SOPS website screenshot

SOPS

SOPS (Secrets OPerationS) is a CNCF Sandbox encrypted file editor that supports YAML, JSON, ENV, INI, and binary formats. SOPS encrypts file values while leaving keys in cleartext, enabling secure storage of secrets in version control systems. Supports AWS KMS, GCP KMS, Azure Key Vault, HuaweiCloud KMS, age, and PGP for key management. Originally created at Mozilla and donated to the CNCF in 2023.

SOPS publishes 1 API on the APIs.io network. Tagged areas include Secrets Management, Encryption, Configuration Management, DevOps, and Security.

The SOPS catalog on APIs.io includes 1 JSON-LD context and 1 Spectral governance ruleset.

SOPS’s developer surface includes documentation, release notes, changelog, engineering blog, and 9 more developer resources.

🌐 Visit website 📡 Source on GitHub
35.4/100 thin ▬ flat Agent 3/100 human only Full breakdown ↓
scored 2026-08-05 · rubric v0.9.1
AccessFreemium
1 APIs
Secrets ManagementEncryptionConfiguration ManagementDevOpsSecurityKubernetesCNCF

Kin Score

Kin Score Kin Score How this is scored →
scored 2026-08-05 · rubric v0.9.1
Composite quality — 35.4/100 · thin
Contract Quality 3.2 / 25
Developer Ergonomics 2.2 / 20
Commercial Clarity 7.9 / 20
Operational Transparency 8.2 / 13
Governance 7.0 / 12
Discoverability 6.9 / 10
Agent readiness — 3/100 · human only
Machine-Readable Contract 0 / 18
Agentic Access Contract 0 / 10
MCP Server 0 / 12
Machine-Readable Auth 0 / 10
Idempotency 0 / 9
Stable Error Semantics 0 / 8
Request/Response Examples 0 / 7
Rate-Limit Signaling 7 / 7
Typed Event Surface 0 / 6
Agent Skills 0 / 5
Well-Known Catalog 0 / 4
Consent & Bot Identity 0 / 3
A2A Agent Card 0 / 8
Dry-Run / Simulate Mode 0 / 4
Improve this rating by publishing the missing artifacts — every area above can be raised, and the full rubric is at apis.io/rating/. This rating is computed from github.com/api-evangelist/sops: open an issue to ask a question, or submit a pull request to add artifacts. Want it done for you? Prioritized profiling — $2,500 →

APIs 1

Individual APIs this provider publishes, each with its own machine-readable definition.

SOPS Go Library

The SOPS decrypt Go package provides programmatic access to SOPS-encrypted files from Go applications. It supports decryption of YAML, JSON, ENV, INI, and binary formats using c...

Pricing Plans 1

Published pricing tiers and plan structures.

Sops Plans Pricing

3 plans

PLANS

Rate Limits 1

Documented rate limits and quota policies.

Sops Rate Limits

5 limits

RATE LIMITS

FinOps 1

Cost, billing, and metering signals for API financial operations.

Sops Finops

FINOPS

Semantic Vocabularies 1

JSON-LD contexts and semantic vocabularies used across these APIs.

Sops Context

4 classes · 11 properties

JSON-LD

Spectral Rules 1

Spectral governance rulesets for linting and validating these APIs.

SOPS API Rules

5 rules · 4 warnings 1 info

SPECTRAL

JSON Schema 1

Standalone JSON Schema definitions for this provider's data models.

SOPS Encrypted File

1 properties

JSON SCHEMA

JSON Structure 1

JSON Structure definitions describing this provider's data shapes.

Sops Config Structure

0 properties

JSON STRUCTURE

Examples 1

Example request and response payloads for these APIs.

Sops Encrypt File Example

8 fields

EXAMPLE

Security Posture 1

Authentication, domain security, vulnerability disclosure, and trust-center signals.

Sops Domain Security

TLSv1.3 · HSTS

SECURITY

Resources

Get Started 1

Portal, sign-up, and the first successful call

CNCF Sandbox
CNCF Sandbox

Documentation 1

Reference material describing how the API behaves

Documentation
Documentation

Build 3

SDKs, sample code, and the tooling you integrate with

GitHubOrg
GitHubOrg
 GitHubRepository
GitHubRepository
 Flux Integration
Flux Integration

Access & Security 2

Authentication, authorization, and security posture

DomainSecurity
DomainSecurity
 Security
Security

Operate 2

Status, limits, changes, and where to get help

ReleaseNotes
ReleaseNotes
 ChangeLog
ChangeLog

Commercial 1

Pricing, plans, and the legal terms of use

License
License

Company 2

The organization behind the API

Website
Website
 Blog
Blog

Other 1

Properties that don't map to a standard resource type

Homebrew
Homebrew

Source (apis.yml)

apis.yml Raw ↑ 
aid: sops
name: SOPS
description: SOPS (Secrets OPerationS) is a CNCF Sandbox encrypted file editor that supports YAML, JSON, ENV, INI, and binary
  formats. SOPS encrypts file values while leaving keys in cleartext, enabling secure storage of secrets in version control
  systems. Supports AWS KMS, GCP KMS, Azure Key Vault, HuaweiCloud KMS, age, and PGP for key management. Originally created
  at Mozilla and donated to the CNCF in 2023.
type: Index
accessModel:
  pricing: freemium
  onboarding: unknown
  trial: false
  try_now: false
  public: false
  label: Freemium
  confidence: medium
  source:
  - plans
  generated: '2026-07-22'
  method: derived
position: Consumer
access: 3rd-Party
image: https://kinlane-images.s3.amazonaws.com/shared/apis-json/icons/sops.png
tags:
- Secrets Management
- Encryption
- Configuration Management
- DevOps
- Security
- Kubernetes
- CNCF
created: '2025'
modified: '2026-05-02'
url: https://raw.githubusercontent.com/api-evangelist/sops/refs/heads/main/apis.yml
specificationVersion: '0.19'
apis:
- aid: sops:sops-go-library
  name: SOPS Go Library
  description: The SOPS decrypt Go package provides programmatic access to SOPS-encrypted files from Go applications. It supports
    decryption of YAML, JSON, ENV, INI, and binary formats using configured key management services.
  humanURL: https://getsops.io/docs/
  baseURL: https://github.com/getsops/sops
  tags:
  - Go
  - Secrets Management
  - Encryption
  - Library
  properties:
  - type: Documentation
    url: https://getsops.io/docs/
  - type: GitHub
    url: https://github.com/getsops/sops
  - type: ReleaseNotes
    url: https://github.com/getsops/sops/releases
common:
- type: DomainSecurity
  url: security/sops-domain-security.yml
- type: Website
  url: https://getsops.io/
- type: Documentation
  url: https://getsops.io/docs/
- type: GitHubOrg
  url: https://github.com/getsops
- type: GitHubRepository
  url: https://github.com/getsops/sops
- type: ReleaseNotes
  url: https://github.com/getsops/sops/releases
- type: License
  url: https://github.com/getsops/sops/blob/main/LICENSE
- type: ChangeLog
  url: https://github.com/getsops/sops/blob/main/CHANGELOG.rst
- type: CNCF Sandbox
  url: https://www.cncf.io/projects/sops/
- type: Homebrew
  url: https://formulae.brew.sh/formula/sops
- type: Flux Integration
  url: https://fluxcd.io/flux/guides/mozilla-sops/
- type: Blog
  url: https://getsops.io/blog/
- type: Security
  url: https://github.com/getsops/sops/blob/main/SECURITY.md
features:
- Encrypts file values while keeping keys in cleartext
- Supports AWS KMS, GCP KMS, Azure Key Vault, HuaweiCloud KMS, age, PGP
- Works with YAML, JSON, ENV, INI, and binary file formats
- Key groups using Shamir Secret Sharing for multi-factor access control
- Audit logging via PostgreSQL integration
- Git integration for transparent decryption in diffs
- Configuration file (.sops.yaml) for creation and destination rules
- exec-env and exec-file commands to avoid secret exposure to disk
- In-place encryption/decryption for workflow integration
integrations:
- AWS KMS
- GCP KMS
- Azure Key Vault
- HuaweiCloud KMS
- age encryption
- PGP/GPG
- Kubernetes Secrets
- Flux CD
- ArgoCD
- Helm
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com