Create a secret

Stores a value under a name, encrypted, for binding to computers with PUT /computers/{id}/secrets. The answer is the secret without its value; the value cannot be read back by any route.

Owners only. A name is unique within its scope: a taken one is a 409 with reason: "name_taken", and sending the same request again gets the same answer.

TWO LIMITS, both answered 400: the account holds at most 100 secrets at once, and deleting one frees a place. A workspace holding active secrets cannot be deleted (see DELETE /workspaces/{id}). Secrets orphaned by older workspace deletions remain unreachable and still count; this safeguard does not repair them. The account may create at most 1000 over its lifetime, deleted ones included, which deleting does not free — once that is reached, only support can raise it. GET /secrets reports both in limits.

Without workspace_id the secret is account-wide, and a computer in any workspace may be bound to it. An API key confined to a workspace creates in that workspace, and naming any other scope is a 403. From an account-wide key, a workspace_id that names no workspace of this account is a 400, No such workspace on this account.

Requires the owner role or higher.