# client.system_env

> client.system_env — the systemEnv operations.

`client.system_env` — the `systemEnv` operations.

On `AsyncKindgi` every method is the same, awaited.

## `client.system_env.set_cloud_secret()`

```python signature
set_cloud_secret(
    tenant_id: str | UUID,
    name: str,
    body: EnvCloudSecretSetRequest | Mapping[str, Any] | None = None,
    /,
    *,
    env_name: str,
    scope_kind: Literal['tenant', 'org', 'project'],
    scope_id: str | UUID | None = None,
    idempotency_key: str | None = None,
    timeout: float | None = None,
    **fields: Any,
) -> EnvCloudSecret
```

Set an env name to a cloud secret. `PUT /v1/system/tenants/{tenantId}/env/{name}`

Sets an env name, at a scope of the tenant and one env, to a version of a secret the operator's cloud holds. A pack service whose pack declares the name is given it by that name, and its host reads the value from the cloud as the pack service's own account: the runtime keeps the name, never a value. Every pack service runs as that one account, so only a system key sets one. The version is a number, so what a pack service runs changes only when this does. A name set both to this and to a plain value or a secret is `pack-env-ambiguous`. The tenant sees the name as set (`GET /v1/env/cloud-secrets`, the pack-env check), never the path. Recorded as `env-set` in the tenant's audit record, naming the system key and marked `cloudSecret`, never with the path. Every write bumps `revision`; `ifRevision` guards it. Takes `system:env-refs`. A closing tenant is frozen: `409 tenant-closing`.

## `client.system_env.delete_cloud_secret()`

```python signature
delete_cloud_secret(
    tenant_id: str | UUID,
    name: str,
    /,
    *,
    env_name: str,
    scope_kind: Literal['tenant', 'org', 'project'],
    scope_id: str | UUID | None = None,
    timeout: float | None = None,
) -> EnvDeleteResult
```

Remove an env name's cloud secret. `DELETE /v1/system/tenants/{tenantId}/env/{name}`

Removes the cloud secret an env name is set to, at that scope and env: its pack services lose the name at their next revision. Idempotent: `{ deleted: false }` when there's none. Recorded as `env-deleted` in the tenant's audit record, naming the system key and marked `cloudSecret`, never with the path. Takes `system:env-refs`. A closing tenant is frozen: `409 tenant-closing`.

## `client.system_env.list_cloud_secrets()`

```python signature
list_cloud_secrets(
    tenant_id: str | UUID,
    /,
    *,
    env_name: str,
    scope_kind: Literal['tenant', 'org', 'project'],
    scope_id: str | UUID | None = None,
    limit: int | None = None,
    cursor: str | None = None,
    timeout: float | None = None,
) -> EnvCloudSecretPage
```

List a tenant's cloud secrets. `GET /v1/system/tenants/{tenantId}/env`

The env names set to a cloud secret at one scope of the tenant and one env, in name order, each with its `cloudSecret`. Takes `system:env-refs`.