Secrets
Covers 3 API operations in the secrets category.
| Method | Path | Description |
|---|---|---|
| GET | /v1/orgs/{orgSlug}/projects/{projectName}/secrets | List of secret names and versions (runlot secret list) |
| PUT | /v1/orgs/{orgSlug}/projects/{projectName}/secrets/{secretName} | Create or update a secret (runlot secret set) |
| DELETE | /v1/orgs/{orgSlug}/projects/{projectName}/secrets/{secretName} | Delete a secret (runlot secret delete) |
GET /v1/orgs/{orgSlug}/projects/{projectName}/secrets
The value is never present in any response. The only way the value leaves is through
the worker's env.<NAME> (docs/phase6.md B3·B4). member and above.
operationId listSecrets
| Status code | Description | Response body |
|---|---|---|
| 200 | List | SecretList |
| 403 | — | — |
| 404 | — | — |
PUT /v1/orgs/{orgSlug}/projects/{projectName}/secrets/{secretName}
This is not idempotent — every call bumps version, and on the next convergence the
node replaces that project's workerd with the new environment without downtime
(the same path as a deployment). No redeploy is needed.
cp-public does not store the value. cp-core seals it with the master key (docs/phase6.md
B1). The secret.set audit event records only the name.
Member or above.
operationId setSecret
Request body: application/json · object
| Status code | Description | Response body |
|---|---|---|
| 200 | Stored name and version | SecretMeta |
| 400 | The name does not follow the rules (bad_request) or is a reserved name (reserved_name: DB, ASSETS, RUNLOT_* — the uppercase counterparts of the env.db and env.assets bindings, and the node prefix) | Error |
| 403 | — | — |
| 404 | — | — |
DELETE /v1/orgs/{orgSlug}/projects/{projectName}/secrets/{secretName}
A name that does not exist returns 404 — there is no response that claims deletion while
deleting nothing. Member or above. Audited as secret.delete.
operationId deleteSecret
| Status code | Description | Response body |
|---|---|---|
| 204 | deleted | — |
| 403 | — | — |
| 404 | — | — |