Skip to main content
PUT
Create or rotate an environment secret

Authorizations

Authorization
string
header
required

WorkOS access JWT or a user-owned WorkOS API key. User keys are bound to one organization and restricted to their enabled product permissions. Session-only onboarding and session revocation require an interactive access JWT. No cookie session is assumed.

Headers

X-Request-Id
string

Optional caller-provided correlation identifier.

Required string length: 1 - 128
Idempotency-Key
string
required

Identifies one mutation and its canonical request payload.

Required string length: 1 - 128

Path Parameters

project_id
string
required

Project identifier.

Pattern: ^[0-9A-HJKMNP-TV-Z]{26}$
environment_id
string
required

Environment identifier.

Pattern: ^[0-9A-HJKMNP-TV-Z]{26}$
secret_name
string
required

Uppercase environment-variable name.

Pattern: ^[A-Z][A-Z0-9_]{0,127}$

Body

application/json
value
string
required
write-only

Write-only plaintext value. It is encrypted before persistence and never returned.

Required string length: 1 - 5120

Response

Stored secret metadata. The value is never returned.

Environment secret metadata. The plaintext and ciphertext are never returned.

name
string
required
Pattern: ^[A-Z][A-Z0-9_]{0,127}$
revision
integer
required
Required range: x >= 1
key_version
integer
required
Required range: x >= 1
created_at
string<date-time>
required
updated_at
string<date-time>
required
desired_generation
integer
required
Required range: x >= 0
applied_generation
integer
required
Required range: x >= 0
delivery_state
enum<string>
required
Available options:
not_deployed,
pending,
ready,
failed
runtime_provider
enum<string> | null
required
Available options:
wfp,
container,
null
applied_secret_count
integer
required
Required range: 0 <= x <= 100
last_error
string | null
required
Pattern: ^[A-Z][A-Z0-9_]{0,63}$