Secrets Store (v1)

OpenCloud v1 reference for Secrets Store.

Base URL: https://apis.roblox.com

Endpoints

Method	Path	Name
`POST`	`/cloud/v2/universes/:universeId/secrets`	`postCloudV2UniversesUniverseIdSecrets`
`GET`	`/cloud/v2/universes/:universeId/secrets`	`getCloudV2UniversesUniverseIdSecrets`
`PATCH`	`/cloud/v2/universes/:universeId/secrets/:secretId`	`patchCloudV2UniversesUniverseIdSecretsSecretId`
`DELETE`	`/cloud/v2/universes/:universeId/secrets/:secretId`	`deleteCloudV2UniversesUniverseIdSecretsSecretId`
`GET`	`/cloud/v2/universes/:universeId/secrets/public-key`	`getCloudV2UniversesUniverseIdSecretsPublicKey`

`postCloudV2UniversesUniverseIdSecrets`

POST /cloud/v2/universes/:universeId/secrets

BETA Creates a new secret. A maximum of 500 secrets per universe is allowed. Only the owner of the universe can create secrets. For group-owned universes, only the group owner or authorized members can create secrets. To encrypt the secret: 1. Get the public key using the Get Public Key endpoint 2. Encrypt your secret using LibSodium sealed box 3. Base64 encode the encrypted content Include the key_id from the public key response in the request. For an example, see the Secrets store guide. Engine: Not available in-engine

Scopes: universe.secret:write

Usage

import { fetchApi } from 'rozod';
import { postCloudV2UniversesUniverseIdSecrets } from 'rozod/lib/opencloud/v1/secrets-store';

const data = await fetchApi(postCloudV2UniversesUniverseIdSecrets, {
  universeId: /* integer */,
  body: { /* ... */ }
});

Parameters

Name	Type	Required	Description
`universeId`	`integer`	Yes	The universe ID

Request Body

Field	Type	Description
`id`	`string \| null`
`secret`	`string \| null`
`key_id`	`string \| null`
`domain`	`string \| null`
`create_time`	`string \| null`
`update_time`	`string \| null`

Response

Field	Type	Description
`id`	`string \| null`
`secret`	`string \| null`
`key_id`	`string \| null`
`domain`	`string \| null`
`create_time`	`string \| null`
`update_time`	`string \| null`

Errors

Status	Description
400	Bad Request
403	Forbidden
409	Conflict

`getCloudV2UniversesUniverseIdSecrets`

GET /cloud/v2/universes/:universeId/secrets

BETA Lists all secrets defined for a universe. Secret content is not returned for security reasons - only metadata such as ID, domain, creation and update timestamps are included. Only the owner of the universe can list secrets. For group-owned universes, only the group owner or authorized members can list secrets. Engine: Not available in-engine

Scopes: universe.secret:read

Usage

import { fetchApi } from 'rozod';
import { getCloudV2UniversesUniverseIdSecrets } from 'rozod/lib/opencloud/v1/secrets-store';

const data = await fetchApi(getCloudV2UniversesUniverseIdSecrets, {
  universeId: /* integer */,
  limit: /* integer? = 10 */,
  cursor: /* string? */
});

Parameters

Name	Type	Required	Description
`universeId`	`integer`	Yes	The universe ID
`limit`	`integer? = 10`	No	Number of secrets to return per page (1-500, default 10)
`cursor`	`string?`	No	Pagination cursor from previous response

Response

Field	Type	Description
`secrets`	`object[] \| null`	See below
`nextPageCursor`	`string \| null`
`previousPageCursor`	`string \| null`

secrets[] item fields:

Field	Type	Description
`id`	`string \| null`
`secret`	`string \| null`
`key_id`	`string \| null`
`domain`	`string \| null`
`create_time`	`string \| null`
`update_time`	`string \| null`

Errors

Status	Description
400	Bad Request
403	Forbidden

`patchCloudV2UniversesUniverseIdSecretsSecretId`

PATCH /cloud/v2/universes/:universeId/secrets/:secretId

BETA Updates an existing secret. Only the owner of the universe can update secrets. For group-owned universes, only the group owner or authorized members can update secrets. Only the secret content, key_id, and domain can be updated - the secret ID cannot be changed. To encrypt the updated secret: 1. Get the current public key using the GetPublicKey endpoint 2. Encrypt your new secret content using LibSodium sealed box 3. Base64 encode the encrypted content Include the key_id from the public key response in the request. For an example, see the Secrets store guide. Engine: Not available in-engine

Scopes: universe.secret:write

Usage

import { fetchApi } from 'rozod';
import { patchCloudV2UniversesUniverseIdSecretsSecretId } from 'rozod/lib/opencloud/v1/secrets-store';

const data = await fetchApi(patchCloudV2UniversesUniverseIdSecretsSecretId, {
  universeId: /* integer */,
  secretId: /* string */,
  body: { /* ... */ }
});

Parameters

Name	Type	Required	Description
`universeId`	`integer`	Yes	The universe ID
`secretId`	`string`	Yes	The ID of the secret to update

Request Body

All fields are optional (PATCH partial update)

Field	Type	Description
`id`	`string \| null`
`secret`	`string \| null`
`key_id`	`string \| null`
`domain`	`string \| null`
`create_time`	`string \| null`
`update_time`	`string \| null`

Response

Field	Type	Description
`id`	`string \| null`
`secret`	`string \| null`
`key_id`	`string \| null`
`domain`	`string \| null`
`create_time`	`string \| null`
`update_time`	`string \| null`

Errors

Status	Description
400	Bad Request
403	Forbidden
404	Not Found

`deleteCloudV2UniversesUniverseIdSecretsSecretId`

DELETE /cloud/v2/universes/:universeId/secrets/:secretId

BETA Permanently deletes a secret from a universe. Only the owner of the universe can delete secrets. For group-owned universes, only the group owner or authorized members can delete secrets. This operation is irreversible. Make sure you no longer need the secret before deleting it. Engine: Not available in-engine

Scopes: universe.secret:write

Usage

import { fetchApi } from 'rozod';
import { deleteCloudV2UniversesUniverseIdSecretsSecretId } from 'rozod/lib/opencloud/v1/secrets-store';

const data = await fetchApi(deleteCloudV2UniversesUniverseIdSecretsSecretId, {
  universeId: /* integer */,
  secretId: /* string */
});

Parameters

Name	Type	Required	Description
`universeId`	`integer`	Yes	The universe ID
`secretId`	`string`	Yes	The ID of the secret to delete

Response

Type: unknown

Errors

Status	Description
400	Bad Request
403	Forbidden
404	Not Found

`getCloudV2UniversesUniverseIdSecretsPublicKey`

GET /cloud/v2/universes/:universeId/secrets/public-key

BETA Retrieves the public key for a universe. You need this key to encrypt secret content before sending it to Roblox. Only the owner of the universe can retrieve the public key. For group-owned universes, only the group owner or authorized members can retrieve the public key. The secret id field is static and always returns “public-key”. The returned public key in the secret field is universe-specific and derived from a master key using the universe ID. Use this key with LibSodium sealed box encryption to encrypt your secret content before creating or updating secrets. Include the key_id from the public key response in the request to create or update a secret. Engine: Not available in-engine

Scopes: universe.secret:read

Usage

import { fetchApi } from 'rozod';
import { getCloudV2UniversesUniverseIdSecretsPublicKey } from 'rozod/lib/opencloud/v1/secrets-store';

const data = await fetchApi(getCloudV2UniversesUniverseIdSecretsPublicKey, {
  universeId: /* integer */
});

Parameters

Name	Type	Required	Description
`universeId`	`integer`	Yes	The universe ID

Response

Field	Type	Description
`id`	`string \| null`
`secret`	`string \| null`
`key_id`	`string \| null`
`domain`	`string \| null`
`create_time`	`string \| null`
`update_time`	`string \| null`

Errors

Status	Description
400	Bad Request
403	Forbidden