secrets

Narrow where a secret goes, without its value.

Sets the secret's hosts and/or rules to ones that let the value go nowhere new: every host one of its hosts names (a.example.com or *.a.example.com under *.example.com), and every method and path a rule allows one its rules allow now (a secret without rules allows every request, so any rules narrow it). Either left out stays as it is. Anything wider is refused (400, invalid_request): a new place could learn the value, so widening needs the value (PUT /v1/egress-secrets/{name}). Recorded in the audit log as an update with narrowed. Takes effect on new connections within seconds.

put/v1/egress-secrets/{name}/rules

Request

  • Base URL: https://api.withruntime.com
  • URL: https://api.withruntime.com/v1/egress-secrets/{name}/rules
  • Auth: HTTP bearer

Path parameters

namestring required

The environment variable the placeholder is in, inside every sandbox of the organization. Upper case letters, digits and underscores.

Example:OPENAI_API_KEY

Headers

Idempotency-Keystring

Replaying the same key with the same request within 24 hours returns the first result and never repeats the effect. A refusal is not kept: a request refused before it ran (no_capacity, busy, a limit) runs afresh when sent again with its key. The SDKs send one automatically; the server makes one when absent and returns it in the idempotency-key response header.

Request body

hostsstring[]

Where the value may go. The proxy puts it only into HTTPS requests to these hosts.

Example request

{
  "hosts": [
    "api.openai.com"
  ],
  "rules": [
    {
      "methods": [
        "GET",
        "HEAD"
      ],
      "paths": [
        "/v1/chat/completions"
      ]
    }
  ]
}

Response

Success

namestring
hostsstring[]
headerstring
formatstring
placeholderstring

What the sandbox sees in the environment variable. Without header, the proxy replaces it with the value in a credential header (Authorization, x-api-key, x-goog-api-key, api-key, xi-api-key, x-subscription-token, private-token) of HTTPS requests to the hosts; in the URL or any other header it goes out as it is.

valueBytesinteger
createdAtstring date-time
updatedAtstring date-time
enforcedboolean

True when every server running the organization's sandboxes, and every server still holding an earlier version, confirmed the change; a sandbox that starts or wakes later is given it before it runs. False while a server has not confirmed it yet: each server asks Runtime for changes every 15 seconds, and one that has not heard from Runtime for a minute sends no secret's value until it has.

Example response

{
  "rules": [
    {
      "methods": [
        "GET",
        "HEAD"
      ],
      "paths": [
        "/v1/chat/completions"
      ]
    }
  ],
  "only": {
    "labels": [
      {
        "role": "hub"
      }
    ]
  }
}

Changes

No recorded changes to this operation across all 1 revision of this API.