Update secret | BCTRL Docs

Update one or more fields on a Vault secret without reading its current value. Fields not included remain unchanged. Use null to clear nullable fields.

Update a secret

1 const updated = await bctrl.tools.call("vault.secrets.update", {
2   name: "production/github/login",
3   password: process.env.NEW_GITHUB_PASSWORD!,
4   label: "Updated GitHub account",
5 });
6 
7 console.log(updated.name, updated.hasTotp);

At least one field besides name must be provided.

Request parameters

Parameter	Type	Required	Description
`name`	`VaultSecretName`	Yes	Secret to update.
`username`	`string`	No	Username on a login secret.
`password`	`string`	No	Password on a login secret.
`value`	`string`	No	Value on a value secret.
`totpSecret`	`string \| null`	No	Base32 TOTP seed. Use `null` to clear it.
`label`	`string \| null`	No	Display label. Use `null` to clear it.
`origins`	`string[] \| null`	No	Exact allowed origins. Use `null` to clear them.
`originPatterns`	`string[] \| null`	No	Allowed origin patterns. Use `null` to clear them.
`notes`	`string \| null`	No	Private notes. Use `null` to clear them.

Response

The response contains the same safe metadata as Get secret metadata; it never returns the updated secret value.

Field	Type	Always present	Description
`name`	`VaultSecretName`	Yes	Secret name.
`type`	`"login" \| "value"`	Yes	Stored secret shape.
`label`	`string`	No	Display label, when set.
`origins`	`string[]`	No	Exact allowed origins, when configured.
`originPatterns`	`string[]`	No	Allowed origin patterns, when configured.
`hasTotp`	`boolean`	Yes	Whether a TOTP seed exists.
`createdAt`	`string`	No	Creation timestamp, when available.
`updatedAt`	`string`	No	Update timestamp, when available.

Get secret metadata — inspect the result
Read secret value — read when authorized
Spaces — configure Vault access

Update a secret

Request parameters

Response

Next