Put App Secret
PUT /apps/{app_id}/secrets/{secret_key}
Declare a secret, or rotate where an existing one lives.
UPSERT, not create. Re-declaring a key is a rotation rather than a 409: the
builder is saying the value moved, and refusing would make the common case an
error and push them towards delete-then-create, which loses created_at and
briefly leaves the app declaring nothing.
provider_ref is a POINTER. The DTO refuses the obvious credential shapes,
which is a guardrail against the honest mistake rather than a security
control: nothing can reliably tell a path from a secret, but someone pasting a
value because the field sits next to the key is the likely error, and this
turns a silent unrecoverable leak into a 422 they read.
Authorizations
Parameters
Path Parameters
Header Parameters
Request Body required
Responses
200
Successful Response
object
One declared secret. A POINTER and two timestamps, never a value.
There is no value field and there must never be one. The control plane
stores WHICH secrets an app declares and where they live, so a build can be
rendered without the platform ever holding what the build will read.
422
Validation Error