Create a secret

Creates one secret in a project environment. Fails rather than overwrites when the key already exists.

POST/secrets

Request body

requiredapplication/json

projectIdstring<uuid>required

matches ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$

environmentstringrequired

min length 1 · max length 50 · matches ^[a-z0-9][a-z0-9-]*$

keystringrequired

min length 1 · max length 255 · matches ^[A-Z][A-Z0-9_]*$

kindstring

Allowed:literaltemplate

valuestring

max length 65536

sourcestring

max length 65536

expectedVersioninteger

min 0 · max 9007199254740991

Responses

201Success.

idstring<uuid>required

projectIdstring<uuid>required

environmentstringrequired

min length 1 · max length 50 · matches ^[a-z0-9][a-z0-9-]*$

keystringrequired

min length 1 · max length 255

versionintegerrequired

max 9007199254740991

createdAtstring<date-time>required

updatedAtstring<date-time>required

400The request failed validation. `field` names the offending input.

statusCodeintegerrequired

HTTP status code, repeated in the body.

min -9007199254740991 · max 9007199254740991

codestringrequired

Stable machine-readable error code, e.g. `SECRET_NOT_FOUND` or `FORBIDDEN`. Branch on this, never on the message.

messagestringrequired

Human-readable explanation. Wording may change.

fieldstring

The offending request field, present on validation failures.

401No credential was presented, or it is invalid or revoked.

statusCodeintegerrequired

HTTP status code, repeated in the body.

min -9007199254740991 · max 9007199254740991

codestringrequired

Stable machine-readable error code, e.g. `SECRET_NOT_FOUND` or `FORBIDDEN`. Branch on this, never on the message.

messagestringrequired

Human-readable explanation. Wording may change.

fieldstring

The offending request field, present on validation failures.

403The credential is valid but lacks the required scope, role or team access.

statusCodeintegerrequired

HTTP status code, repeated in the body.

min -9007199254740991 · max 9007199254740991

codestringrequired

Stable machine-readable error code, e.g. `SECRET_NOT_FOUND` or `FORBIDDEN`. Branch on this, never on the message.

messagestringrequired

Human-readable explanation. Wording may change.

fieldstring

The offending request field, present on validation failures.

404The resource does not exist, or is not visible to this credential.

statusCodeintegerrequired

HTTP status code, repeated in the body.

min -9007199254740991 · max 9007199254740991

codestringrequired

Stable machine-readable error code, e.g. `SECRET_NOT_FOUND` or `FORBIDDEN`. Branch on this, never on the message.

messagestringrequired

Human-readable explanation. Wording may change.

fieldstring

The offending request field, present on validation failures.

429Rate limited. Retry after the interval named in the response.

statusCodeintegerrequired

HTTP status code, repeated in the body.

min -9007199254740991 · max 9007199254740991

codestringrequired

Stable machine-readable error code, e.g. `SECRET_NOT_FOUND` or `FORBIDDEN`. Branch on this, never on the message.

messagestringrequired

Human-readable explanation. Wording may change.

fieldstring

The offending request field, present on validation failures.

500Unexpected server error. The body never carries internal detail.

statusCodeintegerrequired

HTTP status code, repeated in the body.

min -9007199254740991 · max 9007199254740991

codestringrequired

Stable machine-readable error code, e.g. `SECRET_NOT_FOUND` or `FORBIDDEN`. Branch on this, never on the message.

messagestringrequired

Human-readable explanation. Wording may change.

fieldstring

The offending request field, present on validation failures.

Request

curl -X POST "https://api.varsafe.dev/secrets" \
  -H "Content-Type: application/json" \
  -d '{
  "projectId": "<uuid>",
  "environment": "string",
  "key": "string",
  "kind": "literal",
  "value": "string",
  "source": "string",
  "expectedVersion": 0
}'

const response = await fetch("https://api.varsafe.dev/secrets", {
  method: "POST",
  headers: {
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
  "projectId": "<uuid>",
  "environment": "string",
  "key": "string",
  "kind": "literal",
  "value": "string",
  "source": "string",
  "expectedVersion": 0
})
});

import requests

response = requests.post(
    "https://api.varsafe.dev/secrets",
    headers={
        "Content-Type": "application/json"
    },
    json={
  "projectId": "<uuid>",
  "environment": "string",
  "key": "string",
  "kind": "literal",
  "value": "string",
  "source": "string",
  "expectedVersion": 0
},
)

Response

{
  "id": "<uuid>",
  "projectId": "<uuid>",
  "environment": "string",
  "key": "string",
  "version": 0,
  "createdAt": "2024-01-01T00:00:00Z",
  "updatedAt": "2024-01-01T00:00:00Z"
}