Read the env a deployment's pack service is to be given
const url = 'https://example.com/v1/system/tenants/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/deployments/example/pack-env?secrets=values';const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request GET \ --url 'https://example.com/v1/system/tenants/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/deployments/example/pack-env?secrets=values' \ --header 'Authorization: Bearer <token>'For whatever runs the deployment’s pack service: where each name its pack declares is set (at the deployment’s project, then its org, then the tenant, at the env the server serves), and the values when nothing stands in the way. A name set both ways (pack-env-ambiguous), a required one set nowhere (pack-env-missing), or one set only as a secret whose value wasn’t asked for (pack-env-secret-not-yet) is a problem, and then no value is given. With secrets=values, each name set only as a secret is given in secrets, read at the version its revision names; a secret that can’t be read for a reason the platform fixes is pack-env-secret-unreadable, and then no value is given. Each value given out is on the audit record, a secret’s written before the answer. Refused for a retired deployment (endpoint-retired) and a closing or suspended tenant. On a key of its own, system:pack-env: system:deployments reads no value, and kindgi:system no secret’s.
Authorizations
Section titled “Authorizations”Parameters
Section titled “Parameters”Path Parameters
Section titled “Path Parameters”The tenant’s id (a UUID).
The deployment’s id, as GET /v1/system/deployments lists it.
Query Parameters
Section titled “Query Parameters”values: give the values of the names set only as a secret too, in secrets, each audited before the answer. Only for a key holding system:pack-env itself. Left out: such a name is pack-env-secret-not-yet, and no secret is read.
Responses
Section titled “Responses”Where each name is set, and the values when there is no problem.
What the deployment’s pack service is to be given: where each declared name is set, and the values when nothing stands in the way, plain ones in env and, when asked for (secrets=values), secrets in secrets. Each value given out is on the audit record: env-resolved as the deployment’s system read, and secret-resolved (caller pack-env, with the request id as its correlationId and the system key’s id), written before the answer.
object
Changes whenever what would be given changes: a value written or removed, a secret set or revoked. Made from scopes, row ids, revisions and update times, never from a value. Send it back with the endpoint (packEnvRevision) or PUT …/pack-env.
Every declared name, required ones first, each list in name order.
One name the deployment’s pack declares: where it’s set, and why it can’t be given to the pack service, if it can’t (secretScope, for ambiguous only, names the secret’s scope). Each name is looked for at the deployment’s project, then its org, then the tenant (most specific wins); a tenant-wide deployment’s, at the tenant’s Default project. Never a value.
object
Set nowhere, as a plain value or a secret (optional names too).
Why it can’t be given to the pack service. ambiguous: set both as a secret and as a plain value (secretScope names the secret’s scope). secret-not-yet: set only as a secret, and the orchestrator didn’t ask for secret values (secrets=values); a tool reads it per call (ctx.secrets). missing: a required name set nowhere. unreadable: set as a secret, and it can’t be read for a reason the platform fixes, not the owner. Absent when it can be given, and for an optional name set nowhere. The owner’s check (GET /v1/deployments/{deploymentId}/pack-env) lists a name set only as a secret as kind: 'secret', with no problem.
Where a value is set: the deployment’s project, the project’s org, or the tenant.
object
The project’s or the org’s id. Absent for the tenant.
Why a deployment’s pack service can’t be given its declared environment, the first in this order: pack-env-ambiguous (a name is set both as a secret and as a plain value), pack-env-secret-not-yet (a name is set only as a secret, and its value wasn’t asked for), pack-env-missing (a required name is set nowhere), pack-env-secret-unreadable (a name’s secret is set, but it can’t be read for a reason the platform fixes, not the owner; only a read with secrets=values finds it, and only when there’s no other problem). A later runtime may add codes, so treat an unknown one as a reason not yet named.
Each declared name that is set, by name, as plain values. Absent while there is a problem: then nothing is given, and the service keeps what it runs.
object
With secrets=values only: each declared name that is set only as a secret, by name ({} when there’s none). Never put one into a plain env. Absent while there is a problem, and when it wasn’t asked for.
object
A secret given to the deployment’s pack service: its value, read at the version revision names, and audited before the answer.
object
ps1-…: the same for the same value under the same name, and changes whenever what’s given for the name does (a new version, another scope, a revoke or a delete). Made from the name’s part of the deployment’s revision, never from the value.
Example
{ "names": [ { "kind": "env", "scope": { "kind": "project" }, "problem": "ambiguous", "secretScope": { "kind": "project" } } ], "problem": "pack-env-ambiguous"}A secrets other than values (bad-input).
object
object
Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).
Optional, kind-specific.
object
Server-assigned request id; also echoed via X-Request-Id header.
Examplegenerated
{ "error": { "code": "example", "message": "example", "details": {}, "requestId": "example" }}Missing / malformed / expired / revoked bearer token.
object
object
Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).
Optional, kind-specific.
object
Server-assigned request id; also echoed via X-Request-Id header.
Examplegenerated
{ "error": { "code": "example", "message": "example", "details": {}, "requestId": "example" }}A tenant’s key or session (system-principal-required), a system key without system:pack-env (system-scope-missing), or with secrets=values, a key that doesn’t hold system:pack-env itself, kindgi:system included (system-scope-missing).
object
object
Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).
Optional, kind-specific.
object
Server-assigned request id; also echoed via X-Request-Id header.
Examplegenerated
{ "error": { "code": "example", "message": "example", "details": {}, "requestId": "example" }}No such tenant (tenant-not-found), or no such deployment in it (deployment-not-found).
object
object
Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).
Optional, kind-specific.
object
Server-assigned request id; also echoed via X-Request-Id header.
Examplegenerated
{ "error": { "code": "example", "message": "example", "details": {}, "requestId": "example" }}The tenant is closing or suspended (tenant-closing, tenant-suspended), or the deployment’s pack service was retired (endpoint-retired).
object
object
Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).
Optional, kind-specific.
object
Server-assigned request id; also echoed via X-Request-Id header.
Examplegenerated
{ "error": { "code": "example", "message": "example", "details": {}, "requestId": "example" }}The server doesn’t give a pack service its declared env: its pack services take theirs from how they’re run (pack-env-unsupported). Or, with secrets=values, it has nowhere to audit a secret given out, so it gives none (pack-env-secrets-unaudited).
object
object
Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).
Optional, kind-specific.
object
Server-assigned request id; also echoed via X-Request-Id header.
Examplegenerated
{ "error": { "code": "example", "message": "example", "details": {}, "requestId": "example" }}With secrets=values: the secret store is out, a secret changed while it was read, twice, or the secrets’ audit rows weren’t written. Nothing is given: try again (pack-env-unavailable).
object
object
Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).
Optional, kind-specific.
object
Server-assigned request id; also echoed via X-Request-Id header.
Examplegenerated
{ "error": { "code": "example", "message": "example", "details": {}, "requestId": "example" }}See also
PUT /v1/system/tenants/{tenantId}/deployments/{deploymentId}/pack-env: Record the env revision a deployment's pack service runsGET /v1/system/tenants: List tenantsPOST /v1/system/tenants: Create a tenantGET /v1/system/tenants/{tenantId}: Read a tenant- Error code
bad-input - Error code
deployment-not-found - Error code
endpoint-retired - Error code
pack-env-secrets-unaudited - Error code
pack-env-unavailable - Error code
pack-env-unsupported - Error code
system-principal-required - Error code
system-scope-missing - Error code
tenant-closing - Error code
tenant-not-found - Error code
tenant-suspended - Every error code