Create or update an organization secret

PUT

/orgs/{org}/codespaces/secrets/{secret_name}

Creates or updates an organization secret with an encrypted value. Encrypt your secret using
LibSodium. You must authenticate using an access
token with the admin:org scope to use this endpoint.

Example encrypting a secret using Node.js

Encrypt your secret using the libsodium-wrappers library.

Example encrypting a secret using Python

Encrypt your secret using pynacl with Python 3.

from base64 import b64encode
from nacl import encoding, public

def encrypt(public_key: str, secret_value: str) -> str:
  """Encrypt a Unicode string using the public key."""
  public_key = public.PublicKey(public_key.encode("utf-8"), encoding.Base64Encoder())
  sealed_box = public.SealedBox(public_key)
  encrypted = sealed_box.encrypt(secret_value.encode("utf-8"))
  return b64encode(encrypted).decode("utf-8")

Example encrypting a secret using C#

Encrypt your secret using the Sodium.Core package.

var secretValue = System.Text.Encoding.UTF8.GetBytes("mySecret");
var publicKey = Convert.FromBase64String("2Sg8iYjAxxmI2LvUXpJjkYrMxURPc8r+dB7TJyvvcCU=");

var sealedPublicKeyBox = Sodium.SealedPublicKeyBox.Create(secretValue, publicKey);

Console.WriteLine(Convert.ToBase64String(sealedPublicKeyBox));

Example encrypting a secret using Ruby

Encrypt your secret using the rbnacl gem.

Request Example

Shell

JavaScript

Java

Swift

curl --location --request PUT 'https://api.github.com/orgs//codespaces/secrets/' \
--header 'Content-Type: application/json' \
--data-raw '{
    "encrypted_value": "c2VjcmV0",
    "key_id": "012345678912345678",
    "selected_repository_ids": [
        1296269,
        1296280
    ],
    "visibility": "selected"
}'

Response Example

201 - default

null

Request

Path Params

org

string

required

The organization name. The name is not case sensitive.

secret_name

string

required

The name of the secret.

Body Params application/json

encrypted_value

string

optional

The value for your secret, encrypted with LibSodium using the public key retrieved from the Get an organization public key endpoint.

Match pattern:

^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$

key_id

string

optional

The ID of the key you used to encrypt the secret.

selected_repository_ids

array[integer]

optional

An array of repository IDs that can access the organization secret. You can only provide a list of repository IDs when the visibility is set to selected. You can manage the list of selected repositories using the List selected repositories for an organization secret, Set selected repositories for an organization secret, and Remove selected repository from an organization secret endpoints.

visibility

enum<string>

required

Which type of organization repositories have access to the organization secret. selected means only the repositories specified by selected_repository_ids can access the secret.

Allowed values:

allprivateselected

Examples

Responses

🟢201Response when creating a secret

application/json

Body

object {0}

🟢204Response when updating a secret

🟠404404

🟠422422

Modified at 2023-08-15 02:59:24

Get an organization secret

List selected repositories for an organization secret

Create or update an organization secret

Example encrypting a secret using Node.js#

Example encrypting a secret using Python#

Example encrypting a secret using C##

Example encrypting a secret using Ruby#

Request

Responses

Example encrypting a secret using Node.js

Example encrypting a secret using Python

Example encrypting a secret using C#

Example encrypting a secret using Ruby