---
title: "Create or update an organization secret"
method: POST
path: "/v1/orgs/{orgId}/secrets"
tags: ["Secrets"]
---

# Create or update an organization secret

`POST /v1/orgs/{orgId}/secrets`

## Request

- Base URL: `https://api.spice.ai`
- URL: `https://api.spice.ai/v1/orgs/{orgId}/secrets`
- Auth: HTTP bearer

Creates an organization secret, or replaces the value of the one with the same name. The value is encrypted at rest and never returned. A name reserved by a platform-managed secret is refused.

## Path parameters

- `orgId` integer, required

## Headers

- `X-Org-Name` string

## Request body

- object
  - `name` string, required
  - `value` string, required

## Response `200`

The existing secret's value was replaced

- Secret
  - `id` integer: Unique identifier for the secret
  - `name` string: Name of the secret
  - `value` string: Always masked with asterisks
  - `created_at` string, date-time: Timestamp when the secret was created
  - `updated_at` string, date-time: Timestamp when the secret was last updated

## Other responses

- `201`: The secret was created
- `400`: Invalid org id (`invalid_org_id`), X-Org-Name does not name that org (`org_path_mismatch`), or the JSON body is not valid
- `401`: Unauthorized
- `403`: Insufficient scope (requires secrets:write), the viewer role, or the caller is not a member of the organization (`org_forbidden`), a machine credential named an organization other than its own (`org_assertion_mismatch`), or the organization a machine credential is bound to has been deleted (`org_deleted`)
- `409`: The name is reserved by a platform-managed secret (code: `secret_name_reserved`)
- `413`: Request body too large
- `500`: Internal server error

---

[API](https://skmtc.dev/spice/apis/spice-cloud-control-plane-api.md) - [All operations](https://skmtc.dev/spice/apis/spice-cloud-control-plane-api/llms.txt) - [OpenAPI document](https://skmtc.dev/spice/apis/spice-cloud-control-plane-api/revisions/5f3b75dd847d?raw)