---
title: "Put Current Workspace Secret"
method: PUT
path: "/api/v1/workspaces/current/secrets/{key}"
tags: ["workspaces"]
---

# Put Current Workspace Secret

`PUT /api/v1/workspaces/current/secrets/{key}`

## Request

- Base URL: `https://api.smith.langchain.com`
- URL: `https://api.smith.langchain.com/api/v1/workspaces/current/secrets/{key}`
- Auth: one of:
  - API key in header `X-API-Key`
  - API key in header `X-Tenant-Id`
  - HTTP bearer

Create or update a workspace secret and the hosts it may be sent to.

Omit `value` to keep the current one; it is required to create a secret.
`configs` replaces the secret's hosts; omitted or empty restores the
built-in defaults for known provider keys. The value is never returned.

## Path parameters

- `key` string, required

## Request body

- WorkspaceSecretUpsert
  - `value` string, nullable: Secret value. Required to create a secret; omit to keep the current value.
  - `configs` SecretConfigInput[], nullable: Full replacement of the allowed hosts. Omitted or empty removes custom hosts so the built-in defaults, if any, apply.
    - `host_pattern` string, required: Exact host or a leading '*.' wildcard, e.g. 'api.openai.com'.
    - `header_name` string, nullable: HTTP header the secret is sent in. Null leaves it to the consumer.
    - `header_value_template` string, nullable: Header value with '{value}' replaced by the secret, e.g. 'Bearer {value}'. Null sends the raw secret.

## Response `200`

Successful Response

- WorkspaceSecret: A workspace secret's key and the hosts it may be sent to. Never the value.
  - `key` string, required
  - `configs` SecretConfig[]: Hosts the secret may be sent to, with built-in defaults applied. Listed secrets include it only when include_configs is true.
    - `host_pattern` string, required: Exact host or a leading '*.' wildcard, e.g. 'api.openai.com'.
    - `header_name` string, nullable: HTTP header the secret is sent in. Null leaves it to the consumer.
    - `header_value_template` string, nullable: Header value with '{value}' replaced by the secret, e.g. 'Bearer {value}'. Null sends the raw secret.
    - `id` string, uuid, nullable: Omitted for a built-in default.
    - `source` 'DEFAULT' | 'CUSTOM', required: Whether a secret config comes from the built-in catalog or an admin.
    - `created_at` string, date-time, nullable: Omitted for a built-in default.
    - `updated_at` string, date-time, nullable: Omitted for a built-in default.

## Other responses

- `201`: Secret created.
- `400`: The value is missing for a new secret, or a host config is invalid.
- `422`: Validation Error

## Changes

- **2026-10-16** `1a8ee9358d81`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/langchain-ai/apis/langsmith/changes/api/v1/workspaces/current/secrets/:key/put.md)

---

[API](https://skmtc.dev/langchain-ai/apis/langsmith.md) - [All operations](https://skmtc.dev/langchain-ai/apis/langsmith/llms.txt) - [OpenAPI document](https://skmtc.dev/langchain-ai/apis/langsmith/revisions/7a01c01f75e8?raw)