Skip to main content
POST
/
secrets
/
{id}
:undelete
Restore a soft-deleted secret
curl --request POST \
  --url https://api.akua.dev/v1/secrets/{id}:undelete \
  --header 'Authorization: Bearer <token>' \
  --header 'if-match: <if-match>'
{
  "id": "<string>",
  "workspace_id": "<string>",
  "name": "<string>",
  "kind": "generic",
  "validation": {
    "validated_at": 1,
    "error": "<string>"
  },
  "version_count": 1,
  "enabled_version_count": 1,
  "created_at": 1,
  "updated_at": 1,
  "etag": "<string>",
  "description": "<string>",
  "labels": {},
  "mime_type": "<string>",
  "version_aliases": {},
  "deleted_at": 1,
  "purge_at": 1,
  "expire_time": 1
}

Documentation Index

Fetch the complete documentation index at: https://akua-1dce587a.mintlify.app/llms.txt

Use this file to discover all available pages before exploring further.

Authorizations

​
Authorization
string
header
required

workspace API token (sk_akua_...) or OAuth2 JWT. Create tokens at https://akua.dev/developers/api-tokens

Headers

​
akua-context
string

Optional workspace/scope context for the request. Carries a single workspace wire id (ws_…) today. Only needed for broad tokens — a workspace-owned token implies its workspace.

Required string length: 1 - 53
Example:

"ws_j572abc123def456"

​
idempotency-key
string

Caller-supplied idempotency key. Repeated requests with the same key return the existing resource instead of creating a duplicate. Safe to retry after a timed-out or interrupted request.

Required string length: 1 - 64
Example:

"create-prod-2026-05-07"

​
if-match
string
required

The etag of the resource version the client last read. Required on writes when the resource exposes an etag field. Mismatch returns 409 ABORTED with the current etag in the error metadata.

Required string length: 1 - 256
Example:

"42"

Path Parameters

​
id
string
required

Secret ID. Prefixed form sec_<id> is canonical.

Required string length: 1 - 54
Example:

"sec_j572abc123def456"

Response

Secret restored

​
id
string
required
Required string length: 1 - 54
​
workspace_id
string
required
Required string length: 1 - 53
​
name
string
required
Required string length: 1 - 200
​
kind
string
required

Secret kind. Current public create values: cloud_provider/hcloud, cloud_provider/aws, cloud_provider/gcp, cloud_provider/azure, oci_registry, cloudflare_api, webhook_signing, generic. cloud_credential is migration-only metadata and cannot be used for new public creates.

Example:

"generic"

​
state
enum<string>
required
Available options:
active,
soft_deleted
​
validation
object
required

Server-managed validation telemetry. Populated for credential-typed secrets; null otherwise. OUTPUT_ONLY — clients cannot set this on create/update.

​
version_count
integer
required
Required range: x >= 0
​
enabled_version_count
integer
required
Required range: x >= 0
​
created_at
integer
required

Unix timestamp (seconds)

Required range: x >= 0
​
updated_at
integer
required

Unix timestamp (seconds)

Required range: x >= 0
​
etag
string
required
​
description
string
Maximum string length: 500
​
labels
object
​
mime_type
string
Maximum string length: 100
​
version_aliases
object
​
deleted_at
integer

Unix timestamp (seconds)

Required range: x >= 0
​
purge_at
integer

Unix timestamp (seconds)

Required range: x >= 0
​
expire_time
integer

Unix timestamp (seconds)

Required range: x >= 0