Skip to main content
POST
Create

Authorizations

Authorization
string
header
required

API key from your incident.io dashboard (Settings → API keys)

Body

application/json
name
string
required

Human-readable name, unique within the organisation amongst unarchived secrets

Example:

"PagerDuty webhook token"

value
string
required

The secret's plaintext value. It's stored encrypted and never returned by the API.

Example:

"sk_live_abc123"

description
string

Optional description of what this secret is for

Example:

"Auth token for the PagerDuty outgoing webhook"

owning_team_ids
string[]

IDs of the teams that own this secret. When empty or omitted, the secret is owned by the whole organisation.

Example:

Response

201 - application/json

Created response.

secret
object
required

A secret is a named credential that workflows can reference, for example an auth token for an outgoing webhook.

Its value can be set and rotated but never read back: the API stores it encrypted and only ever returns masked metadata (the last four characters of the current value). Update the value with the rotate action, which appends a new version and retires the previous one.