> ## Documentation Index
> Fetch the complete documentation index at: https://docs.niadra.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Criar referência de segredo

> Registra a referência de um segredo guardado no cofre da célula.



## OpenAPI

````yaml openapi/pt/control.json POST /v1/secret-refs
openapi: 3.1.0
info:
  title: API de controle da Niadra
  version: '1'
  description: >-
    Tenants, projetos, fontes, chaves, pessoas, configuração e uso. Nunca recebe
    conteúdo de cliente.
servers:
  - url: https://control.api.niadra.com
security: []
paths:
  /v1/secret-refs:
    post:
      summary: Criar referência de segredo
      description: >-
        Registra a referência de um segredo que o Console gravou direto no cofre
        da célula, como o segredo de assinatura de um webhook. Só metadados
        passam por aqui. Exige o papel admin, integration ou security.


        **Autenticação.** Token de pessoa emitido pelo controle (`Authorization:
        Bearer <JWT>`), com o papel que a operação pede.
      operationId: put_secret_ref_v1_secret_refs_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SecretRefIn'
            example:
              space_id: 0192f0a0-3d4e-7f50-8b61-7c8d9e0f1a23
              ref: spaces/0192f0a0-3d4e-7f50-8b61-7c8d9e0f1a23/webhook/whsec-crm
              kind: webhook
              version: 2
        required: true
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecretRefOut'
              example:
                space_id: 0192f0a0-3d4e-7f50-8b61-7c8d9e0f1a23
                ref: spaces/0192f0a0-3d4e-7f50-8b61-7c8d9e0f1a23/webhook/whsec-crm
                kind: webhook
                version: 2
                rotated_by: 0192f0a0-4e5f-7061-9c72-8d9e0f1a2b35
                rotated_at: '2026-09-20T15:30:00Z'
          description: A referência.
        '422':
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/Problem'
          description: O pedido não bate com o contrato.
      security:
        - personToken: []
components:
  schemas:
    SecretRefIn:
      additionalProperties: false
      properties:
        kind:
          maxLength: 256
          minLength: 1
          title: Kind
          type: string
          description: >-
            `webhook` para segredo de assinatura de webhook, `model` para
            credencial de modelo.
        ref:
          maxLength: 256
          minLength: 1
          title: Ref
          type: string
          description: >-
            O caminho do segredo no cofre da célula, como
            `spaces/<space_id>/webhook/whsec-crm`.
        space_id:
          format: uuid
          title: Space Id
          type: string
        version:
          minimum: 1
          title: Version
          type: integer
      required:
        - space_id
        - ref
        - kind
        - version
      title: SecretRefIn
      type: object
    SecretRefOut:
      additionalProperties: false
      properties:
        kind:
          maxLength: 256
          minLength: 1
          title: Kind
          type: string
        ref:
          maxLength: 256
          minLength: 1
          title: Ref
          type: string
        rotated_at:
          format: date-time
          title: Rotated At
          type: string
        rotated_by:
          format: uuid
          title: Rotated By
          type: string
        space_id:
          format: uuid
          title: Space Id
          type: string
        version:
          minimum: 1
          title: Version
          type: integer
      required:
        - space_id
        - ref
        - kind
        - version
        - rotated_by
        - rotated_at
      title: SecretRefOut
      type: object
    Problem:
      additionalProperties: false
      description: >-
        Detalhes do problema no formato da RFC 9457; `code` vem do catálogo de
        erros versionado.
      properties:
        code:
          title: Code
          type: string
        detail:
          anyOf:
            - type: string
            - type: 'null'
          default: null
          title: Detail
        request_id:
          anyOf:
            - type: string
            - type: 'null'
          default: null
          title: Request Id
        status:
          title: Status
          type: integer
        title:
          title: Title
          type: string
        type:
          default: about:blank
          title: Type
          type: string
      required:
        - title
        - status
        - code
      title: Problem
      type: object
  securitySchemes:
    personToken:
      type: http
      scheme: bearer
      bearerFormat: JWT

````