Overview
Secrets
Section titled “Secrets”Sensitive per-env values (/v1/secrets/*). The ONLY endpoint that accepts plaintext is POST /v1/secrets; every other route is metadata-only (value NEVER returns on list / get / listVersions / getVersion — structural redaction). Rotation is discriminated: sync providers return 201 inline, async providers return 202 with a status URL + SSE events URL. Hard-revoke performs cryptographic erasure. Every mutating route is capability-gated (secrets:write, secrets:rotate, secrets:revoke, secrets:revoke:hard).