# Secrets

| Method | Path | Purpose |
|---|---|---|
| GET | `/secrets` | Secret names |
| PATCH | `/secrets/:key` | Set a secret with `{ "value": "..." }` |
| DELETE | `/secrets/:key` | Remove a secret |

Values are write-only: reading lists keys, never contents.

Each call takes an optional `environment` (a query parameter, or a body field
on PATCH): `preview` or `live`. Without it, the value everywhere; with it, the
value only that environment uses instead. Listing without it returns every
secret, preview's own included; with it, what that environment can read: the
value everywhere, the test value and its own. Each comes with its
`environment` (`null` for the value everywhere) and `tests` (`true` for a test
value).

Keys use uppercase letters, digits and underscores, starting with a letter.
Keys starting with `VATIO_`, and `DISPATCHER`, are reserved for Vatio.