---
title: "Update a secret’s description or usage permissions"
method: PATCH
path: "/v1/secrets/{secret_id}"
tags: ["Secrets"]
---

# Update a secret’s description or usage permissions

`PATCH /v1/secrets/{secret_id}`

## Request

- Base URL: `https://api.shardflux.dev`
- URL: `https://api.shardflux.dev/v1/secrets/{secret_id}`
- Auth: HTTP bearer

Takes effect for the next session start that resolves it. Names are immutable (delete and recreate).

## Path parameters

- `secret_id` string, uuid, required

## Request body

- object
  - `description` string
  - `allowed_project_ids` string[], nullable
  - `allowed_workspace_ids` string[], nullable
  - `allowed_tools` string[]

## Response `200`

Secret metadata. Values are write-only: no API returns them except the cell resolution endpoint.

- object: Secret metadata. Values are write-only: no API returns them except the cell resolution endpoint.
  - `id` string, uuid, required: UUIDv7, lowercase canonical form.
  - `organization_id` string, uuid, required: UUIDv7, lowercase canonical form.
  - `project_id` string, uuid, nullable, required: UUIDv7, lowercase canonical form.
  - `scope` union, required
    - 'organization'
    - 'project'
  - `name` string, required: Environment variable name the value is injected as.
  - `description` string, required
  - `current_version` integer, required
  - `permissions` object, required
    - `allowed_project_ids` string[], nullable, required: Organization secrets: projects whose workspaces may use it (null = every project of the organization, [] = none). Always null for project secrets.
    - `allowed_workspace_ids` string[], nullable, required: Only these workspaces (null = any workspace of the allowed projects). Not inherited by forks.
    - `allowed_tools` string[], required: Tools that may receive the value at session start (the tool token must carry the tool too).
  - `created_by` object, required
    - `type` union, required
      - 'user'
      - 'api_key'
    - `id` string, uuid, required: UUIDv7, lowercase canonical form.
  - `created_at` string, date-time, required: RFC 3339 UTC timestamp with Z.
  - `updated_at` string, date-time, required: RFC 3339 UTC timestamp with Z.
  - `rotated_at` string, date-time, nullable, required: RFC 3339 UTC timestamp with Z.
  - `deleted_at` string, date-time, nullable, required: RFC 3339 UTC timestamp with Z.

## Other responses

- `4XX`: Default Response
- `5XX`: Default Response

---

[API](https://skmtc.dev/shardflux/apis/shardflux-api.md) · [All operations](https://skmtc.dev/shardflux/apis/shardflux-api/llms.txt) · [OpenAPI document](https://skmtc.dev/shardflux/apis/shardflux-api/revisions/ea685f7b39c4?raw)