The Secrets surface of the Soda Cloud v4 API — 5 operation(s) across 3 path(s).
Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay
Every API here is available over the APIs.io API and to AI agents over MCP.
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.curl "https://apis.io/api/v1/apis/soda-data:soda-data-secrets-api"curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
openapi: 3.2.0
info:
title: Soda Cloud API v4 Secrets API
version: v1
description: The Soda Cloud REST API (v4 public API). Assembled verbatim from the OpenAPI 3.1.0 documents Soda publishes inside each REST API reference page at https://docs.soda.io/reference/soda-apis/rest-api/.
contact:
name: Soda
url: https://www.soda.io
servers:
- description: Cloud EU
url: https://cloud.soda.io
- description: Cloud US
url: https://cloud.us.soda.io
security:
- basicAuthApiKey: []
- cookieToken: []
tags:
- name: Secrets
description: Soda Cloud API Secret Endpoints
paths:
/api/v1/secrets:
get:
description: 'This endpoint allows you to list secrets in your organization.
This GET is a paginated API that uses the following parameters to request specific details:
- `size`: Supply an integer value between 10 and 1000, inclusive. The default value is 10.
- `page`: Supply an integer value. The default value is 0.
- `search`: Supply a string value to filter secrets by name (case-insensitive partial match).
## Authentication
User authentication required: `true`
This endpoint accepts authentication via API keys in the `Basic` authentication header, or a pre-authenticated token in HTTP cookie `token`. Cookie sessions extend automatically on each request.
## Authorization
Users must have global role permission MANAGE_DATASOURCES_AND_AGENTS to execute this call.
## Tags
`Secrets`
## Rate limiting
60 requests/60 seconds'
operationId: GET/api/v1/secrets
parameters:
- in: query
name: page
schema:
type: integer
format: int32
- in: query
name: search
schema:
type: string
- in: query
name: size
schema:
type: integer
format: int32
responses:
'200':
content:
application/json:
schema:
type: object
$ref: '#/components/schemas/PublicApiListSecretsResponse'
description: Successful response
'400':
content:
application/json:
schema:
type: object
$ref: '#/components/schemas/ErrorResponse'
description: Bad request
'401':
content:
application/json:
schema:
type: object
$ref: '#/components/schemas/ErrorResponse'
description: Unauthorized
'403':
content:
application/json:
schema:
type: object
$ref: '#/components/schemas/ErrorResponse'
description: Forbidden
'429':
content:
application/json:
schema:
type: object
$ref: '#/components/schemas/ErrorResponse'
description: Too many requests
'500':
content:
application/json:
schema:
type: object
$ref: '#/components/schemas/ErrorResponse'
description: Internal server error
summary: List secrets
tags:
- Secrets
post:
description: 'Creates a new secret in your organization. Secrets store encrypted credentials that can be referenced in datasource configurations using `${secret.NAME}` placeholders, keeping sensitive values out of plain text.
## Encryption
Secret values must be encrypted **client-side** before sending them to this endpoint. This enables a zero-trust design, where Soda never decrypts the secret. Decryption happens only during scan execution, within the runner.
Use the `GET /api/v1/secretsPublicKey` endpoint to obtain the server''s RSA public key. The encryption uses a two-layer scheme:
1. Fetch the RSA public key from `GET /api/v1/secretsPublicKey`.
2. Generate a random AES-256-GCM key (32 bytes) and initialization vector (IV, 12 bytes).
3. Encrypt the secret value using AES-256-GCM with the generated key and IV. Base64-encode the ciphertext and prefix it with `encrypted_`. This becomes the `encryptedValue` field.
4. Export the raw AES key and IV as base64 strings and concatenate them as `{base64_key}:::{base64_iv}`. Encrypt this string using RSA-OAEP (SHA-256) with the public key from step 1. Base64-encode the result. This becomes the `encryptionKey` field.
## Constraints
- The secret `name` must not contain whitespace and must be unique within the organization.
- Both `encryptionKey` and `encryptedValue` are required.
- The organization must have the contracts feature enabled and the secure store must not be disabled.
## Authentication
User authentication required: `true`
This endpoint accepts authentication via API keys in the `Basic` authentication header, or a pre-authenticated token in HTTP cookie `token`. Cookie sessions extend automatically on each request.
## Authorization
Users must have global role permission MANAGE_DATASOURCES_AND_AGENTS to execute this call.
## Tags
`Secrets`
## Rate limiting
10 requests/60 seconds'
operationId: POST/api/v1/secrets
requestBody:
content:
application/json:
schema:
type: object
$ref: '#/components/schemas/PublicApiCreateSecretRequestDTO'
required: true
responses:
'200':
content:
application/json:
schema:
type: object
$ref: '#/components/schemas/PublicApiCreateSecretResponse'
description: Successful response
'400':
content:
application/json:
schema:
type: object
$ref: '#/components/schemas/ErrorResponse'
description: Bad request
'401':
content:
application/json:
schema:
type: object
$ref: '#/components/schemas/ErrorResponse'
description: Unauthorized
'403':
content:
application/json:
schema:
type: object
$ref: '#/components/schemas/ErrorResponse'
description: Forbidden
'429':
content:
application/json:
schema:
type: object
$ref: '#/components/schemas/ErrorResponse'
description: Too many requests
'500':
content:
application/json:
schema:
type: object
$ref: '#/components/schemas/ErrorResponse'
description: Internal server error
summary: Create a secret
tags:
- Secrets
/api/v1/secrets/{secretId}:
post:
description: 'Updates the encrypted value of an existing secret. The secret name cannot be changed.
Both `encryptionKey` and `encryptedValue` must be provided together — you cannot update one without the other.
## Encryption
The new secret value must be encrypted **client-side** using the same two-layer encryption scheme as creation. See the `POST /api/v1/secrets` (Create a secret) endpoint for the full encryption workflow.
## Authentication
User authentication required: `true`
This endpoint accepts authentication via API keys in the `Basic` authentication header, or a pre-authenticated token in HTTP cookie `token`. Cookie sessions extend automatically on each request.
## Authorization
Users must have global role permission MANAGE_DATASOURCES_AND_AGENTS to execute this call.
## Tags
`Secrets`
## Rate limiting
100 requests/60 seconds'
operationId: POST/api/v1/secrets/{secretId}
parameters:
- in: path
name: secretId
required: true
schema:
type: string
requestBody:
content:
application/json:
schema:
type: object
$ref: '#/components/schemas/PublicApiUpdateSecretRequestDTO'
required: true
responses:
'200':
content:
application/json:
schema:
type: object
$ref: '#/components/schemas/PublicApiUpdateSecretResponse'
description: Successful response
'400':
content:
application/json:
schema:
type: object
$ref: '#/components/schemas/ErrorResponse'
description: Bad request
'401':
content:
application/json:
schema:
type: object
$ref: '#/components/schemas/ErrorResponse'
description: Unauthorized
'403':
content:
application/json:
schema:
type: object
$ref: '#/components/schemas/ErrorResponse'
description: Forbidden
'404':
content:
application/json:
schema:
type: object
$ref: '#/components/schemas/ErrorResponse'
description: Not found
'429':
content:
application/json:
schema:
type: object
$ref: '#/components/schemas/ErrorResponse'
description: Too many requests
'500':
content:
application/json:
schema:
type: object
$ref: '#/components/schemas/ErrorResponse'
description: Internal server error
summary: Update a secret
tags:
- Secrets
delete:
description: 'Deletes an existing secret.
The secret cannot be deleted if it is referenced by a datasource configuration.
## Authentication
User authentication required: `true`
This endpoint accepts authentication via API keys in the `Basic` authentication header, or a pre-authenticated token in HTTP cookie `token`. Cookie sessions extend automatically on each request.
## Authorization
Users must have global role permission MANAGE_DATASOURCES_AND_AGENTS to execute this call.
## Tags
`Secrets`
## Rate limiting
10 requests/60 seconds'
operationId: DELETE/api/v1/secrets/{secretId}
parameters:
- in: path
name: secretId
required: true
schema:
type: string
responses:
'200':
content:
application/json:
schema:
type: object
$ref: '#/components/schemas/PublicApiDeleteSecretResponse'
description: Successful response
'400':
content:
application/json:
schema:
type: object
$ref: '#/components/schemas/ErrorResponse'
description: Bad request
'401':
content:
application/json:
schema:
type: object
$ref: '#/components/schemas/ErrorResponse'
description: Unauthorized
'403':
content:
application/json:
schema:
type: object
$ref: '#/components/schemas/ErrorResponse'
description: Forbidden
'404':
content:
application/json:
schema:
type: object
$ref: '#/components/schemas/ErrorResponse'
description: Not found
'429':
content:
application/json:
schema:
type: object
$ref: '#/components/schemas/ErrorResponse'
description: Too many requests
'500':
content:
application/json:
schema:
type: object
$ref: '#/components/schemas/ErrorResponse'
description: Internal server error
summary: Delete a secret
tags:
- Secrets
/api/v1/secretsPublicKey:
get:
description: 'Returns the RSA public key in JWK (JSON Web Key) format, used for client-side encryption of secret values.
## Usage
When creating or updating a secret, the secret value must be encrypted client-side before sending it to the API. This endpoint provides the RSA public key needed for that encryption.
## Encryption workflow
1. Fetch this public key.
2. Generate a random AES-256-GCM key (32 bytes) and initialization vector (IV, 12 bytes).
3. Encrypt the secret value using AES-256-GCM with the generated key and IV. Base64-encode the ciphertext and prefix it with `encrypted_`. This becomes the `encryptedValue` field.
4. Export the raw AES key and IV as base64 strings and concatenate them as `{base64_key}:::{base64_iv}`. Encrypt this string using RSA-OAEP (SHA-256) with this public key. Base64-encode the result. This becomes the `encryptionKey` field.
5. Use the `encryptedValue` and `encryptionKey` in the create or update secret request.
## Authentication
User authentication required: `true`
This endpoint accepts authentication via API keys in the `Basic` authentication header, or a pre-authenticated token in HTTP cookie `token`. Cookie sessions extend automatically on each request.
## Authorization
Users must have global role permission MANAGE_DATASOURCES_AND_AGENTS to execute this call.
## Tags
`Secrets`
## Rate limiting
60 requests/60 seconds'
operationId: GET/api/v1/secretsPublicKey
responses:
'200':
content:
application/json:
schema:
type: object
$ref: '#/components/schemas/PublicApiGetEncryptionKeyResponse'
description: Successful response
'401':
content:
application/json:
schema:
type: object
$ref: '#/components/schemas/ErrorResponse'
description: Unauthorized
'403':
content:
application/json:
schema:
type: object
$ref: '#/components/schemas/ErrorResponse'
description: Forbidden
'429':
content:
application/json:
schema:
type: object
$ref: '#/components/schemas/ErrorResponse'
description: Too many requests
'500':
content:
application/json:
schema:
type: object
$ref: '#/components/schemas/ErrorResponse'
description: Internal server error
summary: Get the encryption public key
tags:
- Secrets
components:
schemas:
PublicApiDeleteSecretResponse:
type: object
properties:
message:
type: string
PublicApiUpdateSecretResponse:
type: object
properties:
secret:
type: object
$ref: '#/components/schemas/PublicApiSecretDTO'
PublicApiCreateSecretResponse:
type: object
properties:
secret:
type: object
$ref: '#/components/schemas/PublicApiSecretDTO'
PublicApiListSecretsResponse:
type: object
properties:
content:
type: array
items:
type: object
$ref: '#/components/schemas/PublicApiSecretDTO'
first:
type: boolean
last:
type: boolean
number:
type: integer
format: int32
size:
type: integer
format: int32
totalElements:
type: integer
format: int32
totalPages:
type: integer
format: int32
required:
- content
- first
- last
- number
- size
- totalElements
- totalPages
MapOfStringTo_object:
type: object
additionalProperties: true
ErrorResponse:
type: object
properties:
code:
type: string
message:
type: string
PublicApiUpdateSecretRequestDTO:
type: object
properties:
encryptedValue:
type: string
encryptionKey:
type: string
required:
- encryptedValue
- encryptionKey
PublicApiGetEncryptionKeyResponse:
type: object
properties:
encryptionKey:
type: object
$ref: '#/components/schemas/MapOfStringTo_object'
PublicApiSecretDTO:
type: object
properties:
created:
type: string
format: date-time
id:
type: string
lastUpdated:
type: string
format: date-time
name:
type: string
PublicApiCreateSecretRequestDTO:
type: object
properties:
encryptedValue:
type: string
encryptionKey:
type: string
name:
type: string
required:
- encryptedValue
- encryptionKey
- name
securitySchemes:
basicAuthApiKey:
scheme: basic
type: http
cookieToken:
in: cookie
name: token
type: apiKey