---
title: "POST /team/secrets"
method: POST
path: "/team/secrets"
tags: ["team"]
---

# POST /team/secrets

`POST /team/secrets`

## Request

- Base URL: `https://api.scalar.com/core`
- URL: `https://api.scalar.com/core/team/secrets`
- Auth: HTTP bearer

Create a team secret or var. A team admin replaces the value of an existing name of the same kind unless the mode is create; anyone else, and a create, gets a conflict for one

## Request body

- object
  - `environment` string, required
  - `name` string, required
  - `kind` 'secret' | 'var', required
  - `value` string, required
  - `mode` 'create' | 'upsert'

## Response `200`

Default Response

- object
  - `uid` string, required
  - `environment` string, required
  - `name` string, required
  - `kind` 'secret' | 'var', required
  - `value` string
  - `fingerprint` string, required
  - `createdAt` number, required
  - `rotatedAt` number, nullable, required
  - `createdBy` string, nullable, required
  - `rotatedBy` string, nullable, required

## Other responses

- `400`: Bad request
- `401`: No auth
- `403`: Forbidden
- `404`: Not found
- `422`: Invalid payload
- `500`: Uncaught error

## Changes

- **2026-10-13** `31d9832a717b`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/scalar/apis/core/changes/team/secrets/post.md)

---

[API](https://skmtc.dev/scalar/apis/core.md) - [All operations](https://skmtc.dev/scalar/apis/core/llms.txt) - [OpenAPI document](https://skmtc.dev/scalar/apis/core/revisions/b3aa8493faa8?raw)