Create (201) or rotate (200, version++) a secret.

PUT

/v0/projects/{id}/functions/secrets/{name}

curl --request PUT \
  --url https://infra-hyphae.run/v0/projects/example/functions/secrets/example \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "value": "example" }'

• The hosted deployment (CloudFront terminates TLS; cloudd behind it).
• Local cloudd (loopback), plain HTTP.

The value (UTF-8, ≤ 4 KiB, no NUL) is encrypted at rest in the control store with cloudd’s process key (CLOUDD_SECRETS_KEY; XChaCha20-Poly1305, bound to project and name) and injected as NAME=value into the environment of every subsequent invoke of this project’s functions — for owner and project-key invokes alike. Running workers are not touched; the next invoke sees the new set. Owner session only. Receipted with the name; the value appears in no receipt, log, or response. PROJECT_ID, FUNCTION_NAME, and CLOUD_ORIGIN cannot be shadowed.

Authorizations

• sessionToken

Parameters

Path Parameters

id

required

string

/^prj_[0-9a-f]{16}$/

name

required

string

/^[A-Z][A-Z0-9_]{0,63}$/

Request Body^required

Media typeapplication/json

object

value

required

UTF-8, no NUL. Never returned.

string

<= 4096 characters

Example^generated

{
  "value": "example"
}

Responses

200

Rotated.

Media typeapplication/json

There is deliberately no value field.

object

project

required

string

/^prj_[0-9a-f]{16}$/

name

required

string

/^[A-Z][A-Z0-9_]{0,63}$/

version

required

integer

created_at

required

RFC 3339, UTC.

string format: date-time

updated_at

required

RFC 3339, UTC.

string format: date-time

Example^generated

{
  "project": "example",
  "name": "example",
  "version": 1,
  "created_at": "2026-04-15T12:00:00Z",
  "updated_at": "2026-04-15T12:00:00Z"
}

201

Created.

Media typeapplication/json

There is deliberately no value field.

object

project

required

string

/^prj_[0-9a-f]{16}$/

name

required

string

/^[A-Z][A-Z0-9_]{0,63}$/

version

required

integer

created_at

required

RFC 3339, UTC.

string format: date-time

updated_at

required

RFC 3339, UTC.

string format: date-time

Example^generated

{
  "project": "example",
  "name": "example",
  "version": 1,
  "created_at": "2026-04-15T12:00:00Z",
  "updated_at": "2026-04-15T12:00:00Z"
}

400

Malformed or out-of-bounds input (invalid_request).

Media typeapplication/json

object

error

required

object

code

required

string

Allowed values: invalid_request authentication_required authorization_denied not_found conflict payload_too_large not_implemented tenant_not_running tenant_running function_runtime_missing function_timeout function_bad_output function_busy orchestrator_unavailable upstream_unavailable internal

message

required

string

Example

{
  "error": {
    "code": "invalid_request"
  }
}

401

Missing, malformed, duplicate, or unknown credential (authentication_required).

Media typeapplication/json

object

error

required

object

code

required

string

Allowed values: invalid_request authentication_required authorization_denied not_found conflict payload_too_large not_implemented tenant_not_running tenant_running function_runtime_missing function_timeout function_bad_output function_busy orchestrator_unavailable upstream_unavailable internal

message

required

string

Example

{
  "error": {
    "code": "invalid_request"
  }
}

Headers

WWW-Authenticate

string

Allowed value: Bearer realm="hyphae-cloud"

404

Unknown route, or a project the caller does not own (not_found).

Media typeapplication/json

object

error

required

object

code

required

string

Allowed values: invalid_request authentication_required authorization_denied not_found conflict payload_too_large not_implemented tenant_not_running tenant_running function_runtime_missing function_timeout function_bad_output function_busy orchestrator_unavailable upstream_unavailable internal

message

required

string

Example

{
  "error": {
    "code": "invalid_request"
  }
}