Replace a secret’s value

Replaces the value and moves revision_id. Send the revision_id you read: if it has moved since, the answer is 409 with reason: "stale_revision" and nothing changed. Sending the same request again gets the same answer: read the secret again and retry with its current revision_id.

A computer bound to it as an environment variable gets the new value in its desktop session at its next start or restart; on an image that supports it, a running one is also sent the new value for new shells and for every exec, plain or with session: "desktop", so the next one sees it, while programs already running keep the value they started with. One bound to it as a FILE is also sent the new value while it runs. Both are sent asynchronously and on a best-effort basis: the answer does not wait for that, and does not say whether it landed. Unless the update was confirmed — not if its host was unreachable, or refused it, or took it and never answered — a running computer may still hold the old value until its next start or restart, which always delivers the latest.

A secret a computer’s egress_proxy.credentials_secret_id names must keep a user:password value (a colon, no control characters, one trailing newline ignored): any other is refused with 400 and nothing changed. Owners only.

A secret in a workspace is found only with that workspace_id; for any other it is a 404, a workspace_id that names no workspace of this account included. An API key confined to a workspace that names any other scope, null included, is refused with 403 instead; an account-wide key gets the 404.

Requires the owner role or higher.