swarm_secret

The swarm_secret domain has 5 actions. On the meta surface they are all reached through arcane_swarm_secret; on the individual surface each one is its own tool; on the dynamic surface run them with arcane_execute_action and the canonical ID.

Summary

Action	Title	Kind
swarm_secret.create	Create swarm secret	write
swarm_secret.delete	Delete swarm secret	destructive
swarm_secret.get	Get swarm secret	read
swarm_secret.list	List swarm secrets	read
swarm_secret.update	Update swarm secret labels	write

Actions

swarm_secret.create

Create swarm secret

• Kind: write
• Required parameters: spec
• Meta tool: arcane_swarm_secret with "action": "create"
• Individual tool: arcane_swarm_secret_create
• Arcane route: POST /api/environments/{id}/swarm/secrets
• Operation ID: create-swarm-secret
• Usage: spec uses Docker’s field names: {Name (required), Data (the secret, base64-encoded), Labels}. Returns the created secret with its id. The value can never be read back, and secrets are immutable: to rotate, create a new secret and reference it in the service’s spec.TaskTemplate.ContainerSpec.Secrets (SecretID, SecretName, File) with swarm_service.create or swarm_service.update. Requires the swarm:secrets permission. Use swarm_config.create for non-sensitive data.
• Related actions: swarm_secret.list, swarm_service.create, swarm_service.update, swarm_config.create

swarm_secret.delete

Delete swarm secret

• Kind: destructive — requires confirm: true
• Required parameters: secretId
• Meta tool: arcane_swarm_secret with "action": "delete"
• Individual tool: arcane_swarm_secret_delete
• Arcane route: DELETE /api/environments/{id}/swarm/secrets/{secretId}
• Operation ID: delete-swarm-secret
• Usage: secretId (ID or name) from swarm_secret.list. Refused while any service still references the secret. Update or delete that service first (its old tasks may take a moment to release it). Requires the swarm:secrets permission.
• Related actions: swarm_secret.list, swarm_service.list, swarm_service.update, swarm_service.delete

swarm_secret.get

Get swarm secret

• Kind: read
• Required parameters: secretId
• Meta tool: arcane_swarm_secret with "action": "get"
• Individual tool: arcane_swarm_secret_get
• Arcane route: GET /api/environments/{id}/swarm/secrets/{secretId}
• Operation ID: get-swarm-secret
• Usage: secretId from swarm_secret.list (Docker also resolves a name). Returns id, version, timestamps and spec (Name, Labels) only: Docker never returns a secret’s data. Not found returns 404, and the environment must be a swarm manager.
• Related actions: swarm_secret.list, swarm_secret.delete, swarm_service.list

swarm_secret.list

List swarm secrets

• Kind: read
• Required parameters: none
• Meta tool: arcane_swarm_secret with "action": "list"
• Individual tool: arcane_swarm_secret_list
• Arcane route: GET /api/environments/{id}/swarm/secrets
• Operation ID: list-swarm-secrets
• Usage: Returns a page of the environment’s swarm secrets (start, limit default 20), each with id, spec (Name, Labels), version and timestamps. The secret value is never included. search matches the name or ID, sort by name, createdAt or updatedAt with order asc or desc. The environment must be a swarm manager: outside a swarm it fails with ‘Swarm mode is not enabled’, on a worker with ‘Swarm manager access required’ (swarm.status only reports whether swarm mode is on, not the node’s role). Requires swarm:read.
• Related actions: swarm_secret.get, swarm_secret.create, swarm_secret.delete, swarm_secret.update, swarm.status

swarm_secret.update

Update swarm secret labels

• Kind: write
• Required parameters: secretId, labels, version
• Meta tool: arcane_swarm_secret with "action": "update"
• Individual tool: arcane_swarm_secret_update
• Arcane route: PUT /api/environments/{id}/swarm/secrets/{secretId}
• Operation ID: update-swarm-secret
• Since: Arcane v2.17.0
• Usage: Replaces the labels of a secret (secretId, ID or name, from swarm_secret.list) with labels ({} clears them). The value and name are immutable, so to rotate it create a new secret and reference it from the services (swarm_service.update). version is the secret’s version.Index from swarm_secret.get (0 uses the current one), and a stale version is refused by Docker. Returns the updated secret without its value. Requires the swarm:secrets permission.
• Related actions: swarm_secret.get, swarm_secret.list, swarm_secret.create, swarm_service.update