# `PUT /v1/workspace/apps/{appId}/secrets/{name}` — Set an App's secret

Part of the [Bkper Managed Agent API](https://bkper.com/docs/api/managed-agent.md). Read its guide for authentication, conventions, and examples.

Set one secret of the App's deployment in `env`, replacing one of the same name. 409 not_deployed when the App is not deployed there yet; 403 workspace_forbidden unless the user is its owner or a developer. Only with the user's own token: through an App or channel bot, 404. For every App Bkper knows, managed or hosted elsewhere; deploying keeps them. Values are write-only: never returned, logged or shown to the agent.

## Operation contract

```json
{
  "operationId": "putAppSecret",
  "tags": [
    "Workspace"
  ],
  "summary": "Set an App's secret",
  "security": [
    {
      "bearerAuth": []
    }
  ],
  "parameters": [
    {
      "name": "appId",
      "in": "path",
      "required": true,
      "schema": {
        "type": "string",
        "pattern": "^[A-Za-z0-9_-]{1,64}$"
      }
    },
    {
      "name": "name",
      "in": "path",
      "required": true,
      "schema": {
        "type": "string",
        "pattern": "^[A-Za-z][A-Za-z0-9_]{0,255}$"
      }
    },
    {
      "name": "env",
      "in": "query",
      "required": true,
      "schema": {
        "type": "string",
        "enum": [
          "production",
          "preview"
        ]
      },
      "description": "Which deployment: production or preview."
    }
  ],
  "description": "Set one secret of the App's deployment in `env`, replacing one of the same name. 409 not_deployed when the App is not deployed there yet; 403 workspace_forbidden unless the user is its owner or a developer. Only with the user's own token: through an App or channel bot, 404. For every App Bkper knows, managed or hosted elsewhere; deploying keeps them. Values are write-only: never returned, logged or shown to the agent.",
  "requestBody": {
    "required": true,
    "content": {
      "application/json": {
        "schema": {
          "$ref": "#/components/schemas/PutAppSecret"
        }
      }
    }
  },
  "responses": {
    "204": {
      "description": "Set"
    },
    "400": {
      "description": "Rejected; never contains credentials or upstream payloads.",
      "content": {
        "application/json": {
          "schema": {
            "$ref": "#/components/schemas/Error"
          }
        }
      }
    },
    "401": {
      "description": "Rejected; never contains credentials or upstream payloads.",
      "content": {
        "application/json": {
          "schema": {
            "$ref": "#/components/schemas/Error"
          }
        }
      }
    },
    "403": {
      "description": "Rejected; never contains credentials or upstream payloads.",
      "content": {
        "application/json": {
          "schema": {
            "$ref": "#/components/schemas/Error"
          }
        }
      }
    },
    "404": {
      "description": "Rejected; never contains credentials or upstream payloads.",
      "content": {
        "application/json": {
          "schema": {
            "$ref": "#/components/schemas/Error"
          }
        }
      }
    },
    "409": {
      "description": "Rejected; never contains credentials or upstream payloads.",
      "content": {
        "application/json": {
          "schema": {
            "$ref": "#/components/schemas/Error"
          }
        }
      }
    },
    "410": {
      "description": "Rejected; never contains credentials or upstream payloads.",
      "content": {
        "application/json": {
          "schema": {
            "$ref": "#/components/schemas/Error"
          }
        }
      }
    },
    "411": {
      "description": "Rejected; never contains credentials or upstream payloads.",
      "content": {
        "application/json": {
          "schema": {
            "$ref": "#/components/schemas/Error"
          }
        }
      }
    },
    "413": {
      "description": "Rejected; never contains credentials or upstream payloads.",
      "content": {
        "application/json": {
          "schema": {
            "$ref": "#/components/schemas/Error"
          }
        }
      }
    },
    "422": {
      "description": "Rejected; never contains credentials or upstream payloads.",
      "content": {
        "application/json": {
          "schema": {
            "$ref": "#/components/schemas/Error"
          }
        }
      }
    },
    "503": {
      "description": "Rejected; never contains credentials or upstream payloads.",
      "content": {
        "application/json": {
          "schema": {
            "$ref": "#/components/schemas/Error"
          }
        }
      }
    }
  }
}
```

## Schemas

### PutAppSecret

```json
{
  "type": "object",
  "properties": {
    "value": {
      "type": "string",
      "minLength": 1,
      "maxLength": 5120,
      "description": "The secret's value, exactly as the App reads it, 1 byte to 5 KiB of UTF-8. Write-only: never returned, logged or shown to the agent."
    }
  },
  "required": [
    "value"
  ],
  "additionalProperties": false
}
```

### Error

```json
{
  "type": "object",
  "properties": {
    "error": {
      "type": "object",
      "properties": {
        "code": {
          "type": "string",
          "description": "Stable code, e.g. not_found, idempotency_conflict, session_working, usage_limit_exceeded. Open."
        },
        "type": {
          "description": "Category, e.g. invalid_request_error, authentication_error, usage_limit_error. Open.",
          "type": "string"
        },
        "message": {
          "type": "string"
        },
        "host": {
          "description": "host_in_use: the host another service holds.",
          "type": "string"
        },
        "service": {
          "description": "host_in_use: the id of the service that holds the host.",
          "type": "string"
        },
        "reason": {
          "description": "file_invalid: why the change, or a picture, was refused. Open: path | text | size | skill | skills | count | type.",
          "type": "string"
        },
        "paths": {
          "description": "file_exists from an add: every path of the request where a file is and `replace` was not set, all at once, so the person can be asked once. publish_conflict: the files someone published changes to the same lines of.",
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "publishers": {
          "description": "publish_conflict: who published those changes, by name.",
          "type": "array",
          "items": {
            "type": "string"
          }
        }
      },
      "required": [
        "code"
      ]
    }
  },
  "required": [
    "error"
  ]
}
```

## Authentication

```json
{
  "bearerAuth": {
    "type": "http",
    "scheme": "bearer"
  }
}
```