> ## Documentation Index > Fetch the complete documentation index at: https://docs.ohmyho.st/llms.txt > Use this file to discover all available pages before exploring further. # Create or rotate an environment secret > Accepts a write-only value and returns metadata only. Replays require the same canonical value digest. ## OpenAPI ````yaml /openapi.json put /v1/projects/{project_id}/environments/{environment_id}/secrets/{secret_name} openapi: 3.1.2 info: title: ohmyho.st API version: 0.0.0 description: >- Public REST API for ohmyho.st hosting, projects, domains, email, credits and exports. servers: - url: https://app.ohmyho.st description: Production control API - url: https://dev.app.ohmyho.st description: Development control API security: - BearerAuth: [] paths: /v1/projects/{project_id}/environments/{environment_id}/secrets/{secret_name}: put: summary: Create or rotate an environment secret description: >- Accepts a write-only value and returns metadata only. Replays require the same canonical value digest. operationId: putEnvironmentSecret parameters: - $ref: '#/components/parameters/RequestId' - $ref: '#/components/parameters/IdempotencyKey' - $ref: '#/components/parameters/ProjectId' - $ref: '#/components/parameters/EnvironmentId' - $ref: '#/components/parameters/SecretName' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/PutEnvironmentSecretRequest' responses: '200': description: Stored secret metadata. The value is never returned. headers: X-Request-Id: $ref: '#/components/headers/XRequestId' content: application/json: schema: $ref: '#/components/schemas/EnvironmentSecret' '400': $ref: '#/components/responses/Problem' '401': $ref: '#/components/responses/Problem' '403': $ref: '#/components/responses/Problem' '404': $ref: '#/components/responses/ResourceNotFound' '409': $ref: '#/components/responses/IdempotencyConflict' '429': $ref: '#/components/responses/Problem' '503': $ref: '#/components/responses/Problem' components: parameters: RequestId: name: X-Request-Id in: header description: Optional caller-provided correlation identifier. required: false schema: type: string minLength: 1 maxLength: 128 IdempotencyKey: name: Idempotency-Key in: header description: Identifies one mutation and its canonical request payload. required: true schema: type: string minLength: 1 maxLength: 128 ProjectId: name: project_id in: path description: Project identifier. required: true schema: $ref: '#/components/schemas/Ulid' EnvironmentId: name: environment_id in: path description: Environment identifier. required: true schema: $ref: '#/components/schemas/Ulid' SecretName: name: secret_name in: path description: Uppercase environment-variable name. required: true schema: type: string pattern: ^[A-Z][A-Z0-9_]{0,127}$ schemas: PutEnvironmentSecretRequest: type: object additionalProperties: false required: - value properties: value: type: string description: >- Write-only plaintext value. It is encrypted before persistence and never returned. minLength: 1 maxLength: 5120 writeOnly: true EnvironmentSecret: type: object description: >- Environment secret metadata. The plaintext and ciphertext are never returned. additionalProperties: false required: - name - revision - key_version - created_at - updated_at - desired_generation - applied_generation - delivery_state - runtime_provider - applied_secret_count - last_error properties: name: type: string pattern: ^[A-Z][A-Z0-9_]{0,127}$ revision: type: integer minimum: 1 key_version: type: integer minimum: 1 created_at: type: string format: date-time updated_at: type: string format: date-time desired_generation: type: integer minimum: 0 applied_generation: type: integer minimum: 0 delivery_state: type: string enum: - not_deployed - pending - ready - failed runtime_provider: type: - string - 'null' enum: - wfp - container - null applied_secret_count: type: integer minimum: 0 maximum: 100 last_error: type: - string - 'null' pattern: ^[A-Z][A-Z0-9_]{0,63}$ Ulid: type: string pattern: ^[0-9A-HJKMNP-TV-Z]{26}$ ProblemDetails: type: object description: RFC 9457 Problem Details extended with stable ohmyhost recovery fields. additionalProperties: false required: - type - title - status - code - request_id - retryable - suggested_action properties: type: type: string format: uri-reference title: type: string minLength: 1 status: type: integer minimum: 400 maximum: 599 detail: type: string instance: type: string format: uri-reference code: type: string enum: - invalid_request - unauthenticated - forbidden - resource_not_found - idempotency_key_reused - project_handle_unavailable - project_identity_unavailable - deployment_plan_expired - deployment_plan_incompatible - confirmation_expired - confirmation_invalid - etag_mismatch - promotion_source_stale - promotion_target_stale - promotion_invalid_target - mail_domain_conflict - mail_domain_required - framework_conversion_required - migration_filename_noncanonical - environment_secret_mutation_blocked - container_runtime_required - payload_too_large - rate_limited - insufficient_organization_credits - paid_plan_required - project_budget_exceeded - compute_performance_paid_required - compute_performance_unavailable - compute_change_pending - compute_change_conflict - billing_purchase_conflict - cloudflare_authorization_closed - project_notes_conflict - project_export_not_ready - interactive_login_required - api_key_creation_uncertain - api_key_permissions_unavailable - reconciliation_exhausted - service_unavailable request_id: type: string minLength: 1 maxLength: 128 retryable: type: boolean retry_after_seconds: type: integer minimum: 1 maximum: 86400 description: >- Optional machine-readable retry delay for a rate limit, matching Retry-After. suggested_action: type: string minLength: 1 IdempotencyConflictProblem: allOf: - $ref: '#/components/schemas/ProblemDetails' - type: object properties: code: const: idempotency_key_reused headers: XRequestId: description: Correlates the request with operations, events, logs, and audit records. required: true schema: type: string minLength: 1 maxLength: 128 responses: Problem: description: The request failed. headers: X-Request-Id: $ref: '#/components/headers/XRequestId' content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' ResourceNotFound: description: >- The resource does not exist or is not visible to the authenticated principal. headers: X-Request-Id: $ref: '#/components/headers/XRequestId' content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' examples: resourceNotFound: value: type: https://docs.ohmyho.st/errors/resource-not-found title: Resource not found status: 404 code: resource_not_found request_id: req_01J00000000000000000000000 retryable: false suggested_action: Check the resource identifier and your access scope. IdempotencyConflict: description: The idempotency key was already used with a different canonical request. headers: X-Request-Id: $ref: '#/components/headers/XRequestId' content: application/problem+json: schema: $ref: '#/components/schemas/IdempotencyConflictProblem' examples: reusedKey: value: type: https://docs.ohmyho.st/errors/idempotency-key-reused title: Idempotency key reused status: 409 code: idempotency_key_reused request_id: req_01J00000000000000000000000 retryable: false suggested_action: Retry with a new idempotency key. securitySchemes: BearerAuth: type: http scheme: bearer description: >- WorkOS access JWT or a user-owned WorkOS API key. User keys are bound to one organization and restricted to their enabled product permissions. Session-only onboarding and session revocation require an interactive access JWT. No cookie session is assumed. ````