secrets

Store or replace a secret that sandboxes use without seeing it.

Every sandbox of the organization (or, with only, the sandboxes it names by label or id, and every copy of the Apps it names) gets an environment variable of this name holding a placeholder. With header set, the egress proxy sets that header on every HTTPS request to the hosts and puts the value nowhere else; without, it replaces the placeholder with the value in a credential header (Authorization, x-api-key, x-goog-api-key, api-key, xi-api-key, x-subscription-token, private-token). A placeholder in the URL or any other header goes out as it is, so a server that echoes a request back never shows the value. With rules (an account with credit), only requests whose method and path a rule allows carry it. The value is sealed to the hosts' key and never returned. Replacing a secret keeps its placeholder. Takes effect on new connections within seconds.

put/v1/egress-secrets/{name}

Request

Base URL: https://api.withruntime.com
URL: https://api.withruntime.com/v1/egress-secrets/{name}
Auth: HTTP bearer

Path parameters

namestring required

The environment variable the placeholder is in, inside every sandbox of the organization. Upper case letters, digits and underscores.

Example:OPENAI_API_KEY

Headers

Idempotency-Keystring

Replaying the same key with the same request within 24 hours returns the first result and never repeats the effect. A refusal is not kept: a request refused before it ran (no_capacity, busy, a limit) runs afresh when sent again with its key. The SDKs send one automatically; the server makes one when absent and returns it in the idempotency-key response header.

Request body

valuestring required

The secret. Visible ASCII and spaces, at most 8 KiB. Stored sealed and never returned.

hostsstring[] required

Where the value may go. The proxy puts it only into HTTPS requests to these hosts.

headerstring

Optional. Set this header on every request to the hosts, replacing one the sandbox sent, so code needs no placeholder at all; the value then goes into this header and nowhere else. Without it, the placeholder is replaced only in a credential header: Authorization, x-api-key, x-goog-api-key, api-key, xi-api-key, x-subscription-token, private-token.

formatstring

Optional, with header. The header's value, with {value} where the secret goes. Default "{value}".

Example request

{
  "hosts": [
    "api.openai.com"
  ],
  "header": "Authorization",
  "format": "Bearer {value}",
  "rules": [
    {
      "methods": [
        "GET",
        "HEAD"
      ],
      "paths": [
        "/v1/chat/completions"
      ]
    }
  ],
  "only": {
    "labels": [
      {
        "role": "hub"
      }
    ]
  }
}

Response

Success

namestring

hostsstring[]

headerstring

formatstring

placeholderstring

What the sandbox sees in the environment variable. Without header, the proxy replaces it with the value in a credential header (Authorization, x-api-key, x-goog-api-key, api-key, xi-api-key, x-subscription-token, private-token) of HTTPS requests to the hosts; in the URL or any other header it goes out as it is.

valueBytesinteger

createdAtstring date-time

updatedAtstring date-time

enforcedboolean

True when every server running the organization's sandboxes, and every server still holding an earlier version, confirmed the change; a sandbox that starts or wakes later is given it before it runs. False while a server has not confirmed it yet: each server asks Runtime for changes every 15 seconds, and one that has not heard from Runtime for a minute sends no secret's value until it has.

Example response

{
  "rules": [
    {
      "methods": [
        "GET",
        "HEAD"
      ],
      "paths": [
        "/v1/chat/completions"
      ]
    }
  ],
  "only": {
    "labels": [
      {
        "role": "hub"
      }
    ]
  }
}

Changes

No recorded changes to this operation across all 1 revision of this API.