Write an Agent's secret
Creates or replaces one credential of the Agent's vault: an environment_secret (the variable name reads the sentinel nylorun_managed in the sandbox, and egress-gate sets the value as a header on requests to allowedHosts), an environment_variable (a plain variable), or a bearer token or headers map for the MCP servers and HTTP tools at url. The same name and type re-seals the value and binding; another type replaces it. A rotated value is used from the next request. A second credential for a host or a URL is 409 credential_conflict. When the Agent's manifest declares secret slots (while it moves to another version, that version's), send only the value ({ value }, or { headers } for a headers slot): the type and binding come from the slot, and a name it does not declare is 409 secret_not_in_manifest.
AuthorizationBearer <token>An application key of the Tenant (PUT /v1/tenant/keys/{keyId}), or Studio's key, derived from the admin key. With Nylorun-Subject and Nylorun-Scopes, it acts for that person, narrowed to those scopes. Never accepted from a browser (Origin).
agentId*stringThe Agent id, percent-encoded: users%2Falice%2Ftriage for users/alice/triage
name*stringThe secret's name: the variable for environment_secret and environment_variable, a label for bearer and headers
Nylorun-Protocol*stringThe protocol version, 18
Nylorun-Subject?stringThe person an application key acts for
Nylorun-Scopes?stringThe subject's space-separated scopes; required with a subject
application/json- body
requestId?string1 <= lengthtype*"environment_secret""environment_secret"value*string1 <= lengthallowedHosts*array<string>1 <= itemsinject?The secret, without its value
application/json- response
name*stringtype*string"bearer""headers""workload""environment_secret""environment_variable"binding*headerNames?array<string>via?stringtoolPrefix?stringidentity?createdAt*stringrotatedAt?stringimport { createClient } from "@nylorun/agents";const client = await createClient();// The Agent's manifest declares the slot "linear": its type, URL and binding.await client.agents.secrets.put("users/alice/assistant", "linear", { value: process.env.LINEAR_TOKEN!,});{ "name": "string", "type": "bearer", "binding": { "url": "string", "allowedHosts": [ "string" ], "inject": { "header": "string", "format": "string" } }, "headerNames": [ "string" ], "via": "string", "toolPrefix": "string", "identity": { "header": "string" }, "createdAt": "string", "rotatedAt": "string"}