When you're signed in rather than using an API key, you must be a team owner or admin (otherwise 403 SECRETS_ADMIN_REQUIRED).

post/api/secrets

Request

Request body

namestring required

1-128 letters, digits, _ or -, starting with a letter or digit. Unique within your team.

descriptionstring

Trimmed before it's stored.

type'secret' | 'totp' | 'op_token'

What the value is. Fixed at creation. secret: any string, set as an environment variable and, once it has allowed origins, typed into browser pages. totp: an authenticator seed (base32, or an otpauth://totp/ URI); environment variables get the code current when the process starts, and fills type the code current at fill time. op_token: a 1Password service account token, used only to read the onePassword fields of a sandbox create, process start or browser credential fill; it's never an environment variable, a vault entry or a value typed into a page. Treat types you don't recognize as opaque: more may be added.

protection'platform' | 'customer'

platform (the default): the value is encrypted to the platform key. customer: each version is also wrapped with your own key, and each use passes the envelope you unwrapped. See Customer-protected secrets.

Response

Success

idstring uuid required
namestring required

1-128 letters, digits, _ or -, starting with a letter or digit. Unique within your team.

descriptionstring required
type'secret' | 'totp' | 'op_token' required

What the value is. Fixed at creation. secret: any string, set as an environment variable and, once it has allowed origins, typed into browser pages. totp: an authenticator seed (base32, or an otpauth://totp/ URI); environment variables get the code current when the process starts, and fills type the code current at fill time. op_token: a 1Password service account token, used only to read the onePassword fields of a sandbox create, process start or browser credential fill; it's never an environment variable, a vault entry or a value typed into a page. Treat types you don't recognize as opaque: more may be added.

encryptionContextstring required

Copy this verbatim into the ctx header of every envelope you upload for this secret. Don't build it yourself: it includes the secret's type for types other than secret, and an envelope sealed with another context returns 400 SECRET_ENVELOPE_INVALID.

latestVersioninteger nullable required

The newest version number, or null until a value is uploaded.

createdAtstring date-time required
updatedAtstring date-time required
protection'platform' | 'customer'

platform (the default): the value is encrypted to the platform key. customer: each version is also wrapped with your own key, and each use passes the envelope you unwrapped. See Customer-protected secrets.

Changes