---
title: "Replace agent secrets"
method: PUT
path: "/v2/agents/{agent_key}/secrets"
tags: ["Agent Secrets"]
---

# Replace agent secrets

`PUT /v2/agents/{agent_key}/secrets`

Replaces the agent's secrets. The submitted map fully replaces the previous set. Names not in the request are removed.
Secrets are stored encrypted at rest.

## Path parameters

- `agent_key` string, required — A unique key that identifies an agent.

## Headers

- `Request-Timeout` integer
- `Request-Timeout-Millis` integer

## Request body

- ReplaceAgentSecretsRequest — Request body that replaces the agent's secrets. The submitted map fully replaces the stored set. Names not in the request are removed. Secrets are stored encrypted at rest.
  - `secrets` object, required — Map of secret name to plaintext value.

## Response `200`

The agent's secrets after the replace, with values masked.

- AgentSecrets — Agent-scoped secrets for the agent. On read, values are masked (`****`). Plaintext is never returned. Reference values from a tool's `argument_override` via `{"$ref": "agent.secrets.<name>"}`.
  - `secrets` object, required — Map of secret name to masked value.

## Other responses

- `400` — Invalid request.
- `403` — Permissions do not allow modifying this agent.
- `404` — Agent not found.

---

[API](https://skmtc.net/vectara/apis/vectara-rest-api-v2.md) · [All operations](https://skmtc.net/vectara/apis/vectara-rest-api-v2/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/vectara/vectara-rest-api-v2/versions/fca567a46b3a/schema)