# Secret routes: revoke, rotate, store

URL: /code/api/secret/verbs · Id: `page:code/api/secret/verbs`

> The Secret Verbs revoke, rotate, store as api.sb routes, with inputs, result, refusals and an example.

Reference for [Secret](/business/nouns/secret), one group of [Secret routes](/code/api/secret).

### Secret.revoke
Revoke ends a Secret so no call fills it again; the record and its history stay. [Verb page](/business/nouns/secret/revoke?interface=api).

```text
POST /{namespace}/secrets/{secret}/revoke
```

Path: `secret`. Body, as JSON: the other inputs. Emits [`Secret.revoked`](/business/events/Secret.revoked).

**Inputs**

| Input | Type | Required | Description |
| --- | --- | --- | --- |
| `secret` | [Secret](/business/nouns/secret) | Yes | The Secret to revoke. |
| `reason` | `text` | No | Why, such as a leaked value. |

**Returns**

| Output | Type | Required | Description |
| --- | --- | --- | --- |
| `secret` | [Secret](/business/nouns/secret) | Yes | The revoked Secret. |

**Refuses when**

| Check | Error | Fix | Then call |
| --- | --- | --- | --- |
| The key is valid, but its scopes do not allow this operation. | [`forbidden`](/code/api/errors/forbidden) | Use a key whose scopes cover the operation, or ask an owner of the namespace to grant them. | None. |

**Example**

```bash
curl -X POST https://api.sb/leaseline.app/secrets/secret_UaNXUkKsJB/revoke \
  -H "Authorization: Bearer $STARTUP_BUILDER_API_KEY"
```

```json
{
  "api": "https://api.sb/leaseline.app",
  "secret": {
    "$id": "https://api.sb/leaseline.app/secrets/secret_UaNXUkKsJB",
    "$type": "Secret",
    "name": "MAPS_KEY",
    "environment": "test",
    "scope": "startup"
  },
  "action": {
    "$id": "https://api.sb/leaseline.app/actions/act_br07HsG8MG",
    "operation": "Secret.revoke",
    "status": "done"
  },
  "links": {
    "self": "https://api.sb/leaseline.app/actions/act_br07HsG8MG"
  }
}
```

### Secret.rotate
Rotate replaces a Secret’s value, and calls already running finish on the old one. [Verb page](/business/nouns/secret/rotate?interface=api).

```text
POST /{namespace}/secrets/{secret}/rotate
```

Path: `secret`. Body, as JSON: the other inputs. Emits [`Secret.rotated`](/business/events/Secret.rotated).

**Inputs**

| Input | Type | Required | Description |
| --- | --- | --- | --- |
| `secret` | [Secret](/business/nouns/secret) | Yes | The Secret to rotate. |
| `value` | `string` | No | The new value; omitted when the upstream issues one. |

**Returns**

| Output | Type | Required | Description |
| --- | --- | --- | --- |
| `secret` | [Secret](/business/nouns/secret) | Yes | The Secret, with its new `rotatedAt`. |

**Refuses when**

| Check | Error | Fix | Then call |
| --- | --- | --- | --- |
| The key is valid, but its scopes do not allow this operation. | [`forbidden`](/code/api/errors/forbidden) | Use a key whose scopes cover the operation, or ask an owner of the namespace to grant them. | None. |

**Example**

```bash
curl -X POST https://api.sb/leaseline.app/secrets/secret_UaNXUkKsJB/rotate \
  -H "Authorization: Bearer $STARTUP_BUILDER_API_KEY"
```

```json
{
  "api": "https://api.sb/leaseline.app",
  "secret": {
    "$id": "https://api.sb/leaseline.app/secrets/secret_UaNXUkKsJB",
    "$type": "Secret",
    "name": "MAPS_KEY",
    "environment": "test",
    "scope": "startup"
  },
  "action": {
    "$id": "https://api.sb/leaseline.app/actions/act_br07HsG8MG",
    "operation": "Secret.rotate",
    "status": "done"
  },
  "links": {
    "self": "https://api.sb/leaseline.app/actions/act_br07HsG8MG"
  }
}
```

### Secret.store
Store writes a Secret’s value for one environment; the value is never returned by any Interface. [Verb page](/business/nouns/secret/store?interface=api).

```text
POST /{namespace}/secrets/store
```

Body, as JSON: the inputs. Emits [`Secret.stored`](/business/events/Secret.stored).

**Inputs**

| Input | Type | Required | Description |
| --- | --- | --- | --- |
| `name` | `string` | Yes | The name Functions declare. |
| `value` | `string` | Yes | The credential; write-only. |
| `environment` | `string` | Yes | Where it holds. |

**Returns**

| Output | Type | Required | Description |
| --- | --- | --- | --- |
| `secret` | [Secret](/business/nouns/secret) | Yes | The Secret, without its value. |

**Refuses when**

| Check | Error | Fix | Then call |
| --- | --- | --- | --- |
| The key is valid, but its scopes do not allow this operation. | [`forbidden`](/code/api/errors/forbidden) | Use a key whose scopes cover the operation, or ask an owner of the namespace to grant them. | None. |

**Example**

```bash
curl -X POST https://api.sb/leaseline.app/secrets/store \
  -H "Authorization: Bearer $STARTUP_BUILDER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name":"MAPS_KEY","value":"Example value","environment":"test"}'
```

```json
{
  "api": "https://api.sb/leaseline.app",
  "secret": {
    "$id": "https://api.sb/leaseline.app/secrets/secret_UaNXUkKsJB",
    "$type": "Secret",
    "name": "MAPS_KEY",
    "environment": "test",
    "scope": "startup"
  },
  "action": {
    "$id": "https://api.sb/leaseline.app/actions/act_br07HsG8MG",
    "operation": "Secret.store",
    "status": "done"
  },
  "links": {
    "self": "https://api.sb/leaseline.app/actions/act_br07HsG8MG"
  }
}
```