---
title: "Create a Secret Store for the given organization."
method: POST
path: "/orgs/{orgId}/secretstores"
tags: ["public", "SecretStore"]
---

# Create a Secret Store for the given organization.

`POST /orgs/{orgId}/secretstores`

## Path parameters

- `orgId` string, required

## Request body

- CreateSecretStorePayloadRequest — Secret Store represents external secret management system used by an organization to store secrets referenced in Humanitec. It must contain exactly one of the following elements to define Secret Store specification: `awssm` (AWS Secret Manager), `azurekv` (Azure Key Vault), `gcpsm` (GCP Secret Manager), `vault` (HashiCorp Vault).
  - `awssm` AWSSMRequest — AWS Secret Manager specification.
    - `auth` AWSAuthRequest — Credentials to authenticate AWS Secret Manager.
      - `access_key_id` string
      - `secret_access_key` string
    - `endpoint` string
    - `region` string
  - `azurekv` AzureKVRequest — Azure Key Vault specification.
    - `auth` AzureAuthRequest — Credentials to authenticate Azure Key Vault.
      - `client_id` string
      - `client_secret` string
    - `tenant_id` string
    - `url` string
  - `gcpsm` GCPSMRequest — GCP Secret Manager specification.
    - `auth` GCPAuthRequest — Credentials to authenticate GCP Secret Manager.
      - `secret_access_key` string
    - `project_id` string
  - `id` string, required — The Secret Store ID.
  - `primary` boolean, required — Defines whether the Secret Store is the primary secret management system for the organization.
  - `vault` VaultRequest — Vault specification.
    - `agent_id` string
    - `auth` VaultAuthRequest — Credentials to authenticate Vault.
      - `role` string
      - `token` string
    - `path` string
    - `url` string

## Response `201`

Secret Store successfully added.

- SecretStoreResponse — Secret Store represents external secret management system used by an organization to store secrets referenced in Humanitec.
  - `awssm` AWSSMResponse — AWS Secret Manager specification.
    - `endpoint` string
    - `region` string
  - `azurekv` AzureKVResponse — Azure Key Vault specification.
    - `tenant_id` string
    - `url` string
  - `created_at` string, required
  - `created_by` string, required
  - `gcpsm` GCPSMResponse — GCP Secret Manager specification.
    - `project_id` string
  - `humanitec` HumanitecResponse — Humanitec built-in Secret Store specification.
  - `id` string, required
  - `primary` boolean, required
  - `updated_at` string, required
  - `updated_by` string, required
  - `vault` VaultResponse — Vault specification.
    - `agent_id` string
    - `path` string
    - `url` string

## Other responses

- `400` — One or more request body parameters are either missing, invalid, or the requested payload is not provided or is malformed.
- `401` — Request unauthorised.
- `409` — Conflict.

---

[API](https://skmtc.net/humanitec/apis/humanitec-api.md) · [All operations](https://skmtc.net/humanitec/apis/humanitec-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/humanitec/humanitec-api/revisions/e21ad140ec3c/schema)