> ## Documentation Index
> Fetch the complete documentation index at: https://syteca.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Add Secret

> Syteca ACB REST API endpoint to create a new secret — Windows / AD / Unix SSH / Unix Telnet / Web / MSSQL account. Required vs ignored fields depend on the secret's type.

Creates a new secret. The required and ignored fields depend on the secret's `type` — see [Required vs ignored fields by SecretType](/docs/api/acb/data-models#required-vs-ignored-fields-by-secrettype) for the per-type matrix.

<Note>
  For ACB deployments updated from a version prior to 1.2, switch to the `https://{hostname}/EkranACB` server in the Playground.
</Note>

### Permissions required

The user owning the Access Token must have **Editor** or **Owner** role on the target parent folder.

### Secret type → required target field

| `type`                                                | Required target field |
| ----------------------------------------------------- | --------------------- |
| `ADAccount`                                           | `domain`              |
| `WindowsAccount`                                      | `computer_name`       |
| `UnixAccountSSH`, `UnixAccountTelnet`, `MSSQLAccount` | `server`              |
| `WebAccount`                                          | `url`                 |

All types require `login`. For `UnixAccountSSH`, the credentials can be either a password (`password` field) or an SSH key (`ssh_key` field).

### v1.4 changes

* `rotation.rotate_every_min` is now required with **minimum 1**. To disable rotation, set `rotation: { enabled: false, rotate_every_min: 1 }`.
* New `check_password` field for configuring heartbeat checks — see [CheckPassword](/docs/api/acb/data-models#checkpassword).

### Errors

See [Status codes](/docs/api/acb/api-reference#status-codes). Common errors:

* **400 Bad Request** — missing required field for the secret type, or invalid configuration object.
* **403 Forbidden** — user lacks Editor/Owner role on the parent folder.
* **409 Conflict** — secret name already exists in the parent folder.

## Related

<CardGroup cols={2}>
  <Card title="Data models — fields by SecretType" icon="braces" href="/docs/api/acb/data-models#required-vs-ignored-fields-by-secrettype">Per-type field matrix.</Card>
  <Card title="Update secret" icon="file-pen" href="/docs/api/acb/endpoints/update-secret">Modify after creation.</Card>
  <Card title="Bulk add" icon="layers" href="/docs/api/acb/endpoints/bulk-add">Create many secrets in one call.</Card>
  <Card title="Add folder" icon="folder-plus" href="/docs/api/acb/endpoints/add-folder">Organize secrets in folders.</Card>
</CardGroup>


## OpenAPI

````yaml POST /api/secrets
openapi: 3.0.3
info:
  title: Application Credentials Broker API
  description: >-
    API for managing secrets and folders in the Application Credentials Broker
    system
  version: 1.4.0
  contact:
    name: API Support
    email: support@example.com
servers:
  - url: https://your-syteca-host/SytecaACB
    description: On-premises Syteca ACB service (v1.2 or later)
    variables:
      hostname:
        default: your-syteca-host.example.com
        description: Your Syteca Application Server hostname
  - url: https://your-syteca-host/EkranACB
    description: Legacy URL prefix for ACB deployments updated from pre-v1.2
    variables:
      hostname:
        default: your-syteca-host.example.com
        description: Your Syteca Application Server hostname
security:
  - AccessTokenAuth: []
paths:
  /api/secrets:
    post:
      tags:
        - Secrets
      summary: Add new secret
      description: Creates a new secret with the provided data
      operationId: addSecret
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SecretRequestDto'
      responses:
        '201':
          description: Secret created successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecretPasswordlessResponseDto'
        '400':
          description: Invalid request data
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '403':
          description: Access denied
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
components:
  schemas:
    SecretRequestDto:
      type: object
      properties:
        name:
          type: string
          maxLength: 512
          description: Name of the secret
        type:
          $ref: '#/components/schemas/SecretType'
        description:
          type: string
          maxLength: 2000
          description: Description of the secret
        password:
          type: string
          description: The password value
        ssh_key:
          $ref: '#/components/schemas/SshKey'
        parent_folder_id:
          type: integer
          format: int32
          minimum: 0
          description: ID of the parent folder
        parent_folder_name:
          type: string
          maxLength: 512
          description: Name of the parent folder
        domain:
          type: string
          maxLength: 512
          description: Domain for AD accounts
        computer_name:
          type: string
          maxLength: 512
          description: Computer name for Windows/Unix accounts
        url:
          type: string
          maxLength: 2000
          format: uri
          description: URL for web accounts
        server:
          type: string
          maxLength: 512
          description: Server for database accounts
        login:
          type: string
          maxLength: 512
          description: Login username
        computers:
          type: array
          items:
            type: string
          description: List of computers
        file_transfer:
          $ref: '#/components/schemas/FileTransfer'
        rotation:
          $ref: '#/components/schemas/Rotation'
        record_activities:
          type: boolean
          description: Whether to record activities for this secret
        check_out:
          $ref: '#/components/schemas/CheckOut'
        require_approval:
          $ref: '#/components/schemas/RequireApproval'
        permissions:
          $ref: '#/components/schemas/Permissions'
        check_password:
          $ref: '#/components/schemas/CheckPassword'
      required:
        - name
        - type
        - login
    SecretPasswordlessResponseDto:
      type: object
      properties:
        id:
          type: integer
          format: int32
          description: Unique identifier of the secret
        name:
          type: string
          description: Name of the secret
        type:
          $ref: '#/components/schemas/SecretType'
        description:
          type: string
          description: Description of the secret
        parent_folder_id:
          type: integer
          format: int32
          description: ID of the parent folder
        domain:
          type: string
          description: Domain for AD accounts
        computer_name:
          type: string
          description: Computer name for Windows/Unix accounts
        url:
          type: string
          description: URL for web accounts
        server:
          type: string
          description: Server for database accounts
        login:
          type: string
          description: Login username
        computers:
          type: array
          items:
            type: string
          description: List of computers
        file_transfer:
          $ref: '#/components/schemas/FileTransfer'
        rotation:
          $ref: '#/components/schemas/Rotation'
        record_activities:
          type: boolean
          description: Whether to record activities for this secret
        check_out:
          $ref: '#/components/schemas/CheckOut'
        require_approval:
          $ref: '#/components/schemas/RequireApproval'
        permissions:
          $ref: '#/components/schemas/Permissions'
        check_password:
          $ref: '#/components/schemas/CheckPassword'
        check_password_status:
          $ref: '#/components/schemas/PasswordCheckStatus'
        last_password_check_utc:
          type: string
          format: date-time
          nullable: true
          description: UTC timestamp of the last password check
        password_rotation_status:
          $ref: '#/components/schemas/PasswordRotationStatus'
        last_password_rotation_utc:
          type: string
          format: date-time
          nullable: true
          description: UTC timestamp of the last password rotation
      required:
        - id
        - name
        - type
        - login
    ErrorResponse:
      type: object
      properties:
        status:
          type: integer
          description: HTTP status code
        message:
          type: string
          description: Error message
      required:
        - status
        - message
    SecretType:
      type: string
      enum:
        - None
        - UnixAccountSSH
        - UnixAccountTelnet
        - WindowsAccount
        - ADAccount
        - WebAccount
        - MSSQLAccount
      description: Type of secret
    SshKey:
      type: object
      properties:
        private_key:
          type: string
          description: SSH private key
        pass_phrase:
          type: string
          description: Passphrase for the private key
      required:
        - private_key
    FileTransfer:
      type: object
      properties:
        protocol:
          $ref: '#/components/schemas/FileTransferProtocol'
        port:
          type: integer
          format: int32
          minimum: 0
          maximum: 65535
          default: 22
          description: Port number for file transfer
      required:
        - protocol
        - port
    Rotation:
      type: object
      properties:
        enabled:
          type: boolean
          description: Whether rotation is enabled
        rotate_every_min:
          type: integer
          format: int32
          minimum: 1
          description: Rotation interval in minutes
      required:
        - enabled
        - rotate_every_min
    CheckOut:
      type: object
      properties:
        enabled:
          type: boolean
          description: Whether check-out is enabled
        rotate_on_checkin:
          type: boolean
          description: Whether to rotate password on check-in
        auto_checkin_after_min:
          type: integer
          format: int32
          default: 60
          description: Auto check-in timeout in minutes
      required:
        - enabled
        - rotate_on_checkin
        - auto_checkin_after_min
    RequireApproval:
      type: object
      properties:
        require_approval_type:
          $ref: '#/components/schemas/SecretUsagePermissionType'
        approver_users:
          type: array
          items:
            type: string
          description: List of approver users
        approver_user_groups:
          type: array
          items:
            type: string
          description: List of approver user groups
        require_owners_and_approvers:
          type: boolean
          default: false
          description: Whether to require both owners and approvers
        working_dates:
          $ref: '#/components/schemas/WorkingDatePeriod'
        working_hours:
          $ref: '#/components/schemas/WorkingTimePeriod'
        working_days:
          type: array
          items:
            $ref: '#/components/schemas/DayOfWeek'
          description: Working days of the week
      required:
        - require_approval_type
    Permissions:
      type: object
      properties:
        inherit_users_and_roles:
          type: boolean
          default: false
          description: Whether to inherit users and roles from parent
        inherit_features:
          type: boolean
          default: false
          description: Whether to inherit features from parent
        users:
          type: array
          items:
            $ref: '#/components/schemas/Permission'
          description: User permissions
        user_groups:
          type: array
          items:
            $ref: '#/components/schemas/Permission'
          description: User group permissions
    CheckPassword:
      type: object
      properties:
        enabled:
          type: boolean
          default: false
          description: Whether heartbeat password checking is enabled
        check_every:
          type: integer
          format: int32
          default: 30
          description: Interval for password check.
        check_period_type:
          $ref: '#/components/schemas/PasswordCheckPeriodType'
      required:
        - enabled
        - check_every
        - check_period_type
    PasswordCheckStatus:
      type: string
      enum:
        - None
        - Valid
        - Invalid
        - Failed
      description: Status of the last password check (heartbeat)
    PasswordRotationStatus:
      type: string
      enum:
        - Disabled
        - Enabled
        - Failed
      description: Status of password rotation
    FileTransferProtocol:
      type: string
      enum:
        - Sftp
        - Scp
        - Ftp
      description: File transfer protocol
    SecretUsagePermissionType:
      type: string
      enum:
        - None
        - RequiredForAll
        - RequiredForOwners
        - RequiredForNonOwners
      description: Secret usage permission type
    WorkingDatePeriod:
      type: object
      properties:
        from:
          type: string
          format: date-time
          description: Start date
        to:
          type: string
          format: date-time
          description: End date
      required:
        - from
        - to
    WorkingTimePeriod:
      type: object
      properties:
        from:
          type: string
          format: time
          description: Start time
        to:
          type: string
          format: time
          description: End time
      required:
        - from
        - to
    DayOfWeek:
      type: string
      enum:
        - Sunday
        - Monday
        - Tuesday
        - Wednesday
        - Thursday
        - Friday
        - Saturday
      description: Day of the week
    Permission:
      type: object
      properties:
        name:
          type: string
          description: User or group name
        access_type:
          $ref: '#/components/schemas/SecretPermissionType'
        features:
          type: array
          items:
            $ref: '#/components/schemas/AdditionalFeature'
          description: Additional features granted
      required:
        - name
        - access_type
    PasswordCheckPeriodType:
      type: string
      enum:
        - Minute
        - Hour
        - Day
      description: Period type for the password check interval
    SecretPermissionType:
      type: string
      enum:
        - None
        - PAMUser
        - Owner
        - Viewer
      description: Secret permission type
    AdditionalFeature:
      type: string
      enum:
        - CopyPassword
        - ViewPassword
        - FileTransfer
      description: Additional features for permissions
  securitySchemes:
    AccessTokenAuth:
      type: apiKey
      in: header
      name: Authorization
      description: Access token for authentication

````