Add a secret store

Enterprise. Add an AWS Secrets Manager or HashiCorp Vault (KV version 2) store to the environment. Anlyon authenticates to it first, without reading any secret (STS GetCallerIdentity, or Vault auth/token/lookup-self); if that fails nothing is saved and the request answers SECRET_STORE_CHECK_FAILED. The credential is encrypted and never returned. Requests to the store go through the same address checks as action dispatch, so a store on a private address is refused, unless a workspace admin allowed it in the secret store settings on a self-hosted edition.

POST/api/v2/secret-stores

Authorization

AuthorizationBearer token (Anlyon API key) · headerrequired

Workspace API key sent as Authorization: Bearer <key>.

better-auth.session_tokenAPI key · cookierequired

Browser session used by dashboard-only operations.

Header parameters

X-Request-Idstring

Optional caller correlation ID. Unsafe or oversized values are replaced.

max length 128

Request body

requiredapplication/json

One of:

object

namestringrequired

matches ^[a-z0-9][a-z0-9-]{0,62}$

typestringrequired

Allowed:aws_secrets_manager

descriptionstring

max length 500

configAwsSecretStoreConfigrequired

Show properties

regionstringrequired

matches ^[a-z]{2}(-[a-z]+)+-\d{1,2}$

authstringrequired

access_key signs with the stored keys. assume_role uses them to assume roleArn first.

Allowed:access_keyassume_role

roleArnstring | null

externalIdstring | null

min length 2 · max length 1224

credentialAwsSecretStoreCredentialrequired

Show properties

accessKeyIdstringrequired

matches ^[A-Z0-9]{16,128}$

secretAccessKeystringrequired

min length 16 · max length 256

allowedPathsstring[] | null

min items 1 · max items 20

cacheTtlSecondsinteger

min 0 · max 300 · default: 30

object

namestringrequired

matches ^[a-z0-9][a-z0-9-]{0,62}$

typestringrequired

Allowed:hashicorp_vault

descriptionstring

max length 500

configVaultSecretStoreConfigrequired

Show properties

addressstring<uri>required

The Vault origin alone

max length 512

namespacestring | null

Vault Enterprise namespace.

mountstring

The KV version 2 mount.

default: "secret"

authstringrequired

Allowed:tokenapprole

authMountstring | null

The AppRole auth mount. Default approle.

credentialVaultSecretStoreCredentialrequired

Show properties

One of:

object

tokenstringrequired

min length 8 · max length 4096

object

roleIdstringrequired

min length 1 · max length 256

secretIdstringrequired

min length 1 · max length 4096

allowedPathsstring[] | null

min items 1 · max items 20

cacheTtlSecondsinteger

min 0 · max 300 · default: 30

Responses

201

Secret store settings and health returned; the credential is never exposed.

successbooleanrequired

Allowed:true

dataSecretStorerequired

A secret store's settings and health. Its credential is never exposed by any API.

Show properties

idstringrequired

namestringrequired

typestringrequired

Allowed:aws_secrets_managerhashicorp_vault

descriptionstring | nullrequired

configAwsSecretStoreConfig | VaultSecretStoreConfigrequired

Show properties

One of:

AwsSecretStoreConfig

regionstringrequired

matches ^[a-z]{2}(-[a-z]+)+-\d{1,2}$

authstringrequired

access_key signs with the stored keys. assume_role uses them to assume roleArn first.

Allowed:access_keyassume_role

roleArnstring | null

externalIdstring | null

min length 2 · max length 1224

VaultSecretStoreConfig

addressstring<uri>required

The Vault origin alone

max length 512

namespacestring | null

Vault Enterprise namespace.

mountstring

The KV version 2 mount.

default: "secret"

authstringrequired

Allowed:tokenapprole

authMountstring | null

The AppRole auth mount. Default approle.

credentialKindstringrequired

Which kind of credential is stored. The credential itself is never returned.

Allowed:access_keytokenapprole

allowedPathsstring[] | nullrequired

Path prefixes a secret may point at. Null means any path the credential can read.

cacheTtlSecondsintegerrequired

How long a value read from the store is kept in the API process's memory, never on disk or in a shared cache. 0 reads the store at every dispatch.

min 0 · max 300

healthobject | nullrequired

Show properties

statusstringrequired

Allowed:activeunreachable

checkedAtstring<date-time>required

reasonstring | nullrequired

Allowed:store_unreachablestore_deniedreference_not_foundnull

createdAtstring<date-time>required

updatedAtstring<date-time>required

202

Accepted, not applied: the change loosens a guardrail, so a workspace admin has to approve it. Location is the request to poll.

successbooleanrequired

Allowed:true

signOffRequiredbooleanrequired

Allowed:true

dataSignOffRequestrequired

A governance change that loosens a guardrail, asked for by an API key, a CLI login or an MCP session, waiting for a workspace admin. Give signOffUrl to a person; poll pollUrl.

Show properties

objectstringrequired

Allowed:sign_off_request

idstringrequired

statusstringrequired

pending until a workspace admin decides. applied: approved and in effect. rejected, expired (after 24 hours), cancelled (withdrawn by the credential) and failed (approved but could not be applied, see error): nothing changed.

Allowed:pendingappliedrejectedexpiredcancelledfailed

operationstringrequired

Allowed:policy.createpolicy.updatepolicy.deletepolicy_file.applyimpact_limit.updateimpact_limit.archivebudget.putbudget.deleteenvironment.resumeaction.createaction.updateaction.importsecret.putsecret_store.createsecret_store.updatesecret_store_settings.updateoauth_app.put

environmentIdstring<uuid>required

resourceobject | nullrequired

Show properties

typestringrequired

idstringrequired

namestring

summarystringrequired

changesSignOffChange[]required

Show properties

Array of SignOffChange

fieldstringrequired

fromany | nullrequired

The value before. Never a secret value.

toany | nullrequired

The value after. Never a secret value.

directionstringrequired

Allowed:tighteninglooseningneutral

reasonstringrequired

diffstringrequired

The changes as plain text

signOffUrlstring<uri>required

The console page where a workspace admin approves or rejects it. Give this to a person.

pollUrlstringrequired

pollAfterSecondsintegerrequired

requestedByobjectrequired

Show properties

typestringrequired

Allowed:api_keyoauth_clientsystem

idstring | nullrequired

onBehalfOfstring | null

For a CLI login or an MCP session

createdAtstring<date-time>required

expiresAtstring<date-time>required

decidedAtstring<date-time> | nullrequired

decidedByobject | nullrequired

Show properties

typestringrequired

Allowed:user

idstringrequired

viastringrequired

Allowed:consoleemail_link

decisionNotestring | nullrequired

resultany | nullrequired

When applied, what the original request would have returned: the limit, budget, policy or action as it now is.

errorobject | nullrequired

Show properties

codestringrequired

messagestringrequired

400

Bad Request - Invalid input data

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

fixErrorFix

How to get past this error, for a person or an agent. Present on refusals with a known next step, such as a missing scope or role, a plan or billing limit, a halted environment, or a missing secret, connected account, OAuth app or end-user header. Absent when there is no fix to give. Kept in production responses, unlike details.

Show properties

summarystringrequired

One sentence that says what to do.

commandstring

An exact anlyon CLI command that fixes it. Absent when no command does.

urlstring<uri>

An absolute console link where a person fixes it.

docsstring<uri>

A docs page that explains it.

401

Unauthorized - Invalid or missing API key

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

fixErrorFix

Show properties

summarystringrequired

One sentence that says what to do.

commandstring

An exact anlyon CLI command that fixes it. Absent when no command does.

urlstring<uri>

An absolute console link where a person fixes it.

docsstring<uri>

A docs page that explains it.

403

Authenticated credential lacks the required scope or workspace access.

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

fixErrorFix

Show properties

summarystringrequired

One sentence that says what to do.

commandstring

An exact anlyon CLI command that fixes it. Absent when no command does.

urlstring<uri>

An absolute console link where a person fixes it.

docsstring<uri>

A docs page that explains it.

404

Not Found - Resource does not exist

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

fixErrorFix

Show properties

summarystringrequired

One sentence that says what to do.

commandstring

An exact anlyon CLI command that fixes it. Absent when no command does.

urlstring<uri>

An absolute console link where a person fixes it.

docsstring<uri>

A docs page that explains it.

422

The store refused the credential (SECRET_STORE_CHECK_FAILED). Nothing was saved.

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

fixErrorFix

Show properties

summarystringrequired

One sentence that says what to do.

commandstring

An exact anlyon CLI command that fixes it. Absent when no command does.

urlstring<uri>

An absolute console link where a person fixes it.

docsstring<uri>

A docs page that explains it.

429

Too Many Requests - Rate limit exceeded. A workspace's API requests are limited per minute and per UTC clock hour by plan; Retry-After says when to try again, and an hourly refusal names the limit and when the count resets. Successful responses carry the same limits in X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset (the minute) and X-RateLimit-Limit-Hour, X-RateLimit-Remaining-Hour, X-RateLimit-Reset-Hour (the hour).

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

fixErrorFix

Show properties

summarystringrequired

One sentence that says what to do.

commandstring

An exact anlyon CLI command that fixes it. Absent when no command does.

urlstring<uri>

An absolute console link where a person fixes it.

docsstring<uri>

A docs page that explains it.

502

The store did not answer (SECRET_STORE_CHECK_FAILED). Nothing was saved.

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

fixErrorFix

Show properties

summarystringrequired

One sentence that says what to do.

commandstring

An exact anlyon CLI command that fixes it. Absent when no command does.

urlstring<uri>

An absolute console link where a person fixes it.

docsstring<uri>

A docs page that explains it.

Try it

Server

Base URLCustom base URLOverrides the selected server when set.

Authorization

Bearer token (Anlyon API key)Remember on this deviceInclude my values in samples

Parameters

X-Request-IdheaderOptional caller correlation ID. Unsafe or oversized values are replaced.

Bodyapplication/json

Request body

Request

curl -X POST 'https://api.anlyon.com/api/v2/secret-stores' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{
  "name": "string",
  "type": "aws_secrets_manager",
  "description": "string",
  "config": {
    "region": "eu-west-1",
    "auth": "access_key",
    "roleArn": "arn:aws:iam::123456789012:role/anlyon-secrets-reader",
    "externalId": "string"
  },
  "credential": {
    "accessKeyId": "EXAMPLEACCESSKEYID00",
    "secretAccessKey": "stringstringstri"
  },
  "allowedPaths": [
    "string"
  ],
  "cacheTtlSeconds": 30
}'

const response = await fetch("https://api.anlyon.com/api/v2/secret-stores", {
  method: "POST",
  headers: {
    "Authorization": "Bearer YOUR_TOKEN",
    "Content-Type": "application/json"
  },
  body: "{\n  \"name\": \"string\",\n  \"type\": \"aws_secrets_manager\",\n  \"description\": \"string\",\n  \"config\": {\n    \"region\": \"eu-west-1\",\n    \"auth\": \"access_key\",\n    \"roleArn\": \"arn:aws:iam::123456789012:role/anlyon-secrets-reader\",\n    \"externalId\": \"string\"\n  },\n  \"credential\": {\n    \"accessKeyId\": \"EXAMPLEACCESSKEYID00\",\n    \"secretAccessKey\": \"stringstringstri\"\n  },\n  \"allowedPaths\": [\n    \"string\"\n  ],\n  \"cacheTtlSeconds\": 30\n}"
});

import requests

response = requests.post(
    "https://api.anlyon.com/api/v2/secret-stores",
    headers={
        "Authorization": "Bearer YOUR_TOKEN",
        "Content-Type": "application/json"
    },
    data="{\n  \"name\": \"string\",\n  \"type\": \"aws_secrets_manager\",\n  \"description\": \"string\",\n  \"config\": {\n    \"region\": \"eu-west-1\",\n    \"auth\": \"access_key\",\n    \"roleArn\": \"arn:aws:iam::123456789012:role/anlyon-secrets-reader\",\n    \"externalId\": \"string\"\n  },\n  \"credential\": {\n    \"accessKeyId\": \"EXAMPLEACCESSKEYID00\",\n    \"secretAccessKey\": \"stringstringstri\"\n  },\n  \"allowedPaths\": [\n    \"string\"\n  ],\n  \"cacheTtlSeconds\": 30\n}",
)

Response

{
  "success": true,
  "data": {
    "id": "sst_01JABCDEF",
    "name": "prod-vault",
    "type": "aws_secrets_manager",
    "description": "string",
    "config": {
      "region": "eu-west-1",
      "auth": "access_key",
      "roleArn": "arn:aws:iam::123456789012:role/anlyon-secrets-reader",
      "externalId": "string"
    },
    "credentialKind": "access_key",
    "allowedPaths": [
      "string"
    ],
    "cacheTtlSeconds": 0,
    "health": {
      "status": "active",
      "checkedAt": "2019-08-24T14:15:22Z",
      "reason": "store_unreachable"
    },
    "createdAt": "2019-08-24T14:15:22Z",
    "updatedAt": "2019-08-24T14:15:22Z"
  }
}

{
  "success": true,
  "signOffRequired": true,
  "data": {
    "object": "sign_off_request",
    "id": "sor_V1StGXR8Z5jdHi6BmyT9q",
    "status": "pending",
    "operation": "impact_limit.update",
    "environmentId": "19f5cc2e-7657-437a-9268-83cd3d563563",
    "resource": {
      "type": "impact_limit",
      "id": "lim_01JABCDEF",
      "name": "Daily refunds"
    },
    "summary": "Raise impact limit \"Daily refunds\" from 500 to 5000 usd",
    "changes": [
      {
        "field": "amount",
        "from": 500,
        "to": 5000,
        "direction": "loosening",
        "reason": "Raises the limit."
      }
    ],
    "diff": "amount (loosens): Raises the limit.\n- 500\n+ 5000",
    "signOffUrl": "https://console.anlyon.com/sign-offs/sor_V1StGXR8Z5jdHi6BmyT9q",
    "pollUrl": "/api/v2/sign-offs/sor_V1StGXR8Z5jdHi6BmyT9q",
    "pollAfterSeconds": 5,
    "requestedBy": {
      "type": "api_key",
      "id": "string",
      "onBehalfOf": "string"
    },
    "createdAt": "2019-08-24T14:15:22Z",
    "expiresAt": "2019-08-24T14:15:22Z",
    "decidedAt": "2019-08-24T14:15:22Z",
    "decidedBy": {
      "type": "user",
      "id": "string",
      "via": "console"
    },
    "decisionNote": "string",
    "result": null,
    "error": {
      "code": "SIGN_OFF_STALE",
      "message": "string"
    }
  }
}

{
  "success": false,
  "error": {
    "code": "VALIDATION_ERROR",
    "message": "Invalid request data",
    "details": {
      "url": "Invalid URL format"
    }
  }
}

{
  "success": false,
  "error": {
    "code": "AUTHENTICATION_ERROR",
    "message": "Invalid or missing API key"
  }
}

{
  "success": false,
  "requestId": "req_0123456789abcdef0123456789abcdef",
  "error": {
    "code": "VALIDATION_ERROR",
    "message": "Invalid request data",
    "details": {},
    "fix": {
      "summary": "Log in again and approve the anlyon:secrets consent group, which grants secrets:write.",
      "command": "anlyon auth login --scope anlyon:secrets",
      "url": "https://console.anlyon.com/settings/api-keys",
      "docs": "https://docs.anlyon.com/cli/authentication"
    }
  }
}

{
  "success": false,
  "error": {
    "code": "NOT_FOUND",
    "message": "Resource not found"
  }
}

{
  "success": false,
  "requestId": "req_0123456789abcdef0123456789abcdef",
  "error": {
    "code": "VALIDATION_ERROR",
    "message": "Invalid request data",
    "details": {},
    "fix": {
      "summary": "Log in again and approve the anlyon:secrets consent group, which grants secrets:write.",
      "command": "anlyon auth login --scope anlyon:secrets",
      "url": "https://console.anlyon.com/settings/api-keys",
      "docs": "https://docs.anlyon.com/cli/authentication"
    }
  }
}

{
  "success": false,
  "error": {
    "code": "RATE_LIMIT_EXCEEDED",
    "message": "Rate limit exceeded. Please try again later."
  }
}

{
  "success": false,
  "requestId": "req_0123456789abcdef0123456789abcdef",
  "error": {
    "code": "VALIDATION_ERROR",
    "message": "Invalid request data",
    "details": {},
    "fix": {
      "summary": "Log in again and approve the anlyon:secrets consent group, which grants secrets:write.",
      "command": "anlyon auth login --scope anlyon:secrets",
      "url": "https://console.anlyon.com/settings/api-keys",
      "docs": "https://docs.anlyon.com/cli/authentication"
    }
  }
}