API Reference
Security and Secrets API
API surface for SOIT security policy, secret references, and governed access.
Security and secrets APIs manage the policy and secret-reference surfaces that protect external access.
Prefixes
/api/v1/security
/api/v1/secretsSecurity endpoints
| Method | Path | Purpose |
|---|---|---|
| GET / PUT | /egress/tenant, /egress/workspace | Read and set egress policy per scope |
| GET | /egress/audits | Egress policy decision audit log |
| GET / PUT | /limits/tenant, /limits/workspace | Usage/rate limit policy per scope |
Secrets endpoints
| Method | Path | Purpose |
|---|---|---|
| GET / POST | / | List and create secret references |
| GET / PATCH / DELETE | /{secret_id} | Inspect, update, or remove a reference |
| POST | /{secret_id}/test | Verify the reference resolves |
Notes
- Secrets are references (
vault | kms | localprovider + path) — the API never returns plaintext values. - Egress is deny-by-default; policy checks run at the gateway and their outcomes are auditable via
/egress/auditsand the run audit log. See Secrets and Security. - New in v1.4.0: a target on a private or loopback address also needs its network in the deployment's
EGRESS_PRIVATE_NETWORKS. See Private networks.