Menu
Platform
AI
App store purchases
Credits
Database
Flags
Generated Assets
Monitoring
Notifications
Organizations
Payments
- Payments
- Payments quickstart
- Checkout policies
- Checkout sessions
- Customer subscriptions
- Entitlement grants
- Exchange rates
- Licence keys
- Licence tokens
- Merchant accounts
- Portal sessions
- Price catalogs
- Revenue
- Revenue facts
- Revenue sources
- Tax threshold statuses
- Usage events
- Usage invoices
- Usage meter prices
- Usage meters
- Usage reservations
- Usage settings
- Usage tiers
Sandboxes
Webhooks
Getting Started
Authentication
KV Store
Deploy & Infrastructure
Reference
sylphx secrets profiles
Every sylphx secrets profiles command: its argument, its flags and a run line.
The profiles commands of Sylphx Secrets, as the CLI spells them: the same
calls as the profiles API page, typed for the
shell. Install, sign in and the grammar are on the CLI index.
#get
Gets a profile: its kind, grants, sites and latest version; never a value.
NAME — the resource's name; a bare id is enough below the linked
project.
CLI
sylphx secrets profiles get orgs/acme/projects/shop/envs/production/profiles/profileGET https://api.sylphx.com/v1/orgs/acme/projects/shop/envs/production/profiles/profile · scope secrets:read · effect read · Request, response and examples
#list
Lists the profiles of an environment.
PARENT — optional: the CLI fills it from the linked project or the
key's scope when it is left out.
CLI
sylphx secrets profiles list orgs/acme/projects/shop/envs/productionGET https://api.sylphx.com/v1/orgs/acme/projects/shop/envs/production/profiles · scope secrets:read · effect read · Request, response and examples
Flags
| Flag | Type | What it does |
|---|---|---|
--page-size | int | At most this many; default 50, clamped to 1000. |
--page-token | string | next_page_token of the previous page. |
--filter | string | AIP-160 filter over labels and filterable fields. |
--order-by | string | AIP-132 ordering over filterable fields. |
#create
Creates an empty profile; its first version is written by a write-back mount (:open with WRITE_BACK, then :commit).
ID — The id segment of the new Resource's name; the server assigns one when omitted.
CLI
sylphx secrets profiles create --parent orgs/acme/projects/shop/envs/production --spec.kind browserPOST https://api.sylphx.com/v1/orgs/acme/projects/shop/envs/production/profiles · scope secrets:write · effect write · Request, response and examples
Flags
| Flag | Type | What it does |
|---|---|---|
--parent | string | The parent to create in; defaults to the linked project or the key's scope. |
--meta.labels | key=value | Caller-writable, indexed labels (AIP-122 label rules). Repeat the flag for each value. |
--meta.annotations | key=value | Caller-writable, unindexed annotations. Repeat the flag for each value. |
--meta.display-name | string | Caller-writable human-readable name. |
--spec.kind | enum | What the profile holds. Required. One of browser, computer. |
--spec.grants | json | Who may mount it and how. A principal with no grant cannot mount it, whatever its scopes. Repeat the flag for each value. |
--spec.paths | string | For a computer profile: the paths under the sandbox's home directory its archive holds, for example .config/app. Repeat the flag for each value. |
--dry-run | bool | Validate and print the result without writing (validate_only). |
#update
Updates a profile's grants or declared paths. Granting a mount is this call: nothing else adds a grant.
NAME — the resource's name; a bare id is enough below the linked
project.
CLI
sylphx secrets profiles update orgs/acme/projects/shop/envs/production/profiles/profilePATCH https://api.sylphx.com/v1/orgs/acme/projects/shop/envs/production/profiles/profile · scope secrets:write · effect write · Request, response and examples
Flags
| Flag | Type | What it does |
|---|---|---|
--meta.labels | key=value | Caller-writable, indexed labels (AIP-122 label rules). Repeat the flag for each value. |
--meta.annotations | key=value | Caller-writable, unindexed annotations. Repeat the flag for each value. |
--meta.display-name | string | Caller-writable human-readable name. |
--spec.grants | json | Who may mount it and how. A principal with no grant cannot mount it, whatever its scopes. Repeat the flag for each value. |
--spec.paths | string | For a computer profile: the paths under the sandbox's home directory its archive holds, for example .config/app. Repeat the flag for each value. |
--dry-run | bool | Validate and print the result without writing (validate_only). |
#delete
Deletes a profile; with force, a profile that has versions too, which destroys every version.
NAME — the resource's name; a bare id is enough below the linked
project.
CLI
sylphx secrets profiles delete orgs/acme/projects/shop/envs/production/profiles/profile --yesDELETE https://api.sylphx.com/v1/orgs/acme/projects/shop/envs/production/profiles/profile · scope secrets:write · effect destructive · Request, response and examples
Flags
| Flag | Type | What it does |
|---|---|---|
--etag | string | Delete only if the current etag matches. |
--dry-run | bool | Validate and print the result without writing (validate_only). |
--force | bool | Also destroy every version; without it a profile with versions fails with INVALID_STATE. |
--yes | bool | Do not ask before this destructive call. |
#open
Mounts a profile for one session: returns the state of one version and, for WRITE_BACK, an attachment that :commit writes through until it expires. Every call is audited with the caller's context; the caller's principal needs a grant of at least the requested mode.
NAME — the resource's name; a bare id is enough below the linked
project.
CLI
sylphx secrets profiles open orgs/acme/projects/shop/envs/production/profiles/profilePOST https://api.sylphx.com/v1/orgs/acme/projects/shop/envs/production/profiles/profile:open · scope secrets:mount · effect read · Request, response and examples
Flags
| Flag | Type | What it does |
|---|---|---|
--mode | enum | READ_ONLY (the default) or WRITE_BACK. One of read_only, write_back. |
--version | string | A version to mount; unset mounts the latest. |
--ttl | duration | How long a WRITE_BACK attachment may commit; default 1 hour, at most 12 hours. A lost session cannot write back after it. |
--context | key=value | Who mounts it, for the audit trail: for example run, step, member. At most 16 entries; keys and values are names, never values. Repeat the flag for each value. |
#commit
Writes a mounted profile back as a new version, by compare-and-set on the version the attachment was opened at (or last committed). When another write landed first, nothing is lost: the result is still a new version, merged site by site with the newer write winning, and marked as a conflict.
NAME — the resource's name; a bare id is enough below the linked
project.
CLI
sylphx secrets profiles commit orgs/acme/projects/shop/envs/production/profiles/profilePOST https://api.sylphx.com/v1/orgs/acme/projects/shop/envs/production/profiles/profile:commit · scope secrets:mount · effect write · Request, response and examples
Flags
| Flag | Type | What it does |
|---|---|---|
--attachment | string | The attachment OpenProfile returned with WRITE_BACK. Required. |
--state | string | The whole state to write, in the profile kind's form, at most 2 MiB. Required. The value is never returned. |