Rotate or re-bind a secret
Rotate the value and/or change how it is delivered. A rotation reaches NEW RUNS ONLY: a session already running holds the old value — materialized in its box's environment, or inside an egress policy that cannot be read back — and there is no safe way to replace it mid-run.
Request body
The new credential. Same exposure as on create: it travels in this body.
null clears it; omit to leave it unchanged.
Switching to brokered requires the host binding in the same call; switching to materialized clears it.
Required for brokered, forbidden for materialized. Exact hostnames — no scheme, no port, no wildcard: the proxy matches a host, and a URL installs a rule that silently never fires.
Required for brokered, forbidden for materialized. e.g. Authorization.
Required for brokered, forbidden for materialized. The header value with {} where the secret goes, e.g. Bearer {}. A template without {} is rejected: it installs a constant header that never carries the credential.
Response
The updated secret, as metadata.
The environment-variable name (^[A-Z_][A-Z0-9_]*$). This IS the secret's identity: what a materialized delivery exports, what a workflow references, and what stays stable across a rotation. Immutable.
brokered — the sandbox's egress proxy injects the value as a request header OUTSIDE the VM, so the box never holds it. Prevents EXTRACTION, not USE: any process in the box can call the bound host while the policy is live, and it works for HTTPS APIs only (domain rules bind on ports 80/443). materialized — a real environment variable inside the box, which is the only thing a CLI can read; EXTRACTABLE BY DESIGN.
Brokered only: the exact hostnames the header is injected on.
Brokered only: the header name.
Brokered only: the header value, with {} where the secret goes.
project — admin-managed, delivered to every member's sessions. user — personal, delivered ONLY in sessions its owner starts and silently absent from anyone else's run of the same environment. Immutable.
Personal secrets only. Project-shared rows have no owner.
When this secret was last HANDED TO a run — not when it was last used. Brokered use is unobservable by construction (the proxy injects the header; the request is never seen here), so used would be a number nobody can honestly produce. null means nothing has been recorded, which is not the same as never delivered.