> ## Documentation Index
> Fetch the complete documentation index at: https://docs.encrata.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Workflow Secrets

> Manage encrypted secrets available to workflow webhook steps.

## Authentication

Requires a JWT token or API key in the `Authorization` header.

```bash theme={"dark"}
Authorization: Bearer YOUR_TOKEN
```

## List Secrets

```bash theme={"dark"}
GET /api/workflows/secrets
```

Returns secret names only values are never exposed.

### Example response

```json theme={"dark"}
{
  "secrets": [
    { "name": "SLACK_WEBHOOK_URL", "created_at": "2026-05-01T10:00:00Z" },
    { "name": "CRM_API_KEY", "created_at": "2026-05-15T08:00:00Z" }
  ]
}
```

***

## Create Secret

```bash theme={"dark"}
POST /api/workflows/secrets
```

<ParamField body="name" type="string" required>
  Secret name. Use in step configs as `{{secrets.SLACK_WEBHOOK_URL}}`.
</ParamField>

<ParamField body="value" type="string" required>
  Secret value. Encrypted at rest cannot be retrieved after creation.
</ParamField>

### Example request

```bash theme={"dark"}
curl -X POST "https://encrata.com/api/workflows/secrets" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "name": "SLACK_WEBHOOK_URL", "value": "https://hooks.slack.com/services/..." }'
```

### Example response

```json theme={"dark"}
{
  "success": true,
  "name": "SLACK_WEBHOOK_URL"
}
```

***

## Delete Secret

```bash theme={"dark"}
DELETE /api/workflows/secrets
```

<ParamField body="name" type="string" required>
  Secret name to delete.
</ParamField>

### Example request

```bash theme={"dark"}
curl -X DELETE "https://encrata.com/api/workflows/secrets" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "name": "SLACK_WEBHOOK_URL" }'
```

### Example response

```json theme={"dark"}
{
  "success": true,
  "message": "Secret deleted"
}
```

***

## Usage in Steps

Reference secrets in webhook step configs using the `{{secrets.NAME}}` syntax:

```json theme={"dark"}
{
  "id": "notify",
  "type": "webhook",
  "config": {
    "url": "{{secrets.SLACK_WEBHOOK_URL}}",
    "method": "POST",
    "headers": {
      "Authorization": "Bearer {{secrets.CRM_API_KEY}}"
    }
  }
}
```