Secrets

SecretsResource

Methods

create() ->
post/v5/sgp/secrets

Create an account-level secret.

The secret value is stored in the cloud provider's secret store. SGP only stores metadata (key name, description, audit info). The value is never returned by any API. Returns 409 if a secret with the same key already exists.

Parameters
key: str
(maxLength: 253, minLength: 1)

Secret name (e.g. openai-api-key). Must be lowercase alphanumeric with hyphens/dots, matching Kubernetes secret naming conventions.

value: str
(minLength: 1)

The secret value to store

description: Optional[str]

Optional human-readable description

Returns
id: str
account_id: str
cloud_secret_path: str
created_at:
(format: date-time)
created_by:

The identity that created the entity.

key: str
description: Optional[str]
object: Optional[Literal["sgp_cloud_secret"]]
(default: "sgp_cloud_secret")
updated_at: Optional[datetime]
(format: date-time)

Timestamp of last update.

updated_by: Optional[str]

User who last updated the secret.

Request example
200Example
list() -> SyncCursorPage[]
get/v5/sgp/secrets

List secret metadata for the account. Values are never returned.

retrieve() ->
get/v5/sgp/secrets/{secret_id}

Get a single secret's metadata by ID. The value is never returned.

update(, ) ->
patch/v5/sgp/secrets/{secret_id}

Update an existing secret's description and/or value.

If value is provided, the cloud provider secret is updated. The secret value is never returned by any API.

delete()
delete/v5/sgp/secrets/{secret_id}

Delete a secret from both the cloud provider and SGP metadata.

Domain types

class CloudSecret: ...

API response model for a secret. Never includes the secret value.