roboto.domain.secrets

Create a new secret in the Roboto platform.

Creates a new secret with the specified name and optionally sets its initial value. The secret will be stored in the organization’s secure secret store (AWS Secrets Manager).

Usage

Create a secret without an initial value:

secret = Secret.create(name="api_key", caller_org_id="org_123")
print(secret.name)
# 'api_key'

Create a secret with an initial value:

secret = Secret.create(
    name="database_password", caller_org_id="org_123", initial_value="super_secure_password"
)
print(secret.name)
# 'database_password'

Delete this secret from the Roboto platform.

Permanently removes the secret and its value from the secure storage backend. This operation cannot be undone.

Usage

Delete a secret:

secret = Secret.from_name("old_api_key")
secret.delete()
# # Secret is now permanently deleted

Retrieve all secrets belonging to an organization.

Returns a generator that yields all secrets owned by the specified organization. Results are paginated automatically to handle large numbers of secrets efficiently.

Usage

List all secrets in an organization:

secrets = list(Secret.for_org(org_id="org_123"))
for secret in secrets:
    print(f"Secret: {secret.name}")
# Secret: api_key
# Secret: database_password

Process secrets one at a time without loading all into memory:

for secret in Secret.for_org(org_id="org_123"):
    print(f"Processing secret: {secret.name}")
    # Process each secret individually

Load an existing secret by name.

Secret names are unique within an organization, so a name + org_id combination provides a fully qualified reference to a specific secret.

Usage

Load a secret from the caller’s organization:

secret = Secret.from_name(name="api_key")
print(secret.name)
# 'api_key'

Load a secret from a specific organization:

secret = Secret.from_name(name="database_password", org_id="org_123")
print(f"{secret.name} in {secret.org_id}")
# 'database_password in org_123'

Load an existing secret by URI.

Usage

Load a secret from a URI:

secret = Secret.from_uri("roboto-secret://api_key@org_123")
print(f"{secret.name} in {secret.org_id}")
# 'api_key in org_123'

Load a secret from a URI with a default org ID:

secret = Secret.from_uri("roboto-secret://api_key", fallback_org_id="org_123")
print(f"{secret.name} in {secret.org_id}")
# 'api_key in org_123'

Read the value stored in this secret.

Securely retrieves the secret’s value from the underlying secret store (AWS Secrets Manager). The operation uses temporary, scoped credentials to ensure secure access to the secret store.

Usage

Read a secret’s value:

secret = Secret.from_name("api_key")
value = secret.read_value()
print(value.get_secret_value())
# 'super_secret_api_key_value'

Refresh this secret’s metadata from the Roboto platform.

Updates the secret’s local metadata by fetching the latest information from the server. This is useful to get updated timestamps or other metadata that may have changed since the secret was last loaded.

Usage

Refresh a secret’s metadata:

secret = Secret.from_name("api_key")
secret.refresh()
# Secret now has the latest metadata from the server

Update the value stored in this secret.

Securely updates the secret’s value in the underlying secret store (AWS Secrets Manager). The operation uses temporary, scoped credentials to ensure secure access to the secret store.

Usage

Update a secret’s value:

secret = Secret.from_name("api_key")
secret.update_value("new_secret_api_key_value")
# Secret value has been updated in the secure store

Chain method calls:

secret = Secret.create(name="temp_key").update_value("initial_value")
print(secret.name)
# 'temp_key'