Secrets

📄️List secrets

Keyset-paginated. Filters are typed query params (`field=value`, `field[op]=value`); unknown filters, unsortable fields and malformed values are rejected with 400 `validation_failed`. The value is write-only: it is stored encrypted and is never returned by any endpoint. To rotate it, PATCH the row (or PUT by `key`) with a new `value`.

📄️Create secret

Store a secret an agent workflow can reference as `${{secrets.KEY}}`. A duplicate `key` in the workspace is refused with 409 `conflict`. The value is write-only: it is stored encrypted and is never returned by any endpoint. To rotate it, PATCH the row (or PUT by `key`) with a new `value`.

📄️Create or update secret

Upsert matched by `key` within the caller workspace — the rotation path, no id lookup needed. Creates with 201 when the key is new, replaces the value with 200 when it exists. The value is write-only: it is stored encrypted and is never returned by any endpoint. To rotate it, PATCH the row (or PUT by `key`) with a new `value`.

📄️Get secret

Accepts either the internal UUID or the resource `external_id`.

📄️Update secret

Replace the value or the notes. `key` is immutable: workflows reference it by name, so renaming would break them silently — delete and re-create instead.

📄️Delete secret

Soft-delete. Workflow steps referencing the key start failing with `secret not defined` from the next run on.