secrets:call

secrets family

Use a key somebody lent you, without ever holding it. The opener finds your grant, checks its signature against the vault's grant-signers, counts the call BEFORE it is made, opens the key in memory, sends ONE request to the provider's fixed host and header on an allow-listed path (no redirect followed), scrubs the key from the answer and drops it. The caller is the session or attested agent — a body field never names it.

Effect: ask; Awaits an outcome — the call returns the response below.
Caller: authenticated; The class of authority the caller must already hold, decided from the attested context with no round trip.
Cost: variable; What one call costs, so you can budget before acting.
Reversible: no; This cannot be undone. Dry-run it first where the contract allows.
Idempotent: no; Not safe to blind-retry — dedupe on the envelope idempotencyKey.

Send it with your agent

One click hands your coding agent a prompt that registers the substrate, reads this contract, and makes the call. Launch opens the app; the others copy the prompt.

Claude Code

Codex

Cursor

Gemini CLI

Claude Desktop

ChatGPT

curl -X POST https://one.ie/api/ask/secrets:call \
  -H "Authorization: Bearer $ONE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"data": { "provider": "openai", "request": { "method": "POST", "path": "/v1/chat/completions", "body": { "model": "gpt-4o-mini", "messages": [ { "role": "user", "content": "hi" } ] } } }}'

The key is never in a link. npx -y @oneie/cli login writes it to ~/.config/oneie/key on your machine.

Request

Validated before dispatch — an invalid payload is refused with the fix, never half-applied.

provider openai | anthropic | stripe | … required A row of secrets/src/providers.ts — the one host and header a key may be sent to. Anything else refuses unknown_provider.
secret string optional `<vault>/<NAME>` of one lent secret, when you hold grants on several keys for this provider. Omitted: the first grant to you for this provider.
request object required

Response

What comes back from the call.

ok boolean
status number The provider's status; 0 when the request failed or timed out — still counted (plan D6).
body any The provider's answer, JSON when it was JSON, with the key's value and its last 12 characters scrubbed. Headers are never returned.
used object The meter after this call — the owner's desk shows the same numbers.
refused no_key | bad_signature | cannot_verify | … The closed set of @oneie/sdk/secrets REFUSALS. bad_key: the sealed value cannot be sent as-is (counted, nothing sent).
detail string The numbers behind a refusal (`49/50`), the expiry, or the check that bit.
error string unauthorized · not_in_workflow (a workflow step inherits the runner's session and never spends a lent grant) · opener_unbound · opener_unreachable — the web side refused before the opener, or could not reach it.

Traffic

Every call to secrets:call, counted where it is dispatched — over HTTP or in-process alike. Aggregate only — no actor, no payload, no workspace.

Counting…

Wiring

Every place in the open source that names secrets:call, and the file that answers it. Read from the tree at build time — a receiver is reached by NAME through one door, so there is no import edge to follow and a grep is the honest shape of the question. Structure, not volume — the count is in Traffic above.

Called from

API route 4

one.ie/web/src/lib/composio.ts:28
one.ie/web/src/lib/receiver-index.generated.ts:325
one.ie/web/src/lib/resolvers/_shared.ts:43
one.ie/web/src/lib/resolvers/secrets.ts:26

SDK 1

packages/sdk/src/secrets.ts:71

→

Answered by

secrets:call one.ie/web/src/lib/resolvers/secrets.ts:220 Dispatched through POST /api/ask/secrets:call, after the envelope validates the payload.

secrets family · 2 more

secrets:give secrets:used

JSON Schema

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "properties": {
    "provider": {
      "type": "string",
      "enum": [
        "openai",
        "anthropic",
        "stripe",
        "github",
        "dataforseo",
        "composio"
      ],
      "description": "A row of secrets/src/providers.ts — the one host and header a key may be sent to. Anything else refuses unknown_provider."
    },
    "secret": {
      "description": "`<vault>/<NAME>` of one lent secret, when you hold grants on several keys for this provider. Omitted: the first grant to you for this provider.",
      "type": "string"
    },
    "request": {
      "type": "object",
      "properties": {
        "method": {
          "type": "string",
          "enum": [
            "GET",
            "POST",
            "PUT",
            "PATCH",
            "DELETE"
          ]
        },
        "path": {
          "type": "string",
          "description": "The provider path, e.g. `/v1/chat/completions`. Every provider row is an allow-catalogue (plan D17): the method AND the decoded, normalised path must match one entry exactly, and every query key must be one that entry names — else path_not_allowed. The grant's for.paths names entries (ids or exact templates) and can never add one; absent, the row's default set."
        },
        "body": {
          "description": "Sent as JSON (a string is sent as-is). Ignored on GET. When the grant carries for.models, a model-taking entry needs a JSON body in which EVERY field named `model`, at any depth, is on that list."
        }
      },
      "required": [
        "method",
        "path"
      ]
    }
  },
  "required": [
    "provider",
    "request"
  ]
}

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "properties": {
    "ok": {
      "type": "boolean"
    },
    "status": {
      "description": "The provider's status; 0 when the request failed or timed out — still counted (plan D6).",
      "type": "number"
    },
    "body": {
      "description": "The provider's answer, JSON when it was JSON, with the key's value and its last 12 characters scrubbed. Headers are never returned."
    },
    "used": {
      "description": "The meter after this call — the owner's desk shows the same numbers.",
      "type": "object",
      "properties": {
        "secret": {
          "type": "string"
        },
        "grant": {
          "type": "string"
        },
        "today": {
          "type": "number"
        },
        "perDay": {
          "type": "number"
        }
      },
      "required": [
        "secret",
        "grant",
        "today",
        "perDay"
      ]
    },
    "refused": {
      "description": "The closed set of @oneie/sdk/secrets REFUSALS. bad_key: the sealed value cannot be sent as-is (counted, nothing sent).",
      "type": "string",
      "enum": [
        "no_key",
        "bad_signature",
        "cannot_verify",
        "stopped",
        "expired",
        "over_limit",
        "path_not_allowed",
        "redirect",
        "unknown_provider",
        "bad_key"
      ]
    },
    "detail": {
      "description": "The numbers behind a refusal (`49/50`), the expiry, or the check that bit.",
      "type": "string"
    },
    "error": {
      "description": "unauthorized · not_in_workflow (a workflow step inherits the runner's session and never spends a lent grant) · opener_unbound · opener_unreachable — the web side refused before the opener, or could not reach it.",
      "type": "string"
    }
  },
  "required": [
    "ok"
  ]
}