Create a secret for credential injection

Create a secret

curl --request POST \
  --url https://api.onecli.sh/v1/secrets \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "name": "Anthropic Production",
  "hostPattern": "api.anthropic.com",
  "valueSource": "inline",
  "value": "<string>",
  "opRef": "<string>",
  "opDisplay": {
    "vault": "<string>",
    "item": "<string>",
    "field": "<string>"
  },
  "pathPattern": "<string>",
  "injectionConfig": {
    "headerName": "<string>",
    "valueFormat": "<string>"
  }
}
'

import requests

url = "https://api.onecli.sh/v1/secrets"

payload = {
    "name": "Anthropic Production",
    "hostPattern": "api.anthropic.com",
    "valueSource": "inline",
    "value": "<string>",
    "opRef": "<string>",
    "opDisplay": {
        "vault": "<string>",
        "item": "<string>",
        "field": "<string>"
    },
    "pathPattern": "<string>",
    "injectionConfig": {
        "headerName": "<string>",
        "valueFormat": "<string>"
    }
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    name: 'Anthropic Production',
    hostPattern: 'api.anthropic.com',
    valueSource: 'inline',
    value: '<string>',
    opRef: '<string>',
    opDisplay: {vault: '<string>', item: '<string>', field: '<string>'},
    pathPattern: '<string>',
    injectionConfig: {headerName: '<string>', valueFormat: '<string>'}
  })
};

fetch('https://api.onecli.sh/v1/secrets', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.onecli.sh/v1/secrets",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'name' => 'Anthropic Production',
    'hostPattern' => 'api.anthropic.com',
    'valueSource' => 'inline',
    'value' => '<string>',
    'opRef' => '<string>',
    'opDisplay' => [
        'vault' => '<string>',
        'item' => '<string>',
        'field' => '<string>'
    ],
    'pathPattern' => '<string>',
    'injectionConfig' => [
        'headerName' => '<string>',
        'valueFormat' => '<string>'
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.onecli.sh/v1/secrets"

	payload := strings.NewReader("{\n  \"name\": \"Anthropic Production\",\n  \"hostPattern\": \"api.anthropic.com\",\n  \"valueSource\": \"inline\",\n  \"value\": \"<string>\",\n  \"opRef\": \"<string>\",\n  \"opDisplay\": {\n    \"vault\": \"<string>\",\n    \"item\": \"<string>\",\n    \"field\": \"<string>\"\n  },\n  \"pathPattern\": \"<string>\",\n  \"injectionConfig\": {\n    \"headerName\": \"<string>\",\n    \"valueFormat\": \"<string>\"\n  }\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.onecli.sh/v1/secrets")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"name\": \"Anthropic Production\",\n  \"hostPattern\": \"api.anthropic.com\",\n  \"valueSource\": \"inline\",\n  \"value\": \"<string>\",\n  \"opRef\": \"<string>\",\n  \"opDisplay\": {\n    \"vault\": \"<string>\",\n    \"item\": \"<string>\",\n    \"field\": \"<string>\"\n  },\n  \"pathPattern\": \"<string>\",\n  \"injectionConfig\": {\n    \"headerName\": \"<string>\",\n    \"valueFormat\": \"<string>\"\n  }\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.onecli.sh/v1/secrets")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"name\": \"Anthropic Production\",\n  \"hostPattern\": \"api.anthropic.com\",\n  \"valueSource\": \"inline\",\n  \"value\": \"<string>\",\n  \"opRef\": \"<string>\",\n  \"opDisplay\": {\n    \"vault\": \"<string>\",\n    \"item\": \"<string>\",\n    \"field\": \"<string>\"\n  },\n  \"pathPattern\": \"<string>\",\n  \"injectionConfig\": {\n    \"headerName\": \"<string>\",\n    \"valueFormat\": \"<string>\"\n  }\n}"

response = http.request(request)
puts response.read_body

{
  "id": "<string>",
  "name": "<string>",
  "type": "<string>",
  "valueSource": "inline",
  "opRef": "<string>",
  "hostPattern": "<string>",
  "pathPattern": "<string>",
  "createdAt": "2023-11-07T05:31:56Z",
  "preview": "<string>",
  "attachedAgents": [
    "<string>"
  ]
}

{
  "error": "<string>"
}

{
  "error": "<string>"
}

POST

secrets

Create a secret

curl --request POST \
  --url https://api.onecli.sh/v1/secrets \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "name": "Anthropic Production",
  "hostPattern": "api.anthropic.com",
  "valueSource": "inline",
  "value": "<string>",
  "opRef": "<string>",
  "opDisplay": {
    "vault": "<string>",
    "item": "<string>",
    "field": "<string>"
  },
  "pathPattern": "<string>",
  "injectionConfig": {
    "headerName": "<string>",
    "valueFormat": "<string>"
  }
}
'

import requests

url = "https://api.onecli.sh/v1/secrets"

payload = {
    "name": "Anthropic Production",
    "hostPattern": "api.anthropic.com",
    "valueSource": "inline",
    "value": "<string>",
    "opRef": "<string>",
    "opDisplay": {
        "vault": "<string>",
        "item": "<string>",
        "field": "<string>"
    },
    "pathPattern": "<string>",
    "injectionConfig": {
        "headerName": "<string>",
        "valueFormat": "<string>"
    }
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    name: 'Anthropic Production',
    hostPattern: 'api.anthropic.com',
    valueSource: 'inline',
    value: '<string>',
    opRef: '<string>',
    opDisplay: {vault: '<string>', item: '<string>', field: '<string>'},
    pathPattern: '<string>',
    injectionConfig: {headerName: '<string>', valueFormat: '<string>'}
  })
};

fetch('https://api.onecli.sh/v1/secrets', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.onecli.sh/v1/secrets",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'name' => 'Anthropic Production',
    'hostPattern' => 'api.anthropic.com',
    'valueSource' => 'inline',
    'value' => '<string>',
    'opRef' => '<string>',
    'opDisplay' => [
        'vault' => '<string>',
        'item' => '<string>',
        'field' => '<string>'
    ],
    'pathPattern' => '<string>',
    'injectionConfig' => [
        'headerName' => '<string>',
        'valueFormat' => '<string>'
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.onecli.sh/v1/secrets"

	payload := strings.NewReader("{\n  \"name\": \"Anthropic Production\",\n  \"hostPattern\": \"api.anthropic.com\",\n  \"valueSource\": \"inline\",\n  \"value\": \"<string>\",\n  \"opRef\": \"<string>\",\n  \"opDisplay\": {\n    \"vault\": \"<string>\",\n    \"item\": \"<string>\",\n    \"field\": \"<string>\"\n  },\n  \"pathPattern\": \"<string>\",\n  \"injectionConfig\": {\n    \"headerName\": \"<string>\",\n    \"valueFormat\": \"<string>\"\n  }\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.onecli.sh/v1/secrets")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"name\": \"Anthropic Production\",\n  \"hostPattern\": \"api.anthropic.com\",\n  \"valueSource\": \"inline\",\n  \"value\": \"<string>\",\n  \"opRef\": \"<string>\",\n  \"opDisplay\": {\n    \"vault\": \"<string>\",\n    \"item\": \"<string>\",\n    \"field\": \"<string>\"\n  },\n  \"pathPattern\": \"<string>\",\n  \"injectionConfig\": {\n    \"headerName\": \"<string>\",\n    \"valueFormat\": \"<string>\"\n  }\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.onecli.sh/v1/secrets")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"name\": \"Anthropic Production\",\n  \"hostPattern\": \"api.anthropic.com\",\n  \"valueSource\": \"inline\",\n  \"value\": \"<string>\",\n  \"opRef\": \"<string>\",\n  \"opDisplay\": {\n    \"vault\": \"<string>\",\n    \"item\": \"<string>\",\n    \"field\": \"<string>\"\n  },\n  \"pathPattern\": \"<string>\",\n  \"injectionConfig\": {\n    \"headerName\": \"<string>\",\n    \"valueFormat\": \"<string>\"\n  }\n}"

response = http.request(request)
puts response.read_body

{
  "id": "<string>",
  "name": "<string>",
  "type": "<string>",
  "valueSource": "inline",
  "opRef": "<string>",
  "hostPattern": "<string>",
  "pathPattern": "<string>",
  "createdAt": "2023-11-07T05:31:56Z",
  "preview": "<string>",
  "attachedAgents": [
    "<string>"
  ]
}

{
  "error": "<string>"
}

{
  "error": "<string>"
}

Stores a new credential for the workspace. The anthropic and openai types are auto-configured, while generic secrets need injection details. See LLMs for LLM keys, then grant the secret to an agent. Creates a workspace secret. The gateway uses secrets to inject credentials into outbound requests matching the host and path patterns.

anthropic and openai types are auto-configured (an openai value that is a full connection string also sets the host).
generic type requires an injectionConfig.
Instead of an inline value, set valueSource to onepassword and provide opRef; the gateway resolves the value at request time through the workspace’s 1Password vault connection.

A new secret is attached to every agent in the workspace automatically (attachedAgents); adjust with the Grants endpoints.

Availability: Cloud · Community (self-hosted) · Enterprise (self-hosted)

Authorizations

Authorization

string

header

required

A workspace API key (oc_…) or organization API key (oc_org_…). Workspace-scoped endpoints called with an organization key also need X-Workspace-Id.

Body

application/json

name

string

required

Required string length: 1 - 255

Example:

"Anthropic Production"

type

enum<string>

required

Available options:

anthropic,

openai,

generic

hostPattern

string

required

Hostname pattern to match (no ://, /, or spaces). A * wildcard must stand for whole labels and the pattern must end in a literal domain that is not a public suffix (*.example.com is fine, *.com is not).

Example:

"api.anthropic.com"

valueSource

enum<string>

default:inline

Available options:

inline,

onepassword

value

string

The secret value (API key, token, and so on). Required unless valueSource is onepassword.

Required string length: 1 - 10000

opRef

string

1Password secret reference (op://vault/item/field). Required when valueSource is onepassword.

opDisplay

object

Human-readable labels of the picked 1Password vault/item/field, for display only.

Show child attributes

pathPattern

string

Optional path pattern to match.

Maximum string length: 1000

injectionConfig

Header injection · object

How the gateway injects this secret into matching outbound requests (generic secrets only). Exactly one variant:

Header — { "headerName": "Authorization", "valueFormat": "Bearer {value}" }
Query parameter — { "paramName": "key", "paramFormat": "{value}" }
URL path template — { "pathTemplate": "/bot{value}" } (must start with / and contain {value} exactly once)
URL path regex — { "pathRegex": "^/bot([^/]+)", "pathReplacement": "/bot{value}" } (replacement must contain {value})

Unknown or mixed keys are rejected.

Header injection
Query parameter injection
URL path template injection
URL path regex injection

Show child attributes

Response

Secret created

The narrowed secret representation returned by create endpoints.

string

name

string

type

string

valueSource

enum<string>

Available options:

inline,

onepassword

opRef

string | null

hostPattern

string

pathPattern

string | null

createdAt

string<date-time>

preview

string

Masked preview of the value (inline secrets only).

attachedAgents

string[]

Agent ids the new secret was granted to automatically (workspace secrets only; empty for organization secrets).

Workspace

Organization

Enterprise

Platform

Create a secret for credential injection

Authorizations

Body

Response