---
# @generated by sylphx-gen. Do not edit.
title: "sylphx secrets secret_bindings"
description: "The sylphx secrets secret_bindings commands of Sylphx Secrets: every verb, with its argument, its flags and a run line."
type: reference
product: platform
summary: "Every sylphx secrets secret_bindings command: its argument, its flags and a run line."
updated: 2026-09-28
nav: false
---

> **This method is not served on the public API.** `api.sylphx.com` does not route this call: its backend is not deployed behind the public API, or does not implement the call. This page documents the contract. It is kept out of the sidebar and of search engines.

The `secret_bindings` commands of Sylphx Secrets, as the CLI spells them: the same
calls as [the `secret_bindings` API page](/docs/api/secret_bindings), typed for the
shell. [Install, sign in and the grammar](/docs/cli) are on the CLI index.

## get

Gets a secret binding.

**`NAME`** — the resource's name; a bare id is enough below the linked
project.

**CLI**

```bash
sylphx secrets secret-bindings get orgs/acme/projects/shop/envs/production/secret_bindings/secret-binding
```

`GET https://api.sylphx.com/v1/orgs/acme/projects/shop/envs/production/secret_bindings/secret-binding` · scope `secrets:read` · effect `read` · [Request, response and examples](/docs/api/secret_bindings/get)

## list

Lists secret bindings in an environment.

**`PARENT`** — optional: the CLI fills it from the linked project or the
key's scope when it is left out.

**CLI**

```bash
sylphx secrets secret-bindings list orgs/acme/projects/shop/envs/production
```

`GET https://api.sylphx.com/v1/orgs/acme/projects/shop/envs/production/secret_bindings` · scope `secrets:read` · effect `read` · [Request, response and examples](/docs/api/secret_bindings/list)

**Flags**

| Flag | Type | What it does |
| --- | --- | --- |
| `--page-size` | `int` | At most this many; default 50, clamped to 1000. |
| `--page-token` | `string` | `next_page_token` of the previous page. |
| `--filter` | `string` | AIP-160 filter over labels and filterable fields. |
| `--order-by` | `string` | AIP-132 ordering over filterable fields. |

## create

Creates a secret binding.

**`ID`** — The id segment of the new Resource's name; the server assigns one when omitted.

**CLI**

```bash
sylphx secrets secret-bindings create --parent orgs/acme/projects/shop/envs/production --spec.secret … --spec.workload …
```

`POST https://api.sylphx.com/v1/orgs/acme/projects/shop/envs/production/secret_bindings` · scope `secrets:write` · effect `write` · [Request, response and examples](/docs/api/secret_bindings/create)

**Flags**

| Flag | Type | What it does |
| --- | --- | --- |
| `--parent` | `string` | The parent to create in; defaults to the linked project or the key's scope. |
| `--meta.labels` | `key=value` | Caller-writable, indexed labels (AIP-122 label rules). Repeat the flag for each value. |
| `--meta.annotations` | `key=value` | Caller-writable, unindexed annotations. Repeat the flag for each value. |
| `--meta.display-name` | `string` | Caller-writable human-readable name. |
| `--spec.secret` | `string` | The Secret to deliver, in the same environment. Required. |
| `--spec.version` | `string` | A pinned version; unset delivers the Secret's latest enabled version. |
| `--spec.workload` | `string` | The name of the Resource that consumes the value, for example a Hosting service. Required. |
| `--spec.env-var.variable` | `string` | The variable name, for example `DATABASE_PASSWORD`. |
| `--spec.file.path` | `string` | The absolute path, for example `/run/secrets/tls.key`. |
| `--spec.egress.hosts` | `string` | The hosts the value may be sent to, for example `api.example.com`. Repeat the flag for each value. |
| `--spec.egress.header` | `string` | The request header to set, for example `Authorization`. |
| `--spec.egress.header-template` | `string` | The header value, with `{value}` standing for the Secret, for example `Bearer {value}`; default `{value}`. |
| `--dry-run` | `bool` | Validate and print the result without writing (validate_only). |

## update

Updates a secret binding.

**`NAME`** — the resource's name; a bare id is enough below the linked
project.

**CLI**

```bash
sylphx secrets secret-bindings update orgs/acme/projects/shop/envs/production/secret_bindings/secret-binding --spec.secret … --spec.workload …
```

`PATCH https://api.sylphx.com/v1/orgs/acme/projects/shop/envs/production/secret_bindings/secret-binding` · scope `secrets:write` · effect `write` · [Request, response and examples](/docs/api/secret_bindings/update)

**Flags**

| Flag | Type | What it does |
| --- | --- | --- |
| `--meta.labels` | `key=value` | Caller-writable, indexed labels (AIP-122 label rules). Repeat the flag for each value. |
| `--meta.annotations` | `key=value` | Caller-writable, unindexed annotations. Repeat the flag for each value. |
| `--meta.display-name` | `string` | Caller-writable human-readable name. |
| `--spec.secret` | `string` | The Secret to deliver, in the same environment. Required. |
| `--spec.version` | `string` | A pinned version; unset delivers the Secret's latest enabled version. |
| `--spec.workload` | `string` | The name of the Resource that consumes the value, for example a Hosting service. Required. |
| `--spec.env-var.variable` | `string` | The variable name, for example `DATABASE_PASSWORD`. |
| `--spec.file.path` | `string` | The absolute path, for example `/run/secrets/tls.key`. |
| `--spec.egress.hosts` | `string` | The hosts the value may be sent to, for example `api.example.com`. Repeat the flag for each value. |
| `--spec.egress.header` | `string` | The request header to set, for example `Authorization`. |
| `--spec.egress.header-template` | `string` | The header value, with `{value}` standing for the Secret, for example `Bearer {value}`; default `{value}`. |
| `--dry-run` | `bool` | Validate and print the result without writing (validate_only). |

## delete

Deletes a secret binding.

**`NAME`** — the resource's name; a bare id is enough below the linked
project.

**CLI**

```bash
sylphx secrets secret-bindings delete orgs/acme/projects/shop/envs/production/secret_bindings/secret-binding --yes
```

`DELETE https://api.sylphx.com/v1/orgs/acme/projects/shop/envs/production/secret_bindings/secret-binding` · scope `secrets:write` · effect `destructive` · [Request, response and examples](/docs/api/secret_bindings/delete)

**Flags**

| Flag | Type | What it does |
| --- | --- | --- |
| `--etag` | `string` | Delete only if the current etag matches. |
| `--dry-run` | `bool` | Validate and print the result without writing (validate_only). |
| `--yes` | `bool` | Do not ask before this destructive call. |