Secrets

A RestoreTrust secret is metadata that points to a secret already present in the worker's Kubernetes environment. The API stores the reference, not the credential value.

Service types

Use s3, ftp, sftp, or smb for source credentials. Schedules can also reference:

• archive_password for a password-protected ZIP backup
• age_identity for age identity-file decryption
• age_passphrase for age passphrase decryption

local_secret_name must be a valid lowercase Kubernetes object name and cannot refer to the worker identity secret.

Lifecycle constraints

Secret values are never returned. You can update name, description, local_secret_name, or set status to active or paused. The service type is immutable.

A secret cannot be paused or deleted while a source or schedule references it. List filters support name, service_type, and status.

Endpoint reference

• Create secret metadata
• List secrets
• Get secret metadata
• Update secret metadata
• Delete secret metadata

Required scopes are v1.secrets:read, v1.secrets:write, and v1.secrets:delete.