Add a secret version
Upload a new encrypted value for a secret.
Authorizations
Path Parameters
Secret ID.
Body
The value, encrypted on your side as a compact JWE: five canonical, unpadded base64url segments. Wrap the content key with RSA-OAEP-256 using the key from GET /api/secrets/public-key, and encrypt the content with A256GCM. The protected header must hold exactly alg (RSA-OAEP-256), enc (A256GCM), kid (the public key's kid) and ctx (the secret's encryptionContext, copied verbatim). The plaintext is the value as UTF-8: any string for secret; a base32 seed (spaces and hyphens are ignored, = padding only at the end) or an otpauth://totp/ URI (with secret and optionally algorithm SHA1, SHA256 or SHA512, digits 6 or 8, and period 1-300) for totp; a 1Password service account token for op_token. The value can be at most 32 KiB, without NUL bytes, and the envelope at most 64 KiB. The API checks the envelope's structure but can't decrypt it, so it can't check the value: an invalid TOTP seed returns 422 SECRET_VALUE_INVALID when it's used. The Hyperbrowser SDKs and CLI validate the value and build the envelope for you, so we recommend using them rather than encrypting by hand.
65536