API
Environment variables
Read and change a Serverless App Service's environment variables.
Values are encrypted at rest; sensitive values are never returned. See Environment variables for targets and the names the platform reserves.
Every route below, with its parameters, request and response, errors and samples, is in the API reference.
| Route | What it does |
|---|---|
GET /v1/orgs/:orgId/projects/:projectId/env | Lists the Serverless App Service's variables, and shared: the organization's shared variables (a Serverless App Service variable with the same key replaces a shared one per environment). Values of sensitive variables are null. |
GET /v1/orgs/:orgId/projects/:projectId/env/values | One environment's variables as a deployment gets them (shared ones overridden by the Serverless App Service's), for local development (cactive env pull, cactive dev). Sensitive values are null, except development-only secrets marked devReadable when the caller has env:write (audited as env.reveal). |
POST /v1/orgs/:orgId/projects/:projectId/env | Creates or replaces many variables at once (e.g. a pasted .env file), all with the same environments and sensitivity. Nothing is written unless every key is valid. |
PUT /v1/orgs/:orgId/projects/:projectId/env/:key | Creates or replaces a variable. Omit value to keep the stored value, for example to change the targets of a sensitive variable. |
DELETE /v1/orgs/:orgId/projects/:projectId/env/:key | Deletes a variable. Running deployments keep the value they started with. |
GET /v1/orgs/:orgId/projects/:projectId/env/:key/value | Reads a value back (version: an earlier one). Sensitive values only as their access rule allows; audited. |
GET /v1/orgs/:orgId/projects/:projectId/env/:key/versions | The versions kept (when each was set and by whom), newest first. |
POST /v1/orgs/:orgId/projects/:projectId/env/:key/versions/:version/restore | Sets an earlier value again, as a new version. Takes effect on the next deployment. |
PUT /v1/orgs/:orgId/projects/:projectId/env/:key/settings | A rotation reminder and who may read the value back. |
GET /v1/orgs/:orgId/env | Lists the organization's shared variables. Sensitive values are null. |
POST /v1/orgs/:orgId/env | Creates or replaces many shared variables at once, all with the same environments and sensitivity. |
PUT /v1/orgs/:orgId/env/:key | Creates or replaces a shared variable. Omit value to keep the stored one. |
DELETE /v1/orgs/:orgId/env/:key | Deletes a shared variable. Serverless App Services' own variables with the same key are unaffected. |
GET /v1/orgs/:orgId/env/:key/value | Reads a value back (version: an earlier one). Sensitive values only as their access rule allows; audited. |
GET /v1/orgs/:orgId/env/:key/versions | The versions kept (when each was set and by whom), newest first. |
POST /v1/orgs/:orgId/env/:key/versions/:version/restore | Sets an earlier value again, as a new version. Takes effect on the next deployment. |
PUT /v1/orgs/:orgId/env/:key/settings | A rotation reminder and who may read the value back. |
GET /v1/orgs/:orgId/secrets | Every secret in the organization (shared ones and each Serverless App Service's sensitive variables): key, targets, current version, last change and by whom, rotation reminder and when it's due, and the access rule. Never values. Also limit, the plan's secretsMax. Needs env:read. |