{
  "openapi": "3.0.0",
  "info": {
    "title": "quiva.ai Secrets Manager API",
    "description": "API for managing secrets in the quiva.ai platform",
    "version": "0.1.0",
    "contact": {
      "name": "quiva.ai Support"
    }
  },
  "servers": [
    {
      "url": "https://api.quiva.ai",
      "description": "Production API server"
    }
  ],
  "security": [
    {
      "bearerAuth": []
    },
    {
      "apiKeyAuth": []
    }
  ],
  "paths": {
    "/secrets": {
      "get": {
        "summary": "List secrets",
        "description": "Retrieves a list of secrets from the secrets bucket. By default, only key names are returned unless reveal=true is specified.",
        "operationId": "listSecrets",
        "tags": [
          "Secrets"
        ],
        "parameters": [
          {
            "name": "limit",
            "in": "query",
            "description": "Maximum number of secrets to return (default: 100)",
            "required": false,
            "schema": {
              "type": "integer",
              "default": 100,
              "minimum": 1
            }
          },
          {
            "name": "reveal",
            "in": "query",
            "description": "Whether to include secret values in the response",
            "required": false,
            "schema": {
              "type": "boolean",
              "default": false
            }
          }
        ],
        "responses": {
          "200": {
            "description": "List of secrets retrieved successfully",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SecretList"
                }
              }
            }
          },
          "400": {
            "description": "Bad request",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                },
                "example": {
                  "error": "the list errored"
                }
              }
            }
          }
        },
        "x-resource-type": "service"
      },
      "put": {
        "summary": "Create or update a secret",
        "description": "Stores a new secret or updates an existing one in the secrets bucket",
        "operationId": "putSecret",
        "tags": [
          "Secrets"
        ],
        "requestBody": {
          "description": "Secret details to store",
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/SecretCreate"
              },
              "example": {
                "key": "api-key",
                "value": "sk_live_abcdefghijklmnopqrstuvwxyz"
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Secret created/updated successfully",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "message": {
                      "type": "string",
                      "example": "success"
                    }
                  }
                },
                "example": {
                  "message": "success"
                }
              }
            }
          },
          "400": {
            "description": "Bad request",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                },
                "example": {
                  "error": "invalid request format"
                }
              }
            }
          }
        },
        "x-resource-type": "service"
      }
    },
    "/secrets/{key}": {
      "get": {
        "summary": "Get a secret",
        "description": "Retrieves a specific secret by its key from the secrets bucket",
        "operationId": "getSecret",
        "tags": [
          "Secrets"
        ],
        "parameters": [
          {
            "name": "key",
            "in": "path",
            "description": "The key of the secret to retrieve",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "scope",
            "in": "query",
            "required": false,
            "description": "Use `user` for a personal secret; omit for an account secret",
            "schema": {
              "type": "string",
              "enum": [
                "user"
              ]
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Secret retrieved successfully",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Secret"
                },
                "example": {
                  "key": "api-key",
                  "value": "sk_live_abcdefghijklmnopqrstuvwxyz"
                }
              }
            }
          },
          "400": {
            "description": "Bad request",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                },
                "example": {
                  "error": "error retrieving secret"
                }
              }
            }
          },
          "404": {
            "description": "Secret not found",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                },
                "example": {
                  "error": "resource not found"
                }
              }
            }
          }
        },
        "x-resource-type": "service"
      },
      "delete": {
        "summary": "Delete a secret",
        "description": "Removes a specific secret by its key from the secrets bucket",
        "operationId": "deleteSecret",
        "tags": [
          "Secrets"
        ],
        "parameters": [
          {
            "name": "key",
            "in": "path",
            "description": "The key of the secret to delete",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "scope",
            "in": "query",
            "required": false,
            "description": "Use `user` for a personal secret; omit for an account secret",
            "schema": {
              "type": "string",
              "enum": [
                "user"
              ]
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Secret deleted successfully",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "message": {
                      "type": "string",
                      "example": "success"
                    }
                  }
                },
                "example": {
                  "message": "success"
                }
              }
            }
          },
          "400": {
            "description": "Bad request",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                },
                "example": {
                  "error": "error deleting secret"
                }
              }
            }
          },
          "404": {
            "description": "Secret not found",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                },
                "example": {
                  "error": "resource not found"
                }
              }
            }
          }
        },
        "x-resource-type": "service"
      }
    },
    "/secrets/user": {
      "get": {
        "summary": "List personal secrets",
        "description": "Lists the signed-in user's personal secrets. These are scoped to the caller and never appear in **GET /secrets**. By default only key names are returned; pass `reveal=true` for values.",
        "operationId": "listUserSecrets",
        "tags": [
          "Secrets"
        ],
        "x-resource-type": "service",
        "x-path-derived": true,
        "parameters": [
          {
            "name": "limit",
            "in": "query",
            "required": false,
            "description": "Maximum number of secrets to return (default: 500)",
            "schema": {
              "type": "integer"
            }
          },
          {
            "name": "reveal",
            "in": "query",
            "required": false,
            "description": "Include secret values",
            "schema": {
              "type": "boolean"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Success",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SecretList"
                }
              }
            }
          },
          "400": {
            "description": "Bad request",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "401": {
            "description": "Unauthorized",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        }
      }
    }
  },
  "components": {
    "securitySchemes": {
      "bearerAuth": {
        "type": "http",
        "scheme": "bearer",
        "bearerFormat": "JWT"
      },
      "apiKeyAuth": {
        "type": "apiKey",
        "in": "header",
        "name": "x-api-key"
      },
      "oauth2": {
        "type": "oauth2",
        "description": "API integration client credentials. Tokens only work on the task-sync routes in workspaces.",
        "flows": {
          "clientCredentials": {
            "tokenUrl": "https://api.quiva.ai/oauth/token",
            "scopes": {}
          }
        }
      }
    },
    "schemas": {
      "Secret": {
        "type": "object",
        "properties": {
          "key": {
            "type": "string",
            "description": "The unique identifier for the secret"
          },
          "value": {
            "type": "string",
            "description": "The secret value"
          }
        },
        "required": [
          "key",
          "value"
        ]
      },
      "SecretListItem": {
        "type": "object",
        "properties": {
          "key": {
            "type": "string",
            "description": "The unique identifier for the secret"
          },
          "value": {
            "type": "string",
            "description": "The secret value (only included when reveal=true)"
          }
        },
        "required": [
          "key"
        ]
      },
      "SecretCreate": {
        "type": "object",
        "properties": {
          "key": {
            "type": "string",
            "description": "The unique identifier for the secret"
          },
          "value": {
            "type": "string",
            "description": "The secret value to store"
          },
          "scope": {
            "type": "string",
            "enum": [
              "user",
              "account"
            ],
            "description": "Where to store the secret; `account` is the default"
          }
        },
        "required": [
          "key",
          "value"
        ]
      },
      "Error": {
        "type": "object",
        "properties": {
          "error": {
            "type": "string",
            "description": "Error message describing what went wrong"
          }
        },
        "required": [
          "error"
        ]
      },
      "SecretList": {
        "type": "object",
        "properties": {
          "results": {
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/SecretListItem"
            }
          },
          "results_total": {
            "type": "integer"
          },
          "truncated": {
            "type": "boolean",
            "description": "More results exist than the limit returned"
          },
          "next_cursor": {
            "type": "string",
            "description": "Cursor for the next page"
          }
        }
      }
    }
  },
  "tags": [
    {
      "name": "Secrets",
      "description": "Operations for managing secrets"
    }
  ]
}