openapi: 3.0.0 info: title: gitpod.v1 gitpod.v1.AccountService gitpod.v1.SecretService API version: v1.0.0 servers: - url: https://api.gitpod.io description: Gitpod API tags: - name: gitpod.v1.SecretService x-displayName: gitpod.v1.SecretService paths: /gitpod.v1.SecretService/CreateSecret: servers: [] post: description: "Creates a new secret for a project.\n\n Use this method to:\n - Store sensitive configuration values\n - Set up environment variables\n - Configure registry authentication\n - Add file-based secrets\n\n ### Examples\n\n - Create environment variable:\n\n Creates a secret that will be available as an environment variable.\n\n ```yaml\n name: \"DATABASE_URL\"\n projectId: \"b0e12f6c-4c67-429d-a4a6-d9838b5da047\"\n value: \"postgresql://user:pass@localhost:5432/db\"\n environmentVariable: true\n ```\n\n - Create file secret:\n\n Creates a secret that will be mounted as a file.\n\n ```yaml\n name: \"SSH_KEY\"\n projectId: \"b0e12f6c-4c67-429d-a4a6-d9838b5da047\"\n value: \"-----BEGIN RSA PRIVATE KEY-----\\n...\"\n filePath: \"/home/gitpod/.ssh/id_rsa\"\n ```\n\n - Create registry auth:\n\n Creates credentials for private container registry.\n\n ```yaml\n name: \"DOCKER_AUTH\"\n projectId: \"b0e12f6c-4c67-429d-a4a6-d9838b5da047\"\n value: \"username:password\"\n containerRegistryBasicAuthHost: \"https://registry.example.com\"\n ```" operationId: gitpod.v1.SecretService.CreateSecret parameters: [] requestBody: content: application/json: examples: create_environment_variable: description: Creates a secret that will be available as an environment variable. value: environmentVariable: true name: DATABASE_URL projectId: b0e12f6c-4c67-429d-a4a6-d9838b5da047 value: postgresql://user:pass@localhost:5432/db create_file_secret: description: Creates a secret that will be mounted as a file. value: filePath: /home/gitpod/.ssh/id_rsa name: SSH_KEY projectId: b0e12f6c-4c67-429d-a4a6-d9838b5da047 value: '-----BEGIN RSA PRIVATE KEY----- ...' create_registry_auth: description: Creates credentials for private container registry. value: containerRegistryBasicAuthHost: https://registry.example.com name: DOCKER_AUTH projectId: b0e12f6c-4c67-429d-a4a6-d9838b5da047 value: username:password schema: $ref: '#/components/schemas/gitpod.v1.CreateSecretRequest' required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/gitpod.v1.CreateSecretResponse' description: Success default: content: application/json: schema: $ref: '#/components/schemas/connect.error' description: Error security: - bearerAuth: [] summary: CreateSecret tags: - gitpod.v1.SecretService /gitpod.v1.SecretService/DeleteSecret: servers: [] post: description: "Deletes a secret permanently.\n\n Use this method to:\n - Remove unused secrets\n - Clean up old credentials\n\n ### Examples\n\n - Delete secret:\n\n Permanently removes a secret.\n\n ```yaml\n secretId: \"d2c94c27-3b76-4a42-b88c-95a85e392c68\"\n ```" operationId: gitpod.v1.SecretService.DeleteSecret parameters: [] requestBody: content: application/json: examples: delete_secret: description: Permanently removes a secret. value: secretId: d2c94c27-3b76-4a42-b88c-95a85e392c68 schema: $ref: '#/components/schemas/gitpod.v1.DeleteSecretRequest' required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/gitpod.v1.DeleteSecretResponse' description: Success default: content: application/json: schema: $ref: '#/components/schemas/connect.error' description: Error security: - bearerAuth: [] summary: DeleteSecret tags: - gitpod.v1.SecretService /gitpod.v1.SecretService/GetSecretValue: servers: [] post: description: "Gets the value of a secret. Only available to environments that are authorized to access the secret.\n\n Use this method to:\n - Retrieve secret values\n - Access credentials\n\n ### Examples\n\n - Get secret value:\n\n Retrieves the value of a specific secret.\n\n ```yaml\n secretId: \"d2c94c27-3b76-4a42-b88c-95a85e392c68\"\n ```" operationId: gitpod.v1.SecretService.GetSecretValue parameters: [] requestBody: content: application/json: examples: get_secret_value: description: Retrieves the value of a specific secret. value: secretId: d2c94c27-3b76-4a42-b88c-95a85e392c68 schema: $ref: '#/components/schemas/gitpod.v1.GetSecretValueRequest' required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/gitpod.v1.GetSecretValueResponse' description: Success default: content: application/json: schema: $ref: '#/components/schemas/connect.error' description: Error security: - bearerAuth: [] summary: GetSecretValue tags: - gitpod.v1.SecretService /gitpod.v1.SecretService/ListSecrets: servers: [] post: description: "Lists secrets\n\n Use this method to:\n - View all project secrets\n - View all user secrets\n\n ### Examples\n\n - List project secrets:\n\n Shows all secrets for a project.\n\n ```yaml\n filter:\n scope:\n projectId: \"b0e12f6c-4c67-429d-a4a6-d9838b5da047\"\n pagination:\n pageSize: 20\n ```\n\n - List user secrets:\n\n Shows all secrets for a user.\n\n ```yaml\n filter:\n scope:\n userId: \"123e4567-e89b-12d3-a456-426614174000\"\n pagination:\n pageSize: 20\n ```" operationId: gitpod.v1.SecretService.ListSecrets parameters: - in: query name: pageSize schema: default: 25 maximum: 100 minimum: 0 type: integer - in: query name: token schema: default: '' type: string requestBody: content: application/json: examples: list_project_secrets: description: Shows all secrets for a project. value: filter: scope: projectId: b0e12f6c-4c67-429d-a4a6-d9838b5da047 pagination: pageSize: 20 list_user_secrets: description: Shows all secrets for a user. value: filter: scope: userId: 123e4567-e89b-12d3-a456-426614174000 pagination: pageSize: 20 schema: $ref: '#/components/schemas/gitpod.v1.ListSecretsRequest' required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/gitpod.v1.ListSecretsResponse' description: Success default: content: application/json: schema: $ref: '#/components/schemas/connect.error' description: Error security: - bearerAuth: [] summary: ListSecrets tags: - gitpod.v1.SecretService /gitpod.v1.SecretService/UpdateSecretValue: servers: [] post: description: "Updates the value of an existing secret.\n\n Use this method to:\n - Rotate secret values\n - Update credentials\n\n ### Examples\n\n - Update secret value:\n\n Changes the value of an existing secret.\n\n ```yaml\n secretId: \"d2c94c27-3b76-4a42-b88c-95a85e392c68\"\n value: \"new-secret-value\"\n ```" operationId: gitpod.v1.SecretService.UpdateSecretValue parameters: [] requestBody: content: application/json: examples: update_secret_value: description: Changes the value of an existing secret. value: secretId: d2c94c27-3b76-4a42-b88c-95a85e392c68 value: new-secret-value schema: $ref: '#/components/schemas/gitpod.v1.UpdateSecretValueRequest' required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/gitpod.v1.UpdateSecretValueResponse' description: Success default: content: application/json: schema: $ref: '#/components/schemas/connect.error' description: Error security: - bearerAuth: [] summary: UpdateSecretValue tags: - gitpod.v1.SecretService components: schemas: gitpod.v1.Principal: enum: - PRINCIPAL_UNSPECIFIED - PRINCIPAL_ACCOUNT - PRINCIPAL_USER - PRINCIPAL_RUNNER - PRINCIPAL_ENVIRONMENT - PRINCIPAL_SERVICE_ACCOUNT - PRINCIPAL_RUNNER_MANAGER title: Principal type: string gitpod.v1.UpdateSecretValueResponse: additionalProperties: false title: UpdateSecretValueResponse type: object gitpod.v1.Subject: additionalProperties: false properties: id: description: id is the UUID of the subject format: uuid title: id type: string principal: $ref: '#/components/schemas/gitpod.v1.Principal' description: Principal is the principal of the subject title: principal title: Subject type: object connect.error: additionalProperties: true description: 'Error type returned by Connect: https://connectrpc.com/docs/go/errors/#http-representation' properties: code: description: The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code]. enum: - canceled - unknown - invalid_argument - deadline_exceeded - not_found - already_exists - permission_denied - resource_exhausted - failed_precondition - aborted - out_of_range - unimplemented - internal - unavailable - data_loss - unauthenticated example: - not_found type: string message: description: A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client. type: string title: Connect Error type: object gitpod.v1.CreateSecretResponse: additionalProperties: false properties: secret: $ref: '#/components/schemas/gitpod.v1.Secret' title: secret title: CreateSecretResponse type: object gitpod.v1.DeleteSecretResponse: additionalProperties: false title: DeleteSecretResponse type: object gitpod.v1.ListSecretsRequest.Filter: additionalProperties: false properties: projectIds: deprecated: true description: "project_ids filters the response to only Secrets used by these Project IDs\n Deprecated: use scope instead. Values in project_ids will be ignored." items: deprecated: true format: uuid maxItems: 25 type: string maxItems: 25 title: project_ids type: array scope: $ref: '#/components/schemas/gitpod.v1.SecretScope' description: scope is the scope of the secrets to list title: scope title: Filter type: object gitpod.v1.PaginationRequest: additionalProperties: false properties: pageSize: description: "Page size is the maximum number of results to retrieve per page.\n Defaults to 25. Maximum 100." format: int32 maximum: 100 title: page_size type: integer token: description: "Token for the next set of results that was returned as next_token of a\n PaginationResponse" title: token type: string title: PaginationRequest type: object gitpod.v1.GetSecretValueRequest: additionalProperties: false properties: secretId: format: uuid title: secret_id type: string title: GetSecretValueRequest type: object gitpod.v1.ListSecretsResponse: additionalProperties: false properties: pagination: $ref: '#/components/schemas/gitpod.v1.PaginationResponse' description: pagination contains the pagination options for listing secrets title: pagination secrets: items: $ref: '#/components/schemas/gitpod.v1.Secret' title: secrets type: array title: ListSecretsResponse type: object gitpod.v1.ListSecretsRequest: additionalProperties: false properties: filter: $ref: '#/components/schemas/gitpod.v1.ListSecretsRequest.Filter' title: filter pagination: $ref: '#/components/schemas/gitpod.v1.PaginationRequest' description: pagination contains the pagination options for listing environments title: pagination title: ListSecretsRequest type: object gitpod.v1.CreateSecretRequest: additionalProperties: false oneOf: - not: anyOf: - required: - containerRegistryBasicAuthHost - required: - environmentVariable - required: - filePath required: - apiOnly - not: anyOf: - required: - apiOnly - required: - environmentVariable - required: - filePath required: - containerRegistryBasicAuthHost - not: anyOf: - required: - apiOnly - required: - containerRegistryBasicAuthHost - required: - filePath required: - environmentVariable - not: anyOf: - required: - apiOnly - required: - containerRegistryBasicAuthHost - required: - environmentVariable required: - filePath properties: apiOnly: description: "api_only indicates the secret is only available via API/CLI.\n These secrets are NOT automatically injected into services or devcontainers.\n Useful for secrets that should only be consumed programmatically (e.g., by security agents)." title: api_only type: boolean containerRegistryBasicAuthHost: description: secret will be mounted as a docker config in the environment VM, mount will have the docker registry host title: container_registry_basic_auth_host type: string environmentVariable: description: secret will be created as an Environment Variable with the same name as the secret title: environment_variable type: boolean filePath: description: 'absolute path to the file where the secret is mounted value must be an absolute path (e.g. /path/to/file): ``` this.matches(''^/[^/].*$'') ``` ' title: file_path type: string name: maxLength: 127 minLength: 3 pattern: ^[0-9a-zA-Z_]{3,}$ title: name type: string projectId: deprecated: true description: "project_id is the ProjectID this Secret belongs to\n Deprecated: use scope instead" title: project_id type: string scope: $ref: '#/components/schemas/gitpod.v1.SecretScope' description: scope is the scope of the secret title: scope value: description: value is the plaintext value of the secret maxLength: 10240 minLength: 1 title: value type: string title: CreateSecretRequest type: object gitpod.v1.GetSecretValueResponse: additionalProperties: false properties: value: title: value type: string title: GetSecretValueResponse type: object gitpod.v1.PaginationResponse: additionalProperties: false properties: nextToken: description: "Token passed for retrieving the next set of results. Empty if there are no\n more results" title: next_token type: string title: PaginationResponse type: object gitpod.v1.Secret: additionalProperties: false oneOf: - not: anyOf: - required: - containerRegistryBasicAuthHost - required: - environmentVariable - required: - filePath required: - apiOnly - not: anyOf: - required: - apiOnly - required: - environmentVariable - required: - filePath required: - containerRegistryBasicAuthHost - not: anyOf: - required: - apiOnly - required: - containerRegistryBasicAuthHost - required: - filePath required: - environmentVariable - not: anyOf: - required: - apiOnly - required: - containerRegistryBasicAuthHost - required: - environmentVariable required: - filePath properties: apiOnly: description: api_only indicates the secret is only available via API/CLI title: api_only type: boolean containerRegistryBasicAuthHost: description: secret will be mounted as a registry secret format: uri title: container_registry_basic_auth_host type: string createdAt: $ref: '#/components/schemas/google.protobuf.Timestamp' title: created_at creator: $ref: '#/components/schemas/gitpod.v1.Subject' description: creator is the identity of the creator of the secret title: creator environmentVariable: description: secret will be created as an Environment Variable with the same name as the secret title: environment_variable type: boolean filePath: description: absolute path to the file where the secret is mounted title: file_path type: string id: format: uuid title: id type: string name: description: Name of the secret for humans. title: name type: string projectId: deprecated: true description: "The Project ID this Secret belongs to\n Deprecated: use scope instead" format: uuid title: project_id type: string scope: $ref: '#/components/schemas/gitpod.v1.SecretScope' title: scope updatedAt: $ref: '#/components/schemas/google.protobuf.Timestamp' title: updated_at title: Secret type: object google.protobuf.Timestamp: description: "A Timestamp represents a point in time independent of any time zone or local\n calendar, encoded as a count of seconds and fractions of seconds at\n nanosecond resolution. The count is relative to an epoch at UTC midnight on\n January 1, 1970, in the proleptic Gregorian calendar which extends the\n Gregorian calendar backwards to year one.\n\n All minutes are 60 seconds long. Leap seconds are \"smeared\" so that no leap\n second table is needed for interpretation, using a [24-hour linear\n smear](https://developers.google.com/time/smear).\n\n The range is from 0001-01-01T00:00:00Z to 9999-12-31T23:59:59.999999999Z. By\n restricting to that range, we ensure that we can convert to and from [RFC\n 3339](https://www.ietf.org/rfc/rfc3339.txt) date strings.\n\n # Examples\n\n Example 1: Compute Timestamp from POSIX `time()`.\n\n Timestamp timestamp;\n timestamp.set_seconds(time(NULL));\n timestamp.set_nanos(0);\n\n Example 2: Compute Timestamp from POSIX `gettimeofday()`.\n\n struct timeval tv;\n gettimeofday(&tv, NULL);\n\n Timestamp timestamp;\n timestamp.set_seconds(tv.tv_sec);\n timestamp.set_nanos(tv.tv_usec * 1000);\n\n Example 3: Compute Timestamp from Win32 `GetSystemTimeAsFileTime()`.\n\n FILETIME ft;\n GetSystemTimeAsFileTime(&ft);\n UINT64 ticks = (((UINT64)ft.dwHighDateTime) << 32) | ft.dwLowDateTime;\n\n // A Windows tick is 100 nanoseconds. Windows epoch 1601-01-01T00:00:00Z\n // is 11644473600 seconds before Unix epoch 1970-01-01T00:00:00Z.\n Timestamp timestamp;\n timestamp.set_seconds((INT64) ((ticks / 10000000) - 11644473600LL));\n timestamp.set_nanos((INT32) ((ticks % 10000000) * 100));\n\n Example 4: Compute Timestamp from Java `System.currentTimeMillis()`.\n\n long millis = System.currentTimeMillis();\n\n Timestamp timestamp = Timestamp.newBuilder().setSeconds(millis / 1000)\n .setNanos((int) ((millis % 1000) * 1000000)).build();\n\n Example 5: Compute Timestamp from Java `Instant.now()`.\n\n Instant now = Instant.now();\n\n Timestamp timestamp =\n Timestamp.newBuilder().setSeconds(now.getEpochSecond())\n .setNanos(now.getNano()).build();\n\n Example 6: Compute Timestamp from current time in Python.\n\n timestamp = Timestamp()\n timestamp.GetCurrentTime()\n\n # JSON Mapping\n\n In JSON format, the Timestamp type is encoded as a string in the\n [RFC 3339](https://www.ietf.org/rfc/rfc3339.txt) format. That is, the\n format is \"{year}-{month}-{day}T{hour}:{min}:{sec}[.{frac_sec}]Z\"\n where {year} is always expressed using four digits while {month}, {day},\n {hour}, {min}, and {sec} are zero-padded to two digits each. The fractional\n seconds, which can go up to 9 digits (i.e. up to 1 nanosecond resolution),\n are optional. The \"Z\" suffix indicates the timezone (\"UTC\"); the timezone\n is required. A proto3 JSON serializer should always use UTC (as indicated by\n \"Z\") when printing the Timestamp type and a proto3 JSON parser should be\n able to accept both UTC and other timezones (as indicated by an offset).\n\n For example, \"2017-01-15T01:30:15.01Z\" encodes 15.01 seconds past\n 01:30 UTC on January 15, 2017.\n\n In JavaScript, one can convert a Date object to this format using the\n standard\n [toISOString()](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Date/toISOString)\n method. In Python, a standard `datetime.datetime` object can be converted\n to this format using\n [`strftime`](https://docs.python.org/2/library/time.html#time.strftime) with\n the time format spec '%Y-%m-%dT%H:%M:%S.%fZ'. Likewise, in Java, one can use\n the Joda Time's [`ISODateTimeFormat.dateTime()`](\n http://joda-time.sourceforge.net/apidocs/org/joda/time/format/ISODateTimeFormat.html#dateTime()\n ) to obtain a formatter capable of generating timestamps in this format." format: date-time type: string gitpod.v1.UpdateSecretValueRequest: additionalProperties: false properties: secretId: format: uuid title: secret_id type: string value: description: value is the plaintext value of the secret maxLength: 10240 minLength: 1 title: value type: string title: UpdateSecretValueRequest type: object gitpod.v1.SecretScope: additionalProperties: false oneOf: - not: anyOf: - required: - projectId - required: - serviceAccountId - required: - userId required: - organizationId - not: anyOf: - required: - organizationId - required: - serviceAccountId - required: - userId required: - projectId - not: anyOf: - required: - organizationId - required: - projectId - required: - userId required: - serviceAccountId - not: anyOf: - required: - organizationId - required: - projectId - required: - serviceAccountId required: - userId properties: organizationId: description: organization_id is the Organization ID this Secret belongs to format: uuid title: organization_id type: string projectId: description: project_id is the Project ID this Secret belongs to format: uuid title: project_id type: string serviceAccountId: description: service_account_id is the Service Account ID this Secret belongs to format: uuid title: service_account_id type: string userId: description: user_id is the User ID this Secret belongs to format: uuid title: user_id type: string title: SecretScope type: object gitpod.v1.DeleteSecretRequest: additionalProperties: false properties: secretId: format: uuid title: secret_id type: string title: DeleteSecretRequest type: object securitySchemes: bearerAuth: bearerFormat: JWT scheme: bearer type: http x-tagGroups: - name: gitpod.v1 tags: - gitpod.v1.AccountService - gitpod.v1.AgentService - gitpod.v1.AgentSecurityService - gitpod.v1.BillingService - gitpod.v1.EditorService - gitpod.v1.EnvironmentAutomationService - gitpod.v1.EnvironmentService - gitpod.v1.ErrorsService - gitpod.v1.EventService - gitpod.v1.GatewayService - gitpod.v1.GroupService - gitpod.v1.IdentityService - gitpod.v1.InsightsService - gitpod.v1.IntegrationService - gitpod.v1.NotificationService - gitpod.v1.OnaIntelligenceService - gitpod.v1.OrganizationService - gitpod.v1.PrebuildService - gitpod.v1.ProjectService - gitpod.v1.RunnerConfigurationService - gitpod.v1.RunnerInteractionService - gitpod.v1.RunnerManagerService - gitpod.v1.RunnerService - gitpod.v1.SecretService - gitpod.v1.ServiceAccountService - gitpod.v1.SessionService - gitpod.v1.TeamService - gitpod.v1.UsageService - gitpod.v1.UserService - gitpod.v1.WebhookService - gitpod.v1.WorkflowService