Skip to main content

SetGuardrailProviderSecret

POST 
/v1/customers/:customer_id/projects/:project_id/guardrails/providers/:id/secret

SetGuardrailProviderSecret stores the credential a provider authenticates to its backing service with. This is the ONLY way a credential enters the system: it is never accepted in GuardrailProvider.config.

Write-only. The value is encrypted at rest, the provider row keeps only a reference to it, and no read path -- List, Get, or the data-plane configuration -- ever returns it. GuardrailProvider.has_api_key is all a reader learns.

Calling it again ROTATES: the stored credential is replaced in place and the provider keeps its id, its configuration and every rule bound to it. There is no un-set; deleting the provider's project destroys the stored credential.

The operation is audit-logged. The audit entry records who set a credential on which provider, never the value.

Returns NOT_FOUND when no such provider is visible in the requested scope, and PERMISSION_DENIED for a global row or a catalog template (both are read-only; a template is copied into an instance before it is used).

Request​

Responses​

Success