Secrets
Covers 3 API operations in the secrets category.
| Method | Path | Description |
|---|---|---|
| GET | /v1/orgs/{orgSlug}/projects/{projectName}/secrets | List of secret names and versions (runlot secret list) |
| PUT | /v1/orgs/{orgSlug}/projects/{projectName}/secrets/{secretName} | Create or update a secret (runlot secret set) |
| DELETE | /v1/orgs/{orgSlug}/projects/{projectName}/secrets/{secretName} | Delete a secret (runlot secret delete) |
GET /v1/orgs/{orgSlug}/projects/{projectName}/secrets
The value is never present in any response. The only way a value leaves Runlot is
through the worker's env.<NAME>. Requires member or higher.
operationId listSecrets
| Status code | Description | Response body |
|---|---|---|
| 200 | List | SecretList |
| 403 | — | — |
| 404 | — | — |
PUT /v1/orgs/{orgSlug}/projects/{projectName}/secrets/{secretName}
This is not idempotent — every call bumps version. Shortly afterwards the running
worker is replaced with the new environment without downtime, by the same path
a deployment uses. No redeploy is needed.
The value is stored encrypted and never returned. The secret.set audit event records
only the name.
Requires member or higher.
operationId setSecret
Request body: application/json · object
| Status code | Description | Response body |
|---|---|---|
| 200 | Stored name and version | SecretMeta |
| 400 | The name does not follow the rules (bad_request) or is a reserved name (reserved_name: DB, ASSETS, RUNLOT_* — the uppercase counterparts of the env.db and env.assets bindings, and the node prefix) | Error |
| 403 | — | — |
| 404 | — | — |
DELETE /v1/orgs/{orgSlug}/projects/{projectName}/secrets/{secretName}
A name that does not exist returns 404 — there is no response that claims deletion while
deleting nothing. Requires member or higher. Audited as secret.delete.
operationId deleteSecret
| Status code | Description | Response body |
|---|---|---|
| 204 | deleted | — |
| 403 | — | — |
| 404 | — | — |