> ## Documentation Index
> Fetch the complete documentation index at: https://simplecloud.app/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Create a client-encrypted network secret

> Creates a secret from a v1 envelope encrypted by the client with the network's current public key. The controller validates the envelope structure and key fingerprint but cannot decrypt or authenticate the ciphertext.



## OpenAPI

````yaml https://controller.simplecloud.app/swagger/doc.json post /v0/secrets/encrypted
openapi: 3.1.0
info:
  contact:
    email: support@swagger.io
    name: API Support
    url: http://www.swagger.io/support
  description: API for SimpleCloud Controller
  license:
    name: Apache 2.0
    url: http://www.apache.org/licenses/LICENSE-2.0.html
  termsOfService: http://swagger.io/terms/
  title: SimpleCloud Controller API
  version: '1.0'
servers:
  - url: https://controller.platform.simplecloud.app/
security: []
externalDocs:
  description: ''
  url: ''
paths:
  /v0/secrets/encrypted:
    post:
      tags:
        - secrets
      summary: Create a client-encrypted network secret
      description: >-
        Creates a secret from a v1 envelope encrypted by the client with the
        network's current public key. The controller validates the envelope
        structure and key fingerprint but cannot decrypt or authenticate the
        ciphertext.
      parameters:
        - description: Network ID
          in: header
          name: X-Network-ID
          required: true
          schema:
            type: string
        - description: Network Credential (network password or JWT)
          in: header
          name: X-Network-Credential
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/models.WriteEncryptedSecretRequest'
        description: Secret key, encrypted value, and encryption-key fingerprint
        required: true
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/models.CreateEncryptedSecretResponse'
          description: Created
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/models.ErrorResponse'
          description: Bad Request
        '401':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/models.ErrorResponse'
          description: Unauthorized
        '409':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/models.ErrorResponse'
          description: Conflict
        '500':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/models.ErrorResponse'
          description: Internal Server Error
components:
  schemas:
    models.WriteEncryptedSecretRequest:
      description: Request for creating or updating a client-encrypted network secret
      properties:
        encrypted_value:
          example: AYd2K1zr...
          type: string
        key:
          example: DATABASE_PASSWORD
          type: string
        key_fingerprint:
          example: 3f5a...
          type: string
      required:
        - encrypted_value
        - key
        - key_fingerprint
      type: object
    models.CreateEncryptedSecretResponse:
      description: Response for creating a client-encrypted network secret
      properties:
        key:
          example: DATABASE_PASSWORD
          type: string
        message:
          example: Secret created successfully
          type: string
        secret_id:
          example: 123e4567-e89b-12d3-a456-426614174000
          type: string
      type: object
    models.ErrorResponse:
      description: Generic error response
      properties:
        error:
          type: string
      type: object

````