> ## Documentation Index
> Fetch the complete documentation index at: https://docs.portkey.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Create secret reference



## OpenAPI

````yaml https://raw.githubusercontent.com/PaloAltoNetworks/openapi/refs/heads/main/openapi.yaml post /secret-references
openapi: 3.0.0
info:
  title: Prisma AIRS AI Gateway API
  version: 3.0.0
  description: ''
servers:
  - url: https://aigw.portkey.ai/v1
    description: Managed
  - url: https://self-hosted-gateway-url.example.com/v1
    description: Self-hosted -- replace with your own gateway host
security:
  - Authorization: []
tags:
  - name: Assistants
    description: ''
  - name: Audio
    description: ''
  - name: Batch
    description: ''
  - name: Chat
    description: ''
  - name: Completions
    description: ''
  - name: Embeddings
    description: ''
  - name: Files
    description: ''
  - name: Fine-Tuning
    description: ''
  - name: Images
    description: ''
  - name: Model Pricing
    description: ''
  - name: Models
    description: ''
  - name: Moderations
    description: ''
  - name: OCR
    description: ''
  - name: Realtime
    description: ''
  - name: Rerank
    description: ''
  - name: Responses
    description: ''
  - name: Vector Stores
    description: ''
  - name: Configs
    description: ''
  - name: Guardrails
    description: ''
  - name: Integrations
    description: ''
  - name: Integrations > Models
    description: ''
  - name: Integrations > Workspaces
    description: ''
  - name: Providers
    description: ''
  - name: Secret References
    description: ''
  - name: MCP Integrations
    description: ''
  - name: MCP Integrations > Capabilities
    description: ''
  - name: MCP Integrations > Metadata
    description: ''
  - name: MCP Integrations > Workspaces
    description: ''
  - name: MCP Servers
    description: ''
  - name: MCP Servers > Capabilities
    description: ''
  - name: MCP Servers > Connections
    description: ''
  - name: MCP Servers > User Access
    description: ''
  - name: API Keys
    description: ''
  - name: Deployments
    description: ''
  - name: Org Guardrails
    description: ''
  - name: Rate Limit Policies
    description: ''
  - name: Usage Limit Policies
    description: ''
  - name: Analytics > Graphs
    description: ''
  - name: Analytics > Groups
    description: ''
  - name: Analytics > Summary
    description: ''
  - name: Feedback
    description: ''
  - name: Logs
    description: ''
paths:
  /secret-references:
    servers:
      - url: https://api.apps.paloaltonetworks.com/ai_gw/admin/v2
        description: Managed
    post:
      tags:
        - Secret References
      operationId: createSecretReference
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateSecretReferenceRequest'
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    format: uuid
                  slug:
                    type: string
                  object:
                    type: string
                    enum:
                      - secret-reference
        '400':
          description: ''
        '403':
          description: ''
components:
  schemas:
    CreateSecretReferenceRequest:
      type: object
      required:
        - name
        - manager_type
        - auth_config
        - secret_path
      properties:
        organisation_id:
          type: string
          format: uuid
        name:
          type: string
          minLength: 1
          maxLength: 255
        slug:
          type: string
          pattern: ^[a-zA-Z0-9_-]+$
          maxLength: 255
        description:
          type: string
          maxLength: 1024
          nullable: true
        manager_type:
          type: string
          enum:
            - aws_sm
            - azure_kv
            - hashicorp_vault
        auth_config:
          oneOf:
            - $ref: '#/components/schemas/AwsAccessKeyAuthConfig'
            - $ref: '#/components/schemas/AwsAssumedRoleAuthConfig'
            - $ref: '#/components/schemas/AwsServiceRoleAuthConfig'
            - $ref: '#/components/schemas/AzureEntraAuthConfig'
            - $ref: '#/components/schemas/AzureManagedAuthConfig'
            - $ref: '#/components/schemas/AzureDefaultAuthConfig'
            - $ref: '#/components/schemas/HashicorpTokenAuthConfig'
            - $ref: '#/components/schemas/HashicorpAppRoleAuthConfig'
            - $ref: '#/components/schemas/HashicorpKubernetesAuthConfig'
          discriminator:
            propertyName: aws_auth_type
        secret_path:
          type: string
          maxLength: 1024
        secret_key:
          type: string
          maxLength: 255
          nullable: true
        allow_all_workspaces:
          type: boolean
          default: true
        allowed_workspaces:
          type: array
          items:
            type: string
          minItems: 1
        tags:
          type: object
          nullable: true
          additionalProperties:
            type: string
    AwsAccessKeyAuthConfig:
      type: object
      required:
        - aws_auth_type
        - aws_access_key_id
        - aws_secret_access_key
        - aws_region
      properties:
        aws_auth_type:
          type: string
          enum:
            - accessKey
        aws_access_key_id:
          type: string
        aws_secret_access_key:
          type: string
        aws_region:
          type: string
    AwsAssumedRoleAuthConfig:
      type: object
      required:
        - aws_auth_type
        - aws_role_arn
        - aws_region
      properties:
        aws_auth_type:
          type: string
          enum:
            - assumedRole
        aws_role_arn:
          type: string
        aws_external_id:
          type: string
          nullable: true
        aws_region:
          type: string
    AwsServiceRoleAuthConfig:
      type: object
      required:
        - aws_auth_type
      properties:
        aws_auth_type:
          type: string
          enum:
            - serviceRole
        aws_region:
          type: string
    AzureEntraAuthConfig:
      type: object
      required:
        - azure_auth_mode
        - azure_entra_tenant_id
        - azure_entra_client_id
        - azure_entra_client_secret
        - azure_vault_url
      properties:
        azure_auth_mode:
          type: string
          enum:
            - entra
        azure_entra_tenant_id:
          type: string
        azure_entra_client_id:
          type: string
        azure_entra_client_secret:
          type: string
        azure_vault_url:
          type: string
          format: uri
    AzureManagedAuthConfig:
      type: object
      required:
        - azure_auth_mode
        - azure_vault_url
      properties:
        azure_auth_mode:
          type: string
          enum:
            - managed
        azure_managed_client_id:
          type: string
        azure_vault_url:
          type: string
          format: uri
    AzureDefaultAuthConfig:
      type: object
      required:
        - azure_auth_mode
        - azure_vault_url
      properties:
        azure_auth_mode:
          type: string
          enum:
            - default
        azure_vault_url:
          type: string
          format: uri
    HashicorpTokenAuthConfig:
      type: object
      required:
        - vault_auth_type
        - vault_addr
        - vault_token
      properties:
        vault_auth_type:
          type: string
          enum:
            - token
        vault_addr:
          type: string
          format: uri
        vault_token:
          type: string
        vault_namespace:
          type: string
    HashicorpAppRoleAuthConfig:
      type: object
      required:
        - vault_auth_type
        - vault_addr
        - vault_role_id
        - vault_secret_id
      properties:
        vault_auth_type:
          type: string
          enum:
            - approle
        vault_addr:
          type: string
          format: uri
        vault_role_id:
          type: string
        vault_secret_id:
          type: string
        vault_namespace:
          type: string
    HashicorpKubernetesAuthConfig:
      type: object
      required:
        - vault_auth_type
        - vault_addr
        - vault_role
      properties:
        vault_auth_type:
          type: string
          enum:
            - kubernetes
        vault_addr:
          type: string
          format: uri
        vault_role:
          type: string
        vault_namespace:
          type: string
  securitySchemes:
    Authorization:
      type: http
      scheme: bearer

````