---
title: "Create Internal"
method: POST
path: "/api/v1/secrets/internal"
tags: ["Secrets"]
---

# Create Internal

`POST /api/v1/secrets/internal`

CreateInternal creates a secret vault for internal C1 users.

## Request body

- C1ApiSecretsV1PaperSecretServiceCreateInternalRequest — The PaperSecretServiceCreateInternalRequest message.
  - `allowedUserIds` string[], nullable — C1 User IDs allowed to view this secret (1 to 128).
  - `contentType` string — For FILE secrets: MIME content type of the original file. Ignored for TEXT secrets.
  - `displayName` string — Optional cleartext label visible to the creator in "My Secrets" view. Not encrypted — do not put sensitive data here.
  - `expiresIn` string, duration
  - `fileSize` string, int64 — For FILE secrets: expected file size in bytes (max 1GB). Ignored for TEXT secrets.
  - `filename` string — For FILE secrets: original filename (sanitized server-side). Ignored for TEXT secrets.
  - `inputFormat` 'SECRET_INPUT_FORMAT_UNSPECIFIED' | 'SECRET_INPUT_FORMAT_PLAINTEXT' | 'SECRET_INPUT_FORMAT_JSON' | 'SECRET_INPUT_FORMAT_YAML' | 'SECRET_INPUT_FORMAT_KEY_VALUE' — For TEXT secrets: hint about the plaintext format (e.g., JSON, YAML, key-value). Used by the viewer UI for syntax highlighting. Does not affect encryption.
  - `maxViews` integer — Maximum number of views before the secret is burned (0 = unlimited).
  - `secretType` 'SECRET_TYPE_UNSPECIFIED' | 'SECRET_TYPE_TEXT' | 'SECRET_TYPE_FILE' — Secret type: TEXT or FILE. TEXT secrets use SetTextContent to upload encrypted content (max 64KB). FILE secrets use the upload_url from CreateResponse to upload encrypted content (max 1GB).

## Response `200`

Successful response

- C1ApiSecretsV1PaperSecretServiceCreateResponse — The PaperSecretServiceCreateResponse message.
  - `ageRecipient` string — Age X25519 recipient public key (format: "age1...") for client-side encryption. All content MUST be encrypted to this recipient using the Age encryption format before calling SetTextContent or uploading to upload_url. See: https://age-encryption.org
  - `secret` C1ApiSecretsV1PaperSecret — PaperSecret is the API view of a secret (combines Vault + PaperVault fields). The vault_id is the primary identifier (Vault.id).
    - `allowedEmails` string[], nullable — The allowedEmails field.
    - `allowedUserIds` string[], nullable — Access control
    - `contentDeleted` boolean — The contentDeleted field.
    - `contentExpiresAt` string, date-time
    - `contentReady` boolean — Whether content has been set (text uploaded or file uploaded)
    - `contentType` string — The contentType field.
    - `createdAt` string, date-time
    - `creatorUserId` string — Creator
    - `currentViews` integer — The currentViews field.
    - `deletedAt` string, date-time
    - `displayName` string — From Vault
    - `fileSize` string, int64 — File metadata
    - `filename` string — For FILE secrets: original filename (sanitized)
    - `inputFormat` 'SECRET_INPUT_FORMAT_UNSPECIFIED' | 'SECRET_INPUT_FORMAT_PLAINTEXT' | 'SECRET_INPUT_FORMAT_JSON' | 'SECRET_INPUT_FORMAT_YAML' | 'SECRET_INPUT_FORMAT_KEY_VALUE' — The inputFormat field.
    - `maxViews` integer — View tracking
    - `secretType` 'SECRET_TYPE_UNSPECIFIED' | 'SECRET_TYPE_TEXT' | 'SECRET_TYPE_FILE' — The secretType field.
    - `shareCode` string — Human-friendly share code (XXXX-XXXX-XXXX) for shareable URLs
    - `shareUrl` string — URL to share with recipients (populated when content_ready is true)
    - `sharingMode` 'PAPER_VAULT_SHARING_MODE_UNSPECIFIED' | 'PAPER_VAULT_SHARING_MODE_INTERNAL' | 'PAPER_VAULT_SHARING_MODE_EXTERNAL' — From PaperVault
    - `status` 'SECRET_STATUS_UNSPECIFIED' | 'SECRET_STATUS_ACTIVE' | 'SECRET_STATUS_EXPIRED' | 'SECRET_STATUS_BURNED' | 'SECRET_STATUS_REVOKED' | 'SECRET_STATUS_DATA_DELETED' — Computed status
    - `updatedAt` string, date-time
    - `vaultId` string — Vault.id - primary identifier for the secret
  - `uploadUrl` string — For FILE secrets: capability URL for uploading the Age-encrypted file. Send an HTTP PUT request with the Age-encrypted file bytes as the body and Content-Type: application/octet-stream. The payload MUST begin with the Age header "age-encryption.org/v1\n". Maximum file size: 1GB. Empty for TEXT secrets.
  - `vaultId` string — Vault ID - primary identifier for this secret.

---

[API](https://skmtc.net/conductorone/apis/c1-api.md) · [All operations](https://skmtc.net/conductorone/apis/c1-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/conductorone/c1-api/revisions/d391405a35d3/schema)