Skip to navigation
API ReferenceSecrets

Create a secret

View as Markdown

Create a Secret at a new path. The returned ID addresses it; paths remain reference keys.

Authentication

AuthorizationBearer

Use Bearer <api-key>.

Headers

BCTRL-VersionenumOptional
Dated API version. Defaults to the release pinned when the API key was created.
Allowed values:
BCTRL-SpacestringOptional
Select one authorized Space by its opaque ID or unique name. Omission uses the operation default.
BCTRL-Subaccount-IdstringOptional
Optional effective subaccount context for organization API keys. Subaccount API keys are already scoped and cannot use this header to act as another subaccount.
Idempotency-KeystringOptional1-200 characters

Optional retry key for this billable operation. Reusing the same key with the same request replays its stable outcome; credential-bearing results may be freshly issued for the same principal. Reusing it with a different request returns 409.

Request

Create a secret at an unoccupied path. Values are write-only.

pathstringRequired1-512 characters

Secret path, for example prod/github/bot. May contain /.

typeenumRequired

login: username, password and TOTP seed for a site. value: one opaque value.

Allowed values:
labelstring or nullOptional<=512 characters
notesstringOptional1-16384 characters

Free-form notes. Write-only.

originslist of stringsOptional

Origins a login may be filled into: https://host[:port], or https://*.host for any subdomain.

passwordstringOptional1-4096 characters

Password of a login. Write-only.

totpstringOptional1-1024 characters

TOTP seed (base32) of a login. Write-only.

usernamestring or nullOptional<=512 characters
valuestringOptional1-65536 characters

The value of a value secret. Write-only.

Response headers

BCTRL-Request-IdstringOptional
Current request identifier, also echoed in errors.
BCTRL-VersionstringOptional
Negotiated dated API version.
RateLimit-Limitinteger

Evaluated policy limit; zero when no finite policy was evaluated.

RateLimit-Remaininginteger

Remaining policy budget; zero when no finite policy was evaluated.

RateLimit-Resetinteger

Seconds until reset; zero when no finite policy was evaluated.

Response

Created
createdAtdatetime
RFC 3339 timestamp with a UTC offset.
hasNotesboolean
hasPasswordboolean
hasTotpboolean
hasValueboolean
idstring
Unique secret identifier generated by BCTRL.
labelstring or null
lastUsedAtdatetime or null
RFC 3339 timestamp with a UTC offset.
object"secret"
originslist of strings

Origins a login may be filled into: https://host[:port], or https://*.host for any subdomain.

pathstring1-512 characters

Secret path, for example prod/github/bot. May contain /.

subaccountIdstring or null1-64 characters

The owning subaccount, or null for an organization-wide secret.

typeenum

login: username, password and TOTP seed for a site. value: one opaque value.

Allowed values:
updatedAtdatetime
RFC 3339 timestamp with a UTC offset.
usernamestring or null

Not secret; readable.

versioninteger

Current version; the ETag of the secret.

Errors

400
Bad Request Error
401
Unauthorized Error
403
Forbidden Error
409
Conflict Error
429
Too Many Requests Error