Secrets — API Reference

Package: dodil.ignite.v1 · Service: SecretService

CRUD over named, Vault-backed credential slots (a git PAT or a registry login), scoped per organization and referenced by name from builds and deploys. All four RPCs are unary.

HTTP examples use staging (https://api.dev.dodil.io) and send camelCase JSON; gRPC examples use $IGNITE_GRPC and proto snake_case (see Conventions). Every call needs Authorization: Bearer $DODIL_TOKEN.

The SecretValue shape

A slot holds exactly one credential, modeled as a oneof — set git_secret or registry_secret, never both.

GitSecret

RegistrySecret

SecretMetadata (returned by every RPC that reports a slot)

CreateSecret

POST /v1/ignite/secrets — create a slot, or overwrite an existing one with the same name (this is how you rotate). Returns metadata only.

Request

curl -X POST https://api.dev.dodil.io/v1/ignite/secrets \
  -H "Authorization: Bearer $DODIL_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "ghcr-pull",
    "value": {
      "registrySecret": {
        "username": "acme-bot",
        "password": "ghp_xxx",
        "serverAddress": "ghcr.io"
      }
    }
  }'

grpcurl -H "Authorization: Bearer $DODIL_TOKEN" \
  -d '{
    "name": "ghcr-pull",
    "value": {
      "registry_secret": {
        "username": "acme-bot",
        "password": "ghp_xxx",
        "server_address": "ghcr.io"
      }
    }
  }' \
  $IGNITE_GRPC dodil.ignite.v1.SecretService/CreateSecret

Response

CreateSecretResponse — metadata (SecretMetadata).

GetSecret

GET /v1/ignite/secrets/{name} — read a slot including its value.

Slots are not write-only: this returns the stored token/password in cleartext to the owning org. Treat the GetSecret scope as access to the credential itself — see How Secrets Work.

curl https://api.dev.dodil.io/v1/ignite/secrets/ghcr-pull \
  -H "Authorization: Bearer $DODIL_TOKEN"

grpcurl -H "Authorization: Bearer $DODIL_TOKEN" \
  -d '{"name": "ghcr-pull"}' \
  $IGNITE_GRPC dodil.ignite.v1.SecretService/GetSecret

Response

GetSecretResponse — name (string), value (SecretValue — the real credential), metadata (SecretMetadata).

ListSecrets

GET /v1/ignite/secrets — list every slot in the org. Metadata only — values are never returned here.

curl https://api.dev.dodil.io/v1/ignite/secrets \
  -H "Authorization: Bearer $DODIL_TOKEN"

grpcurl -H "Authorization: Bearer $DODIL_TOKEN" \
  $IGNITE_GRPC dodil.ignite.v1.SecretService/ListSecrets

Response

ListSecretsResponse — secrets (repeated SecretMetadata).

DeleteSecret

DELETE /v1/ignite/secrets/{name} — remove a slot. Idempotent: deleting a name that doesn’t exist is not an error.

curl -X DELETE https://api.dev.dodil.io/v1/ignite/secrets/ghcr-pull \
  -H "Authorization: Bearer $DODIL_TOKEN"

grpcurl -H "Authorization: Bearer $DODIL_TOKEN" \
  -d '{"name": "ghcr-pull"}' \
  $IGNITE_GRPC dodil.ignite.v1.SecretService/DeleteSecret

Response

DeleteSecretResponse — deleted (bool): true if a slot was removed, false if none existed.

See also

• Secrets — overview and CLI cheat-sheet
• How Secrets Work — slots, rotation, reference fields
• Bring Your Own Image · Build from Git
• Conventions — transport, auth, wire format