Create a secret
Create a secret, then upload its value as a version.
Authorizations
Body
1-128 letters, digits, _ or -, starting with a letter or digit. Unique within your team.
^[a-zA-Z0-9][a-zA-Z0-9_-]{0,127}$Trimmed before it's stored.
1024What the value is. Fixed at creation. secret: any string, set as an environment variable and, once it has allowed origins, typed into browser pages. totp: an authenticator seed (base32, or an otpauth://totp/ URI); environment variables get the code current when the process starts, and fills type the code current at fill time. op_token: a 1Password service account token, used only by 1Password vaults; it's never an environment variable, a vault entry or a browser credential. Treat types you don't recognize as opaque: more may be added.
secret, totp, op_token For secret and totp, you can set browser.allowedOrigins now or later with PATCH /api/secrets/{id}. op_token accepts only {}.
Response
Success
A secret. The API never returns its value.
1-128 letters, digits, _ or -, starting with a letter or digit. Unique within your team.
^[a-zA-Z0-9][a-zA-Z0-9_-]{0,127}$1024What the value is. Fixed at creation. secret: any string, set as an environment variable and, once it has allowed origins, typed into browser pages. totp: an authenticator seed (base32, or an otpauth://totp/ URI); environment variables get the code current when the process starts, and fills type the code current at fill time. op_token: a 1Password service account token, used only by 1Password vaults; it's never an environment variable, a vault entry or a browser credential. Treat types you don't recognize as opaque: more may be added.
secret, totp, op_token Settings that aren't secret, returned by the API and editable without uploading a new value. A secret or totp secret can't be filled into browser pages until browser.allowedOrigins is set. An op_token secret accepts only {} (otherwise 400 SECRET_METADATA_INVALID).
Copy this verbatim into the ctx header of every envelope you upload for this secret. Don't build it yourself: it includes the secret's type for types other than secret, and an envelope sealed with another context returns 400 SECRET_ENVELOPE_INVALID.
The newest version number, or null until a value is uploaded.