Skip to main content
See Resource references for accepted reference kinds, lookup scopes, canonical identities and exact list filters. Secrets stores small sensitive values — database passwords, third-party API tokens, signing material — and hands them back only to a caller that is allowed to read them. Values are never stored in the clear: every version is encrypted before it reaches the database, and only ciphertext is persisted. The service is regional — secrets.sa-saopaulo-1.basaltic.sh.

Creating a secret

Naming, and the recovery window a secret carries from the moment it exists.

Reading and writing the value

Why the value has its own endpoint, and how versions accumulate behind it.

Deleting and restoring

The recovery window, and what a deleted secret still answers.

Your own encryption key

Binding a secret to a KMS key of yours, and what that puts in your hands.

Permissions

Every IAM action, and how to grant reading a value separately from everything else.

Platform-owned secrets

The ones this platform creates for itself, and why they are read-only.

Errors

Every error code and the state that produces it.
List requests accept exact, case-sensitive name and crn filters. Both filters apply within your account and the selected region. Invalid or out-of-scope CRNs, empty filters, and conflicting name/CRN filters return an empty page. With include_deleted=true, a reused name can match both the deleted secret and its replacement; use the secret UUID to address a specific secret.