Create secret API Reference

POST

/tenants/{tenant}/secrets

curl --request POST \
  --url https://api.kupe.cloud/api/v1/tenants/acme/secrets \
  --header 'Authorization: <Authorization>' \
  --header 'Content-Type: application/json' \
  --data '{ "name": "database-creds", "secretPath": "services/database/credentials", "sync": [ { "cluster": "production", "namespace": "app", "secretName": "db-credentials" } ] }'

Create a new managed secret. The secretPath points to a key in the tenant’s vault (OpenBao KV v2). Optionally configure sync targets to automatically replicate the secret into Kubernetes namespaces across your managed clusters.

Authorizations

• BearerAuth

Parameters

Path Parameters

tenant

required

string

Tenant name

Request Body

Secret configuration

Media type application/json

object

name

Secret name (DNS-safe, 2-63 characters)

string

Example

database-creds

secretPath

Path in the tenant’s vault (OpenBao KV v2)

string

Example

services/database/credentials

sync

Optional sync targets to replicate the secret into clusters

Array<object>

object

cluster

Target cluster name

string

Example

production

namespace

Target namespace within the cluster

string

Example

app

secretName

Override the Kubernetes secret name (defaults to the managed secret name)

string

Example

db-credentials

Responses

201

Secret created

Media type application/json

object

createdAt

string

name

string

resourceVersion

string

secretPath

string

status

object

conditions

Array<object>

object

key

additional properties

phase

string

syncStatuses

Array<object>

object

key

additional properties

sync

Array<object>

object

cluster

string

namespace

string

secretName

string

Example

{
  "createdAt": "2026-03-10T09:15:00Z",
  "name": "database-creds",
  "resourceVersion": "582019",
  "secretPath": "services/database/credentials",
  "status": {
    "phase": "Synced"
  },
  "sync": [
    {
      "cluster": "production",
      "namespace": "app",
      "secretName": "db-credentials"
    }
  ]
}

Headers

ETag

string

Resource version

400

Validation error

Media type application/json

object

code

string

error

string

field

string

message

string

severity

string

Example ^generated

{
  "code": "example",
  "error": "example",
  "field": "example",
  "message": "example",
  "severity": "example"
}

401

Missing or invalid authentication

Media type application/json

object

code

string

error

string

field

string

message

string

severity

string

Example ^generated

{
  "code": "example",
  "error": "example",
  "field": "example",
  "message": "example",
  "severity": "example"
}

403

Admin access required

Media type application/json

object

code

string

error

string

field

string

message

string

severity

string

Example ^generated

{
  "code": "example",
  "error": "example",
  "field": "example",
  "message": "example",
  "severity": "example"
}

409

Secret name already exists

Media type application/json

object

code

string

error

string

field

string

message

string

severity

string

Example ^generated

{
  "code": "example",
  "error": "example",
  "field": "example",
  "message": "example",
  "severity": "example"
}

429

Rate limit exceeded

Media type application/json

object

code

string

error

string

field

string

message

string

severity

string

Example ^generated

{
  "code": "example",
  "error": "example",
  "field": "example",
  "message": "example",
  "severity": "example"
}