openapi: 3.0.3
info:
  title: Drone REST Builds Secrets API
  description: The Drone REST API provides programmatic access to the Drone CI/CD platform, enabling management of builds, repositories, secrets, cron jobs, templates, and user accounts. Authentication is performed using bearer tokens retrieved from the Drone user interface profile page.
  version: 1.0.0
  contact:
    name: Drone Support
    url: https://docs.drone.io/
  license:
    name: Apache 2.0
    url: https://www.apache.org/licenses/LICENSE-2.0
servers:
- url: https://your-drone-server
  description: Your self-hosted Drone server
security:
- BearerAuth: []
tags:
- name: Secrets
  description: Secret variable management for repos and organizations.
paths:
  /api/repos/{namespace}/{name}/secrets:
    parameters:
    - name: namespace
      in: path
      required: true
      schema:
        type: string
    - name: name
      in: path
      required: true
      schema:
        type: string
    get:
      operationId: listRepoSecrets
      summary: List repository secrets
      description: Returns a list of all secrets for the specified repository.
      tags:
      - Secrets
      responses:
        '200':
          description: List of secrets.
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Secret'
        '401':
          $ref: '#/components/responses/Unauthorized'
    post:
      operationId: createRepoSecret
      summary: Create a repository secret
      description: Creates a new secret for the specified repository.
      tags:
      - Secrets
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Secret'
      responses:
        '200':
          description: Created secret.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Secret'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /api/repos/{namespace}/{name}/secrets/{secret}:
    parameters:
    - name: namespace
      in: path
      required: true
      schema:
        type: string
    - name: name
      in: path
      required: true
      schema:
        type: string
    - name: secret
      in: path
      required: true
      schema:
        type: string
      description: The secret name.
    get:
      operationId: getRepoSecret
      summary: Get a repository secret
      description: Returns a secret by name for the specified repository.
      tags:
      - Secrets
      responses:
        '200':
          description: Secret details.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Secret'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
    patch:
      operationId: updateRepoSecret
      summary: Update a repository secret
      description: Updates an existing secret for the specified repository.
      tags:
      - Secrets
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Secret'
      responses:
        '200':
          description: Updated secret.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Secret'
        '401':
          $ref: '#/components/responses/Unauthorized'
    delete:
      operationId: deleteRepoSecret
      summary: Delete a repository secret
      description: Deletes a secret from the specified repository.
      tags:
      - Secrets
      responses:
        '204':
          description: Secret deleted.
        '401':
          $ref: '#/components/responses/Unauthorized'
  /api/secrets:
    get:
      operationId: listOrgSecrets
      summary: List all organization secrets
      description: Returns a list of all organization-level secrets. Requires admin privileges.
      tags:
      - Secrets
      responses:
        '200':
          description: List of secrets.
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Secret'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /api/secrets/{namespace}:
    parameters:
    - name: namespace
      in: path
      required: true
      schema:
        type: string
      description: The organization namespace.
    get:
      operationId: listNamespaceSecrets
      summary: List namespace secrets
      description: Returns a list of all secrets for the specified namespace/organization.
      tags:
      - Secrets
      responses:
        '200':
          description: List of secrets.
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Secret'
        '401':
          $ref: '#/components/responses/Unauthorized'
    post:
      operationId: createNamespaceSecret
      summary: Create a namespace secret
      description: Creates a new secret for the specified namespace/organization.
      tags:
      - Secrets
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Secret'
      responses:
        '200':
          description: Created secret.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Secret'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /api/secrets/{namespace}/{secret}:
    parameters:
    - name: namespace
      in: path
      required: true
      schema:
        type: string
    - name: secret
      in: path
      required: true
      schema:
        type: string
    get:
      operationId: getNamespaceSecret
      summary: Get a namespace secret
      description: Returns a secret by name from the specified namespace.
      tags:
      - Secrets
      responses:
        '200':
          description: Secret details.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Secret'
        '401':
          $ref: '#/components/responses/Unauthorized'
    patch:
      operationId: updateNamespaceSecret
      summary: Update a namespace secret
      description: Updates a secret in the specified namespace.
      tags:
      - Secrets
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Secret'
      responses:
        '200':
          description: Updated secret.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Secret'
        '401':
          $ref: '#/components/responses/Unauthorized'
    delete:
      operationId: deleteNamespaceSecret
      summary: Delete a namespace secret
      description: Deletes a secret from the specified namespace.
      tags:
      - Secrets
      responses:
        '204':
          description: Secret deleted.
        '401':
          $ref: '#/components/responses/Unauthorized'
components:
  responses:
    Unauthorized:
      description: Authentication credentials missing or invalid.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    NotFound:
      description: Resource not found.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
  schemas:
    Error:
      type: object
      description: API error response.
      properties:
        code:
          type: integer
        message:
          type: string
    Secret:
      type: object
      description: Represents a secret variable stored in Drone.
      properties:
        namespace:
          type: string
        name:
          type: string
        data:
          type: string
        pull_request:
          type: boolean
        pull_request_push:
          type: boolean
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
      description: Bearer token retrieved from the Drone user interface profile page.