---
title: "Return a website approval URL so the account owner can grant a saved package use of one external secret-provider ref ..."
method: POST
path: "/v1/secret-providers/{provider}/lock"
tags: ["secrets"]
---

# Return a website approval URL so the account owner can grant a saved package use of one external secret-provider ref ...

`POST /v1/secret-providers/{provider}/lock`

## Request

- Base URL: `https://api.kody.codes`
- URL: `https://api.kody.codes/v1/secret-providers/{provider}/lock`
- Auth: HTTP bearer

Return a website approval URL so the account owner can grant a saved package use of one external secret-provider ref (canonical i/<item-id>/<field>: UUID or 1Password Connect 26-char id). This capability does not change grants. Send the approval_url to the user and wait. Ad hoc execute does not need this grant; saved packages do.

Org permission: `secret:use`.

## Path parameters

- `provider` string, required: Provider id, for example 1password.

## Request body

- object
  - `ref` string, required: Canonical i/<item-id>/<field> ref (UUID or 1Password Connect 26-char id), or an op:// synonym that already contains that item id.
  - `package_id` string, required: Saved package id that may use this provider ref.

## Response `200`

Success.

- object
  - `provider` string, required
  - `canonical_ref` string, required
  - `package_id` string, required
  - `usage_url` string, required
  - `status` 'approval_required' | 'already_granted', required
  - `approval_url` string, required
  - `message` string, required

## Other responses

- `400`: Error envelope `{ "error": { "code", "message", "details"? } }`.
- `401`: Error envelope `{ "error": { "code", "message", "details"? } }`.
- `403`: Error envelope `{ "error": { "code", "message", "details"? } }`.
- `404`: Error envelope `{ "error": { "code", "message", "details"? } }`.
- `409`: Error envelope `{ "error": { "code", "message", "details"? } }`.
- `413`: Error envelope `{ "error": { "code", "message", "details"? } }`.
- `429`: Too many requests (edge IP/token limit) or an entitlement / plan-cap limit. Wait at least `Retry-After` seconds before retrying.
- `500`: Error envelope `{ "error": { "code", "message", "details"? } }`.
- `503`: Error envelope `{ "error": { "code", "message", "details"? } }`.
- `default`: Error envelope `{ "error": { "code", "message", "details"? } }`.

---

[API](https://skmtc.dev/kody/apis/kody-api.md) · [All operations](https://skmtc.dev/kody/apis/kody-api/llms.txt) · [OpenAPI document](https://skmtc.dev/kody/apis/kody-api/revisions/705f4f022728?raw)