> ## Documentation Index > Fetch the complete documentation index at: https://docs.outerproduct.com/llms.txt > Use this file to discover all available pages before exploring further. # CreateSecret ## OpenAPI ````yaml /http-api-reference/openapi.json post /outerproduct.secret.v1.SecretService/CreateSecret openapi: 3.1.0 info: title: OuterProduct Control Plane API description: >- Control-plane Connect RPCs over HTTP with ProtoJSON request and response bodies. version: v1alpha servers: - url: https://api.outerproduct.com security: - bearerAuth: [] tags: - name: ApiKey description: |- Manages the current user's application-owned personal access tokens. External sign-in is required; personal and execution tokens cannot manage keys. - name: BillingAccount description: >- How a workspace pays: its prepaid balance, topped up through the payment processor and spent by its usage. - name: Image description: >- The image registry: OCI distribution over its storage, whose formats are its own. The control plane serves it to users, admitting each only to their workspace's repository, and forwards to the OCI registry. Manifests and blobs are addressed by digest and never replaced; tags name manifests. - name: ImageBuilder description: >- Builds Images from image specs, and runs their install steps, each adding layers to its parent image, and package builds, each one pinned package's layer on its base, which install steps merge rather than install. The control plane serves `SubmitImageBuild` and `WaitImageBuild` to users, and forwards them to the scheduler's, which imports each image spec's base through the OCI registry, places each install step and package build on a node that builds, and tags the image it built in its workspace's repository. Those nodes serve the steps to the scheduler, by the scheduler's certificate, and run each in the sandbox the scheduler placed it in. - name: Policy description: >- Resource access policies evaluated by the application's Cedar authorizer. A policy belongs to the workspace of the credential that created it and governs only that workspace and what it owns; deployment-wide grants belong to the operator's policy. - name: Run description: >- Submits and observes product Runs, their Calls, and the Calls' Attempts. Every Run owns one rooted Call tree. - name: Secret - name: User description: / User crud service - name: Volume - name: Workspace description: >- The workspace a request's credential is bound to, and its members. A session starts bound to its user's workspace and may switch to another the user belongs to; an API key stays bound to the workspace it was created in. Requests act in the bound workspace. paths: /outerproduct.secret.v1.SecretService/CreateSecret: post: tags: - Secret summary: CreateSecret operationId: outerproduct.secret.v1.SecretService.CreateSecret parameters: - name: Connect-Protocol-Version in: header description: Define the version of the Connect protocol required: true schema: $ref: '#/components/schemas/connect-protocol-version' example: 1 - name: Connect-Timeout-Ms in: header description: Define the timeout, in ms schema: $ref: '#/components/schemas/connect-timeout-header' example: 1000 requestBody: content: application/json: schema: $ref: '#/components/schemas/outerproduct.secret.v1.CreateSecretRequest' required: true responses: '200': description: Success content: application/json: schema: $ref: '#/components/schemas/outerproduct.secret.v1.Secret' default: description: Error content: application/json: schema: $ref: '#/components/schemas/connect.error' components: schemas: connect-protocol-version: type: number examples: - 1 title: Connect-Protocol-Version description: Define the version of the Connect protocol const: 1 connect-timeout-header: type: number examples: - 1000 title: Connect-Timeout-Ms description: Define the timeout, in ms outerproduct.secret.v1.CreateSecretRequest: type: object properties: name: type: string title: name value: allOf: - $ref: '#/components/schemas/outerproduct.secret.v1.SecretValue' title: value comment: type: - string - 'null' title: comment title: CreateSecretRequest required: - value additionalProperties: false outerproduct.secret.v1.Secret: type: object properties: name: type: string title: name description: 'Immutable resource name: secrets/{secret}.' uid: type: string title: uid description: Immutable UUID identity. version: type: string title: version format: int64 description: >- Monotonically increasing version of the stored value. References use the current version. comment: type: - string - 'null' title: comment kind: allOf: - $ref: '#/components/schemas/outerproduct.secret.v1.Secret.Kind' title: kind created_by: type: - string - 'null' title: created_by updated_by: type: - string - 'null' title: updated_by created_at: allOf: - $ref: '#/components/schemas/google.protobuf.Timestamp' title: created_at updated_at: allOf: - $ref: '#/components/schemas/google.protobuf.Timestamp' title: updated_at workspace: type: string title: workspace description: >- The workspace that owns the Secret, its creating credential's; the name is unique in it. cf. Zitadel `resource_owner`; Modal secrets belong to a workspace. title: Secret additionalProperties: false description: Metadata only. Secret material is returned exclusively by AccessSecret. connect.error: type: object properties: code: type: string examples: - not_found enum: - canceled - unknown - invalid_argument - deadline_exceeded - not_found - already_exists - permission_denied - resource_exhausted - failed_precondition - aborted - out_of_range - unimplemented - internal - unavailable - data_loss - unauthenticated description: >- The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code]. message: type: string description: >- A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client. details: type: array items: $ref: '#/components/schemas/connect.error_details.Any' description: >- A list of messages that carry the error details. There is no limit on the number of messages. title: Connect Error additionalProperties: true description: >- Error type returned by Connect: https://connectrpc.com/docs/go/errors/#http-representation outerproduct.secret.v1.SecretValue: type: object allOf: - oneOf: - required: - generic - required: - aws - required: - gcp - required: - azure anyOf: - type: object properties: aws: allOf: - $ref: '#/components/schemas/outerproduct.secret.v1.AwsCredential' title: aws title: aws - type: object properties: azure: allOf: - $ref: '#/components/schemas/outerproduct.secret.v1.AzureCredential' title: azure title: azure - type: object properties: gcp: allOf: - $ref: '#/components/schemas/outerproduct.secret.v1.GcpCredential' title: gcp title: gcp - type: object properties: generic: type: string title: generic format: byte title: generic unevaluatedProperties: false not: allOf: - anyOf: - required: - aws - required: - azure - required: - gcp - required: - generic - not: oneOf: - required: - aws - required: - azure - required: - gcp - required: - generic title: SecretValue outerproduct.secret.v1.Secret.Kind: type: string title: Kind enum: - KIND_UNSPECIFIED - KIND_GENERIC - KIND_AWS - KIND_GCP - KIND_AZURE google.protobuf.Timestamp: type: string examples: - '2023-01-15T01:30:15.01Z' - '2024-12-25T12:00:00Z' format: date-time description: >- A point in time in RFC 3339 format, with up to nanosecond precision. Output uses UTC (`Z`); input may use an offset from UTC. connect.error_details.Any: type: object properties: type: type: string description: >- A URL that acts as a globally unique identifier for the type of the serialized message. For example: `type.googleapis.com/google.rpc.ErrorInfo`. value: type: string format: binary description: >- The Protobuf message, serialized as bytes and base64-encoded. The specific message type is identified by the `type` field. debug: type: object title: Debug additionalProperties: true description: >- Deserialized error detail payload. The 'type' field indicates the schema. This field is for easier debugging and should not be relied upon for application logic. additionalProperties: true description: >- Contains an arbitrary serialized message along with a @type that describes the type of the serialized message, with an additional debug field for ConnectRPC error details. outerproduct.secret.v1.AwsCredential: type: object allOf: - oneOf: - required: - accessKeys - required: - assumeRole anyOf: - type: object properties: accessKeys: allOf: - $ref: >- #/components/schemas/outerproduct.secret.v1.AwsCredential.AccessKeys title: access_keys title: access_keys - type: object properties: assumeRole: allOf: - $ref: >- #/components/schemas/outerproduct.secret.v1.AwsCredential.AssumeRole title: assume_role title: assume_role unevaluatedProperties: false not: allOf: - anyOf: - required: - accessKeys - required: - assumeRole - not: oneOf: - required: - accessKeys - required: - assumeRole title: AwsCredential outerproduct.secret.v1.AzureCredential: type: object allOf: - oneOf: - required: - storageKey - required: - sasToken - required: - servicePrincipal - required: - oauthToken anyOf: - type: object properties: oauthToken: allOf: - $ref: >- #/components/schemas/outerproduct.secret.v1.AzureCredential.OauthToken title: oauth_token title: oauth_token - type: object properties: sasToken: allOf: - $ref: >- #/components/schemas/outerproduct.secret.v1.AzureCredential.SasToken title: sas_token title: sas_token - type: object properties: servicePrincipal: allOf: - $ref: >- #/components/schemas/outerproduct.secret.v1.AzureCredential.ServicePrincipal title: service_principal title: service_principal - type: object properties: storageKey: allOf: - $ref: >- #/components/schemas/outerproduct.secret.v1.AzureCredential.StorageKey title: storage_key title: storage_key unevaluatedProperties: false not: allOf: - anyOf: - required: - oauthToken - required: - sasToken - required: - servicePrincipal - required: - storageKey - not: oneOf: - required: - oauthToken - required: - sasToken - required: - servicePrincipal - required: - storageKey title: AzureCredential outerproduct.secret.v1.GcpCredential: type: object allOf: - oneOf: - required: - serviceAccountKey - required: - oauthToken anyOf: - type: object properties: oauthToken: allOf: - $ref: >- #/components/schemas/outerproduct.secret.v1.GcpCredential.OauthToken title: oauth_token title: oauth_token - type: object properties: serviceAccountKey: allOf: - $ref: >- #/components/schemas/outerproduct.secret.v1.GcpCredential.ServiceAccountKey title: service_account_key title: service_account_key unevaluatedProperties: false not: allOf: - anyOf: - required: - oauthToken - required: - serviceAccountKey - not: oneOf: - required: - oauthToken - required: - serviceAccountKey title: GcpCredential outerproduct.secret.v1.AwsCredential.AccessKeys: type: object properties: accessKeyId: type: string title: access_key_id secretAccessKey: type: string title: secret_access_key sessionToken: type: - string - 'null' title: session_token expiresAt: allOf: - $ref: '#/components/schemas/google.protobuf.Timestamp' title: expires_at title: AccessKeys additionalProperties: false outerproduct.secret.v1.AwsCredential.AssumeRole: type: object properties: baseSecret: type: string title: base_secret description: References an AWS credential Secret used to assume the role. roleArn: type: string title: role_arn externalId: type: - string - 'null' title: external_id roleSessionName: type: - string - 'null' title: role_session_name baseSecretUid: type: string title: base_secret_uid title: AssumeRole additionalProperties: false outerproduct.secret.v1.AzureCredential.OauthToken: type: object properties: accessToken: type: string title: access_token expiresAt: allOf: - $ref: '#/components/schemas/google.protobuf.Timestamp' title: expires_at title: OauthToken additionalProperties: false outerproduct.secret.v1.AzureCredential.SasToken: type: object properties: sasToken: type: string title: sas_token expiresAt: allOf: - $ref: '#/components/schemas/google.protobuf.Timestamp' title: expires_at title: SasToken additionalProperties: false outerproduct.secret.v1.AzureCredential.ServicePrincipal: type: object properties: tenantId: type: string title: tenant_id clientId: type: string title: client_id clientSecret: type: string title: client_secret title: ServicePrincipal additionalProperties: false outerproduct.secret.v1.AzureCredential.StorageKey: type: object properties: accountName: type: string title: account_name accountKey: type: string title: account_key title: StorageKey additionalProperties: false outerproduct.secret.v1.GcpCredential.OauthToken: type: object properties: accessToken: type: string title: access_token expiresAt: allOf: - $ref: '#/components/schemas/google.protobuf.Timestamp' title: expires_at title: OauthToken additionalProperties: false outerproduct.secret.v1.GcpCredential.ServiceAccountKey: type: object properties: clientEmail: type: string title: client_email privateKeyId: type: string title: private_key_id privateKey: type: string title: private_key title: ServiceAccountKey additionalProperties: false securitySchemes: bearerAuth: type: http description: A user session token or personal API key. scheme: bearer ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.