# Overview

## Secrets

Sensitive per-env values (`/v1/secrets/*`). The ONLY endpoint that accepts plaintext is `POST /v1/secrets`; every other route is metadata-only (`value` NEVER returns on list / get / listVersions / getVersion — structural redaction). Rotation is discriminated: sync providers return 201 inline, async providers return 202 with a status URL + SSE events URL. Hard-revoke performs cryptographic erasure. Every mutating route is capability-gated (`secrets:write`, `secrets:rotate`, `secrets:revoke`, `secrets:revoke:hard`).

## Operations

GET

[/v1/secrets](https://docs.kindgi.com/v0.1.8/reference/api/operations/secretslist.md)

POST

[/v1/secrets](https://docs.kindgi.com/v0.1.8/reference/api/operations/secretsset.md)

GET

[/v1/secrets/{name}](https://docs.kindgi.com/v0.1.8/reference/api/operations/secretsget.md)

DELETE

[/v1/secrets/{name}](https://docs.kindgi.com/v0.1.8/reference/api/operations/secretsrevoke.md)

GET

[/v1/secrets/{name}/versions](https://docs.kindgi.com/v0.1.8/reference/api/operations/secretslistversions.md)

GET

[/v1/secrets/{name}/versions/{versionId}](https://docs.kindgi.com/v0.1.8/reference/api/operations/secretsgetversion.md)

POST

[/v1/secrets/{name}/rotate](https://docs.kindgi.com/v0.1.8/reference/api/operations/secretsrotate.md)

GET

[/v1/secrets/{name}/rotations/{rotationId}](https://docs.kindgi.com/v0.1.8/reference/api/operations/secretsgetrotationstatus.md)

GET

[/v1/secrets/{name}/rotations/{rotationId}/events](https://docs.kindgi.com/v0.1.8/reference/api/operations/secretsrotationevents.md)