action | string | Yes | Operation to perform Values: put, get, list, rotate, delete. |
name | string | No | Logical secret name, e.g. ‘openai/default_api_key’. Required for all actions except ‘list’. |
value | string | No | Secret value. Required for ‘put’ and ‘rotate’ actions. |
encoding | string | No | Content encoding: ‘utf-8’ (default) or ‘base64’ for binary secret blobs. Values: utf-8, base64. |
mode | string | No | For ‘put’ action: ‘create’ (fail if exists) or ‘upsert’ (default). Values: create, upsert. |
allowedAgentIds | string[] | No | Agent IDs allowed to access this secret. If omitted, all agents in the workspace can access it. |
description | string | No | Human-readable note about the secret’s purpose. |
tags | string[] | No | Optional classification labels. |
expiresAt | string | No | Optional expiration timestamp (RFC 3339). Secret becomes inaccessible after this time. |
reveal | boolean | No | For ‘get’ action: if true, return the plaintext secret value. Default false (returns masked value). |
purpose | string | No | Required when reveal=true. Audit reason for plaintext retrieval. |
