Secrets

Manage encrypted app secrets

List secrets

get

Returns all secrets for the specified app. Secret values are always masked.

Authorizations

AuthorizationstringRequired

OAuth 2.0 access token obtained from the Spice.ai authentication service

Path parameters

appIdintegerRequired

The ID of the app

Responses

200

List of secrets

application/json

400

Invalid app ID

401

Unauthorized

403

Insufficient scope

404

App not found

500

Internal server error

get/v1/apps/{appId}/secrets

GET /v1/apps/{appId}/secrets HTTP/1.1
Host: api.spice.ai
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

{
  "secrets": [
    {
      "id": 1,
      "name": "text",
      "value": "text",
      "created_at": "2026-01-01T00:00:00.000Z",
      "updated_at": "2026-01-01T00:00:00.000Z"
    }
  ]
}

Create or update a secret

post

Creates a new secret or updates an existing secret with the same name. The secret value is encrypted at rest.

Authorizations

AuthorizationstringRequired

OAuth 2.0 access token obtained from the Spice.ai authentication service

Path parameters

appIdintegerRequired

The ID of the app

Body

namestringRequired

Secret name (must start with a letter or underscore, alphanumeric and underscores only)

Pattern: ^[a-zA-Z_][a-zA-Z0-9_]*$

valuestringRequired

Secret value (will be encrypted at rest)

Responses

200

Secret created or updated successfully

application/json

idintegerOptional

Unique identifier for the secret

namestringOptional

Name of the secret

valuestringOptional

Always masked with asterisks

created_atstring · date-timeOptional

Timestamp when the secret was created

updated_atstring · date-timeOptional

Timestamp when the secret was last updated

400

Invalid request body or app ID

401

Unauthorized

403

Insufficient scope

404

App not found

500

Internal server error

post/v1/apps/{appId}/secrets

POST /v1/apps/{appId}/secrets HTTP/1.1
Host: api.spice.ai
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 30

{
  "name": "text",
  "value": "text"
}

{
  "id": 1,
  "name": "text",
  "value": "text",
  "created_at": "2026-01-01T00:00:00.000Z",
  "updated_at": "2026-01-01T00:00:00.000Z"
}

Get a secret

get

Returns a specific secret by name. The secret value is always masked.

Authorizations

AuthorizationstringRequired

OAuth 2.0 access token obtained from the Spice.ai authentication service

Path parameters

appIdintegerRequired

The ID of the app

secretNamestringRequired

The name of the secret

Responses

200

Secret details (value is masked)

application/json

idintegerOptional

Unique identifier for the secret

namestringOptional

Name of the secret

valuestringOptional

Always masked with asterisks

created_atstring · date-timeOptional

Timestamp when the secret was created

updated_atstring · date-timeOptional

Timestamp when the secret was last updated

400

Invalid app ID

401

Unauthorized

403

Insufficient scope

404

App or secret not found

500

Internal server error

get/v1/apps/{appId}/secrets/{secretName}

GET /v1/apps/{appId}/secrets/{secretName} HTTP/1.1
Host: api.spice.ai
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

{
  "id": 1,
  "name": "text",
  "value": "text",
  "created_at": "2026-01-01T00:00:00.000Z",
  "updated_at": "2026-01-01T00:00:00.000Z"
}

Delete a secret

delete

Permanently deletes a secret by name.

Authorizations

AuthorizationstringRequired

OAuth 2.0 access token obtained from the Spice.ai authentication service

Path parameters

appIdintegerRequired

The ID of the app

secretNamestringRequired

The name of the secret

Responses

204

Secret deleted successfully

No content

400

Invalid app ID

401

Unauthorized

403

Insufficient scope

404

App or secret not found

500

Internal server error

delete/v1/apps/{appId}/secrets/{secretName}

DELETE /v1/apps/{appId}/secrets/{secretName} HTTP/1.1
Host: api.spice.ai
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

No content