Update a secret
update_secretDestructiveIdempotent
Update an existing CI/CD secret by modifying only the supplied fields; pass a new value to rotate it, and replace events or image restrictions with the complete list.
Instructions
Changes a secret. Only the fields you pass are touched — but "events" and "images" are replaced wholesale, not merged, so pass the complete list. Passing "value" rotates the secret.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Secret name, stored case-sensitively — MY_TOKEN and my_token are two secrets. | |
| note | No | Free-text note shown next to the secret in the web UI. | |
| scope | Yes | Which level to act on. "repository" needs repo_id, "organization" needs org_id, and "global" is instance-wide and needs neither (admin only). A pipeline sees the repository level first, then the organization, then global. | |
| value | No | New value. Omit it to leave the value alone. | |
| events | No | Replaces the event list entirely. Pass every event that should apply. | |
| images | No | Restrict the secret to these container images. An empty list — the default — means every image may read it. | |
| org_id | No | Required when scope is "organization". | |
| repo_id | No | Required when scope is "repository". | |
| confirm_token | No | Required when passing "value", when adding a pull_request event, or when clearing "images"; narrowing the exposure and changing the note apply on the first call. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| truncated | No | Present only when the answer was shortened to fit the budget. |