Create an organization secret

curl --request POST \
  --url https://api.onecli.sh/v1/org/secrets \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "name": "Anthropic Production",
  "hostPattern": "api.anthropic.com",
  "valueSource": "inline",
  "value": "<string>",
  "opRef": "<string>",
  "opDisplay": {
    "vault": "<string>",
    "item": "<string>",
    "field": "<string>"
  },
  "pathPattern": "<string>",
  "injectionConfig": {
    "headerName": "<string>",
    "valueFormat": "<string>"
  }
}
'

import requests

url = "https://api.onecli.sh/v1/org/secrets"

payload = {
    "name": "Anthropic Production",
    "hostPattern": "api.anthropic.com",
    "valueSource": "inline",
    "value": "<string>",
    "opRef": "<string>",
    "opDisplay": {
        "vault": "<string>",
        "item": "<string>",
        "field": "<string>"
    },
    "pathPattern": "<string>",
    "injectionConfig": {
        "headerName": "<string>",
        "valueFormat": "<string>"
    }
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    name: 'Anthropic Production',
    hostPattern: 'api.anthropic.com',
    valueSource: 'inline',
    value: '<string>',
    opRef: '<string>',
    opDisplay: {vault: '<string>', item: '<string>', field: '<string>'},
    pathPattern: '<string>',
    injectionConfig: {headerName: '<string>', valueFormat: '<string>'}
  })
};

fetch('https://api.onecli.sh/v1/org/secrets', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.onecli.sh/v1/org/secrets",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'name' => 'Anthropic Production',
    'hostPattern' => 'api.anthropic.com',
    'valueSource' => 'inline',
    'value' => '<string>',
    'opRef' => '<string>',
    'opDisplay' => [
        'vault' => '<string>',
        'item' => '<string>',
        'field' => '<string>'
    ],
    'pathPattern' => '<string>',
    'injectionConfig' => [
        'headerName' => '<string>',
        'valueFormat' => '<string>'
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.onecli.sh/v1/org/secrets"

	payload := strings.NewReader("{\n  \"name\": \"Anthropic Production\",\n  \"hostPattern\": \"api.anthropic.com\",\n  \"valueSource\": \"inline\",\n  \"value\": \"<string>\",\n  \"opRef\": \"<string>\",\n  \"opDisplay\": {\n    \"vault\": \"<string>\",\n    \"item\": \"<string>\",\n    \"field\": \"<string>\"\n  },\n  \"pathPattern\": \"<string>\",\n  \"injectionConfig\": {\n    \"headerName\": \"<string>\",\n    \"valueFormat\": \"<string>\"\n  }\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.onecli.sh/v1/org/secrets")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"name\": \"Anthropic Production\",\n  \"hostPattern\": \"api.anthropic.com\",\n  \"valueSource\": \"inline\",\n  \"value\": \"<string>\",\n  \"opRef\": \"<string>\",\n  \"opDisplay\": {\n    \"vault\": \"<string>\",\n    \"item\": \"<string>\",\n    \"field\": \"<string>\"\n  },\n  \"pathPattern\": \"<string>\",\n  \"injectionConfig\": {\n    \"headerName\": \"<string>\",\n    \"valueFormat\": \"<string>\"\n  }\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.onecli.sh/v1/org/secrets")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"name\": \"Anthropic Production\",\n  \"hostPattern\": \"api.anthropic.com\",\n  \"valueSource\": \"inline\",\n  \"value\": \"<string>\",\n  \"opRef\": \"<string>\",\n  \"opDisplay\": {\n    \"vault\": \"<string>\",\n    \"item\": \"<string>\",\n    \"field\": \"<string>\"\n  },\n  \"pathPattern\": \"<string>\",\n  \"injectionConfig\": {\n    \"headerName\": \"<string>\",\n    \"valueFormat\": \"<string>\"\n  }\n}"

response = http.request(request)
puts response.read_body

{
  "id": "<string>",
  "name": "<string>",
  "type": "<string>",
  "valueSource": "inline",
  "opRef": "<string>",
  "hostPattern": "<string>",
  "pathPattern": "<string>",
  "createdAt": "2023-11-07T05:31:56Z",
  "preview": "<string>",
  "attachedAgents": [
    "<string>"
  ]
}

{
  "error": "<string>"
}

{
  "error": "<string>"
}

POST

org

secrets

Create an organization secret

curl --request POST \
  --url https://api.onecli.sh/v1/org/secrets \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "name": "Anthropic Production",
  "hostPattern": "api.anthropic.com",
  "valueSource": "inline",
  "value": "<string>",
  "opRef": "<string>",
  "opDisplay": {
    "vault": "<string>",
    "item": "<string>",
    "field": "<string>"
  },
  "pathPattern": "<string>",
  "injectionConfig": {
    "headerName": "<string>",
    "valueFormat": "<string>"
  }
}
'

import requests

url = "https://api.onecli.sh/v1/org/secrets"

payload = {
    "name": "Anthropic Production",
    "hostPattern": "api.anthropic.com",
    "valueSource": "inline",
    "value": "<string>",
    "opRef": "<string>",
    "opDisplay": {
        "vault": "<string>",
        "item": "<string>",
        "field": "<string>"
    },
    "pathPattern": "<string>",
    "injectionConfig": {
        "headerName": "<string>",
        "valueFormat": "<string>"
    }
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    name: 'Anthropic Production',
    hostPattern: 'api.anthropic.com',
    valueSource: 'inline',
    value: '<string>',
    opRef: '<string>',
    opDisplay: {vault: '<string>', item: '<string>', field: '<string>'},
    pathPattern: '<string>',
    injectionConfig: {headerName: '<string>', valueFormat: '<string>'}
  })
};

fetch('https://api.onecli.sh/v1/org/secrets', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.onecli.sh/v1/org/secrets",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'name' => 'Anthropic Production',
    'hostPattern' => 'api.anthropic.com',
    'valueSource' => 'inline',
    'value' => '<string>',
    'opRef' => '<string>',
    'opDisplay' => [
        'vault' => '<string>',
        'item' => '<string>',
        'field' => '<string>'
    ],
    'pathPattern' => '<string>',
    'injectionConfig' => [
        'headerName' => '<string>',
        'valueFormat' => '<string>'
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.onecli.sh/v1/org/secrets"

	payload := strings.NewReader("{\n  \"name\": \"Anthropic Production\",\n  \"hostPattern\": \"api.anthropic.com\",\n  \"valueSource\": \"inline\",\n  \"value\": \"<string>\",\n  \"opRef\": \"<string>\",\n  \"opDisplay\": {\n    \"vault\": \"<string>\",\n    \"item\": \"<string>\",\n    \"field\": \"<string>\"\n  },\n  \"pathPattern\": \"<string>\",\n  \"injectionConfig\": {\n    \"headerName\": \"<string>\",\n    \"valueFormat\": \"<string>\"\n  }\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.onecli.sh/v1/org/secrets")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"name\": \"Anthropic Production\",\n  \"hostPattern\": \"api.anthropic.com\",\n  \"valueSource\": \"inline\",\n  \"value\": \"<string>\",\n  \"opRef\": \"<string>\",\n  \"opDisplay\": {\n    \"vault\": \"<string>\",\n    \"item\": \"<string>\",\n    \"field\": \"<string>\"\n  },\n  \"pathPattern\": \"<string>\",\n  \"injectionConfig\": {\n    \"headerName\": \"<string>\",\n    \"valueFormat\": \"<string>\"\n  }\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.onecli.sh/v1/org/secrets")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"name\": \"Anthropic Production\",\n  \"hostPattern\": \"api.anthropic.com\",\n  \"valueSource\": \"inline\",\n  \"value\": \"<string>\",\n  \"opRef\": \"<string>\",\n  \"opDisplay\": {\n    \"vault\": \"<string>\",\n    \"item\": \"<string>\",\n    \"field\": \"<string>\"\n  },\n  \"pathPattern\": \"<string>\",\n  \"injectionConfig\": {\n    \"headerName\": \"<string>\",\n    \"valueFormat\": \"<string>\"\n  }\n}"

response = http.request(request)
puts response.read_body

{
  "id": "<string>",
  "name": "<string>",
  "type": "<string>",
  "valueSource": "inline",
  "opRef": "<string>",
  "hostPattern": "<string>",
  "pathPattern": "<string>",
  "createdAt": "2023-11-07T05:31:56Z",
  "preview": "<string>",
  "attachedAgents": [
    "<string>"
  ]
}

{
  "error": "<string>"
}

{
  "error": "<string>"
}

Stores a credential once at the organization level so every workspace can use it. Use it for keys many teams share, such as a company OpenAI key, then grant the secret to the agents that need it. An organization secret is visible in every workspace and can be granted to any agent. 1Password-resolved values are workspace-only, so valueSource must be inline here.

Availability: Cloud · Community (self-hosted) · Enterprise (self-hosted)

Authorizations

Authorization

string

header

required

A workspace API key (oc_…) or organization API key (oc_org_…). Workspace-scoped endpoints called with an organization key also need X-Workspace-Id.

Body

application/json

name

string

required

Required string length: 1 - 255

Example:

"Anthropic Production"

type

enum<string>

required

Available options:

anthropic,

openai,

generic

hostPattern

string

required

Hostname pattern to match (no ://, /, or spaces). A * wildcard must stand for whole labels and the pattern must end in a literal domain that is not a public suffix (*.example.com is fine, *.com is not).

Example:

"api.anthropic.com"

valueSource

enum<string>

default:inline

Available options:

inline,

onepassword

value

string

The secret value (API key, token, and so on). Required unless valueSource is onepassword.

Required string length: 1 - 10000

opRef

string

1Password secret reference (op://vault/item/field). Required when valueSource is onepassword.

opDisplay

object

Human-readable labels of the picked 1Password vault/item/field, for display only.

Show child attributes

pathPattern

string

Optional path pattern to match.

Maximum string length: 1000

injectionConfig

Header injection · object

How the gateway injects this secret into matching outbound requests (generic secrets only). Exactly one variant:

Header — { "headerName": "Authorization", "valueFormat": "Bearer {value}" }
Query parameter — { "paramName": "key", "paramFormat": "{value}" }
URL path template — { "pathTemplate": "/bot{value}" } (must start with / and contain {value} exactly once)
URL path regex — { "pathRegex": "^/bot([^/]+)", "pathReplacement": "/bot{value}" } (replacement must contain {value})

Unknown or mixed keys are rejected.

Header injection
Query parameter injection
URL path template injection
URL path regex injection

Show child attributes

Response

Secret created

The narrowed secret representation returned by create endpoints.

string

name

string

type

string

valueSource

enum<string>

Available options:

inline,

onepassword

opRef

string | null

hostPattern

string

pathPattern

string | null

createdAt

string<date-time>

preview

string

Masked preview of the value (inline secrets only).

attachedAgents

string[]

Agent ids the new secret was granted to automatically (workspace secrets only; empty for organization secrets).

Workspace

Organization

Enterprise

Platform

Create an organization secret

Authorizations

Body

Response