Skip to main content
PUT
Create or replace an org Secret.

Authorizations

Authorization
string
header
required

Opaque instabox access token (1 hour). Refresh with /v1/auth/refresh (refresh token valid 30 days, rotates on use).

Path Parameters

id
string
required

Organization ID.

name
string
required

A unique environment variable name within an org. The names a sandbox's env reserves are reserved (shell variables such as PATH, HOME, BASH_ENV, ENV and IFS, session and trust-store variables, and INSTABOX_ and SSH_ prefixes). A Secret saved under a name before it was reserved is not delivered: the machine's guest status names it.

Pattern: ^[A-Za-z_][A-Za-z0-9_]{0,127}$

Body

application/json
value
string
required
write-only

UTF-8 text without NUL, at most 65536 bytes. Empty values are valid. Proxy values must also be valid HTTP header values without CR or LF.

delivery
enum<string>
required

Proxy supplies an opaque sandbox-specific placeholder for substitution in ordinary HTTPS headers on allowed hosts (port 443). Env supplies the real value, including credentials needed by native database clients. Unsupported traffic never falls back from proxy to env.

Available options:
proxy,
env
hosts
string[]

Exact ASCII DNS hostnames, normalized to lowercase without a trailing dot, or a standalone * for every public HTTPS destination. Omitted or empty for proxy delivery means ["*"]. No scheme, port, path, partial wildcard, IP literal, or local hostname. Destination checks also reject private and restricted resolved addresses. This scopes credential use, not all sandbox network access.

Maximum array length: 32
Maximum string length: 253

Response

Replaced; reconciliation is pending.

Org Secret metadata. Values, ciphertext and placeholders are never returned.

id
string
required

Stable identity retained by replacements; deletion and recreation makes a new ID.

orgId
string
required
name
string
required

A unique environment variable name within an org. The names a sandbox's env reserves are reserved (shell variables such as PATH, HOME, BASH_ENV, ENV and IFS, session and trust-store variables, and INSTABOX_ and SSH_ prefixes). A Secret saved under a name before it was reserved is not delivered: the machine's guest status names it.

Pattern: ^[A-Za-z_][A-Za-z0-9_]{0,127}$
delivery
enum<string>
required

Proxy supplies an opaque sandbox-specific placeholder for substitution in ordinary HTTPS headers on allowed hosts (port 443). Env supplies the real value, including credentials needed by native database clients. Unsupported traffic never falls back from proxy to env.

Available options:
proxy,
env
hosts
string[]
required

Exact ASCII DNS hostnames, normalized to lowercase without a trailing dot, or a standalone * for every public HTTPS destination. Omitted or empty for proxy delivery means ["*"]. No scheme, port, path, partial wildcard, IP literal, or local hostname. Destination checks also reject private and restricted resolved addresses. This scopes credential use, not all sandbox network access.

Maximum array length: 32
Maximum string length: 253
version
integer
required
Required range: x >= 1
size
integer
required

Raw value size in bytes.

Required range: x >= 0
createdAt
string<date-time>
required
updatedAt
string<date-time>
required