aip_sdk.WorkspaceSecret

aip_sdk.WorkspaceSecret(data: dict[str, Any], client: APIClient)

A named, encrypted credential owned by a workspace.

Anyone who can see the workspace can read a secret's name and description; changing or revealing one needs workspace-admin rights. The value is never carried on this object — reveal() fetches it on demand.

Attributes

• id str: Secret ID.
• name str: Secret name, unique within its workspace. This is the environment variable an op reads it from.
• description str | None: What the secret is for, or None.
• workspace_id str: Workspace that owns the secret.
• created_at datetime | None: When the secret was created.
• updated_at datetime | None: When the secret was last changed.

aip_sdk.WorkspaceSecret.created_at

aip_sdk.WorkspaceSecret.created_at: datetime | None = parse_dt(data['created_at'])

No docstring is defined in the source.

aip_sdk.WorkspaceSecret.delete

aip_sdk.WorkspaceSecret.delete() -> None

Delete this secret.

The value is gone afterwards; there is no undo, and a run that expects this name fails to start until a secret with that name exists again.

Raises

• SecretNotFoundError: If the secret no longer exists.
• ForbiddenError: If you are not an admin of this workspace.
• AuthError: If credentials are missing or invalid.
• APIError: If the deletion otherwise fails.

aip_sdk.WorkspaceSecret.description

aip_sdk.WorkspaceSecret.description: str | None = data.get('description')

No docstring is defined in the source.

aip_sdk.WorkspaceSecret.id

aip_sdk.WorkspaceSecret.id: str = data['id']

No docstring is defined in the source.

aip_sdk.WorkspaceSecret.name

aip_sdk.WorkspaceSecret.name: str = data['name']

No docstring is defined in the source.

aip_sdk.WorkspaceSecret.reveal

aip_sdk.WorkspaceSecret.reveal() -> str

Return this secret's value.

The only call that returns a stored value, and it needs workspace-admin rights. Ops never use it: an op collects the values a run picked for it on its own, as part of being called. Reach for this to check what was stored against the system that issued it, or to recover a value you hold nowhere else.

Returns

• str str: the stored value.

Raises

• SecretNotFoundError: If the secret no longer exists.
• ForbiddenError: If you are not an admin of this workspace, or revealing values is turned off for this deployment.
• UnprocessableEntityError: If the platform cannot decrypt the stored value.
• AuthError: If credentials are missing or invalid.
• APIError: If the request otherwise fails.

Example:

secret = aip.get_secret("OPENAI_API_KEY", workspace_id="ws-abc123")
client = OpenAI(api_key=secret.reveal())

aip_sdk.WorkspaceSecret.update

aip_sdk.WorkspaceSecret.update(*, name: str | None = None, value: str | None = None, description: str | None = None, clear_description: bool = False) -> WorkspaceSecret

Rename this secret, rotate its value, or change its description.

Only what you pass changes. Passing value replaces the stored credential; the previous one is discarded and the next call an op makes uses the new one, with nothing to publish or restart.

Parameters

• name str | None: New name, unique within the workspace. Ops reading the old name stop finding it, so rename before an op declares it rather than after.
• value str | None: New value, encrypted by the platform before storage.
• description str | None: New description.
• clear_description bool: Remove the description. Cannot be combined with description.

Returns

• WorkspaceSecret WorkspaceSecret: this secret with its new fields.

Raises

• InvalidArgumentError: If description and clear_description are both given.
• SecretNotFoundError: If the secret no longer exists.
• DuplicateSecretError: If name is already used in this workspace.
• ForbiddenError: If you are not an admin of this workspace.
• UnprocessableEntityError: If the name or value is rejected, or the platform has no encryption key configured.
• AuthError: If credentials are missing or invalid.
• APIError: If the update otherwise fails.

Example:

secret = aip.get_secret("OPENAI_API_KEY", workspace_id="ws-abc123")
secret.update(value=new_key)

aip_sdk.WorkspaceSecret.updated_at

aip_sdk.WorkspaceSecret.updated_at: datetime | None = parse_dt(data['updated_at'])

No docstring is defined in the source.

aip_sdk.WorkspaceSecret.workspace_id

aip_sdk.WorkspaceSecret.workspace_id: str = data['workspace_id']

No docstring is defined in the source.