# Create a secret or add a version POST /v1/secrets ```sh curl --request POST \ --url https://example.com/v1/secrets \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data '{ "scope": { "kind": "tenant", "tenantId": "example" }, "envName": "example", "name": "example", "value": "example", "writeMode": "create-new", "tags": { "additionalProperty": "example" }, "rotationDueAt": "2026-04-15T12:00:00Z", "ifVersion": 1, "appEnvFile": true }' ``` Accepts a plaintext `value` (as do `POST /v1/secrets/:name/rotate` via `newValue` and `POST /v1/deployments/:deploymentId/secrets`); every other secrets route is metadata-only. Requires the `secrets:write` capability. `writeMode: create-new` returns 201 with the record; `add-version` returns 200. Existing-secret conflicts on `create-new` return 409 `secret-write-conflict`. ## Authorizations - **[bearerAuth](https://docs.kindgi.com/v0.1.10/reference/api.md#bearerauth)** ## Parameters ### Header Parameters **Idempotency-Key** string \>= 1 characters Caller-supplied idempotency key, scoped to the caller: the same key from someone else in the tenant is their own request (from 0.1.5). Retries with the same key return the original response byte-identical (per `docs/API-ROUTE-CONVENTIONS.md` §3.1). A retry sent while the first request still runs is answered `409 idempotency-key-in-flight` with `Retry-After`, on a runtime whose store holds keys (from 0.1.5); retry after it, and you get the first request’s answer. An answer that carries a secret (a new API key or public run token, a session token, a generated signing secret) isn’t kept: a retry gets `409 idempotency-key-replay-withheld`, with the first request’s status and when it succeeded (from 0.1.5). ## Request Bodyrequired application/json object **scope** required One of: - **object** object **kind** required string Allowed values: tenant **tenantId** required string - **object** object **kind** required string Allowed values: org **tenantId** required string **orgId** required string - **object** object **kind** required string Allowed values: project **tenantId** required string **projectId** required string **envName** required Per-environment slug. `[a-z][a-z0-9-]{0,62}` — RFC-1035-like label. string /^\[a-z]\[a-z0-9-]{0,62}$/ **name** required A new secret name: 1 to 255 ASCII letters, digits, `.`, `-` and `_`, starting with a letter, digit or `_`, with any `.` between two non-`.` characters. The server holds a newly-created name to this shape (`create-new`, or an `add-version` of a name not yet stored); a name already stored outside this shape still reads, rotates and takes new versions. string \>= 1 characters **value** required string **writeMode** required string Allowed values: create-new add-version **tags** object **_key_** additional properties string **rotationDueAt** string format: date-time **ifVersion** integer **appEnvFile** Under `kindgi dev` only: write the app’s own env file (the last of `dev.envFiles`, `.env.local` by default) instead of Kindgi’s `.kindgi/secrets.env`, for a value the app reads too, such as a webhook signing secret. A runtime with a secrets store refuses it with `bad-input`. boolean ## Responses ### 200 Version added (add-version). application/json object **record** required object **scope** required One of: - **object** object **kind** required string Allowed values: tenant **tenantId** required string - **object** object **kind** required string Allowed values: org **tenantId** required string **orgId** required string - **object** object **kind** required string Allowed values: project **tenantId** required string **projectId** required string **envName** required Per-environment slug. `[a-z][a-z0-9-]{0,62}` — RFC-1035-like label. string /^\[a-z]\[a-z0-9-]{0,62}$/ **name** required string **currentVersion** required integer **createdAt** required string format: date-time **updatedAt** required string format: date-time **revokedAt** string format: date-time **revokeReason** string **tags** object **_key_** additional properties string **rotationDueAt** string format: date-time **versionId** required integer \>= 1 ##### Example ```json { "record": { "scope": { "kind": "tenant" } } } ``` ### 201 Secret created (create-new). application/json object **record** required object **scope** required One of: - **object** object **kind** required string Allowed values: tenant **tenantId** required string - **object** object **kind** required string Allowed values: org **tenantId** required string **orgId** required string - **object** object **kind** required string Allowed values: project **tenantId** required string **projectId** required string **envName** required Per-environment slug. `[a-z][a-z0-9-]{0,62}` — RFC-1035-like label. string /^\[a-z]\[a-z0-9-]{0,62}$/ **name** required string **currentVersion** required integer **createdAt** required string format: date-time **updatedAt** required string format: date-time **revokedAt** string format: date-time **revokeReason** string **tags** object **_key_** additional properties string **rotationDueAt** string format: date-time **versionId** required integer \>= 1 ##### Example ```json { "record": { "scope": { "kind": "tenant" } } } ``` ### 400 A body that fails validation (`bad-input`), or a secret the store refuses for its name or its value: `reserved-name-prefix`, `secret-name-invalid` (a new name that isn’t 1 to 255 ASCII letters, digits, `.`, `-` and `_` starting with a letter, digit or `_`, with any `.` between two non-`.` characters, or, under `kindgi dev`, isn’t capital letters, digits and underscores, starts with a digit, or is `KINDGI_*`; the message says the rule), `secret-value-too-large`, or `secret-value-invalid` (under `kindgi dev`, a value no env-file quoting can hold so that it reads back unchanged; the message says why). application/json object **error** required object **code** required Stable machine-readable discriminant. Values match domain error codes (see `docs/API-ROUTE-CONVENTIONS.md` §4.3). string **message** required string **details** Optional, kind-specific. object **_key_** additional properties any **requestId** required Server-assigned request id; also echoed via `X-Request-Id` header. string ##### Examplegenerated ```json { "error": { "code": "example", "message": "example", "details": {}, "requestId": "example" } } ``` ### 401 Missing / malformed / expired / revoked bearer token. application/json object **error** required object **code** required Stable machine-readable discriminant. Values match domain error codes (see `docs/API-ROUTE-CONVENTIONS.md` §4.3). string **message** required string **details** Optional, kind-specific. object **_key_** additional properties any **requestId** required Server-assigned request id; also echoed via `X-Request-Id` header. string ##### Examplegenerated ```json { "error": { "code": "example", "message": "example", "details": {}, "requestId": "example" } } ``` ### 403 Bearer token missing `secrets:write` capability. application/json object **error** required object **code** required Stable machine-readable discriminant. Values match domain error codes (see `docs/API-ROUTE-CONVENTIONS.md` §4.3). string **message** required string **details** Optional, kind-specific. object **_key_** additional properties any **requestId** required Server-assigned request id; also echoed via `X-Request-Id` header. string ##### Examplegenerated ```json { "error": { "code": "example", "message": "example", "details": {}, "requestId": "example" } } ``` ### 409 Idempotency-Key was reused with a different body, or resource-state conflict. Or `env-not-served`: this runtime keeps every value under the env it serves (whoami’s `servedEnv`, with `refusesOtherEnvs`), so a value under another env would never be read. `details.envName` is the env asked for, `details.servedEnv` the one to use. A secret that a provider, MCP endpoint or webhook endpoint registered before names under that env, at the scope it’s read at, is still written: it’s read there. Nothing is stored otherwise. application/json object **error** required object **code** required Stable machine-readable discriminant. Values match domain error codes (see `docs/API-ROUTE-CONVENTIONS.md` §4.3). string **message** required string **details** Optional, kind-specific. object **_key_** additional properties any **requestId** required Server-assigned request id; also echoed via `X-Request-Id` header. string ##### Examplegenerated ```json { "error": { "code": "example", "message": "example", "details": {}, "requestId": "example" } } ``` ### 413 The request body is over the API’s limit (`request-too-large`; `details.maxBytes` says how much). application/json object **error** required object **code** required Stable machine-readable discriminant. Values match domain error codes (see `docs/API-ROUTE-CONVENTIONS.md` §4.3). string **message** required string **details** Optional, kind-specific. object **_key_** additional properties any **requestId** required Server-assigned request id; also echoed via `X-Request-Id` header. string ##### Examplegenerated ```json { "error": { "code": "example", "message": "example", "details": {}, "requestId": "example" } } ``` ### 429 `secret-provider-rate-limited`: the secrets store’s external provider is limiting the runtime’s requests. application/json object **error** required object **code** required Stable machine-readable discriminant. Values match domain error codes (see `docs/API-ROUTE-CONVENTIONS.md` §4.3). string **message** required string **details** Optional, kind-specific. object **_key_** additional properties any **requestId** required Server-assigned request id; also echoed via `X-Request-Id` header. string ##### Examplegenerated ```json { "error": { "code": "example", "message": "example", "details": {}, "requestId": "example" } } ``` ### 500 Server error (unmapped domain code or framework crash). application/json object **error** required object **code** required Stable machine-readable discriminant. Values match domain error codes (see `docs/API-ROUTE-CONVENTIONS.md` §4.3). string **message** required string **details** Optional, kind-specific. object **_key_** additional properties any **requestId** required Server-assigned request id; also echoed via `X-Request-Id` header. string ##### Examplegenerated ```json { "error": { "code": "example", "message": "example", "details": {}, "requestId": "example" } } ``` ### 502 `secret-provider-unauthorized`: the secrets store’s external provider refused the runtime’s credentials. application/json object **error** required object **code** required Stable machine-readable discriminant. Values match domain error codes (see `docs/API-ROUTE-CONVENTIONS.md` §4.3). string **message** required string **details** Optional, kind-specific. object **_key_** additional properties any **requestId** required Server-assigned request id; also echoed via `X-Request-Id` header. string ##### Examplegenerated ```json { "error": { "code": "example", "message": "example", "details": {}, "requestId": "example" } } ``` ### 503 `secret-provider-unavailable`: the secrets store’s external provider can’t be reached. application/json object **error** required object **code** required Stable machine-readable discriminant. Values match domain error codes (see `docs/API-ROUTE-CONVENTIONS.md` §4.3). string **message** required string **details** Optional, kind-specific. object **_key_** additional properties any **requestId** required Server-assigned request id; also echoed via `X-Request-Id` header. string ##### Examplegenerated ```json { "error": { "code": "example", "message": "example", "details": {}, "requestId": "example" } } ``` ## See also - [`GET /v1/secrets`: List secret metadata](https://docs.kindgi.com/v0.1.10/reference/api/operations/secretslist.md) - [Keep secrets in your own secret manager](https://docs.kindgi.com/v0.1.10/deploy/self-hosted/secret-manager.md) - [Kindgi 0.1.9](https://docs.kindgi.com/v0.1.10/releases/0.1.9.md) - [Error code `bad-input`](https://docs.kindgi.com/v0.1.10/reference/errors.md#bad-input) - [Error code `env-not-served`](https://docs.kindgi.com/v0.1.10/reference/errors.md#env-not-served) - [Error code `request-too-large`](https://docs.kindgi.com/v0.1.10/reference/errors.md#request-too-large) - [Error code `reserved-name-prefix`](https://docs.kindgi.com/v0.1.10/reference/errors.md#reserved-name-prefix) - [Error code `secret-name-invalid`](https://docs.kindgi.com/v0.1.10/reference/errors.md#secret-name-invalid) - [Error code `secret-provider-rate-limited`](https://docs.kindgi.com/v0.1.10/reference/errors.md#secret-provider-rate-limited) - [Error code `secret-provider-unauthorized`](https://docs.kindgi.com/v0.1.10/reference/errors.md#secret-provider-unauthorized) - [Error code `secret-provider-unavailable`](https://docs.kindgi.com/v0.1.10/reference/errors.md#secret-provider-unavailable) - [Error code `secret-value-invalid`](https://docs.kindgi.com/v0.1.10/reference/errors.md#secret-value-invalid) - [Error code `secret-value-too-large`](https://docs.kindgi.com/v0.1.10/reference/errors.md#secret-value-too-large) - [Every error code](https://docs.kindgi.com/v0.1.10/reference/errors.md)