--- title: "UpdateSecretRule" method: PATCH path: "/v1/namespaces/{object.tenant_meta.namespace}/secret-rules" tags: ["SecretRuleService"] --- # UpdateSecretRule `PATCH /v1/namespaces/{object.tenant_meta.namespace}/secret-rules` Updates a secret rule. ## Path parameters - `object.tenant_meta.namespace` string, required ## Request body - SecretRuleServiceUpdateSecretRuleBody — Request to update a secret rule. - `object` object - `meta` V1Meta — Common fields for all Endor Labs resources. - `annotations` object — Annotations can be used to attach metadata to a resource message. Annotation values can be small or large, structured or unstructured, and may include characters not permitted by labels. The keys may contain alphanumerics, underscores (_), dots (.) and dashes (-). The values of an annotation must be 16384 bytes or smaller. - `create_time` string, date-time — Time the resource was created. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `created_by` string — Name and authentication source of the user who created the object, for example, ewok@endor.ai@google@api-key. - `description` string — Resource description. Must be less than 1024 bytes. - `index_data` V1IndexData — IndexData is used to index the resource for search. It's an internal object. - `data` string[] - `search_score` number, float — search_score is the score of the resource for search. Internal use only. - `tenant` string - `will_be_deleted_at` string, date-time — Time that the resource will be deleted. - `kind` string — Resource kind, for example, HelloResponse. Auto-generated using the protobuf message proto.MessageName().Name(). - `name` string, required — Resource name. Must be 63 characters or less. - `parent_kind` string — Parent object resource kind, for example, Project. - `parent_uuid` string — Parent object UUID. - `references` object — Map of objects referenced in a query API. - `tags` string[] — List of tags attached to the resource. Tags can be used to select objects and to find collections of objects that satisfy certain conditions. A tag must be 255 characters or less. - `update_time` string, date-time — Time the resource was last updated. Note: Updated on all create/patch/delete operations. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `updated_by` string — Name and authentication source of the last user who updated the object, for example, vulnerabilityingestor@endor.ai@x509. - `upsert_time` string, date-time — Time the resource was last upserted. Note: create_time is only set the first time the resource is created. upsert_time is set every time the resource is upseted. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `version` string — Message version. - `propagate` boolean — Propagate indicates that the object should be visible in children namespaces. - `spec` V1SecretRuleSpec — Internal specification of the object. Follows the specification of the gitleaks configuration object defined here: https://github.com/gitleaks/gitleaks/blob/master/config/rule.go - `allowlist` V1Allowlist — Allows a rule to be ignored for specific regexes, paths, and/or commits. - `commits` string[] — A slice of commit SHAs that are allowed to be ignored. - `condition` string — Match condition for this allowlist ("OR" or "AND"). Defaults to "OR". When "AND", all criteria must match for the allowlist to apply. - `description` string — Short human readable description of the allowlist. - `paths` string[] — A slice of path regular expressions that are allowed to be ignored. - `regex_target` string - `regexes` string[] — A slice of content regular expressions that are allowed to be ignored. - `stop_words` string[] — A slice of stop words that are allowed to be ignored. This targets the _secret_, not the content of the regex match like the regexes slice. - `allowlists` V1Allowlist[] — Allows a rule to be ignored for specific regexes, paths, and/or commits. Replaces the singular allowlist field to align with gitleaks v8.21+ config format, which supports multiple allowlists per rule with independent regex_target and condition values. - `commits` string[] — A slice of commit SHAs that are allowed to be ignored. - `condition` string — Match condition for this allowlist ("OR" or "AND"). Defaults to "OR". When "AND", all criteria must match for the allowlist to apply. - `description` string — Short human readable description of the allowlist. - `paths` string[] — A slice of path regular expressions that are allowed to be ignored. - `regex_target` string - `regexes` string[] — A slice of content regular expressions that are allowed to be ignored. - `stop_words` string[] — A slice of stop words that are allowed to be ignored. This targets the _secret_, not the content of the regex match like the regexes slice. - `description` string — The description of the rule. - `disabled` boolean — Rule is disabled. - `entropy` number, float — A float representing the minimum Shannon entropy a regex group must have to be considered a secret. - `keywords` string[] — Keywords are used for pre-regex check filtering. Rules that contain keywords will perform a quick string compare check to make sure the keywords are in the content being scanned. - `path` string - `regex` string — A golang regular expression used to detect secrets. - `rule_id` string — The unique identifier for this rule. - `secret_group` integer — An int used to extract secret from regex match and used as the group that will have its entropy checked if `entropy` is set. - `tags` string[] — An array of strings used for metadata and reporting purposes. - `validation` V1HttpParamsProfile — HttpParamsProfile defines the parameters to create an HTTP request. - `allowed_template_params` HttpParamsProfileAllowedTemplateParam[] - `name` 'TEMPLATE_PARAM_NAME_UNSPECIFIED' | 'TEMPLATE_PARAM_NAME_CLIENT_ID' | 'TEMPLATE_PARAM_NAME_TENANT_ID' — TemplateParamName is the name of the template param used in secret validation profiles. - TEMPLATE_PARAM_NAME_CLIENT_ID: "ClientID" is the template parameter name for client ID. - TEMPLATE_PARAM_NAME_TENANT_ID: "TenantID" is the template parameter name for tenant ID. - `regex` string - `description` string — Detailed description of the request. For example, "GitHub credential validation". - `h_request` V1HttpParamsRequest — HttpParamsRequest contains the information expected with the HTTP request. - `body` V1HttpParam[] — The information to be put in the HTTP body. - `authz` boolean - `key` string — The key for this pair. - `separator` string — The separator to use between key and value. Default is ":". - `value` string — The value. - `header` V1HttpParam[] — The information to be put in the HTTP header. - `authz` boolean - `key` string — The key for this pair. - `separator` string — The separator to use between key and value. Default is ":". - `value` string — The value. - `method` string — Method is either GET or POST. - `method_name` string — Gets appended to the URL as: URL[:method_name] usually followed by the query section. - `query` V1HttpParam[] — The information to be put in the HTTP query section. - `authz` boolean - `key` string — The key for this pair. - `separator` string — The separator to use between key and value. Default is ":". - `value` string — The value. - `uri` string - `h_response` V1HttpParamsResponse — HttpParamsResponse contains the information expected with the HTTP response. - `failed_auth_codes` integer[] — The codes expected on the failed authentication. - `invalid_code_regex` string — The pattern/regex expected on failure. For example, "5\\d\\d". - `status_code` string — The code expected on success. For example, 200. - `successful_auth_codes` integer[] — The codes expected for a successful authentication. - `successful_response_data` object — Map of key-value pairs that must be present in the response body for successful validation. This allows validation beyond just HTTP status codes. Example: {"ok": "true", "status": "active"} would require the response to contain both keys with matching values. The response can contain additional fields. - `successful_response_text` string — The expected response body text for successful validation. Example: "invalid_payload" would require the response body to contain the text "invalid_payload". The response body may contain additional text. - `hmac_auth` V1HttpHmacAuth — HMAC information. - `hdr_name` string — The name of the header field that contains the signature. - `secret` string — The secret to use for the HMAC calculation. - `http_request` V1HttpParamsRequest — HttpParamsRequest contains the information expected with the HTTP request. - `body` V1HttpParam[] — The information to be put in the HTTP body. - `authz` boolean - `key` string — The key for this pair. - `separator` string — The separator to use between key and value. Default is ":". - `value` string — The value. - `header` V1HttpParam[] — The information to be put in the HTTP header. - `authz` boolean - `key` string — The key for this pair. - `separator` string — The separator to use between key and value. Default is ":". - `value` string — The value. - `method` string — Method is either GET or POST. - `method_name` string — Gets appended to the URL as: URL[:method_name] usually followed by the query section. - `query` V1HttpParam[] — The information to be put in the HTTP query section. - `authz` boolean - `key` string — The key for this pair. - `separator` string — The separator to use between key and value. Default is ":". - `value` string — The value. - `uri` string - `http_response` V1HttpParamsResponse — HttpParamsResponse contains the information expected with the HTTP response. - `failed_auth_codes` integer[] — The codes expected on the failed authentication. - `invalid_code_regex` string — The pattern/regex expected on failure. For example, "5\\d\\d". - `status_code` string — The code expected on success. For example, 200. - `successful_auth_codes` integer[] — The codes expected for a successful authentication. - `successful_response_data` object — Map of key-value pairs that must be present in the response body for successful validation. This allows validation beyond just HTTP status codes. Example: {"ok": "true", "status": "active"} would require the response to contain both keys with matching values. The response can contain additional fields. - `successful_response_text` string — The expected response body text for successful validation. Example: "invalid_payload" would require the response body to contain the text "invalid_payload". The response body may contain additional text. - `name` string - `request_body` string — Request body as a string. This will be sent as the body of the HTTP request. If both request_body and the body parameter in SendRequest are provided, the body parameter takes precedence. - `template_params` HttpParamsProfileTemplateParams[] - `values` TemplateParamsTemplateValue[] - `name` 'TEMPLATE_PARAM_NAME_UNSPECIFIED' | 'TEMPLATE_PARAM_NAME_CLIENT_ID' | 'TEMPLATE_PARAM_NAME_TENANT_ID' — TemplateParamName is the name of the template param used in secret validation profiles. - TEMPLATE_PARAM_NAME_CLIENT_ID: "ClientID" is the template parameter name for client ID. - TEMPLATE_PARAM_NAME_TENANT_ID: "TenantID" is the template parameter name for tenant ID. - `value` string — The template parameter value. - `tenant_meta` object — Rules are associated with a tenant and namespace. - `uuid` string — The UUID of the secret rule. - `request` V1UpdateRequest — Message used for all update requests. - `force` boolean — Force will force the update of the resource if any checks fail. - `update_mask` string — Fields to update. Defaults to all fields. ## Response `200` A successful response. - V1SecretRule - `meta` V1Meta, required — Common fields for all Endor Labs resources. - `annotations` object — Annotations can be used to attach metadata to a resource message. Annotation values can be small or large, structured or unstructured, and may include characters not permitted by labels. The keys may contain alphanumerics, underscores (_), dots (.) and dashes (-). The values of an annotation must be 16384 bytes or smaller. - `create_time` string, date-time — Time the resource was created. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `created_by` string — Name and authentication source of the user who created the object, for example, ewok@endor.ai@google@api-key. - `description` string — Resource description. Must be less than 1024 bytes. - `index_data` V1IndexData — IndexData is used to index the resource for search. It's an internal object. - `data` string[] - `search_score` number, float — search_score is the score of the resource for search. Internal use only. - `tenant` string - `will_be_deleted_at` string, date-time — Time that the resource will be deleted. - `kind` string — Resource kind, for example, HelloResponse. Auto-generated using the protobuf message proto.MessageName().Name(). - `name` string, required — Resource name. Must be 63 characters or less. - `parent_kind` string — Parent object resource kind, for example, Project. - `parent_uuid` string — Parent object UUID. - `references` object — Map of objects referenced in a query API. - `tags` string[] — List of tags attached to the resource. Tags can be used to select objects and to find collections of objects that satisfy certain conditions. A tag must be 255 characters or less. - `update_time` string, date-time — Time the resource was last updated. Note: Updated on all create/patch/delete operations. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `updated_by` string — Name and authentication source of the last user who updated the object, for example, vulnerabilityingestor@endor.ai@x509. - `upsert_time` string, date-time — Time the resource was last upserted. Note: create_time is only set the first time the resource is created. upsert_time is set every time the resource is upseted. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `version` string — Message version. - `propagate` boolean — Propagate indicates that the object should be visible in children namespaces. - `spec` V1SecretRuleSpec, required — Internal specification of the object. Follows the specification of the gitleaks configuration object defined here: https://github.com/gitleaks/gitleaks/blob/master/config/rule.go - `allowlist` V1Allowlist — Allows a rule to be ignored for specific regexes, paths, and/or commits. - `commits` string[] — A slice of commit SHAs that are allowed to be ignored. - `condition` string — Match condition for this allowlist ("OR" or "AND"). Defaults to "OR". When "AND", all criteria must match for the allowlist to apply. - `description` string — Short human readable description of the allowlist. - `paths` string[] — A slice of path regular expressions that are allowed to be ignored. - `regex_target` string - `regexes` string[] — A slice of content regular expressions that are allowed to be ignored. - `stop_words` string[] — A slice of stop words that are allowed to be ignored. This targets the _secret_, not the content of the regex match like the regexes slice. - `allowlists` V1Allowlist[] — Allows a rule to be ignored for specific regexes, paths, and/or commits. Replaces the singular allowlist field to align with gitleaks v8.21+ config format, which supports multiple allowlists per rule with independent regex_target and condition values. - `commits` string[] — A slice of commit SHAs that are allowed to be ignored. - `condition` string — Match condition for this allowlist ("OR" or "AND"). Defaults to "OR". When "AND", all criteria must match for the allowlist to apply. - `description` string — Short human readable description of the allowlist. - `paths` string[] — A slice of path regular expressions that are allowed to be ignored. - `regex_target` string - `regexes` string[] — A slice of content regular expressions that are allowed to be ignored. - `stop_words` string[] — A slice of stop words that are allowed to be ignored. This targets the _secret_, not the content of the regex match like the regexes slice. - `description` string — The description of the rule. - `disabled` boolean — Rule is disabled. - `entropy` number, float — A float representing the minimum Shannon entropy a regex group must have to be considered a secret. - `keywords` string[] — Keywords are used for pre-regex check filtering. Rules that contain keywords will perform a quick string compare check to make sure the keywords are in the content being scanned. - `path` string - `regex` string — A golang regular expression used to detect secrets. - `rule_id` string — The unique identifier for this rule. - `secret_group` integer — An int used to extract secret from regex match and used as the group that will have its entropy checked if `entropy` is set. - `tags` string[] — An array of strings used for metadata and reporting purposes. - `validation` V1HttpParamsProfile — HttpParamsProfile defines the parameters to create an HTTP request. - `allowed_template_params` HttpParamsProfileAllowedTemplateParam[] - `name` 'TEMPLATE_PARAM_NAME_UNSPECIFIED' | 'TEMPLATE_PARAM_NAME_CLIENT_ID' | 'TEMPLATE_PARAM_NAME_TENANT_ID' — TemplateParamName is the name of the template param used in secret validation profiles. - TEMPLATE_PARAM_NAME_CLIENT_ID: "ClientID" is the template parameter name for client ID. - TEMPLATE_PARAM_NAME_TENANT_ID: "TenantID" is the template parameter name for tenant ID. - `regex` string - `description` string — Detailed description of the request. For example, "GitHub credential validation". - `h_request` V1HttpParamsRequest — HttpParamsRequest contains the information expected with the HTTP request. - `body` V1HttpParam[] — The information to be put in the HTTP body. - `authz` boolean - `key` string — The key for this pair. - `separator` string — The separator to use between key and value. Default is ":". - `value` string — The value. - `header` V1HttpParam[] — The information to be put in the HTTP header. - `authz` boolean - `key` string — The key for this pair. - `separator` string — The separator to use between key and value. Default is ":". - `value` string — The value. - `method` string — Method is either GET or POST. - `method_name` string — Gets appended to the URL as: URL[:method_name] usually followed by the query section. - `query` V1HttpParam[] — The information to be put in the HTTP query section. - `authz` boolean - `key` string — The key for this pair. - `separator` string — The separator to use between key and value. Default is ":". - `value` string — The value. - `uri` string - `h_response` V1HttpParamsResponse — HttpParamsResponse contains the information expected with the HTTP response. - `failed_auth_codes` integer[] — The codes expected on the failed authentication. - `invalid_code_regex` string — The pattern/regex expected on failure. For example, "5\\d\\d". - `status_code` string — The code expected on success. For example, 200. - `successful_auth_codes` integer[] — The codes expected for a successful authentication. - `successful_response_data` object — Map of key-value pairs that must be present in the response body for successful validation. This allows validation beyond just HTTP status codes. Example: {"ok": "true", "status": "active"} would require the response to contain both keys with matching values. The response can contain additional fields. - `successful_response_text` string — The expected response body text for successful validation. Example: "invalid_payload" would require the response body to contain the text "invalid_payload". The response body may contain additional text. - `hmac_auth` V1HttpHmacAuth — HMAC information. - `hdr_name` string — The name of the header field that contains the signature. - `secret` string — The secret to use for the HMAC calculation. - `http_request` V1HttpParamsRequest — HttpParamsRequest contains the information expected with the HTTP request. - `body` V1HttpParam[] — The information to be put in the HTTP body. - `authz` boolean - `key` string — The key for this pair. - `separator` string — The separator to use between key and value. Default is ":". - `value` string — The value. - `header` V1HttpParam[] — The information to be put in the HTTP header. - `authz` boolean - `key` string — The key for this pair. - `separator` string — The separator to use between key and value. Default is ":". - `value` string — The value. - `method` string — Method is either GET or POST. - `method_name` string — Gets appended to the URL as: URL[:method_name] usually followed by the query section. - `query` V1HttpParam[] — The information to be put in the HTTP query section. - `authz` boolean - `key` string — The key for this pair. - `separator` string — The separator to use between key and value. Default is ":". - `value` string — The value. - `uri` string - `http_response` V1HttpParamsResponse — HttpParamsResponse contains the information expected with the HTTP response. - `failed_auth_codes` integer[] — The codes expected on the failed authentication. - `invalid_code_regex` string — The pattern/regex expected on failure. For example, "5\\d\\d". - `status_code` string — The code expected on success. For example, 200. - `successful_auth_codes` integer[] — The codes expected for a successful authentication. - `successful_response_data` object — Map of key-value pairs that must be present in the response body for successful validation. This allows validation beyond just HTTP status codes. Example: {"ok": "true", "status": "active"} would require the response to contain both keys with matching values. The response can contain additional fields. - `successful_response_text` string — The expected response body text for successful validation. Example: "invalid_payload" would require the response body to contain the text "invalid_payload". The response body may contain additional text. - `name` string - `request_body` string — Request body as a string. This will be sent as the body of the HTTP request. If both request_body and the body parameter in SendRequest are provided, the body parameter takes precedence. - `template_params` HttpParamsProfileTemplateParams[] - `values` TemplateParamsTemplateValue[] - `name` 'TEMPLATE_PARAM_NAME_UNSPECIFIED' | 'TEMPLATE_PARAM_NAME_CLIENT_ID' | 'TEMPLATE_PARAM_NAME_TENANT_ID' — TemplateParamName is the name of the template param used in secret validation profiles. - TEMPLATE_PARAM_NAME_CLIENT_ID: "ClientID" is the template parameter name for client ID. - TEMPLATE_PARAM_NAME_TENANT_ID: "TenantID" is the template parameter name for tenant ID. - `value` string — The template parameter value. - `tenant_meta` V1TenantMeta — Tenant related data for the tenant containing the resource. - `namespace` string, required — Namespaces are a way to organize organizational units into virtual groupings of resources. Namespaces must be a fully qualified name, for example, the child namespace of namespace "endor.prod" called "app" is called "endor.prod.app". - `uuid` string — The UUID of the secret rule. ## Other responses - `default` — An unexpected error response. --- [API](https://skmtc.net/endorlabs/apis/endor-labs-rest-api-reference.md) · [All operations](https://skmtc.net/endorlabs/apis/endor-labs-rest-api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/endorlabs/endor-labs-rest-api-reference/revisions/2fe1f84213b3/schema)