Skip to main content
POST
Restore a soft-deleted secret

Authorizations

Authorization
string
header
required

workspace API token (sk_akua_...) or OAuth2 JWT. Create tokens at https://akua.dev/developers/api-tokens

Headers

akua-context
string

Optional workspace/scope context for the request. Carries a single workspace wire id (ws_…) today. Only needed for broad tokens — a workspace-owned token implies its workspace.

Required string length: 1 - 53
Example:

"ws_j572abc123def456"

idempotency-key
string

Optional caller-supplied idempotency key. Any non-empty key up to 64 characters is accepted. Endpoint-specific documentation describes how the key is used.

Required string length: 1 - 64
Example:

"create-prod-2026-05-07"

if-match
string
required

The etag of the resource version the client last read. Required on writes when the resource exposes an etag field. Mismatch returns 409 ABORTED with the current etag in the error metadata.

Required string length: 1 - 256
Example:

"42"

Path Parameters

id
string
required

Secret ID. Prefixed form sec_<id> is canonical.

Required string length: 1 - 54
Example:

"sec_j572abc123def456"

Response

Secret restored

id
string
required
Required string length: 1 - 54
html_url
string<uri>
required

Absolute dashboard URL for this resource. OUTPUT_ONLY.

Maximum string length: 2048
Example:

"https://akua.dev/secrets/sec_j572abc123def456"

workspace_id
string
required
Required string length: 1 - 53
name
string
required
Required string length: 1 - 200
kind
string
required

Secret kind. Current public create values: cloud_provider/hcloud, cloud_provider/aws, cloud_provider/gcp, cloud_provider/azure, oci_registry, cloudflare_api, webhook_signing, generic. cloud_credential is migration-only metadata and cannot be used for new public creates.

Example:

"generic"

state
enum<string>
required
Available options:
active,
soft_deleted
validation
object | null
required

Server-managed validation telemetry. Populated for credential-typed secrets; null otherwise. OUTPUT_ONLY — clients cannot set this on create/update.

version_count
integer
required
Required range: x >= 0
enabled_version_count
integer
required
Required range: x >= 0
created_at
integer
required

Unix timestamp (seconds)

Required range: x >= 0
updated_at
integer
required

Unix timestamp (seconds)

Required range: x >= 0
etag
string
required
description
string
Maximum string length: 500
labels
object
mime_type
string
Maximum string length: 100
version_aliases
object
deleted_at
integer

Unix timestamp (seconds)

Required range: x >= 0
purge_at
integer

Unix timestamp (seconds)

Required range: x >= 0
expire_time
integer

Unix timestamp (seconds)

Required range: x >= 0