client.env

client.env — the env operations.

On AsyncKindgi every method is the same, awaited.

client.env.list()

list(
    *,
    env_name: str,
    scope_kind: Literal['tenant', 'org', 'project'],
    scope_id: str | UUID | None = None,
    inherit: bool | None = None,
    limit: int | None = None,
    cursor: str | None = None,
    name_prefix: str | None = None,
    timeout: float | None = None,
) -> EnvCollectionPage

Signature

List env entries. GET /v1/env

Cursor-paginated list of env entries at the given (scope, envName). value is present (env is non-sensitive by definition).

client.env.list_cloud_secrets()

list_cloud_secrets(
    *,
    env_name: str,
    scope_kind: Literal['tenant', 'org', 'project'],
    scope_id: str | UUID | None = None,
    limit: int | None = None,
    cursor: str | None = None,
    timeout: float | None = None,
) -> EnvCloudSecretNamePage

Signature

List the names set to a cloud secret. GET /v1/env/cloud-secrets

The env names the operator set to a cloud secret at (scope, envName), in name order: a version of a secret the operator's cloud holds, which a pack service's host reads as the pack service's own account. Which secret is the operator's to know, so it isn't given. The operator sets them with a system key (PUT /v1/system/tenants/{tenantId}/env/{name}).

client.env.get()

get(
    name: str,
    /,
    *,
    env_name: str,
    scope_kind: Literal['tenant', 'org', 'project'],
    scope_id: str | UUID | None = None,
    inherit: bool | None = None,
    timeout: float | None = None,
) -> EnvRecord

Signature

Get one env entry. GET /v1/env/{name}

client.env.put()

put(
    name: str,
    body: EnvSetRequest | Mapping[str, Any] | None = None,
    /,
    *,
    env_name: str,
    scope_kind: Literal['tenant', 'org', 'project'],
    scope_id: str | UUID | None = None,
    idempotency_key: str | None = None,
    timeout: float | None = None,
    **fields: Any,
) -> EnvRecord

Signature

Upsert an env entry. PUT /v1/env/{name}

Requires the env:write capability. Every write bumps revision; optional ifRevision guards against concurrent updates (409 env-write-conflict). Env values aren't secret: they're recorded with each run that uses them. A credential goes in /v1/secrets. A body with cloudSecret is refused: only the operator sets a name to a cloud secret, with a system key.

client.env.delete()

delete(
    name: str,
    /,
    *,
    env_name: str,
    scope_kind: Literal['tenant', 'org', 'project'],
    scope_id: str | UUID | None = None,
    timeout: float | None = None,
) -> EnvDeleteResult

Signature

Delete an env entry. DELETE /v1/env/{name}

Requires the env:write capability. Idempotent — unknown key returns { deleted: false }.