Replace the list of worker names allowed to resolve a secret; [] revokes everyone. With store "env", shares the environment variable NAME (env://NAME), whether or not it is set yet.
consumersstring[]*required
The complete new allowlist of worker names; `[]` revokes everyone.
storeall of
`vault` (default; the secret must exist) or `env` (shares the variable, whether or not it is set yet).
all of (1)
variant 1
one of (2)
variant 1
valuestringenum: vault
variant 2
valuestringenum: env
consumersstring[]*required
Worker names allowed to resolve the value. Empty: nobody.
created_atstring*required
fingerprintstring
First 16 hex characters of HMAC-SHA256(master key, value). Changes on rotation. Vault only: an environment value can change outside this worker.
hintstring*required
Masked value, e.g. `sk-ant…9f2c`; `••••` under 12 characters. Empty for an environment variable that is not set.
last_resolved_bystring
Worker name of the last successful resolver.
locationstring
Env store: where the variable's value is read from now (the `.env` path, or this worker's environment); absent when it is not set.
refstring*required
`secret://NAME` or `env://NAME`, the string to put in versioned configuration.
storeone of*required
Where a secret's value lives.
one of (2)
variant 1
valuestringenum: vault
variant 2
valuestringenum: env
updated_atstring*required
Delete a secret and revoke every consumer's access to it. With store "env", stops sharing the variable; its value stays in .env.
storeall of
`vault` (default) or `env`.
all of (1)
variant 1
one of (2)
variant 1
valuestringenum: vault
variant 2
valuestringenum: env
Look for existing values of the given env var names in this worker's environment, the project's .env and the user's login shell. Reports masked hints and whether each equals the stored value; never a value.
namesstring[]*required
Env var names to look for (also the secret names they would be stored under).
resultsobject[]*required
sourcesobject[]*required
hintstring*required
Masked value found there.
kindstring*requiredenum: process_env, dotenv, login_shell
locationstring*required
The secrets worker's environment, the `.env` path, or the login shell path.
matches_storedboolean*required
The value equals the stored one (same fingerprint).
One secret's metadata (masked hint, fingerprint, consumers, timestamps; for store "env", where the variable is read from), or null. Never the value.
storeall of
`vault` (default) or `env`.
all of (1)
variant 1
one of (2)
variant 1
valuestringenum: vault
variant 2
valuestringenum: env
any of (2)
variant 1
consumersstring[]*required
Worker names allowed to resolve the value. Empty: nobody.
created_atstring*required
fingerprintstring
First 16 hex characters of HMAC-SHA256(master key, value). Changes on rotation. Vault only: an environment value can change outside this worker.
hintstring*required
Masked value, e.g. `sk-ant…9f2c`; `••••` under 12 characters. Empty for an environment variable that is not set.
last_resolved_bystring
Worker name of the last successful resolver.
locationstring
Env store: where the variable's value is read from now (the `.env` path, or this worker's environment); absent when it is not set.
refstring*required
`secret://NAME` or `env://NAME`, the string to put in versioned configuration.
storeone of*required
Where a secret's value lives.
one of (2)
variant 1
valuestringenum: vault
variant 2
valuestringenum: env
updated_atstring*required
Store a value found by secrets::detect: the worker re-reads it from the named source itself, so it never passes through the caller. With store "env", a value found in .env or this worker's environment is shared as it is, and one from the login shell is copied into .env.
consumersstring[]
Omit to keep the current list (`[]` for a new secret).
descriptionstring
Omit to keep the current description; an empty string clears it.
sourceall of*required
Where the worker re-reads the value; it never travels through the caller.
all of (1)
variant 1
valuestringenum: process_env, dotenv, login_shell
storeall of
`vault` (default) or `env`: copied into the project's `.env` (a `dotenv` source is only shared, it is already there).
all of (1)
variant 1
one of (2)
variant 1
valuestringenum: vault
variant 2
valuestringenum: env
consumersstring[]*required
Worker names allowed to resolve the value. Empty: nobody.
created_atstring*required
fingerprintstring
First 16 hex characters of HMAC-SHA256(master key, value). Changes on rotation. Vault only: an environment value can change outside this worker.
hintstring*required
Masked value, e.g. `sk-ant…9f2c`; `••••` under 12 characters. Empty for an environment variable that is not set.
last_resolved_bystring
Worker name of the last successful resolver.
locationstring
Env store: where the variable's value is read from now (the `.env` path, or this worker's environment); absent when it is not set.
refstring*required
`secret://NAME` or `env://NAME`, the string to put in versioned configuration.
storeone of*required
Where a secret's value lives.
one of (2)
variant 1
valuestringenum: vault
variant 2
valuestringenum: env
updated_atstring*required
Every secret's metadata: vault secrets, then shared environment variables (masked hint, consumers, timestamps). Never a value.
secretsobject[]*required
consumersstring[]*required
Worker names allowed to resolve the value. Empty: nobody.
created_atstring*required
fingerprintstring
First 16 hex characters of HMAC-SHA256(master key, value). Changes on rotation. Vault only: an environment value can change outside this worker.
hintstring*required
Masked value, e.g. `sk-ant…9f2c`; `••••` under 12 characters. Empty for an environment variable that is not set.
last_resolved_bystring
Worker name of the last successful resolver.
locationstring
Env store: where the variable's value is read from now (the `.env` path, or this worker's environment); absent when it is not set.
refstring*required
`secret://NAME` or `env://NAME`, the string to put in versioned configuration.
storeone of*required
Where a secret's value lives.
one of (2)
variant 1
valuestringenum: vault
variant 2
valuestringenum: env
updated_atstring*required
Internal: re-read the secrets configuration after an operator change.
idstring
Configuration id that changed.
Return the value behind secret://NAME (the vault) or env://NAME (the project's .env, else this worker's environment) to a worker listed in its consumers; anyone else gets SECRET_FORBIDDEN. The caller is identified by the engine, not by the request.
refstring*required
`secret://NAME`, `env://NAME`, or a bare `NAME` (the vault).
Store a credential under NAME (create, or rotate an existing one) and return its metadata. store "vault" (default) encrypts it, referenced as secret://NAME; store "env" writes NAME=value to the project's .env, referenced as env://NAME. The value is never returned by this or any metadata function. Omitted consumers keep the current allowlist ([] for a new secret).
consumersstring[]
Worker names allowed to resolve. Omit to keep the current list (`[]` for a new secret).
descriptionstring
Omit to keep the current description; an empty string clears it.
namestring*required
`^[A-Za-z_][A-Za-z0-9_.-]{0,127}$`; provider keys reuse their env var name.
storeall of
`vault` (default) or `env`.
all of (1)
variant 1
one of (2)
variant 1
valuestringenum: vault
variant 2
valuestringenum: env
valuestring*required
The credential. Encrypted in the vault, or written as `NAME=value` to the project's `.env`; never returned except by `secrets::resolve`.
consumersstring[]*required
Worker names allowed to resolve the value. Empty: nobody.
created_atstring*required
fingerprintstring
First 16 hex characters of HMAC-SHA256(master key, value). Changes on rotation. Vault only: an environment value can change outside this worker.
hintstring*required
Masked value, e.g. `sk-ant…9f2c`; `••••` under 12 characters. Empty for an environment variable that is not set.
last_resolved_bystring
Worker name of the last successful resolver.
locationstring
Env store: where the variable's value is read from now (the `.env` path, or this worker's environment); absent when it is not set.
refstring*required
`secret://NAME` or `env://NAME`, the string to put in versioned configuration.
storeone of*required
Where a secret's value lives.
one of (2)
variant 1
valuestringenum: vault
variant 2
valuestringenum: env
updated_atstring*required
Where the vault lives, where the master key comes from (III_SECRETS_KEY or a key file outside the project), how many secrets are stored, and the .env the env store uses.
countinteger· uint*requiredmin 0
env_countinteger· uint*requiredmin 0
Environment variables shared with at least one worker.
env_filestring
The `.env` the env store reads and writes, when the worker has one.
key_pathstring
The key file, when `key_source` is `file`.
key_sourceall of*required
`env` when III_SECRETS_KEY supplies the master key, else `file`.
all of (1)
variant 1
valuestringenum: env, file
vault_pathstring*required
versioninteger· uint32*requiredmin 0
Vault file format version.
