> ## Documentation Index > Fetch the complete documentation index at: https://docs.canary.effectiveai.app/llms.txt > Use this file to discover all available pages before exploring further. # Set an app secret > Set an app secret’s value and where it is injected, creating the secret or replacing both. An app secret is a value Effective adds to the app’s outbound HTTPS requests to the hosts you name, so the app’s code never holds it. The running app picks up the change on its next outbound request; no deployment is needed. Needs `build` permission on the app. Safe to retry. ## OpenAPI ````yaml /openapi.json put /apps/{appId}/secrets/{name} openapi: 3.0.3 info: title: Effective API version: 2.0.0 description: The public Effective REST API. Authenticate using an Effective API key. servers: - url: https://api.canary.effectiveai.app/api/v2 description: Canary security: - bearerAuth: [] paths: /apps/{appId}/secrets/{name}: put: tags: - Apps summary: Set an app secret description: >- Set an app secret’s value and where it is injected, creating the secret or replacing both. An app secret is a value Effective adds to the app’s outbound HTTPS requests to the hosts you name, so the app’s code never holds it. The running app picks up the change on its next outbound request; no deployment is needed. Needs `build` permission on the app. Safe to retry. operationId: setAppSecret parameters: - schema: type: string maxLength: 63 pattern: ^app-[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$ description: >- App ID: `app-` followed by lowercase letters, digits and hyphens, ending in a letter or digit. It is part of the app’s hostname, so your organization’s subdomain and the ID together must fit 63 characters. required: true description: >- App ID: `app-` followed by lowercase letters, digits and hyphens, ending in a letter or digit. It is part of the app’s hostname, so your organization’s subdomain and the ID together must fit 63 characters. name: appId in: path - schema: type: string maxLength: 100 pattern: ^[A-Za-z0-9][A-Za-z0-9_.-]*$ description: >- Secret name: letters, digits, `_`, `.` and `-`, starting with a letter or digit, at most 100 characters. required: true description: >- Secret name: letters, digits, `_`, `.` and `-`, starting with a letter or digit, at most 100 characters. name: name in: path requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/V2AppSecretSet' responses: '200': description: The secret, without its value. content: application/json: schema: $ref: '#/components/schemas/V2AppSecret' '400': description: Invalid request or cursor. content: application/json: schema: $ref: '#/components/schemas/V2CodedError' '401': description: Authentication required. content: application/json: schema: $ref: '#/components/schemas/V2CodedError' '403': description: >- You lack the permission this needs on the app, or are a read-only member. content: application/json: schema: $ref: '#/components/schemas/V2CodedError' '404': description: 'app_not_found: missing, archived, or not an app you can open.' content: application/json: schema: $ref: '#/components/schemas/V2CodedError' '413': description: JSON request body exceeds 64 KiB. content: application/json: schema: $ref: '#/components/schemas/V2CodedError' '415': description: Content-Type must be application/json. content: application/json: schema: $ref: '#/components/schemas/V2CodedError' '500': description: Unexpected server error. content: application/json: schema: $ref: '#/components/schemas/V2CodedError' '503': description: Temporarily unavailable; retry later. content: application/json: schema: $ref: '#/components/schemas/V2CodedError' security: - bearerAuth: [] components: schemas: V2AppSecretSet: type: object properties: value: type: string minLength: 1 maxLength: 16000 description: >- The secret value, up to 16,000 characters. It is encrypted and never returned. routes: type: array items: $ref: '#/components/schemas/V2AppSecretRoute' minItems: 1 maxItems: 50 description: >- Where the app’s outbound HTTPS requests get the value: requests to each host and port carry it in the header. required: - value - routes additionalProperties: false V2AppSecret: type: object properties: id: type: string description: Secret name, unique within the app. routes: type: array items: $ref: '#/components/schemas/V2AppSecretRouteView' description: Where the app’s outbound HTTPS requests carry the value. configured: type: boolean description: >- True when a value is set and injected. A secret declared in Effective without a value of its own is false until you set one. updatedAt: type: string format: date-time description: When the secret last changed. required: - id - routes - configured - updatedAt additionalProperties: false V2CodedError: allOf: - $ref: '#/components/schemas/V2Error' - type: object properties: code: type: string minLength: 1 description: Stable error code. Clients must tolerate unknown future codes. details: type: array items: type: object properties: location: type: string enum: - path - query - header - body path: type: array items: type: string maxLength: 64 maxItems: 12 code: type: string enum: - required - invalid_type - invalid_value - unknown_field message: type: string minLength: 1 maxLength: 200 required: - location - path - code - message minItems: 1 maxItems: 20 description: Bounded safe validation issues; may omit some invalid fields. requestId: type: string minLength: 1 maxLength: 128 description: >- Existing server correlation for this HTTP attempt, when available. dataset: type: string enum: - naic - osha description: Dataset needed for dataset_not_enabled. businessCode: type: string description: The rater’s own refusal code, for business_rejection. violations: type: array items: type: object properties: code: type: string description: Authored or built-in constraint code message: type: string description: Authored message for the failed constraint path: type: string description: Input path of the offending value; empty for the request value: nullable: true description: Offending input value, size-bounded by the runtime constraint: type: string description: The constraint the value failed, as text cite: type: string nullable: true description: >- Filing citation of the constraint, when the source cites one required: - code - message - path - value - constraint - cite additionalProperties: false maxItems: 256 description: >- Each input constraint the submission failed, for invalid_inputs and business_rejection. violationsTruncated: type: boolean description: >- True when the rater reported more violations than violations holds. executionId: type: string description: >- The recorded execution of a failed rating, for rater rating failures. accessUrl: type: string nullable: true format: uri description: >- Where to add the product to your account, for product_access_required. required: - code V2AppSecretRoute: type: object properties: host: type: string minLength: 1 maxLength: 253 pattern: ^[a-z0-9.-]+$ description: Hostname the app calls over HTTPS, such as `api.openai.com`. port: type: integer minimum: 1 maximum: 65535 default: 443 description: HTTPS port; defaults to 443. headerName: type: string minLength: 1 maxLength: 128 pattern: ^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$ default: Authorization description: Header that carries the value; defaults to `Authorization`. scheme: type: string nullable: true minLength: 1 maxLength: 128 pattern: ^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$ default: null description: >- For the `Authorization` header, the scheme before the value; null means `Bearer`. Ignored for other headers. valueTemplate: type: string nullable: true minLength: 1 maxLength: 256 default: null description: >- Header value with `{value}` where the secret goes, such as `Token token={value}`; overrides `scheme`. Null sends the value as `scheme` describes. required: - host additionalProperties: false V2AppSecretRouteView: type: object properties: host: type: string description: Hostname the app calls over HTTPS. port: type: integer description: HTTPS port. headerName: type: string description: Header that carries the value. scheme: type: string nullable: true description: >- For the `Authorization` header, the scheme before the value; null means `Bearer`. valueTemplate: type: string nullable: true description: Header value with `{value}` where the secret goes, or null. required: - host - port - headerName - scheme - valueTemplate additionalProperties: false V2Error: type: object properties: error: type: string minLength: 1 description: Human-readable explanation of the failure. required: - error securitySchemes: bearerAuth: type: http scheme: bearer description: 'Effective API key. Send Authorization: Bearer sk-eai-...' ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.