Update a workspace secret

JavaScript

import Cadenya from '@cadenya/cadenya';

const client = new Cadenya({
  apiKey: process.env['CADENYA_API_KEY'], // This is the default and can be omitted
});

const workspaceSecret = await client.workspaceSecrets.update('wsecret_01HXKD2E5NQM3T9AYWCF586W5A', {
  workspaceId: 'workspace_01HXKD2E5NQM3T9AYWCF133E3Q',
});

console.log(workspaceSecret.metadata);

import os
from cadenya import Cadenya

client = Cadenya(
    api_key=os.environ.get("CADENYA_API_KEY"),  # This is the default and can be omitted
)
workspace_secret = client.workspace_secrets.update(
    id="wsecret_01HXKD2E5NQM3T9AYWCF586W5A",
    workspace_id="workspace_01HXKD2E5NQM3T9AYWCF133E3Q",
)
print(workspace_secret.metadata)

package main

import (
	"context"
	"fmt"
	"go.cadenya.com/cadenya-go"
	"go.cadenya.com/cadenya-go/option"
)

func main() {
	client := cadenya.NewClient(
		option.WithAPIKey("My API Key"),
	)
	workspaceSecret, err := client.WorkspaceSecrets.Update(
		context.TODO(),
		"wsecret_01HXKD2E5NQM3T9AYWCF586W5A",
		cadenya.WorkspaceSecretUpdateParams{
			WorkspaceID: cadenya.String("workspace_01HXKD2E5NQM3T9AYWCF133E3Q"),
		},
	)
	if err != nil {
		panic(err.Error())
	}
	fmt.Printf("%+v\n", workspaceSecret.Metadata)
}

require "cadenya"

cadenya = Cadenya::Client.new(api_key: "My API Key")

workspace_secret = cadenya.workspace_secrets.update(
  "wsecret_01HXKD2E5NQM3T9AYWCF586W5A",
  workspace_id: "workspace_01HXKD2E5NQM3T9AYWCF133E3Q"
)

puts(workspace_secret)

curl --request PATCH \
  --url https://api.cadenya.com/v1/workspaces/{workspaceId}/workspace_secrets/{id} \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "spec": {
    "value": "<string>"
  },
  "updateMask": "<string>"
}
'

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.cadenya.com/v1/workspaces/{workspaceId}/workspace_secrets/{id}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "PATCH",
  CURLOPT_POSTFIELDS => json_encode([
    'spec' => [
        'value' => '<string>'
    ],
    'updateMask' => '<string>'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

HttpResponse<String> response = Unirest.patch("https://api.cadenya.com/v1/workspaces/{workspaceId}/workspace_secrets/{id}")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"spec\": {\n    \"value\": \"<string>\"\n  },\n  \"updateMask\": \"<string>\"\n}")
  .asString();

{
  "metadata": {
    "id": "<string>",
    "accountId": "account_01HXKD2E5NQM3T9AYWCFTJHJVF",
    "workspaceId": "workspace_01HXKD2E5NQM3T9AYWCF133E3Q",
    "name": "<string>",
    "profileId": "profile_01HXKD2E5NQM3T9AYWCFS0AP08",
    "createdAt": "2023-11-07T05:31:56Z",
    "externalId": "<string>",
    "labels": {},
    "updatedAt": "2023-11-07T05:31:56Z"
  },
  "spec": {
    "value": "<string>"
  },
  "info": {
    "lastUsedAt": "2023-11-07T05:31:56Z",
    "createdBy": {
      "metadata": {
        "id": "<string>",
        "accountId": "account_01HXKD2E5NQM3T9AYWCFTJHJVF",
        "name": "<string>",
        "profileId": "profile_01HXKD2E5NQM3T9AYWCFS0AP08",
        "externalId": "<string>",
        "labels": {},
        "createdAt": "2023-11-07T05:31:56Z"
      },
      "spec": {
        "email": "<string>",
        "name": "<string>"
      }
    }
  }
}

{
  "code": 123,
  "message": "<string>",
  "details": [
    {
      "@type": "<string>"
    }
  ]
}

PATCH

workspaces

{workspaceId}

workspace_secrets

{id}

JavaScript

import Cadenya from '@cadenya/cadenya';

const client = new Cadenya({
  apiKey: process.env['CADENYA_API_KEY'], // This is the default and can be omitted
});

const workspaceSecret = await client.workspaceSecrets.update('wsecret_01HXKD2E5NQM3T9AYWCF586W5A', {
  workspaceId: 'workspace_01HXKD2E5NQM3T9AYWCF133E3Q',
});

console.log(workspaceSecret.metadata);

import os
from cadenya import Cadenya

client = Cadenya(
    api_key=os.environ.get("CADENYA_API_KEY"),  # This is the default and can be omitted
)
workspace_secret = client.workspace_secrets.update(
    id="wsecret_01HXKD2E5NQM3T9AYWCF586W5A",
    workspace_id="workspace_01HXKD2E5NQM3T9AYWCF133E3Q",
)
print(workspace_secret.metadata)

package main

import (
	"context"
	"fmt"
	"go.cadenya.com/cadenya-go"
	"go.cadenya.com/cadenya-go/option"
)

func main() {
	client := cadenya.NewClient(
		option.WithAPIKey("My API Key"),
	)
	workspaceSecret, err := client.WorkspaceSecrets.Update(
		context.TODO(),
		"wsecret_01HXKD2E5NQM3T9AYWCF586W5A",
		cadenya.WorkspaceSecretUpdateParams{
			WorkspaceID: cadenya.String("workspace_01HXKD2E5NQM3T9AYWCF133E3Q"),
		},
	)
	if err != nil {
		panic(err.Error())
	}
	fmt.Printf("%+v\n", workspaceSecret.Metadata)
}

require "cadenya"

cadenya = Cadenya::Client.new(api_key: "My API Key")

workspace_secret = cadenya.workspace_secrets.update(
  "wsecret_01HXKD2E5NQM3T9AYWCF586W5A",
  workspace_id: "workspace_01HXKD2E5NQM3T9AYWCF133E3Q"
)

puts(workspace_secret)

curl --request PATCH \
  --url https://api.cadenya.com/v1/workspaces/{workspaceId}/workspace_secrets/{id} \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "spec": {
    "value": "<string>"
  },
  "updateMask": "<string>"
}
'

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.cadenya.com/v1/workspaces/{workspaceId}/workspace_secrets/{id}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "PATCH",
  CURLOPT_POSTFIELDS => json_encode([
    'spec' => [
        'value' => '<string>'
    ],
    'updateMask' => '<string>'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

HttpResponse<String> response = Unirest.patch("https://api.cadenya.com/v1/workspaces/{workspaceId}/workspace_secrets/{id}")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"spec\": {\n    \"value\": \"<string>\"\n  },\n  \"updateMask\": \"<string>\"\n}")
  .asString();

{
  "metadata": {
    "id": "<string>",
    "accountId": "account_01HXKD2E5NQM3T9AYWCFTJHJVF",
    "workspaceId": "workspace_01HXKD2E5NQM3T9AYWCF133E3Q",
    "name": "<string>",
    "profileId": "profile_01HXKD2E5NQM3T9AYWCFS0AP08",
    "createdAt": "2023-11-07T05:31:56Z",
    "externalId": "<string>",
    "labels": {},
    "updatedAt": "2023-11-07T05:31:56Z"
  },
  "spec": {
    "value": "<string>"
  },
  "info": {
    "lastUsedAt": "2023-11-07T05:31:56Z",
    "createdBy": {
      "metadata": {
        "id": "<string>",
        "accountId": "account_01HXKD2E5NQM3T9AYWCFTJHJVF",
        "name": "<string>",
        "profileId": "profile_01HXKD2E5NQM3T9AYWCFS0AP08",
        "externalId": "<string>",
        "labels": {},
        "createdAt": "2023-11-07T05:31:56Z"
      },
      "spec": {
        "email": "<string>",
        "name": "<string>"
      }
    }
  }
}

{
  "code": 123,
  "message": "<string>",
  "details": [
    {
      "@type": "<string>"
    }
  ]
}

Rotate a workspace secret without changing where it is referenced. Every adapter that names ${THIS_SECRET} picks up the new value at the next call, no reconfiguration.

await client.workspaceSecrets.update(secretId, {
  workspaceId,
  spec: { value: process.env.NEW_TOKEN! },
});

_, err := client.WorkspaceSecrets.Update(ctx, secretID,
	cadenya.WorkspaceSecretUpdateParams{
		WorkspaceID: cadenya.String(workspaceID),
		Spec: cadenya.WorkspaceSecretSpecParam{
			Value: cadenya.String(os.Getenv("NEW_TOKEN")),
		},
	})

cadenya.workspace_secrets.update(
  secret_id,
  workspace_id: workspace_id,
  spec: {value: ENV["NEW_TOKEN"]}
)

curl -X PATCH "https://api.cadenya.com/v1/workspaces/${WORKSPACE_ID}/workspace_secrets/${SECRET_ID}" \
  -H "Authorization: Bearer ${CADENYA_API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{ "spec": { "value": "..." } }'

The new value takes effect immediately. The old one stops resolving. spec.value is write-only, so the response and every later read redact it to "". You cannot read the value back to check the rotation landed. Confirm it a different way: watch a tool call that uses the secret succeed, or check resolvedSecrets on a tool call to see the scope resolved.

const secret = await client.workspaceSecrets.retrieve(secretId, { workspaceId });
console.log(secret.spec.value);  // '' (always)

Because you cannot read the old value, keep it in your own secret manager if you need a rollback. Cadenya holds it only to resolve at call time.

The value is a zero-value-safe field

A non-empty new value lands through a plain merge; updateMask is not required to rotate:

// Both work to set a new value:
await client.workspaceSecrets.update(secretId, { workspaceId, spec: { value: 'new' } });
await client.workspaceSecrets.update(secretId, { workspaceId, updateMask: 'spec.value', spec: { value: 'new' } });

You would only reach for updateMask to set an empty value, which is rarely what you want for a secret. To rename, send metadata.name; the merge leaves the value untouched.

Create a workspace secret

Storing the value, and the three-scope precedence.

Store and use secrets

Where ${NAME} resolves, and the rotation cutover.

Get a tool call

resolvedSecrets, the way to confirm a secret resolved.

Authorizations

Authorization

string

header

required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Path Parameters

workspaceId

string

required

The workspace the secret belongs to.

Example:

"workspace_01HXKD2E5NQM3T9AYWCF133E3Q"

string

required

The secret to update.

Example:

"wsecret_01HXKD2E5NQM3T9AYWCF586W5A"

Body

application/json

metadata

object

UpdateResourceMetadata contains the user-provided fields for updating a workspace-scoped resource. Read-only fields (id, account_id, workspace_id, profile_id, created_at) are excluded since they are set by the server.

Show child attributes

spec

object

Show child attributes

updateMask

string<field-mask>

Fields to update.

Response

metadata

object

required

Standard metadata for persistent, named resources (e.g., agents, tools, prompts)

Show child attributes

spec

object

required

Show child attributes

info

object

Workspace secret information

Show child attributes

​You rotate blind

​The value is a zero-value-safe field

​Related

Create a workspace secret

Store and use secrets

Get a tool call

Authorizations

Path Parameters

Body

Response

You rotate blind

The value is a zero-value-safe field

Related