---
title: "Set a secret or variable"
method: POST
path: "/workflows/config"
tags: ["Workflow secrets and variables"]
---

# Set a secret or variable

`POST /workflows/config`

## Request

- Base URL: `https://api.nullplatform.com`
- URL: `https://api.nullplatform.com/workflows/config`
- Auth: HTTP bearer

Creates a secret or variable, or rotates its value if it already exists at that place. Safe to call repeatedly.

- The place is exactly one of `path` (a folder, `/` for the whole organization) or `workflow` (one workflow).
- Writing a name that already exists at that place replaces its value; workflows referencing it pick the new value up on their next run.
- The `name` and the `secret` flag are immutable: to change them, delete the entry and recreate it.

## Request body

- object
  - `name` string, required: Entry name (`^[A-Za-z_][A-Za-z0-9_]{0,127}$`), referenced as `secrets.NAME` or `vars.NAME`.
  - `value` string, required: The value. Never returned again if `secret` is true.
  - `secret` boolean, required: Write-only secret (true) or readable variable (false).
  - `path` string: Folder place. Mutually exclusive with `workflow`.
  - `workflow` string: Workflow reference (`wf_...` id or key). Mutually exclusive with `path`.

## Response `200`

The entry already existed; its value was rotated.

- ConfigEntry: A secret or variable. Exactly one of `path` or `workflow` identifies the place it lives. Secret values are write-only: they are never returned by any read.
  - `id` string, required
  - `name` string, required: Referenced in definitions as `${{ secrets.NAME }}` or `${{ vars.NAME }}`.
  - `secret` boolean, required: Immutable. `true` makes the value write-only and redacted everywhere.
  - `path` string: Folder place (`/` is the organization root). Present when the entry lives on a folder.
  - `workflow` string: Workflow reference. Present when the entry lives on one workflow.
  - `value` string, nullable: Only returned for non-secret entries.
  - `effective` boolean: Only with `ancestors=true`: whether this row wins precedence for its name.
  - `mode` 'created' | 'updated': Write responses only: whether the entry was created or its value rotated.
  - `createdBy` string
  - `createdAt` string, date-time, required
  - `updatedAt` string, date-time, required

## Other responses

- `201`: The entry was created.
- `4XX`: Client error, as plain JSON.
- `5XX`: Unexpected server error.

## Changes

- **2026-09-17** `43b3c1ecdfd8`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/nullplatform/apis/nullplatform-api/changes/workflows/config/post.md)

---

[API](https://skmtc.dev/nullplatform/apis/nullplatform-api.md) - [All operations](https://skmtc.dev/nullplatform/apis/nullplatform-api/llms.txt) - [OpenAPI document](https://skmtc.dev/nullplatform/apis/nullplatform-api/revisions/d3f66bc633d4?raw)