---
title: "Copy workspace secrets to an intern"
method: POST
path: "/vault/interns/{internId}/secrets/copy"
tags: ["Vault"]
---

# Copy workspace secrets to an intern

`POST /vault/interns/{internId}/secrets/copy`

Copies the named workspace secrets into one intern's scope, replacing any intern secret with the same name. Each copy keeps the source value and host bindings. Every name must exist in the workspace scope or the request fails with 404 and nothing is copied. A workspace secret whose `hosts` is `null` cannot be copied: the request fails with 409 and nothing is copied until that secret is stored again with hosts. The response carries metadata only. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.

## Path parameters

- `internId` string, uuid, required — UUID of an intern in the workspace selected by the API key.

## Request body

- VaultSecretCopyRequest — Workspace secrets to copy into the intern scope.
  - `names` string[], required — Names of workspace secrets to copy, 1 to 100 unique entries. Every name must exist in the workspace scope.

## Response `200`

Metadata for the copied secrets.

- VaultSecretCopyResponse — Metadata for the copies now stored in the intern scope, one entry per requested name.
  - `data` VaultSecret[], required
    - `created_at` string, date-time, required
    - `fingerprint` string, nullable, required
    - `hosts` string[], nullable, required
    - `name` string, required

## Other responses

- `400` — Bad Request - The secret name, path, query or JSON body failed validation. The vault returns 400 for a malformed request as well.
- `401` — Unauthorized - Missing or unknown API key. Provisioning keys cannot call vault routes.
- `403` — Forbidden - The key has no usable workspace scope, or the request arrived on a regional hostname.
- `404` — Not Found - The intern is not in the selected workspace, the secret does not exist in the selected scope, or the caller is outside the intern programme.
- `408` — Request Timeout - The route deadline passed before the request completed, or the request body stopped arriving.
- `409` — Conflict - A named workspace secret has no hosts yet, or the intern is being transferred to another workspace. Nothing is copied.
- `413` — Payload Too Large - The JSON body exceeds 425000 bytes.
- `429` — Too Many Requests - The vault rate limit was reached.
- `500` — Internal Server Error - Scope lookup failed.
- `502` — Bad Gateway - The vault could not be reached or returned an unexpected response.
- `503` — Service Unavailable - Vault writes are disabled for the caller, or the vault is not configured.
- `504` — Gateway Timeout - The vault did not answer in time.

## Changes

- **2026-09-16** `1e05e5f6495c` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/openrouterteam/apis/openrouter-api/changes/vault/interns/:internId/secrets/copy/post.md)

---

[API](https://skmtc.dev/openrouterteam/apis/openrouter-api.md) · [All operations](https://skmtc.dev/openrouterteam/apis/openrouter-api/llms.txt) · [OpenAPI document](https://skmtc.dev/openrouterteam/apis/openrouter-api/revisions/024c455cb825?raw)