Secrets
The first battery that runs the other way: the other three are things your app does, a secret is something its owner decides. They write, your app reads. Declare the names in saasie.yaml; the values are set by a person and never returned to one.
Every call below goes to the address in your
SAASIE_ANALYTICS_URL
environment variable, with
Authorization: Bearer <token>. Read both from
the environment — they are injected, and hardcoding either is how
an app breaks when the platform moves.
See getting the credential.
GET
/v1/secrets
What this app may read, and whether it is set
Names and status, never values. This is the call to make at boot: a secret that is declared and unset is an app that will fail later, and this is the cheapest place to find out.
200 — Every declared secret
| Field | Type | |
|---|---|---|
secrets* |
object[] | — |
When it does not work
401 | Missing or invalid service token |
403 | The Saasie is stopped |
GET
/v1/secrets/{name}
Read a secret
Fetch it at boot and keep it in memory. The platform does not push a change, so an app that must survive a rotation should refetch on an authentication failure, or poll the list route and compare version — which costs nothing and never moves the value.
200 — The value
| Field | Type | |
|---|---|---|
name* |
string | — |
value* |
string | — |
version* |
number | — |
setAt* |
number | — |
When it does not work
400 | Not a secret name |
401 | Missing or invalid service token |
403 | The Saasie is stopped |
404 | This blueprint does not declare that secret |
409 | Declared, but nobody has set it yet |
501 | This deployment has no secrets battery |
POST
/v1/secrets/{name}/link
A link for whoever holds the credential
Grants exactly one thing: setting this secret, on this Saasie, once, before it expires. It cannot read the current value — not through this token and not through any other — so an app can ask a user for a credential it never sees itself. Send the URL by whatever channel you already have with that person.
200 — The link and when it dies
| Field | Type | |
|---|---|---|
url* |
string | Send this to whoever holds the credential. It sets this one secret on this one Saasie, once, and cannot read the current value. |
name* |
string | — |
expiresAt* |
number | — |
When it does not work
400 | Not a secret name |
401 | Missing or invalid service token |
403 | The Saasie is stopped |
404 | This blueprint does not declare that secret |
429 | Too many links are outstanding |
Generated from
openapi.json, which the
service renders from its own routes. * marks
a required field. Every error body is
{ "error": { "code", "message", "details"? } }.