SecretManager

Manages stored tenant secrets and default secret-injection stubs.

Sync · Async counterpart: AsyncSecretManager

SecretManager declaration

class SecretManager(_SdkOwnedHandle):

SecretManager access

This type is created by the SDK; do not construct it directly.

manager = client.secrets

SecretManager methods

set()

Create or replace a tenant secret.

def set(name: str, val: str, *, cache_ttl_secs: int = 0) -> SecretInfo

Parameters

Name	Type	Default	Description
name	str	—	Display name used to resolve the secret later.
val	str	—	Secret value to store.
cache_ttl_secs	int	0	Number of seconds runtime agents may cache the value.

Returns

• SecretInfo — Metadata for the stored secret. The secret value is never returned.

Examples

>>> secret = client.secrets.set("github-token", os.environ["GITHUB_TOKEN"])
>>> secret.display_name
'github-token'

get()

Resolve a tenant secret by UUID or display name.

def get(name: str) -> SecretInfo

Parameters

Name	Type	Default	Description
name	str	—	Optional resource display name.

Returns

• SecretInfo

list()

List tenant secrets.

def list() -> list[SecretInfo]

Returns

• list[SecretInfo]

delete()

Delete a tenant secret by UUID or display name.

def delete(name: str) -> None

Parameters

Name	Type	Default	Description
name	str	—	Optional resource display name.

list_secret_stubs()

List secret-injection stubs across the tenant.

def list_secret_stubs() -> list[SecretStubInfo]

Returns

• list[SecretStubInfo]

delete_secret_stub()

Delete a secret-injection stub by UUID.

def delete_secret_stub(id: str) -> None

Parameters

Name	Type	Default	Description
id	str	—	Resource UUID or display name.

set_default_secret_stub()

Create or replace a tenant-default secret-injection stub.

def set_default_secret_stub(url: str, path: str | None = None, config: SecretStubConfig | Mapping[str, str] | None = None) -> DefaultSecretStubInfo

Parameters

Name	Type	Default	Description
url	str	—	URL whose credentials should be injected.
path	str | None	None	Path inside the runtime.
config	SecretStubConfig | Mapping[str, str] | None	None	Secret-injection configuration.

Returns

• DefaultSecretStubInfo

list_default_secret_stubs()

List tenant-default secret-injection stubs.

def list_default_secret_stubs() -> list[DefaultSecretStubInfo]

Returns

• list[DefaultSecretStubInfo]

delete_default_secret_stub()

Delete a tenant-default secret-injection stub by UUID.

def delete_default_secret_stub(id: str) -> None

Parameters

Name	Type	Default	Description
id	str	—	Resource UUID or display name.