Skip to content

by Startups.Studio

Core grammar Secret

Secret.rotate

POST /{namespace}/secrets/{secret}/rotate

Rotate replaces a Secret’s value, and calls already running finish on the old one.

Noun: Secret
Mode: do
Event: Secret.rotated

You, to your agent

Rotate the latest secret.

curl -X POST https://api.sb/ledgerlark.com/secrets/secret_1/rotate \
  -H "Authorization: Bearer $STARTUP_BUILDER_API_KEY"

import { $ } from 'startup-builder'

const secret = await $.Secret.rotate({ secret: 'secret_1' })

npx startup-builder do Secret.rotate --json '{"secret":"secret_1"}'

{
  "name": "do",
  "arguments": {
    "code": "return await $.Secret.rotate({ secret: 'secret_1' })"
  }
}

Inputs

Input	Type	Required	Description
`secret`	Secret	required	The Secret to rotate.
`value`	`string`		The new value; omitted when the upstream issues one.

Outputs

Output	Type	Required	Description
`secret`	Secret	required	The Secret, with its new `rotatedAt`.

Effects

Emits Secret.rotated.
Performed by the Security Engineer.
Two-way: it runs at once, in the try, send and do modes.
The secret-rotation Control tests this Verb.

Refuses when

Check	Error	Fix	Then call
The key is valid, but its scopes do not allow this operation.	`forbidden`	Use a key whose scopes cover the operation, or ask an owner of the namespace to grant them.	Secret.rotate

When it waits

Gate	Default
Decision class	Low: two-way, nothing at stake
Delay window	None: it runs once review passes.
Limit	The call Limit of the Permission it runs under.
Over the Limit	It waits `pending` for an Approval from the Founder. Approved, it runs; refused, it ends `refused` with `limit-exceeded`; unanswered by its deadline, it ends `canceled`.

Secret.revoke

Previous Page

Secret.store

Next Page