# client.tenant.config

> client.tenant.config — the tenant.config operations.

`client.tenant.config` — the `tenant.config` operations.

On `AsyncKindgi` every method is the same, awaited.

## `client.tenant.config.list()`

```python signature
list(
    *,
    limit: int | None = None,
    cursor: str | None = None,
    kind: Literal['env', 'config', 'secret'] | None = None,
    key_prefix: str | None = None,
    timeout: float | None = None,
) -> TenantConfigCollectionPage
```

List the tenant's config entries. `GET /v1/tenant/config`

Cursor-paginated: the env entries (in the env binding order), then the secret entries (in the secrets binding order); a page holds at most `limit` entries and `nextCursor` resumes where it ended. Optional `?kind=` narrows to one slot (env / config / secret); `?keyPrefix=` matches on entry key. **Secret values are ALWAYS redacted on this admin surface** — the dispatch path is the only reader that receives raw material.

## `client.tenant.config.upsert()`

```python signature
upsert(
    body: UpsertTenantConfigBody | Mapping[str, Any] | None = None,
    /,
    *,
    idempotency_key: str | None = None,
    timeout: float | None = None,
    **fields: Any,
) -> UpsertTenantConfigResult
```

Upsert a tenant-config entry. `PATCH /v1/tenant/config`

Set / update an entry keyed by `(kind, key)`. Optional `ifRevision` provides optimistic-concurrency: the write fails with `tenant-config-revision-conflict` (409) unless the stored revision matches. Omit for last-write-wins.