Update a secret - Akua

PATCH

vaults

{vault}

secrets

{secret}

Update a secret

curl --request PATCH \
  --url https://api.akua.dev/v1/vaults/{vault}/secrets/{secret} \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'if-match: <if-match>' \
  --data '{
  "labels": {}
}'

import requests

url = "https://api.akua.dev/v1/vaults/{vault}/secrets/{secret}"

payload = { "labels": {} }
headers = {
    "if-match": "<if-match>",
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.patch(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'PATCH',
  headers: {
    'if-match': '<if-match>',
    Authorization: 'Bearer <token>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({labels: {}})
};

fetch('https://api.akua.dev/v1/vaults/{vault}/secrets/{secret}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.akua.dev/v1/vaults/{vault}/secrets/{secret}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "PATCH",
  CURLOPT_POSTFIELDS => json_encode([
    'labels' => [
        
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json",
    "if-match: <if-match>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.akua.dev/v1/vaults/{vault}/secrets/{secret}"

	payload := strings.NewReader("{\n  \"labels\": {}\n}")

	req, _ := http.NewRequest("PATCH", url, payload)

	req.Header.Add("if-match", "<if-match>")
	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.patch("https://api.akua.dev/v1/vaults/{vault}/secrets/{secret}")
  .header("if-match", "<if-match>")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"labels\": {}\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.akua.dev/v1/vaults/{vault}/secrets/{secret}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Patch.new(url)
request["if-match"] = '<if-match>'
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"labels\": {}\n}"

response = http.request(request)
puts response.read_body

{
  "name": "vaults/default/secrets/db-password",
  "vault_id": "default",
  "secret_id": "db-password",
  "labels": {},
  "latest_version": 123,
  "version_count": 123,
  "created_at": 1,
  "updated_at": 1,
  "etag": "<string>"
}

{
  "_tag": "Validation",
  "success": false,
  "errors": [],
  "result": {}
}

{
  "_tag": "Unauthorized",
  "success": false,
  "errors": [],
  "result": {}
}

{
  "_tag": "Forbidden",
  "success": false,
  "errors": [],
  "result": {}
}

{
  "_tag": "NotFound",
  "success": false,
  "errors": [],
  "result": {}
}

{
  "_tag": "Conflict",
  "success": false,
  "errors": [],
  "result": {}
}

{
  "_tag": "Unprocessable",
  "success": false,
  "errors": [],
  "result": {}
}

{
  "_tag": "TooManyRequests",
  "success": false,
  "errors": [],
  "result": {}
}

{
  "_tag": "ServiceUnavailable",
  "success": false,
  "errors": [],
  "result": {}
}

Authorizations

Authorization

string

header

required

Bearer token for the authenticated caller.

Headers

akua-context

string

Optional workspace/scope context for the request. Carries a single workspace wire id (ws_…) today. Only needed for broad tokens - a workspace-owned token implies its workspace.

Required string length: 1 - 53

Example:

"ws_j572abc123def4"

idempotency-key

string

Optional caller-supplied idempotency key. Any non-empty key up to 64 characters is accepted. Endpoint-specific documentation describes how the key is used.

Required string length: 1 - 64

Example:

"create-prod-2026-05-07"

if-match

string

required

The etag of the resource version the client last read. Required on writes when the resource exposes an etag field. Mismatch returns 409 ABORTED with the current etag in the error metadata.

Required string length: 1 - 256

Example:

"42"

Path Parameters

vault

string

required

A vault id chosen by its creator, unique in the Workspace. default is the Workspace vault.

Pattern: ^[a-z]([a-z0-9-]{0,61}[a-z0-9])?$

Example:

"default"

secret

string

required

A secret id, unique in its vault

Pattern: ^[a-z]([a-z0-9-]{0,61}[a-z0-9])?$

Example:

"db-password"

Body

application/json

labels

object

required

Response

Secret

name

string

required

Resource name vaults/{vault}/secrets/{secret}.

Example:

"vaults/default/secrets/db-password"

vault_id

string

required

A vault id chosen by its creator, unique in the Workspace. default is the Workspace vault.

Pattern: ^[a-z]([a-z0-9-]{0,61}[a-z0-9])?$

Example:

"default"

secret_id

string

required

A secret id, unique in its vault

Pattern: ^[a-z]([a-z0-9-]{0,61}[a-z0-9])?$

Example:

"db-password"

labels

object

required

latest_version

integer | null

required

version_count

integer

required

created_at

integer

required

Unix timestamp (seconds)

Required range: x >= 0

updated_at

integer

required

Unix timestamp (seconds)

Required range: x >= 0

etag

string

required

Pass as If-Match on writes. OUTPUT_ONLY.

Maximum string length: 64

Update a secret

curl --request PATCH \
  --url https://api.akua.dev/v1/vaults/{vault}/secrets/{secret} \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'if-match: <if-match>' \
  --data '{
  "labels": {}
}'

import requests

url = "https://api.akua.dev/v1/vaults/{vault}/secrets/{secret}"

payload = { "labels": {} }
headers = {
    "if-match": "<if-match>",
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.patch(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'PATCH',
  headers: {
    'if-match': '<if-match>',
    Authorization: 'Bearer <token>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({labels: {}})
};

fetch('https://api.akua.dev/v1/vaults/{vault}/secrets/{secret}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.akua.dev/v1/vaults/{vault}/secrets/{secret}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "PATCH",
  CURLOPT_POSTFIELDS => json_encode([
    'labels' => [
        
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json",
    "if-match: <if-match>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.akua.dev/v1/vaults/{vault}/secrets/{secret}"

	payload := strings.NewReader("{\n  \"labels\": {}\n}")

	req, _ := http.NewRequest("PATCH", url, payload)

	req.Header.Add("if-match", "<if-match>")
	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.patch("https://api.akua.dev/v1/vaults/{vault}/secrets/{secret}")
  .header("if-match", "<if-match>")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"labels\": {}\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.akua.dev/v1/vaults/{vault}/secrets/{secret}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Patch.new(url)
request["if-match"] = '<if-match>'
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"labels\": {}\n}"

response = http.request(request)
puts response.read_body

{
  "name": "vaults/default/secrets/db-password",
  "vault_id": "default",
  "secret_id": "db-password",
  "labels": {},
  "latest_version": 123,
  "version_count": 123,
  "created_at": 1,
  "updated_at": 1,
  "etag": "<string>"
}

{
  "_tag": "Validation",
  "success": false,
  "errors": [],
  "result": {}
}

{
  "_tag": "Unauthorized",
  "success": false,
  "errors": [],
  "result": {}
}

{
  "_tag": "Forbidden",
  "success": false,
  "errors": [],
  "result": {}
}

{
  "_tag": "NotFound",
  "success": false,
  "errors": [],
  "result": {}
}

{
  "_tag": "Conflict",
  "success": false,
  "errors": [],
  "result": {}
}

{
  "_tag": "Unprocessable",
  "success": false,
  "errors": [],
  "result": {}
}

{
  "_tag": "TooManyRequests",
  "success": false,
  "errors": [],
  "result": {}
}

{
  "_tag": "ServiceUnavailable",
  "success": false,
  "errors": [],
  "result": {}
}