secrets

Change which sandboxes get a secret, without its value.

The body is the secret's only: labels (selectors, any one matching), sandboxes (ids) and/or apps (App or Function ids: every copy of each, of any version). {} gives it to every sandbox of the organization. A sandbox leaving the scope stops carrying the value on its next request within seconds; one entering it has it as quickly, and a new copy of a scoped App has it from its first request.

put/v1/egress-secrets/{name}/sandboxes

Request

  • Base URL: https://api.withruntime.com
  • URL: https://api.withruntime.com/v1/egress-secrets/{name}/sandboxes
  • Auth: HTTP bearer

Path parameters

namestring required

The environment variable the placeholder is in, inside every sandbox of the organization. Upper case letters, digits and underscores.

Example:OPENAI_API_KEY

Headers

Idempotency-Keystring

Replaying the same key with the same request within 24 hours returns the first result and never repeats the effect. A refusal is not kept: a request refused before it ran (no_capacity, busy, a limit) runs afresh when sent again with its key. The SDKs send one automatically; the server makes one when absent and returns it in the idempotency-key response header.

Request body

labelsobject[]

Sandboxes whose labels match any one of these selectors get the secret, including ones created or labelled later.

sandboxesstring[]

These sandboxes (ids of this organization's sandboxes) get the secret.

appsstring[]

Every copy of these Apps or Functions (their ids) gets the secret, whatever its version: copies made by later deploys, restarts and scaling too. A deploy names the secrets its copies see as environment variables (secrets on POST /v1/apps/{id}/deploys).

Example request

{
  "labels": [
    {
      "role": "hub"
    }
  ]
}

Response

Success

namestring
hostsstring[]
headerstring
formatstring
placeholderstring

What the sandbox sees in the environment variable. Without header, the proxy replaces it with the value in a credential header (Authorization, x-api-key, x-goog-api-key, api-key, xi-api-key, x-subscription-token, private-token) of HTTPS requests to the hosts; in the URL or any other header it goes out as it is.

valueBytesinteger
createdAtstring date-time
updatedAtstring date-time
enforcedboolean

True when every server running the organization's sandboxes, and every server still holding an earlier version, confirmed the change; a sandbox that starts or wakes later is given it before it runs. False while a server has not confirmed it yet: each server asks Runtime for changes every 15 seconds, and one that has not heard from Runtime for a minute sends no secret's value until it has.

Example response

{
  "rules": [
    {
      "methods": [
        "GET",
        "HEAD"
      ],
      "paths": [
        "/v1/chat/completions"
      ]
    }
  ],
  "only": {
    "labels": [
      {
        "role": "hub"
      }
    ]
  }
}

Changes

No recorded changes to this operation across all 1 revision of this API.