create_secret_reference
Create a reference to an external secret from AWS Secrets Manager, Azure Key Vault, or HashiCorp Vault, returning a UUID and slug without exposing the secret value.
Instructions
Create a reference to a secret stored in AWS Secrets Manager, Azure Key Vault, or HashiCorp Vault. Authentication credentials are sent to Portkey and exposed to this MCP transcript; use short-lived or workload identity modes when possible. Returns the new UUID and slug, never the resolved external secret.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Human-readable name | |
| slug | No | Optional stable slug containing only letters, numbers, underscores, or hyphens; Portkey generates one when omitted | |
| tags | No | Optional string key-value tags for filtering and organization | |
| secret_key | No | Optional key within a structured external secret; null uses the whole secret value | |
| auth_config | Yes | Choose exactly one documented authentication shape matching manager_type. Credentials are sent to Portkey and visible in the MCP transcript; prefer workload identity or short-lived credentials when available. | |
| description | No | Optional description; use null to leave it empty | |
| secret_path | Yes | Path of the secret in the external secret manager | |
| manager_type | Yes | External secret manager: aws_sm for AWS Secrets Manager, azure_kv for Azure Key Vault, or hashicorp_vault for HashiCorp Vault; must match the auth_config field family | |
| organisation_id | No | Organisation UUID; required when the MCP server is not authenticated with a Portkey API key | |
| allowed_workspaces | No | Workspace UUIDs or slugs allowed to use this reference; omit when allow_all_workspaces is true | |
| allow_all_workspaces | No | Whether every workspace may use this reference; defaults to true and cannot be true with allowed_workspaces |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| ok | Yes | Whether the tool call succeeded and returned structured data | |
| data | No | Structured success payload when ok is true | |
| error | No | Structured error payload when ok is false |