Skip to content
Omniglass Omniglass Omniglass

Secret types

Secret types (/secret-types, with secret:read) is the registry of secret shapes: the secret_type a secret takes, each declaring the fields a secret of that type expects (for example snmp-community or basic-auth). The page renders inside the Catalog area but holds no subrail entry: you reach it by URL, a deliberate removal that matches its gate. The gate is the point: secret is a sensitive resource, deliberately off the *:read viewer floor, so a plain read-everything viewer sees neither the secrets directory nor this page; whoever may read secrets may read the shapes they take, and nobody else. (This registry used to share a page with location types, and the joint fetch meant a viewer without secret:read lost both; the split gives each registry its own page and its own gate. See Location Types.)

The page is the registry’s directory: a table of its rows, sorted alphabetically by display name, each showing the name, label, and origin (always official). A type also carries an id, a uuid minted by the database, the internal address the handle resolves to (ADR-0062); the handle is what you type and read.

  • Pick a row to open its detail blade: the type’s declared fields, each with its name, scalar type, whether the field is itself secret (masked and encrypted on every secret of the type), and its origin. This is what the Secrets create drawer renders as inputs when you pick the type.

  • The registry is read-only, for everyone. There is no create route, and the blade keeps the Edit and Delete pair in place, greyed, for the owner exactly as for an operator, with the reason on hover: “Official: ships with Omniglass and updates with it.” The registry is authoritative reference data, upserted on every boot (ON CONFLICT DO UPDATE), so a release can correct a shape and the correction lands everywhere. This is the opposite ownership story from Location Types, whose shipped rows are operator-owned and seeded only if absent. See the seed model. The shipped set, rendered from the seed itself:

    TypeFieldsAdmin-sensitive default
    snmp-community (SNMP Community)community (secret)no
    basic-auth (Basic Auth)usernamepassword (secret)no
    oauth2-client (OAuth2 Client)client_idclient_secret (secret)yes

  • Each type also carries a sensitivity default consumed at secret creation: an integration type like oauth2-client mints an admin-sensitive secret (admin/owner-only), a device type an operational one. The Secrets guide covers what that means at reveal time.

Using a type, picking the shape when minting a secret, is the secret write (secret:create), not a registry operation. From the CLI the registry is omniglass secret-type list (see the CLI reference); there are no write commands because there are no write routes.