# Link an organization secret to a project ## `PUT /v1/projects/{projectId}/org-secrets/{secretName}` Makes the named organization secret available to the project at deploy time. Linking a secret that is already linked changes nothing. The project's own secrets are not changed; a project secret with the same name takes precedence. ### Path parameters - `projectId` (integer, required): The ID of the project - `secretName` (string, required): The name of the organization secret ### Header parameters - `Authorization` (string, required): `Bearer `. [Authentication](https://spice.ai/docs/cloud/api/management#authentication) lists the tokens it accepts. - `X-Org-Name` (string, optional): The organization to act on, by handle. Omit it to act on the organization the credential is bound to; sending it blank is a 400, not the same as omitting it. A user credential may name any organization its owner belongs to; a machine credential is pinned to its own. A portal session token is bound to none, so it must send this header on every route but `GET /v1/orgs` (400 `org_assertion_required` otherwise). Pattern: `^[A-Za-z0-9._-]{1,255}$`. ### Example request ```bash curl -X PUT "https://api.spice.ai/v1/projects//org-secrets/" \ -H "Authorization: Bearer " ``` ```http PUT /v1/projects//org-secrets/ HTTP/1.1 Host: api.spice.ai Authorization: Bearer ``` ### Responses **200 OK** The secret was already linked Content type: `application/json` - `id` (integer): Unique identifier for the secret - `name` (string): Name of the secret - `value` (string): Always masked with asterisks - `created_at` (string (date-time)): Timestamp when the secret was created - `updated_at` (string (date-time)): Timestamp when the secret was last updated **201 Created** The secret was linked Content type: `application/json` - `id` (integer): Unique identifier for the secret - `name` (string): Name of the secret - `value` (string): Always masked with asterisks - `created_at` (string (date-time)): Timestamp when the secret was created - `updated_at` (string (date-time)): Timestamp when the secret was last updated **400 Bad Request** Invalid project ID or secret name **401 Unauthorized** Unauthorized **403 Forbidden** Insufficient scope (requires secrets:write) or the viewer role **404 Not Found** Project or organization secret not found **409 Conflict** The project already links the maximum of 1000 organization secrets (code: `org_secret_link_limit`) **429 Too Many Requests** Another link change is in progress for this project. Try again. **500 Internal Server Error** Internal server error **503 Service Unavailable** Failed to link the organization secret. Try again. ## `PUT /v1/orgs/{orgId}/projects/{projectId}/org-secrets/{secretName}` The org is `orgId` in the path. Makes the named organization secret available to the project at deploy time. Linking a secret that is already linked changes nothing. The project's own secrets are not changed; a project secret with the same name takes precedence. ### Path parameters - `orgId` (integer, required): The org id from GET /v1/orgs. Minimum: `1`. - `projectId` (integer, required): The ID of the project - `secretName` (string, required): The name of the organization secret ### Header parameters - `Authorization` (string, required): `Bearer `. [Authentication](https://spice.ai/docs/cloud/api/management#authentication) lists the tokens it accepts. - `X-Org-Name` (string, optional): When present, X-Org-Name must name the same org as orgId. Otherwise the request returns org\_path\_mismatch (400). Pattern: `^[A-Za-z0-9._-]{1,255}$`. ### Example request ```bash curl -X PUT "https://api.spice.ai/v1/orgs//projects//org-secrets/" \ -H "Authorization: Bearer " ``` ```http PUT /v1/orgs//projects//org-secrets/ HTTP/1.1 Host: api.spice.ai Authorization: Bearer ``` ### Responses **200 OK** The secret was already linked Content type: `application/json` - `id` (integer): Unique identifier for the secret - `name` (string): Name of the secret - `value` (string): Always masked with asterisks - `created_at` (string (date-time)): Timestamp when the secret was created - `updated_at` (string (date-time)): Timestamp when the secret was last updated **201 Created** The secret was linked Content type: `application/json` - `id` (integer): Unique identifier for the secret - `name` (string): Name of the secret - `value` (string): Always masked with asterisks - `created_at` (string (date-time)): Timestamp when the secret was created - `updated_at` (string (date-time)): Timestamp when the secret was last updated **400 Bad Request** Invalid project ID or secret name. orgId is not a valid org id (`invalid_org_id`), or X-Org-Name does not name that org (`org_path_mismatch`). **401 Unauthorized** Unauthorized **403 Forbidden** Insufficient scope (requires secrets:write) or the viewer role. The caller is not a member of the org (`org_forbidden`). A machine credential named a different org (`org_assertion_mismatch`). The org is deleted (`org_deleted`). **404 Not Found** Project or organization secret not found **409 Conflict** The project already links the maximum of 1000 organization secrets (code: `org_secret_link_limit`) **429 Too Many Requests** Another link change is in progress for this project. Try again. **500 Internal Server Error** Internal server error **503 Service Unavailable** Failed to link the organization secret. Try again. ## `PUT /v1/apps/{appId}/org-secrets/{secretName}` (deprecated) Legacy alias of `/v1/projects/{projectId}/org-secrets/{secretName}` — projects were previously called apps. Makes the named organization secret available to the project at deploy time. Linking a secret that is already linked changes nothing. The project's own secrets are not changed; a project secret with the same name takes precedence. ### Path parameters - `appId` (integer, required): The ID of the project - `secretName` (string, required): The name of the organization secret ### Header parameters - `Authorization` (string, required): `Bearer `. [Authentication](https://spice.ai/docs/cloud/api/management#authentication) lists the tokens it accepts. - `X-Org-Name` (string, optional): The organization to act on, by handle. Omit it to act on the organization the credential is bound to; sending it blank is a 400, not the same as omitting it. A user credential may name any organization its owner belongs to; a machine credential is pinned to its own. A portal session token is bound to none, so it must send this header on every route but `GET /v1/orgs` (400 `org_assertion_required` otherwise). Pattern: `^[A-Za-z0-9._-]{1,255}$`. ### Example request ```bash curl -X PUT "https://api.spice.ai/v1/apps//org-secrets/" \ -H "Authorization: Bearer " ``` ```http PUT /v1/apps//org-secrets/ HTTP/1.1 Host: api.spice.ai Authorization: Bearer ``` ### Responses **200 OK** The secret was already linked Content type: `application/json` - `id` (integer): Unique identifier for the secret - `name` (string): Name of the secret - `value` (string): Always masked with asterisks - `created_at` (string (date-time)): Timestamp when the secret was created - `updated_at` (string (date-time)): Timestamp when the secret was last updated **201 Created** The secret was linked Content type: `application/json` - `id` (integer): Unique identifier for the secret - `name` (string): Name of the secret - `value` (string): Always masked with asterisks - `created_at` (string (date-time)): Timestamp when the secret was created - `updated_at` (string (date-time)): Timestamp when the secret was last updated **400 Bad Request** Invalid project ID or secret name **401 Unauthorized** Unauthorized **403 Forbidden** Insufficient scope (requires secrets:write) or the viewer role **404 Not Found** Project or organization secret not found **409 Conflict** The project already links the maximum of 1000 organization secrets (code: `org_secret_link_limit`) **429 Too Many Requests** Another link change is in progress for this project. Try again. **500 Internal Server Error** Internal server error **503 Service Unavailable** Failed to link the organization secret. Try again. OpenAPI: [api.spice.ai/openapi.json](https://api.spice.ai/openapi.json)