update_secret_reference
DestructiveIdempotent
Update a Secret Reference by modifying its name, tags, authentication configuration, workspace access, or other metadata. Changes are merged into the existing configuration.
Instructions
Update at least one selected field on a Secret Reference. auth_config is merged into the existing manager-specific configuration. allowed_workspaces replaces all workspace mappings and sets allow_all_workspaces=false; allow_all_workspaces=true removes workspace-specific mappings. Credential values are sent to Portkey and exposed to the MCP transcript.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Secret Reference UUID or slug | |
| name | No | New human-readable name | |
| tags | No | Replacement string key-value tags, or null to clear them | |
| secret_key | No | New key within a structured secret, or null to use the whole value | |
| auth_config | No | Provide at least one changed authentication field to merge into the existing configuration; choose one AWS, Azure, or HashiCorp field family and do not mix families | |
| description | No | New description, or null to clear it | |
| secret_path | No | New path of the secret in the external secret manager | |
| allowed_workspaces | No | Replacement list of workspace UUIDs or slugs allowed to use this reference; supplying it sets allow_all_workspaces=false | |
| allow_all_workspaces | No | Whether every workspace may use this reference; cannot be true with allowed_workspaces |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| ok | Yes | Whether the tool call succeeded and returned structured data | |
| data | No | Structured success payload when ok is true | |
| error | No | Structured error payload when ok is false |