Skip to main content
POST
Add a secret version

Authorizations

Authorization
string
header
required

Bearer token for the authenticated caller.

Headers

akua-context
string

Optional workspace/scope context for the request. Carries a single workspace wire id (ws_…) today. Only needed for broad tokens - a workspace-owned token implies its workspace.

Required string length: 1 - 53
Example:

"ws_j572abc123def4"

idempotency-key
string

Optional caller-supplied idempotency key. Any non-empty key up to 64 characters is accepted. Endpoint-specific documentation describes how the key is used.

Required string length: 1 - 64
Example:

"create-prod-2026-05-07"

Path Parameters

vault
string
required

A vault id chosen by its creator, unique in the Workspace. default is the Workspace vault.

Pattern: ^[a-z]([a-z0-9-]{0,61}[a-z0-9])?$
Example:

"default"

secret
string
required

A secret id, unique in its vault

Pattern: ^[a-z]([a-z0-9-]{0,61}[a-z0-9])?$
Example:

"db-password"

Body

application/json
payload
string
required

Response

SecretVersion

name
string
required

Resource name vaults/{vault}/secrets/{secret}/versions/{version}.

version
integer
required
state
enum<string>
required
Available options:
ENABLED,
DISABLED,
DESTROYED
created_at
integer
required

Unix timestamp (seconds)

Required range: x >= 0
destroyed_at
integer | null
required

Unix timestamp (seconds)

Required range: x >= 0
etag
string
required

Pass as If-Match on writes. OUTPUT_ONLY.

Maximum string length: 64