> ## Documentation Index > Fetch the complete documentation index at: https://docs.tai42.ai/llms.txt > Use this file to discover all available pages before exploring further. # Write a secret env value and its manifest !ENV marker together, then reload > Store a pasted secret as an env value and reference it from the manifest by a marker. The env KEY is EITHER an explicit ``key`` OR generated from ``key_hint`` — exactly one (``key | key_hint``). Writes the secret ``value`` to the env store under that key AND marks the key secret (adding it to ``TAI_ENV_SECRET_KEYS``), and writes an ``!ENV ${KEY}`` MARKER at ``manifest_pointer`` — all through the combined ``ConfigService.apply_env_and_change`` pipeline so the env write and the manifest mutate stay consistent. Partial-failure: a manifest-persist failure after the env write does NO rollback — the env write stands as an inert, re-runnable orphan and the op raises loudly. An explicit ``key`` colliding with an existing stored key holding a DIFFERENT value is a loud 400 naming the key; a generated key never shadows a registered settings ``env_var``. The pointer's HEAD segment MUST be ``mcp`` (loud 400 otherwise). The response is the ``reloadConfigResult`` shape; the resolved key is NEVER returned. A dangling ``!ENV`` / X-band refusal surfaces as a loud 400 naming the key (the shared boundary validator, same as ``POST /api/mcp-config``). ## OpenAPI ````yaml /openapi.json post /api/mcp-config/secret-env openapi: 3.1.0 info: description: The operator HTTP surface served under /api/*. title: tai42-skeleton API version: 14.0.2 servers: [] security: [] paths: /api/mcp-config/secret-env: post: tags: - manifest summary: >- Write a secret env value and its manifest !ENV marker together, then reload description: >- Store a pasted secret as an env value and reference it from the manifest by a marker. The env KEY is EITHER an explicit ``key`` OR generated from ``key_hint`` — exactly one (``key | key_hint``). Writes the secret ``value`` to the env store under that key AND marks the key secret (adding it to ``TAI_ENV_SECRET_KEYS``), and writes an ``!ENV ${KEY}`` MARKER at ``manifest_pointer`` — all through the combined ``ConfigService.apply_env_and_change`` pipeline so the env write and the manifest mutate stay consistent. Partial-failure: a manifest-persist failure after the env write does NO rollback — the env write stands as an inert, re-runnable orphan and the op raises loudly. An explicit ``key`` colliding with an existing stored key holding a DIFFERENT value is a loud 400 naming the key; a generated key never shadows a registered settings ``env_var``. The pointer's HEAD segment MUST be ``mcp`` (loud 400 otherwise). The response is the ``reloadConfigResult`` shape; the resolved key is NEVER returned. A dangling ``!ENV`` / X-band refusal surfaces as a loud 400 naming the key (the shared boundary validator, same as ``POST /api/mcp-config``). operationId: post_api_mcp_config_secret_env requestBody: content: application/json: schema: $ref: '#/components/schemas/SetMcpSecretEnv' required: true responses: '200': content: application/json: schema: properties: data: $ref: '#/components/schemas/ApplyResponse' required: - data type: object description: Success. '400': content: application/json: schema: $ref: '#/components/schemas/Error' description: Malformed request. '401': content: application/json: schema: $ref: '#/components/schemas/Error' description: Missing or invalid api key. '503': content: application/json: schema: $ref: '#/components/schemas/ReloadingError' description: The server is applying a config reload; retry shortly. headers: Retry-After: description: Seconds to wait before retrying. schema: type: integer security: - ApiKeyAuth: [] components: schemas: SetMcpSecretEnv: description: >- The combined env+manifest secret op body (``POST /api/mcp-config/secret-env``). ``value`` is the raw secret pasted by the operator. The env KEY it is stored under is EITHER an explicit ``key`` OR generated from ``key_hint`` — exactly one is given (``{value, key | key_hint, manifest_pointer}``). The server writes ``value`` to the env store under that key (marked secret) and writes an ``!ENV ${KEY}`` MARKER at ``manifest_pointer`` — so the secret lives only in the env store and the manifest carries a placeholder. An explicit ``key`` that collides with an existing stored key holding a DIFFERENT value is refused with a loud 400 naming the key (never a silent overwrite of a live secret). ``manifest_pointer`` is a slash-delimited, no-leading-slash path (e.g. ``mcp/0/config/headers/Authorization``) whose HEAD segment MUST be ``mcp`` (the same mcp-only authority ``set_mcp_config`` holds). The generated key is NOT returned. properties: key: anyOf: - type: string - type: 'null' default: null title: Key key_hint: anyOf: - type: string - type: 'null' default: null title: Key Hint manifest_pointer: title: Manifest Pointer type: string value: title: Value type: string required: - value - manifest_pointer title: SetMcpSecretEnv type: object ApplyResponse: description: >- The standard mutation-op response: this worker's local reload result merged with the fleet fan-out summary. ``env_keys`` is the count of env keys the reload loaded. properties: env_keys: title: Env Keys type: integer fanout: $ref: '#/components/schemas/FanoutSummary' status: title: Status type: string required: - status - env_keys - fanout title: ApplyResponse type: object Error: properties: code: description: >- Stable machine-readable reason a client keys a dedicated error state on, present on refusals that opt in (e.g. a 501 not-configured refusal). Optional: absent when the error carries only a human-readable message. type: string error: type: string required: - error type: object ReloadingError: properties: error: const: reloading — the server is applying a config reload; retry shortly type: string reloading: const: true type: boolean required: - error - reloading type: object FanoutSummary: description: >- The mode-tagged fan-out summary embedded under a mutation response's ``fanout`` field. ``mode`` selects the shape: ``local-only`` carries only ``note`` (a lone worker reached no sibling); ``fleet`` and ``unreachable`` carry the per-worker broadcast report (``op``/``reachable``/``local_only``/``results``/``error``), the ``unreachable`` variant having no worker list, only ``error``. The mode-variant fields are optional so one model describes every mode without reshaping any wire payload. properties: error: anyOf: - type: string - type: 'null' default: null title: Error local_only: anyOf: - type: boolean - type: 'null' default: null title: Local Only mode: title: Mode type: string note: anyOf: - type: string - type: 'null' default: null title: Note op: anyOf: - type: string - type: 'null' default: null title: Op reachable: anyOf: - type: boolean - type: 'null' default: null title: Reachable results: anyOf: - items: $ref: '#/components/schemas/FanoutWorkerResult' type: array - type: 'null' default: null title: Results required: - mode title: FanoutSummary type: object FanoutWorkerResult: description: >- One worker's verdict within a multi-worker fan-out report. ``payload`` carries a query op's per-worker data; ``error`` a failed apply's message; ``detail`` the publisher's note for a computed missing/departed/ timed-out verdict. ``outcome`` is the worker's terminal outcome as its wire string. properties: detail: anyOf: - type: string - type: 'null' default: null title: Detail error: anyOf: - type: string - type: 'null' default: null title: Error name: title: Name type: string outcome: title: Outcome type: string payload: anyOf: - $ref: '#/components/schemas/JsonValue' - type: 'null' default: null required: - name - outcome title: FanoutWorkerResult type: object JsonValue: {} securitySchemes: ApiKeyAuth: in: header name: x-api-key type: apiKey ````