---
title: "Create a credential injection route"
method: POST
path: "/secrets/routes"
tags: ["Secrets"]
---

# Create a credential injection route

`POST /secrets/routes`

Requires an owner/admin browser session with recent MFA. Secret values are accepted only for create/rotate requests, never returned, and sensitive route hardening headers are advertised for mutation calls. Credential injection routes bind a secret to one tenant agent and an explicit allowlisted upstream host/path/method/header. Broad host, path, method, internal-host, line-break, and unsafe header injection patterns are rejected by the API.

## Headers

- `X-Steward-Request-Timestamp` string
- `X-Steward-Request-Expires-At` string
- `X-Steward-Signature` string
- `X-Steward-Signing-Key-Id` string
- `Idempotency-Key` string

## Request body

- object
  - `agentId` string, required
  - `hostPattern` string, required
  - `pathPattern` string
  - `method` '*' | 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE' | 'HEAD'
  - `injectAs` 'header', required
  - `injectKey` string, required
  - `injectFormat` string
  - `injectionStrategy` 'header' | 'sigv4'
  - `injectionConfig` object
    - `service` 'ec2'
    - `region` string
  - `priority` integer
  - `enabled` boolean
  - `secretId` string, required

## Response `201`

JSON response

- object
  - `ok` true, required
  - `data` object, required
    - `id` string, required
    - `tenantId` string, required
    - `agentId` string, required
    - `secretId` string, required
    - `hostPattern` string, required
    - `pathPattern` string, required
    - `method` '*' | 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE' | 'HEAD', required
    - `injectAs` 'header', required
    - `injectKey` string, required
    - `injectFormat` string, nullable
    - `injectionStrategy` 'header' | 'sigv4', required
    - `injectionConfig` object, required
      - `service` 'ec2'
      - `region` string
    - `priority` integer
    - `enabled` boolean, required
    - `createdAt` string, date-time

## Other responses

- `400` — JSON response
- `401` — JSON response
- `403` — JSON response
- `404` — JSON response
- `408` — JSON response
- `409` — JSON response

## Changes

- **2026-08-18** `0397c6d8e684` — 4 info
  - added the new optional request property `injectionConfig`
  - added the new optional request property `injectionStrategy`
  - added the required property `data/injectionConfig` to the response with the `201` status
  - added the required property `data/injectionStrategy` to the response with the `201` status
- **2026-08-17** `261a7c8070b2` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/steward-fi/apis/steward-api/changes/secrets/routes/post.md)

---

[API](https://skmtc.dev/steward-fi/apis/steward-api.md) · [All operations](https://skmtc.dev/steward-fi/apis/steward-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/steward-fi/steward-api/revisions/b88b4b97a664/schema)