# Replace a secret's value or note.

`PATCH /o/{org}/secrets/{secret}`

Only its creator or an org admin. A sign-in's value is `username`, `password` and an optional `totp_secret`, replaced together; any other secret's is `value`. Any other field but `description` is refused with `SECRET_FIELD_IMMUTABLE`.

## Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `org` | path | string | yes | The org's slug or id. A caller with no role in the org gets `404`. |
| `secret` | path | string | yes |  |

## Request body

- `value` (string, optional)
- `username` (string, optional)
- `password` (string, optional)
- `totp_secret` (string, optional)
- `description` (string, optional)

## Example request

```bash
curl -X PATCH "https://api.prix.dev/o/$RUSH_ORG/secrets/$SECRET" \
  -H "Authorization: Bearer $RUSH_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'
```

```typescript
const org = process.env.RUSH_ORG;
const secret = process.env.SECRET;

const res = await fetch(`https://api.prix.dev/o/${org}/secrets/${secret}`, {
  method: "PATCH",
  headers: {
    Authorization: `Bearer ${process.env.RUSH_TOKEN}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({}),
});

console.log(res.status, await res.json());
```

```python
import os

import requests

org = os.environ["RUSH_ORG"]
secret = os.environ["SECRET"]

res = requests.patch(
    f"https://api.prix.dev/o/{org}/secrets/{secret}",
    headers={"Authorization": f"Bearer {os.environ['RUSH_TOKEN']}"},
    json={},
)

print(res.status_code, res.json())
```

## Responses

### 200

Updated.

- `data` (Secret, required): A secret without its value.
  - `id` (string, required)
  - `name` (string, required)
  - `kind` (string, required, one of `env`, `header`, `login`)
  - `description` (string, required)
  - `project_id` (string, required)
  - `targets` (array of string, required): Hosts (header) or one origin (login); empty for env.
  - `header_name` (string | null, optional)
  - `header_format` (string | null, optional)
  - `has_totp` (boolean, required)
  - `created_by` (string | null, required): Null once the member who added it has deleted their account; the secret stays with the Project.
  - `created_at` (string, required)
  - `value_updated_at` (string, required)
  - `last_used_at` (string | null, optional)

### 403

Not its creator or an org admin.

### 404

`SECRET_NOT_FOUND`: no such secret the caller can see.

### 422

`SECRET_FIELD_IMMUTABLE`, `SECRET_VALUE_INVALID` or `SECRET_DESCRIPTION_INVALID`.

## Example response (200)

```json
{
  "data": {
    "id": "3f6c1e2a-8b4d-4c1e-9a7f-2d5b6e8c0a14",
    "name": "string",
    "kind": "env",
    "description": "string",
    "project_id": "3f6c1e2a-8b4d-4c1e-9a7f-2d5b6e8c0a14",
    "targets": [
      "string"
    ],
    "header_name": "string",
    "header_format": "string",
    "has_totp": true,
    "created_by": "3f6c1e2a-8b4d-4c1e-9a7f-2d5b6e8c0a14",
    "created_at": "2026-10-06T12:00:00Z",
    "value_updated_at": "2026-10-06T12:00:00Z",
    "last_used_at": "2026-10-06T12:00:00Z"
  }
}
```