Skip to main content
PUT
Store an intern secret

Authorizations

Authorization
string
header
required

API key as bearer token in Authorization header

Path Parameters

internId
string<uuid>
required

UUID of an intern in the workspace selected by the API key.

Example:

"7c9e6679-7425-40de-944b-e07fc1f90ae7"

name
string
required

Secret name. Lowercase letters, digits and single underscores, starting with a letter and not ending with an underscore, 1 to 255 characters.

Required string length: 1 - 255
Pattern: ^(?!.*__)[a-z]([a-z0-9_]*[a-z0-9])?$
Example:

"github_token"

Body

application/json

Secret value and the exact hostnames it may be released to.

hosts
string[]
required

Exact DNS hostnames the secret may be sent to, 1 to 100 entries. Each entry is lowercased and a trailing dot is removed, so API.Example.com. is stored as api.example.com. Schemes, ports, paths, wildcards and empty values are rejected. Duplicates after normalization are collapsed. Matching is exact: a secret bound to api.example.com is never released to example.com or any other hostname.

Required array length: 1 - 100 elements
Maximum string length: 254
value
string
required

Secret value, 1 to 65536 characters. It is encrypted at rest and never returned.

Required string length: 1 - 65536

Response

Metadata for the stored secret.

Metadata for the stored secret.

data
object
required

Metadata for one stored secret. The secret value is never returned. fingerprint is a keyed SHA-256 digest of the value: equal fingerprints within one scope mean equal values, but a workspace secret and its intern copy carry different fingerprints. hosts and fingerprint are null only for legacy rows written before host binding was required; storing the secret again assigns hosts.

Example: