Gitpod gitpod.v1.SecretService API
The gitpod.v1.SecretService API from Gitpod — 5 operation(s) for gitpod.v1.secretservice.
OpenAPI Specification
openapi: 3.0.0
info:
title: gitpod.v1 gitpod.v1.AccountService gitpod.v1.SecretService API
version: v1.0.0
servers:
- url: https://api.gitpod.io
description: Gitpod API
tags:
- name: gitpod.v1.SecretService
x-displayName: gitpod.v1.SecretService
paths:
/gitpod.v1.SecretService/CreateSecret:
servers: []
post:
description: "Creates a new secret for a project.\n\n Use this method to:\n - Store sensitive configuration values\n - Set up environment variables\n - Configure registry authentication\n - Add file-based secrets\n\n ### Examples\n\n - Create environment variable:\n\n Creates a secret that will be available as an environment variable.\n\n ```yaml\n name: \"DATABASE_URL\"\n projectId: \"b0e12f6c-4c67-429d-a4a6-d9838b5da047\"\n value: \"postgresql://user:pass@localhost:5432/db\"\n environmentVariable: true\n ```\n\n - Create file secret:\n\n Creates a secret that will be mounted as a file.\n\n ```yaml\n name: \"SSH_KEY\"\n projectId: \"b0e12f6c-4c67-429d-a4a6-d9838b5da047\"\n value: \"-----BEGIN RSA PRIVATE KEY-----\\n...\"\n filePath: \"/home/gitpod/.ssh/id_rsa\"\n ```\n\n - Create registry auth:\n\n Creates credentials for private container registry.\n\n ```yaml\n name: \"DOCKER_AUTH\"\n projectId: \"b0e12f6c-4c67-429d-a4a6-d9838b5da047\"\n value: \"username:password\"\n containerRegistryBasicAuthHost: \"https://registry.example.com\"\n ```"
operationId: gitpod.v1.SecretService.CreateSecret
parameters: []
requestBody:
content:
application/json:
examples:
create_environment_variable:
description: Creates a secret that will be available as an environment variable.
value:
environmentVariable: true
name: DATABASE_URL
projectId: b0e12f6c-4c67-429d-a4a6-d9838b5da047
value: postgresql://user:pass@localhost:5432/db
create_file_secret:
description: Creates a secret that will be mounted as a file.
value:
filePath: /home/gitpod/.ssh/id_rsa
name: SSH_KEY
projectId: b0e12f6c-4c67-429d-a4a6-d9838b5da047
value: '-----BEGIN RSA PRIVATE KEY-----
...'
create_registry_auth:
description: Creates credentials for private container registry.
value:
containerRegistryBasicAuthHost: https://registry.example.com
name: DOCKER_AUTH
projectId: b0e12f6c-4c67-429d-a4a6-d9838b5da047
value: username:password
schema:
$ref: '#/components/schemas/gitpod.v1.CreateSecretRequest'
required: true
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/gitpod.v1.CreateSecretResponse'
description: Success
default:
content:
application/json:
schema:
$ref: '#/components/schemas/connect.error'
description: Error
security:
- bearerAuth: []
summary: CreateSecret
tags:
- gitpod.v1.SecretService
/gitpod.v1.SecretService/DeleteSecret:
servers: []
post:
description: "Deletes a secret permanently.\n\n Use this method to:\n - Remove unused secrets\n - Clean up old credentials\n\n ### Examples\n\n - Delete secret:\n\n Permanently removes a secret.\n\n ```yaml\n secretId: \"d2c94c27-3b76-4a42-b88c-95a85e392c68\"\n ```"
operationId: gitpod.v1.SecretService.DeleteSecret
parameters: []
requestBody:
content:
application/json:
examples:
delete_secret:
description: Permanently removes a secret.
value:
secretId: d2c94c27-3b76-4a42-b88c-95a85e392c68
schema:
$ref: '#/components/schemas/gitpod.v1.DeleteSecretRequest'
required: true
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/gitpod.v1.DeleteSecretResponse'
description: Success
default:
content:
application/json:
schema:
$ref: '#/components/schemas/connect.error'
description: Error
security:
- bearerAuth: []
summary: DeleteSecret
tags:
- gitpod.v1.SecretService
/gitpod.v1.SecretService/GetSecretValue:
servers: []
post:
description: "Gets the value of a secret. Only available to environments that are authorized to access the secret.\n\n Use this method to:\n - Retrieve secret values\n - Access credentials\n\n ### Examples\n\n - Get secret value:\n\n Retrieves the value of a specific secret.\n\n ```yaml\n secretId: \"d2c94c27-3b76-4a42-b88c-95a85e392c68\"\n ```"
operationId: gitpod.v1.SecretService.GetSecretValue
parameters: []
requestBody:
content:
application/json:
examples:
get_secret_value:
description: Retrieves the value of a specific secret.
value:
secretId: d2c94c27-3b76-4a42-b88c-95a85e392c68
schema:
$ref: '#/components/schemas/gitpod.v1.GetSecretValueRequest'
required: true
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/gitpod.v1.GetSecretValueResponse'
description: Success
default:
content:
application/json:
schema:
$ref: '#/components/schemas/connect.error'
description: Error
security:
- bearerAuth: []
summary: GetSecretValue
tags:
- gitpod.v1.SecretService
/gitpod.v1.SecretService/ListSecrets:
servers: []
post:
description: "Lists secrets\n\n Use this method to:\n - View all project secrets\n - View all user secrets\n\n ### Examples\n\n - List project secrets:\n\n Shows all secrets for a project.\n\n ```yaml\n filter:\n scope:\n projectId: \"b0e12f6c-4c67-429d-a4a6-d9838b5da047\"\n pagination:\n pageSize: 20\n ```\n\n - List user secrets:\n\n Shows all secrets for a user.\n\n ```yaml\n filter:\n scope:\n userId: \"123e4567-e89b-12d3-a456-426614174000\"\n pagination:\n pageSize: 20\n ```"
operationId: gitpod.v1.SecretService.ListSecrets
parameters:
- in: query
name: pageSize
schema:
default: 25
maximum: 100
minimum: 0
type: integer
- in: query
name: token
schema:
default: ''
type: string
requestBody:
content:
application/json:
examples:
list_project_secrets:
description: Shows all secrets for a project.
value:
filter:
scope:
projectId: b0e12f6c-4c67-429d-a4a6-d9838b5da047
pagination:
pageSize: 20
list_user_secrets:
description: Shows all secrets for a user.
value:
filter:
scope:
userId: 123e4567-e89b-12d3-a456-426614174000
pagination:
pageSize: 20
schema:
$ref: '#/components/schemas/gitpod.v1.ListSecretsRequest'
required: true
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/gitpod.v1.ListSecretsResponse'
description: Success
default:
content:
application/json:
schema:
$ref: '#/components/schemas/connect.error'
description: Error
security:
- bearerAuth: []
summary: ListSecrets
tags:
- gitpod.v1.SecretService
/gitpod.v1.SecretService/UpdateSecretValue:
servers: []
post:
description: "Updates the value of an existing secret.\n\n Use this method to:\n - Rotate secret values\n - Update credentials\n\n ### Examples\n\n - Update secret value:\n\n Changes the value of an existing secret.\n\n ```yaml\n secretId: \"d2c94c27-3b76-4a42-b88c-95a85e392c68\"\n value: \"new-secret-value\"\n ```"
operationId: gitpod.v1.SecretService.UpdateSecretValue
parameters: []
requestBody:
content:
application/json:
examples:
update_secret_value:
description: Changes the value of an existing secret.
value:
secretId: d2c94c27-3b76-4a42-b88c-95a85e392c68
value: new-secret-value
schema:
$ref: '#/components/schemas/gitpod.v1.UpdateSecretValueRequest'
required: true
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/gitpod.v1.UpdateSecretValueResponse'
description: Success
default:
content:
application/json:
schema:
$ref: '#/components/schemas/connect.error'
description: Error
security:
- bearerAuth: []
summary: UpdateSecretValue
tags:
- gitpod.v1.SecretService
components:
schemas:
gitpod.v1.Principal:
enum:
- PRINCIPAL_UNSPECIFIED
- PRINCIPAL_ACCOUNT
- PRINCIPAL_USER
- PRINCIPAL_RUNNER
- PRINCIPAL_ENVIRONMENT
- PRINCIPAL_SERVICE_ACCOUNT
- PRINCIPAL_RUNNER_MANAGER
title: Principal
type: string
gitpod.v1.UpdateSecretValueResponse:
additionalProperties: false
title: UpdateSecretValueResponse
type: object
gitpod.v1.Subject:
additionalProperties: false
properties:
id:
description: id is the UUID of the subject
format: uuid
title: id
type: string
principal:
$ref: '#/components/schemas/gitpod.v1.Principal'
description: Principal is the principal of the subject
title: principal
title: Subject
type: object
connect.error:
additionalProperties: true
description: 'Error type returned by Connect: https://connectrpc.com/docs/go/errors/#http-representation'
properties:
code:
description: The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code].
enum:
- canceled
- unknown
- invalid_argument
- deadline_exceeded
- not_found
- already_exists
- permission_denied
- resource_exhausted
- failed_precondition
- aborted
- out_of_range
- unimplemented
- internal
- unavailable
- data_loss
- unauthenticated
example:
- not_found
type: string
message:
description: A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client.
type: string
title: Connect Error
type: object
gitpod.v1.CreateSecretResponse:
additionalProperties: false
properties:
secret:
$ref: '#/components/schemas/gitpod.v1.Secret'
title: secret
title: CreateSecretResponse
type: object
gitpod.v1.DeleteSecretResponse:
additionalProperties: false
title: DeleteSecretResponse
type: object
gitpod.v1.ListSecretsRequest.Filter:
additionalProperties: false
properties:
projectIds:
deprecated: true
description: "project_ids filters the response to only Secrets used by these Project IDs\n Deprecated: use scope instead. Values in project_ids will be ignored."
items:
deprecated: true
format: uuid
maxItems: 25
type: string
maxItems: 25
title: project_ids
type: array
scope:
$ref: '#/components/schemas/gitpod.v1.SecretScope'
description: scope is the scope of the secrets to list
title: scope
title: Filter
type: object
gitpod.v1.PaginationRequest:
additionalProperties: false
properties:
pageSize:
description: "Page size is the maximum number of results to retrieve per page.\n Defaults to 25. Maximum 100."
format: int32
maximum: 100
title: page_size
type: integer
token:
description: "Token for the next set of results that was returned as next_token of a\n PaginationResponse"
title: token
type: string
title: PaginationRequest
type: object
gitpod.v1.GetSecretValueRequest:
additionalProperties: false
properties:
secretId:
format: uuid
title: secret_id
type: string
title: GetSecretValueRequest
type: object
gitpod.v1.ListSecretsResponse:
additionalProperties: false
properties:
pagination:
$ref: '#/components/schemas/gitpod.v1.PaginationResponse'
description: pagination contains the pagination options for listing secrets
title: pagination
secrets:
items:
$ref: '#/components/schemas/gitpod.v1.Secret'
title: secrets
type: array
title: ListSecretsResponse
type: object
gitpod.v1.ListSecretsRequest:
additionalProperties: false
properties:
filter:
$ref: '#/components/schemas/gitpod.v1.ListSecretsRequest.Filter'
title: filter
pagination:
$ref: '#/components/schemas/gitpod.v1.PaginationRequest'
description: pagination contains the pagination options for listing environments
title: pagination
title: ListSecretsRequest
type: object
gitpod.v1.CreateSecretRequest:
additionalProperties: false
oneOf:
- not:
anyOf:
- required:
- containerRegistryBasicAuthHost
- required:
- environmentVariable
- required:
- filePath
required:
- apiOnly
- not:
anyOf:
- required:
- apiOnly
- required:
- environmentVariable
- required:
- filePath
required:
- containerRegistryBasicAuthHost
- not:
anyOf:
- required:
- apiOnly
- required:
- containerRegistryBasicAuthHost
- required:
- filePath
required:
- environmentVariable
- not:
anyOf:
- required:
- apiOnly
- required:
- containerRegistryBasicAuthHost
- required:
- environmentVariable
required:
- filePath
properties:
apiOnly:
description: "api_only indicates the secret is only available via API/CLI.\n These secrets are NOT automatically injected into services or devcontainers.\n Useful for secrets that should only be consumed programmatically (e.g., by security agents)."
title: api_only
type: boolean
containerRegistryBasicAuthHost:
description: secret will be mounted as a docker config in the environment VM, mount will have the docker registry host
title: container_registry_basic_auth_host
type: string
environmentVariable:
description: secret will be created as an Environment Variable with the same name as the secret
title: environment_variable
type: boolean
filePath:
description: 'absolute path to the file where the secret is mounted
value must be an absolute path (e.g. /path/to/file):
```
this.matches(''^/[^/].*$'')
```
'
title: file_path
type: string
name:
maxLength: 127
minLength: 3
pattern: ^[0-9a-zA-Z_]{3,}$
title: name
type: string
projectId:
deprecated: true
description: "project_id is the ProjectID this Secret belongs to\n Deprecated: use scope instead"
title: project_id
type: string
scope:
$ref: '#/components/schemas/gitpod.v1.SecretScope'
description: scope is the scope of the secret
title: scope
value:
description: value is the plaintext value of the secret
maxLength: 10240
minLength: 1
title: value
type: string
title: CreateSecretRequest
type: object
gitpod.v1.GetSecretValueResponse:
additionalProperties: false
properties:
value:
title: value
type: string
title: GetSecretValueResponse
type: object
gitpod.v1.PaginationResponse:
additionalProperties: false
properties:
nextToken:
description: "Token passed for retrieving the next set of results. Empty if there are no\n more results"
title: next_token
type: string
title: PaginationResponse
type: object
gitpod.v1.Secret:
additionalProperties: false
oneOf:
- not:
anyOf:
- required:
- containerRegistryBasicAuthHost
- required:
- environmentVariable
- required:
- filePath
required:
- apiOnly
- not:
anyOf:
- required:
- apiOnly
- required:
- environmentVariable
- required:
- filePath
required:
- containerRegistryBasicAuthHost
- not:
anyOf:
- required:
- apiOnly
- required:
- containerRegistryBasicAuthHost
- required:
- filePath
required:
- environmentVariable
- not:
anyOf:
- required:
- apiOnly
- required:
- containerRegistryBasicAuthHost
- required:
- environmentVariable
required:
- filePath
properties:
apiOnly:
description: api_only indicates the secret is only available via API/CLI
title: api_only
type: boolean
containerRegistryBasicAuthHost:
description: secret will be mounted as a registry secret
format: uri
title: container_registry_basic_auth_host
type: string
createdAt:
$ref: '#/components/schemas/google.protobuf.Timestamp'
title: created_at
creator:
$ref: '#/components/schemas/gitpod.v1.Subject'
description: creator is the identity of the creator of the secret
title: creator
environmentVariable:
description: secret will be created as an Environment Variable with the same name as the secret
title: environment_variable
type: boolean
filePath:
description: absolute path to the file where the secret is mounted
title: file_path
type: string
id:
format: uuid
title: id
type: string
name:
description: Name of the secret for humans.
title: name
type: string
projectId:
deprecated: true
description: "The Project ID this Secret belongs to\n Deprecated: use scope instead"
format: uuid
title: project_id
type: string
scope:
$ref: '#/components/schemas/gitpod.v1.SecretScope'
title: scope
updatedAt:
$ref: '#/components/schemas/google.protobuf.Timestamp'
title: updated_at
title: Secret
type: object
google.protobuf.Timestamp:
description: "A Timestamp represents a point in time independent of any time zone or local\n calendar, encoded as a count of seconds and fractions of seconds at\n nanosecond resolution. The count is relative to an epoch at UTC midnight on\n January 1, 1970, in the proleptic Gregorian calendar which extends the\n Gregorian calendar backwards to year one.\n\n All minutes are 60 seconds long. Leap seconds are \"smeared\" so that no leap\n second table is needed for interpretation, using a [24-hour linear\n smear](https://developers.google.com/time/smear).\n\n The range is from 0001-01-01T00:00:00Z to 9999-12-31T23:59:59.999999999Z. By\n restricting to that range, we ensure that we can convert to and from [RFC\n 3339](https://www.ietf.org/rfc/rfc3339.txt) date strings.\n\n # Examples\n\n Example 1: Compute Timestamp from POSIX `time()`.\n\n Timestamp timestamp;\n timestamp.set_seconds(time(NULL));\n timestamp.set_nanos(0);\n\n Example 2: Compute Timestamp from POSIX `gettimeofday()`.\n\n struct timeval tv;\n gettimeofday(&tv, NULL);\n\n Timestamp timestamp;\n timestamp.set_seconds(tv.tv_sec);\n timestamp.set_nanos(tv.tv_usec * 1000);\n\n Example 3: Compute Timestamp from Win32 `GetSystemTimeAsFileTime()`.\n\n FILETIME ft;\n GetSystemTimeAsFileTime(&ft);\n UINT64 ticks = (((UINT64)ft.dwHighDateTime) << 32) | ft.dwLowDateTime;\n\n // A Windows tick is 100 nanoseconds. Windows epoch 1601-01-01T00:00:00Z\n // is 11644473600 seconds before Unix epoch 1970-01-01T00:00:00Z.\n Timestamp timestamp;\n timestamp.set_seconds((INT64) ((ticks / 10000000) - 11644473600LL));\n timestamp.set_nanos((INT32) ((ticks % 10000000) * 100));\n\n Example 4: Compute Timestamp from Java `System.currentTimeMillis()`.\n\n long millis = System.currentTimeMillis();\n\n Timestamp timestamp = Timestamp.newBuilder().setSeconds(millis / 1000)\n .setNanos((int) ((millis % 1000) * 1000000)).build();\n\n Example 5: Compute Timestamp from Java `Instant.now()`.\n\n Instant now = Instant.now();\n\n Timestamp timestamp =\n Timestamp.newBuilder().setSeconds(now.getEpochSecond())\n .setNanos(now.getNano()).build();\n\n Example 6: Compute Timestamp from current time in Python.\n\n timestamp = Timestamp()\n timestamp.GetCurrentTime()\n\n # JSON Mapping\n\n In JSON format, the Timestamp type is encoded as a string in the\n [RFC 3339](https://www.ietf.org/rfc/rfc3339.txt) format. That is, the\n format is \"{year}-{month}-{day}T{hour}:{min}:{sec}[.{frac_sec}]Z\"\n where {year} is always expressed using four digits while {month}, {day},\n {hour}, {min}, and {sec} are zero-padded to two digits each. The fractional\n seconds, which can go up to 9 digits (i.e. up to 1 nanosecond resolution),\n are optional. The \"Z\" suffix indicates the timezone (\"UTC\"); the timezone\n is required. A proto3 JSON serializer should always use UTC (as indicated by\n \"Z\") when printing the Timestamp type and a proto3 JSON parser should be\n able to accept both UTC and other timezones (as indicated by an offset).\n\n For example, \"2017-01-15T01:30:15.01Z\" encodes 15.01 seconds past\n 01:30 UTC on January 15, 2017.\n\n In JavaScript, one can convert a Date object to this format using the\n standard\n [toISOString()](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Date/toISOString)\n method. In Python, a standard `datetime.datetime` object can be converted\n to this format using\n [`strftime`](https://docs.python.org/2/library/time.html#time.strftime) with\n the time format spec '%Y-%m-%dT%H:%M:%S.%fZ'. Likewise, in Java, one can use\n the Joda Time's [`ISODateTimeFormat.dateTime()`](\n http://joda-time.sourceforge.net/apidocs/org/joda/time/format/ISODateTimeFormat.html#dateTime()\n ) to obtain a formatter capable of generating timestamps in this format."
format: date-time
type: string
gitpod.v1.UpdateSecretValueRequest:
additionalProperties: false
properties:
secretId:
format: uuid
title: secret_id
type: string
value:
description: value is the plaintext value of the secret
maxLength: 10240
minLength: 1
title: value
type: string
title: UpdateSecretValueRequest
type: object
gitpod.v1.SecretScope:
additionalProperties: false
oneOf:
- not:
anyOf:
- required:
- projectId
- required:
- serviceAccountId
- required:
- userId
required:
- organizationId
- not:
anyOf:
- required:
- organizationId
- required:
- serviceAccountId
- required:
- userId
required:
- projectId
- not:
anyOf:
- required:
- organizationId
- required:
- projectId
- required:
- userId
required:
- serviceAccountId
- not:
anyOf:
- required:
- organizationId
- required:
- projectId
- required:
- serviceAccountId
required:
- userId
properties:
organizationId:
description: organization_id is the Organization ID this Secret belongs to
format: uuid
title: organization_id
type: string
projectId:
description: project_id is the Project ID this Secret belongs to
format: uuid
title: project_id
type: string
serviceAccountId:
description: service_account_id is the Service Account ID this Secret belongs to
format: uuid
title: service_account_id
type: string
userId:
description: user_id is the User ID this Secret belongs to
format: uuid
title: user_id
type: string
title: SecretScope
type: object
gitpod.v1.DeleteSecretRequest:
additionalProperties: false
properties:
secretId:
format: uuid
title: secret_id
type: string
title: DeleteSecretRequest
type: object
securitySchemes:
bearerAuth:
bearerFormat: JWT
scheme: bearer
type: http
x-tagGroups:
- name: gitpod.v1
tags:
- gitpod.v1.AccountService
- gitpod.v1.AgentService
- gitpod.v1.AgentSecurityService
- gitpod.v1.BillingService
- gitpod.v1.EditorService
- gitpod.v1.EnvironmentAutomationService
- gitpod.v1.EnvironmentService
- gitpod.v1.ErrorsService
- gitpod.v1.EventService
- gitpod.v1.GatewayService
- gitpod.v1.GroupService
- gitpod.v1.IdentityService
- gitpod.v1.InsightsService
- gitpod.v1.IntegrationService
- gitpod.v1.NotificationService
- gitpod.v1.OnaIntelligenceService
- gitpod.v1.OrganizationService
- gitpod.v1.PrebuildService
- gitpod.v1.ProjectService
- gitpod.v1.RunnerConfigurationService
- gitpod.v1.RunnerInteractionService
- gitpod.v1.RunnerManagerService
- gitpod.v1.RunnerService
- gitpod.v1.SecretService
- gitpod.v1.ServiceAccountService
- gitpod.v1.SessionService
- gitpod.v1.TeamService
- gitpod.v1.UsageService
- gitpod.v1.UserService
- gitpod.v1.WebhookService
- gitpod.v1.WorkflowService