---
title: "Return a website approval URL so the account owner can grant a user-scoped secret to a saved package (one-click Allow..."
method: POST
path: "/v1/secrets/lock"
tags: ["secrets"]
---

# Return a website approval URL so the account owner can grant a user-scoped secret to a saved package (one-click Allow...

`POST /v1/secrets/lock`

## Request

- Base URL: `https://api.kody.codes`
- URL: `https://api.kody.codes/v1/secrets/lock`
- Auth: HTTP bearer

Return a website approval URL so the account owner can grant a user-scoped secret to a saved package (one-click Allow, same spirit as /connect/secrets host approval). This capability does not change allowed_packages. Send the approval_url to the user and wait; never treat this call as a grant. Only the owner can add a grant at /@<slug>/-/secrets/approve or the secret editor. Removing a grant is also website-only. User secrets still allow execute and self-authored / adopted packages to read unless the owner tightens further on the account page. secretSet cannot change allowed_packages.

Org permission: `secret:use`.

## Request body

- object
  - `name` string, required: User-scoped secret name to grant.
  - `package_id` string, required: Saved package id that may use this secret.

## Response `200`

Success.

- object
  - `name` string, required
  - `scope` 'user', required
  - `allowed_packages` string[], required
  - `usage_url` string, required
  - `status` 'approval_required' | 'already_granted', required
  - `approval_url` string, required
  - `message` string, required

## Other responses

- `400`: Error envelope `{ "error": { "code", "message", "details"? } }`.
- `401`: Error envelope `{ "error": { "code", "message", "details"? } }`.
- `403`: Error envelope `{ "error": { "code", "message", "details"? } }`.
- `404`: Error envelope `{ "error": { "code", "message", "details"? } }`.
- `409`: Error envelope `{ "error": { "code", "message", "details"? } }`.
- `413`: Error envelope `{ "error": { "code", "message", "details"? } }`.
- `429`: Too many requests (edge IP/token limit) or an entitlement / plan-cap limit. Wait at least `Retry-After` seconds before retrying.
- `500`: Error envelope `{ "error": { "code", "message", "details"? } }`.
- `503`: Error envelope `{ "error": { "code", "message", "details"? } }`.
- `default`: Error envelope `{ "error": { "code", "message", "details"? } }`.

---

[API](https://skmtc.dev/kody/apis/kody-api.md) · [All operations](https://skmtc.dev/kody/apis/kody-api/llms.txt) · [OpenAPI document](https://skmtc.dev/kody/apis/kody-api/revisions/a020ecedb82b?raw)