delivery: "direct", which places the value in the sandbox environment. Reads return metadata, never the stored value.
Examples reuse connection setup. List metadata before choosing a name and label:
Routes
Store a value
Save the request in a localsecret.json file, replacing YOUR_VALUE with the credential. Keep this file out of source control.
secret.json
Direct delivery refuses the three scope fields. Brokered secrets cannot be attached to hosted evaluation jobs. LLM provider keys are managed separately in the signed-in dashboard, not through this environment-secret endpoint.
An existing
(name, label) with the same value returns updated; delivery and scope can change on that request. A different value returns 409 secret_exists. To rotate, use a new label or delete and recreate the existing identity.
Attach and delete
Add this fragment to a job request:as is optional and defaults to name. Without label, resolution chooses the default row, then the only row if exactly one exists. Multiple other labels produce secret_ambiguous.
To delete the labeled value:
Responses and errors
Write responses use metadata fields such asallowed_hosts, allowed_path_prefixes, allowed_methods, created_at, updated_at, and last_used_at. The list response retains the earlier camelCase spellings: allowedHosts, allowedPathPrefixes, allowedMethods, createdAt, updatedAt, and lastUsedAt. The secret method reference describes their SDK representations.
These endpoints use their own error shape: an error message, with a top-level code on typed write refusals. Do not parse them as the nested hosted error.code envelope. Write codes include invalid_input (400), secret_ambiguous (400), read_only_key (403), secret_not_found (404), and secret_exists (409).