Update a tool set secret

JavaScript

import Cadenya from '@cadenya/cadenya';

const client = new Cadenya({
  apiKey: process.env['CADENYA_API_KEY'], // This is the default and can be omitted
});

const toolSetSecret = await client.toolSets.secrets.update(
  'toolset_01HXKD2E5NQM3T9AYWCFNRMN74',
  'toolsecret_01HXKD2E5NQM3T9AYWCF8PWC4R',
  { workspaceId: 'workspace_01HXKD2E5NQM3T9AYWCF133E3Q' },
);

console.log(toolSetSecret.metadata);

import os
from cadenya import Cadenya

client = Cadenya(
    api_key=os.environ.get("CADENYA_API_KEY"),  # This is the default and can be omitted
)
tool_set_secret = client.tool_sets.secrets.update(
    tool_set_id="toolset_01HXKD2E5NQM3T9AYWCFNRMN74",
    id="toolsecret_01HXKD2E5NQM3T9AYWCF8PWC4R",
    workspace_id="workspace_01HXKD2E5NQM3T9AYWCF133E3Q",
)
print(tool_set_secret.metadata)

package main

import (
	"context"
	"fmt"
	"go.cadenya.com/cadenya-go"
	"go.cadenya.com/cadenya-go/option"
)

func main() {
	client := cadenya.NewClient(
		option.WithAPIKey("My API Key"),
	)
	toolSetSecret, err := client.ToolSets.Secrets.Update(
		context.TODO(),
		"toolset_01HXKD2E5NQM3T9AYWCFNRMN74",
		"toolsecret_01HXKD2E5NQM3T9AYWCF8PWC4R",
		cadenya.ToolSetSecretUpdateParams{
			WorkspaceID: cadenya.String("workspace_01HXKD2E5NQM3T9AYWCF133E3Q"),
		},
	)
	if err != nil {
		panic(err.Error())
	}
	fmt.Printf("%+v\n", toolSetSecret.Metadata)
}

require "cadenya"

cadenya = Cadenya::Client.new(api_key: "My API Key")

tool_set_secret = cadenya.tool_sets.secrets.update(
  "toolset_01HXKD2E5NQM3T9AYWCFNRMN74",
  "toolsecret_01HXKD2E5NQM3T9AYWCF8PWC4R",
  workspace_id: "workspace_01HXKD2E5NQM3T9AYWCF133E3Q"
)

puts(tool_set_secret)

cadenya tool-sets:secrets update \
  --api-key 'My API Key' \
  --workspace-id workspace_01HXKD2E5NQM3T9AYWCF133E3Q \
  --tool-set-id toolset_01HXKD2E5NQM3T9AYWCFNRMN74 \
  --id toolsecret_01HXKD2E5NQM3T9AYWCF8PWC4R

curl --request PATCH \
  --url https://api.cadenya.com/v1/workspaces/{workspaceId}/tool_sets/{toolSetId}/secrets/{id} \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "spec": {
    "value": "<string>"
  },
  "updateMask": "<string>"
}
'

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.cadenya.com/v1/workspaces/{workspaceId}/tool_sets/{toolSetId}/secrets/{id}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "PATCH",
  CURLOPT_POSTFIELDS => json_encode([
    'spec' => [
        'value' => '<string>'
    ],
    'updateMask' => '<string>'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

HttpResponse<String> response = Unirest.patch("https://api.cadenya.com/v1/workspaces/{workspaceId}/tool_sets/{toolSetId}/secrets/{id}")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"spec\": {\n    \"value\": \"<string>\"\n  },\n  \"updateMask\": \"<string>\"\n}")
  .asString();

{
  "metadata": {
    "id": "<string>",
    "accountId": "account_01HXKD2E5NQM3T9AYWCFTJHJVF",
    "workspaceId": "workspace_01HXKD2E5NQM3T9AYWCF133E3Q",
    "name": "<string>",
    "profileId": "profile_01HXKD2E5NQM3T9AYWCFS0AP08",
    "createdAt": "2023-11-07T05:31:56Z",
    "externalId": "<string>",
    "labels": {},
    "updatedAt": "2023-11-07T05:31:56Z"
  },
  "spec": {
    "value": "<string>"
  },
  "info": {
    "lastUsedAt": "2023-11-07T05:31:56Z",
    "createdBy": {
      "metadata": {
        "id": "<string>",
        "accountId": "account_01HXKD2E5NQM3T9AYWCFTJHJVF",
        "name": "<string>",
        "profileId": "profile_01HXKD2E5NQM3T9AYWCFS0AP08",
        "externalId": "<string>",
        "labels": {},
        "createdAt": "2023-11-07T05:31:56Z"
      },
      "spec": {
        "email": "<string>",
        "name": "<string>"
      }
    }
  }
}

{
  "code": 123,
  "message": "<string>",
  "details": [
    {
      "@type": "<string>"
    }
  ]
}

PATCH

workspaces

{workspaceId}

tool_sets

{toolSetId}

secrets

{id}

JavaScript

import Cadenya from '@cadenya/cadenya';

const client = new Cadenya({
  apiKey: process.env['CADENYA_API_KEY'], // This is the default and can be omitted
});

const toolSetSecret = await client.toolSets.secrets.update(
  'toolset_01HXKD2E5NQM3T9AYWCFNRMN74',
  'toolsecret_01HXKD2E5NQM3T9AYWCF8PWC4R',
  { workspaceId: 'workspace_01HXKD2E5NQM3T9AYWCF133E3Q' },
);

console.log(toolSetSecret.metadata);

import os
from cadenya import Cadenya

client = Cadenya(
    api_key=os.environ.get("CADENYA_API_KEY"),  # This is the default and can be omitted
)
tool_set_secret = client.tool_sets.secrets.update(
    tool_set_id="toolset_01HXKD2E5NQM3T9AYWCFNRMN74",
    id="toolsecret_01HXKD2E5NQM3T9AYWCF8PWC4R",
    workspace_id="workspace_01HXKD2E5NQM3T9AYWCF133E3Q",
)
print(tool_set_secret.metadata)

package main

import (
	"context"
	"fmt"
	"go.cadenya.com/cadenya-go"
	"go.cadenya.com/cadenya-go/option"
)

func main() {
	client := cadenya.NewClient(
		option.WithAPIKey("My API Key"),
	)
	toolSetSecret, err := client.ToolSets.Secrets.Update(
		context.TODO(),
		"toolset_01HXKD2E5NQM3T9AYWCFNRMN74",
		"toolsecret_01HXKD2E5NQM3T9AYWCF8PWC4R",
		cadenya.ToolSetSecretUpdateParams{
			WorkspaceID: cadenya.String("workspace_01HXKD2E5NQM3T9AYWCF133E3Q"),
		},
	)
	if err != nil {
		panic(err.Error())
	}
	fmt.Printf("%+v\n", toolSetSecret.Metadata)
}

require "cadenya"

cadenya = Cadenya::Client.new(api_key: "My API Key")

tool_set_secret = cadenya.tool_sets.secrets.update(
  "toolset_01HXKD2E5NQM3T9AYWCFNRMN74",
  "toolsecret_01HXKD2E5NQM3T9AYWCF8PWC4R",
  workspace_id: "workspace_01HXKD2E5NQM3T9AYWCF133E3Q"
)

puts(tool_set_secret)

cadenya tool-sets:secrets update \
  --api-key 'My API Key' \
  --workspace-id workspace_01HXKD2E5NQM3T9AYWCF133E3Q \
  --tool-set-id toolset_01HXKD2E5NQM3T9AYWCFNRMN74 \
  --id toolsecret_01HXKD2E5NQM3T9AYWCF8PWC4R

curl --request PATCH \
  --url https://api.cadenya.com/v1/workspaces/{workspaceId}/tool_sets/{toolSetId}/secrets/{id} \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "spec": {
    "value": "<string>"
  },
  "updateMask": "<string>"
}
'

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.cadenya.com/v1/workspaces/{workspaceId}/tool_sets/{toolSetId}/secrets/{id}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "PATCH",
  CURLOPT_POSTFIELDS => json_encode([
    'spec' => [
        'value' => '<string>'
    ],
    'updateMask' => '<string>'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

HttpResponse<String> response = Unirest.patch("https://api.cadenya.com/v1/workspaces/{workspaceId}/tool_sets/{toolSetId}/secrets/{id}")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"spec\": {\n    \"value\": \"<string>\"\n  },\n  \"updateMask\": \"<string>\"\n}")
  .asString();

{
  "metadata": {
    "id": "<string>",
    "accountId": "account_01HXKD2E5NQM3T9AYWCFTJHJVF",
    "workspaceId": "workspace_01HXKD2E5NQM3T9AYWCF133E3Q",
    "name": "<string>",
    "profileId": "profile_01HXKD2E5NQM3T9AYWCFS0AP08",
    "createdAt": "2023-11-07T05:31:56Z",
    "externalId": "<string>",
    "labels": {},
    "updatedAt": "2023-11-07T05:31:56Z"
  },
  "spec": {
    "value": "<string>"
  },
  "info": {
    "lastUsedAt": "2023-11-07T05:31:56Z",
    "createdBy": {
      "metadata": {
        "id": "<string>",
        "accountId": "account_01HXKD2E5NQM3T9AYWCFTJHJVF",
        "name": "<string>",
        "profileId": "profile_01HXKD2E5NQM3T9AYWCFS0AP08",
        "externalId": "<string>",
        "labels": {},
        "createdAt": "2023-11-07T05:31:56Z"
      },
      "spec": {
        "email": "<string>",
        "name": "<string>"
      }
    }
  }
}

{
  "code": 123,
  "message": "<string>",
  "details": [
    {
      "@type": "<string>"
    }
  ]
}

Rotate a tool set secret without changing where it is referenced. Every tool in this set that names ${THIS_SECRET} picks up the new value at the next call.

await client.toolSets.secrets.update(toolSetId, secretId, {
  workspaceId,
  spec: { value: process.env.NEW_TOKEN! },
});

_, err := client.ToolSets.Secrets.Update(ctx, toolSetID, secretID,
	cadenya.ToolSetSecretUpdateParams{
		WorkspaceID: cadenya.String(workspaceID),
		Spec: cadenya.ToolSetSecretSpecParam{
			Value: os.Getenv("NEW_TOKEN"),
		},
	})

cadenya.tool_sets.secrets.update(
  secret_id,
  tool_set_id: tool_set_id,
  workspace_id: workspace_id,
  spec: {value: ENV.fetch("NEW_TOKEN")}
)

curl -X PATCH "https://api.cadenya.com/v1/workspaces/${WORKSPACE_ID}/tool_sets/${TOOL_SET_ID}/secrets/${SECRET_ID}" \
  -H "Authorization: Bearer ${CADENYA_API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{ "spec": { "value": "'"${NEW_TOKEN}"'" } }'

The new value takes effect at once, and the old one stops resolving. Like every secret, spec.value is write-only: you cannot read it back to confirm the rotation, so verify by watching a tool call that uses it succeed, or check resolvedSecrets on the tool call. A non-empty value lands through a plain merge; updateMask is not needed to rotate. Send metadata.name to rename. Rotating a tool set secret changes only this tool set’s copy. It does not touch a workspace secret of the same name, which other tool sets still resolve.

Get a tool set secret

Confirm it exists after rotating.

Update a workspace secret

Rotate the workspace-wide equivalent.

Store and use secrets

Scopes and rotation.

Authorizations

Authorization

string

header

required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Path Parameters

workspaceId

string

required

The workspace that owns the tool set.

Example:

"workspace_01HXKD2E5NQM3T9AYWCF133E3Q"

toolSetId

string

required

The tool set the secret belongs to. Accepts the canonical ts_… form or the external_id: form.

Example:

"toolset_01HXKD2E5NQM3T9AYWCFNRMN74"

string

required

The secret to update.

Example:

"toolsecret_01HXKD2E5NQM3T9AYWCF8PWC4R"

Body

application/json

metadata

object

UpdateResourceMetadata contains the user-provided fields for updating a workspace-scoped resource. Read-only fields (id, account_id, workspace_id, profile_id, created_at) are excluded since they are set by the server.

Show child attributes

spec

object

Show child attributes

updateMask

string<field-mask>

Fields to update.

Response

metadata

object

required

Standard metadata for persistent, named resources (e.g., agents, tools, prompts)

Show child attributes

spec

object

required

Show child attributes

info

object

Tool set secret information

Show child attributes

​Related

Get a tool set secret

Update a workspace secret

Store and use secrets

Authorizations

Path Parameters

Body

Response

Related