Skip to content
View as Markdown

SecretService

Section titled “SecretService”
class SecretService()

Project secret namespace.

SecretService.__init__

Section titled “SecretService.__init__”
def __init__(impl: AsyncSecretService, bridge: SyncBridge) -> None

SecretService.delete

Section titled “SecretService.delete”
def delete(name: str) -> None

Delete a secret.

SecretService.get

Section titled “SecretService.get”
def get(name: str) -> SecretMeta

Fetch one secret’s metadata (never its value).

SecretService.iter

Section titled “SecretService.iter”
def iter(*,
         cursor: Optional[str] = None,
         limit: Optional[int] = None) -> Iterator[SecretDto]

SecretService.list

Section titled “SecretService.list”
def list(*,
         cursor: Optional[str] = None,
         limit: Optional[int] = None) -> ListResult[SecretDto]

List secret metadata.

SecretService.set

Section titled “SecretService.set”
def set(name: str,
        value: str,
        *,
        allowed_domains: Sequence[str],
        description: Optional[str] = None,
        if_not_exists: bool = False) -> SecretMeta

Create or update a write-only secret.

AsyncSecretService

Section titled “AsyncSecretService”
class AsyncSecretService()

Project secret namespace.

Project-scoped secrets (PLAN-SECRETS.md): named key/value pairs stored encrypted in the project. Attach one or more to a sandbox at creation via the secrets create parameter (a list of names); the sandbox receives an opaque per-VM PLACEHOLDER as an environment variable, and the platform’s egress proxy substitutes the real value into outbound HTTPS requests (a plain http:// request carries the placeholder unchanged). The real value NEVER enters the sandbox and is never returned by the API (write-only).

AsyncSecretService.__init__

Section titled “AsyncSecretService.__init__”
def __init__(transport: AsyncTransport) -> None

AsyncSecretService.list

Section titled “AsyncSecretService.list”
async def list(*,
               cursor: Optional[str] = None,
               limit: Optional[int] = None) -> ListResult[SecretDto]

List secret metadata.

AsyncSecretService.iter

Section titled “AsyncSecretService.iter”
async def iter(*,
               cursor: Optional[str] = None,
               limit: Optional[int] = None) -> AsyncIterator[SecretDto]

AsyncSecretService.get

Section titled “AsyncSecretService.get”
async def get(name: str) -> SecretMeta

Fetch one secret’s metadata (never its value).

AsyncSecretService.set

Section titled “AsyncSecretService.set”
async def set(name: str,
              value: str,
              *,
              allowed_domains: Sequence[str],
              description: Optional[str] = None,
              if_not_exists: bool = False) -> SecretMeta

Create or update a write-only secret.

allowed_domains: The hosts where this secret’s value may be sent (exact or *. wildcard), or ["*"] for any verified host. "*" lets the value reach any HTTPS host, including one a compromised sandbox controls.

AsyncSecretService.delete

Section titled “AsyncSecretService.delete”
async def delete(name: str) -> None

Delete a secret.

SecretDto

Section titled “SecretDto”
SecretDto = _gen.api.Secret

SecretMeta

Section titled “SecretMeta”
SecretMeta = _gen.api.Secret