# Actions Secrets

Secrets are encrypted values available to workflows via the `secrets` context. You can **write and delete** secrets via the API but **never read their values**.

## Repository Secrets

### List Secrets

```
GET /repos/{owner}/{repo}/actions/secrets
```

Returns secret metadata (name, created_at, updated_at) but **never** the secret value.

```bash
curl -s -H "Authorization: token ${FORGEJO_PAT}" \
  "${FORGEJO_URL}/api/v1/repos/{owner}/{repo}/actions/secrets"
```

### Create or Update Secret

```
PUT /repos/{owner}/{repo}/actions/secrets/{secretname}
```

```bash
curl -s -X PUT \
  -H "Authorization: token ${FORGEJO_PAT}" \
  -H "Content-Type: application/json" \
  -d '{"data": "{secret_value}"}' \
  "${FORGEJO_URL}/api/v1/repos/{owner}/{repo}/actions/secrets/{secret_name}"
```

### Delete Secret

```
DELETE /repos/{owner}/{repo}/actions/secrets/{secretname}
```

```bash
curl -s -X DELETE \
  -H "Authorization: token ${FORGEJO_PAT}" \
  "${FORGEJO_URL}/api/v1/repos/{owner}/{repo}/actions/secrets/{secret_name}"
```

## Organization Secrets

### List Org Secrets

```
GET /orgs/{org}/actions/secrets
```

```bash
curl -s -H "Authorization: token ${FORGEJO_PAT}" \
  "${FORGEJO_URL}/api/v1/orgs/{org}/actions/secrets"
```

### Create or Update Org Secret

```
PUT /orgs/{org}/actions/secrets/{secretname}
```

```bash
curl -s -X PUT \
  -H "Authorization: token ${FORGEJO_PAT}" \
  -H "Content-Type: application/json" \
  -d '{"data": "{secret_value}"}' \
  "${FORGEJO_URL}/api/v1/orgs/{org}/actions/secrets/{secret_name}"
```

### Delete Org Secret

```
DELETE /orgs/{org}/actions/secrets/{secretname}
```

```bash
curl -s -X DELETE \
  -H "Authorization: token ${FORGEJO_PAT}" \
  "${FORGEJO_URL}/api/v1/orgs/{org}/actions/secrets/{secret_name}"
```

## User Secrets

### Create or Update User Secret

```
PUT /user/actions/secrets/{secretname}
```

```bash
curl -s -X PUT \
  -H "Authorization: token ${FORGEJO_PAT}" \
  -H "Content-Type: application/json" \
  -d '{"data": "{secret_value}"}' \
  "${FORGEJO_URL}/api/v1/user/actions/secrets/{secret_name}"
```

### Delete User Secret

```
DELETE /user/actions/secrets/{secretname}
```

```bash
curl -s -X DELETE \
  -H "Authorization: token ${FORGEJO_PAT}" \
  "${FORGEJO_URL}/api/v1/user/actions/secrets/{secret_name}"
```

## Request Body

```json
{
  "data": "{secret_value}"
}
```

| Field | Type | Description |
|-------|------|-------------|
| `data` | string | The secret value (required) |

## Important Notes

- Secret values are **write-only** — the API never returns the actual value
- List endpoints return metadata only: name, created_at, updated_at
- PUT is idempotent — it creates the secret if it doesn't exist, or updates it if it does
- Secrets are available in workflows via `${{ secrets.SECRET_NAME }}`
- Secret names are case-insensitive and typically use `UPPER_SNAKE_CASE`
