# Update a secret

> Update a secret's value under the same id, touching no computer.

> Nevia is in beta and open to selected teams. Public launch in Dec 2026. The CLI installs with `curl -fsSL https://get.nevia.cloud | sh`, and the MCP server is at https://api.nevia.cloud/mcp. A person signs in once in the browser.
> Setup, sign-in and requesting access: [SKILL.md](https://nevia.cloud/SKILL.md). When Nevia fits and when it doesn't: [why.md](https://nevia.cloud/why.md).

> For the complete documentation index, see [llms.txt](https://nevia.cloud/llms.txt). This page's HTML version: https://nevia.cloud/docs/reference/api/secrets/updateSecret

`PATCH https://api.nevia.cloud/v1/secrets/{sec}`

## Authorization

- `bearerAuth`: HTTP bearer in the Authorization header

Send the token in the `Authorization: Bearer <token>` header. See [Authenticate](https://nevia.cloud/docs/reference/api.md#authenticate).

## Parameters

| Name | In | Type | Required | Description |
|---|---|---|---|---|
| `sec` | path | string | yes | Secret id: 27 lowercase letters and digits. Match `^[A-Za-z0-9_-]{1,64}$`. |
| `Idempotency-Key` | header | string | no | Optional retry key, kept 24 hours. Length `1 <= length <= 255`. |

## Request body

Content type: `application/json`, required

Schema: `SecretUpdateRequest`

New value for the secret. To rename, delete and create

| Field | Type | Required | Description |
|---|---|---|---|
| `value` | string | yes | New secret value, never returned. |

## Behavior

Each computer's next exec sees the new value. Running processes keep the old one. Rotations and deletes of one secret take turns.

## Example request

### cURL

```bash
curl -X PATCH "https://api.nevia.cloud/v1/secrets/01d4cnjqmc7d2pk9r4w6y8b0c3f" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "value": "<new secret value>"
  }'
```

### JavaScript

```js
const body = JSON.stringify({
  "value": "<new secret value>"
})

fetch("https://api.nevia.cloud/v1/secrets/01d4cnjqmc7d2pk9r4w6y8b0c3f", {
  method: "PATCH",
  headers: {
    "Content-Type": "application/json",
    "Authorization": `Bearer ${process.env.TOKEN}`
  },
  body
})
```

### Python

```python
import os
import requests

url = "https://api.nevia.cloud/v1/secrets/01d4cnjqmc7d2pk9r4w6y8b0c3f"
body = """{
  "value": "<new secret value>"
}"""
response = requests.request("PATCH", url, data = body, headers = {
  "Content-Type": "application/json", 
  "Authorization": f"Bearer {os.environ['TOKEN']}"
})

print(response.text)
```

## Responses

### 200

The secret's metadata. `operations` is empty.

Content type: `application/json`

Schema: `SecretResponse`

| Field | Type | Required | Description |
|---|---|---|---|
| `secret` | Secret | yes | Secret metadata, without its value. |
| `operations` | array<OperationId> | yes | Operations this request started. |

Example:

```json
{
  "secret": {
    "id": "01d4cnjqmc7d2pk9r4w6y8b0c3f",
    "workspace": "01d4cnjjq40hnnh0nwmkg35nv2h",
    "name": "DATABASE_PASSWORD",
    "created_by": "01d4cnjmn4fbb1r5btxb5mypv62",
    "updated_by": "01d4cnjmn4fbb1r5btxb5mypv62",
    "created_at": "2026-09-10T12:34:56Z",
    "updated_at": "2026-09-10T12:34:56Z",
    "deleted_at": "2026-09-10T12:34:56Z"
  },
  "operations": [
    "01d4cnjm89yk0r3xtv80dy0x7by"
  ]
}
```

### 400

`validation_failed`: malformed body, unknown field, or invalid id or name. Fix `details.field` and retry.

Content type: `application/json`

Schema: `ErrorEnvelope`

Body of every error response

| Field | Type | Required | Description |
|---|---|---|---|
| `error` | Error | yes |  |

Example `validation_failed`:

```json
{
  "error": {
    "code": "validation_failed",
    "message": "Unknown field `colour` in the request body. Remove it; request bodies are strict.",
    "details": {
      "field": "colour",
      "in": "body"
    },
    "request_id": "req_01j9k3m2p7q4r8s1"
  }
}
```

### 401

`unauthorized`: the credential is missing, malformed, expired, or revoked. Send a valid bearer token.

Content type: `application/json`

Schema: `ErrorEnvelope`

Body of every error response

| Field | Type | Required | Description |
|---|---|---|---|
| `error` | Error | yes |  |

Example `unauthorized`:

```json
{
  "error": {
    "code": "unauthorized",
    "message": "Missing credential. Send `Authorization: Bearer <token>` with an access token.",
    "details": {},
    "request_id": "req_01j9k3m2p7q4r8s1"
  }
}
```

### 403

`forbidden`: the token is read-only or scoped elsewhere, or the role cannot do this. Use a token or role that allows it.

Content type: `application/json`

Schema: `ErrorEnvelope`

Body of every error response

| Field | Type | Required | Description |
|---|---|---|---|
| `error` | Error | yes |  |

Example `forbidden`:

```json
{
  "error": {
    "code": "forbidden",
    "message": "You can view computer 01d4cnjk3xg90y576w8y6t4gdwm but your role does not allow computer#edit. Ask a workspace admin to change your role (PATCH /v1/workspaces/{ws}/access/{principal}).",
    "details": {
      "computer": "01d4cnjk3xg90y576w8y6t4gdwm",
      "permission": "computer#edit"
    },
    "request_id": "req_01j9k3m2p7q4r8s1"
  }
}
```

### 404

`not_found`: the secret does not exist, or you cannot see it. Both return the same response.

Content type: `application/json`

Schema: `ErrorEnvelope`

Body of every error response

| Field | Type | Required | Description |
|---|---|---|---|
| `error` | Error | yes |  |

Example `not_found`:

```json
{
  "error": {
    "code": "not_found",
    "message": "Secret 01d4cnjqmc7d2pk9r4w6y8b0c3f was not found. List the secrets you can access with GET /v1/secrets?workspace=<ws>.",
    "details": {
      "secret": "01d4cnjqmc7d2pk9r4w6y8b0c3f"
    },
    "request_id": "req_01j9k3m2p7q4r8s1"
  }
}
```

### 409

`idempotency_conflict`: the `Idempotency-Key` was already used with a different body.

Content type: `application/json`

Schema: `ErrorEnvelope`

Body of every error response

| Field | Type | Required | Description |
|---|---|---|---|
| `error` | Error | yes |  |

Example `idempotency_conflict`:

```json
{
  "error": {
    "code": "idempotency_conflict",
    "message": "Idempotency-Key 8f1c2a7e-3b4d-4c5e-9f0a-1b2c3d4e5f60 was already used for a different PATCH /v1/secrets/{sec} request. Use a new key for a new request.",
    "details": {
      "idempotency_key": "8f1c2a7e-3b4d-4c5e-9f0a-1b2c3d4e5f60"
    },
    "request_id": "req_01j9k3m2p7q4r8s1"
  }
}
```

### 422

`not_supported`: the platform has no secret store.

Content type: `application/json`

Schema: `ErrorEnvelope`

Body of every error response

| Field | Type | Required | Description |
|---|---|---|---|
| `error` | Error | yes |  |

Example `not_supported`:

```json
{
  "error": {
    "code": "not_supported",
    "message": "Secrets are not available on this platform, so secret 01d4cnjqmc7d2pk9r4w6y8b0c3f was not updated. Use a variable for values that are not sensitive.",
    "details": {
      "secret": "01d4cnjqmc7d2pk9r4w6y8b0c3f",
      "workspace": "01d4cnjjq40hnnh0nwmkg35nv2h"
    },
    "request_id": "req_01j9k3m2p7q4r8s1"
  }
}
```

### 429

`rate_limited`: slow down. Retry after `Retry-After`.

Content type: `application/json`

Schema: `ErrorEnvelope`

Body of every error response

| Field | Type | Required | Description |
|---|---|---|---|
| `error` | Error | yes |  |

Example `rate_limited`:

```json
{
  "error": {
    "code": "rate_limited",
    "message": "Too many requests. Retry after 2 seconds.",
    "details": {
      "retry_after_seconds": 2
    },
    "request_id": "req_01j9k3m2p7q4r8s1"
  }
}
```

### 500

`request_failed`, or the failed action's own code, such as `creation_failed`, `authorization_failed` or `command_execution_failed`. Quote `request_id` when reporting. The diagnostic stays in server logs.

Content type: `application/json`

Schema: `ErrorEnvelope`

Body of every error response

| Field | Type | Required | Description |
|---|---|---|---|
| `error` | Error | yes |  |

Example `request_failed`:

```json
{
  "error": {
    "code": "request_failed",
    "message": "request failed",
    "details": {},
    "request_id": "req_01j9k3m2p7q4r8s1"
  }
}
```

### 503

`creation_failed`: The action is temporarily unavailable, named by its code (`creation_failed`, `wake_failed`, ...). Wait at least `Retry-After` seconds (60 by default). `details.retryable` says whether repeating the request is safe. Keep the original `Idempotency-Key`. Signing in again does not help. `update_failed`: the secret store is unreachable. The value may still be the previous one, so retry the request, with a new `Idempotency-Key` if the value changed.

Content type: `application/json`

Schema: `ErrorEnvelope`

Body of every error response

| Field | Type | Required | Description |
|---|---|---|---|
| `error` | Error | yes |  |

Example `creation_failed`:

```json
{
  "error": {
    "code": "creation_failed",
    "message": "The computer could not be created. Try again later, and quote request_id if it persists.",
    "details": {
      "retryable": true
    },
    "request_id": "req_01j9k3m2p7q4r8s1"
  }
}
```

Example `update_failed`:

```json
{
  "error": {
    "code": "update_failed",
    "message": "Secret 01d4cnjqmc7d2pk9r4w6y8b0c3f may still have its previous value; send the request again.",
    "details": {
      "secret": "01d4cnjqmc7d2pk9r4w6y8b0c3f",
      "workspace": "01d4cnjjq40hnnh0nwmkg35nv2h",
      "retryable": true
    },
    "request_id": "req_01j9k3m2p7q4r8s1"
  }
}
```