secrets:used

secrets family

Close the loop on one use of a lent key: `mark` on the path `actor → provider:<name>`, or `warn` on it when `refused` is set. Written by whoever made the call (the web resolver, channels) — the opener keeps the meter and writes no signal (plan D9).

Effect: signal; Fire-and-forget — the call returns once accepted, not once done.
Caller: authenticated; The class of authority the caller must already hold, decided from the attested context with no round trip.
Cost: free; What one call costs, so you can budget before acting.
Reversible: no; This cannot be undone. Dry-run it first where the contract allows.
Idempotent: no; Not safe to blind-retry — dedupe on the envelope idempotencyKey.

Send it with your agent

One click hands your coding agent a prompt that registers the substrate, reads this contract, and makes the call. Launch opens the app; the others copy the prompt.

Claude Code

Codex

Cursor

Gemini CLI

Claude Desktop

ChatGPT

curl -X POST https://one.ie/api/signal/secrets:used \
  -H "Authorization: Bearer $ONE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"data": { "provider": "openai", "secret": "0xv/OPENAI", "grant": "g1", "today": 12, "perDay": 500 }}'

The key is never in a link. npx -y @oneie/cli login writes it to ~/.config/oneie/key on your machine.

Request

Validated before dispatch — an invalid payload is refused with the fix, never half-applied.

provider openai | anthropic | stripe | … required The provider row the call went to — the same closed set secrets:call takes; a path `actor → provider:<name>` is only ever written for a real row.
secret string optional `<vault>/<NAME>` that was used.
grant string optional The grant id the call ran on.
today number optional Calls on that grant today, after this one.
perDay number optional
refused no_key | bad_signature | cannot_verify | … optional Set when the call was refused — the loop closes with a warn instead of a mark. The opener's REFUSALS, then the web side's own: not_in_workflow · opener_unbound · opener_unreachable.

Response

The acknowledgement shape — the work itself completes after the call returns.

ok boolean
closed mark | warn
actor string
provider string
error string

Traffic

Every call to secrets:used, counted where it is dispatched — over HTTP or in-process alike. Aggregate only — no actor, no payload, no workspace.

Counting…

Wiring

Every place in the open source that names secrets:used, and the file that answers it. Read from the tree at build time — a receiver is reached by NAME through one door, so there is no import edge to follow and a grep is the honest shape of the question. Structure, not volume — the count is in Traffic above.

Called from

API route 5

one.ie/web/src/lib/composio.ts:44
one.ie/web/src/lib/receiver-index.generated.ts:327
one.ie/web/src/lib/resolvers/composio-tools.ts:13
one.ie/web/src/lib/resolvers/secrets.ts:6
one.ie/web/src/pages/api/composio/verify.ts:19

SDK 1

packages/sdk/src/secrets.ts:73

→

Answered by

secrets:used one.ie/web/src/lib/resolvers/secrets.ts:221 Dispatched through POST /api/signal/secrets:used, after the envelope validates the payload.

secrets family · 2 more

secrets:call secrets:give

JSON Schema

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "properties": {
    "provider": {
      "type": "string",
      "enum": [
        "openai",
        "anthropic",
        "stripe",
        "github",
        "dataforseo",
        "composio"
      ],
      "description": "The provider row the call went to — the same closed set secrets:call takes; a path `actor → provider:<name>` is only ever written for a real row."
    },
    "secret": {
      "description": "`<vault>/<NAME>` that was used.",
      "type": "string"
    },
    "grant": {
      "description": "The grant id the call ran on.",
      "type": "string"
    },
    "today": {
      "description": "Calls on that grant today, after this one.",
      "type": "number"
    },
    "perDay": {
      "type": "number"
    },
    "refused": {
      "description": "Set when the call was refused — the loop closes with a warn instead of a mark. The opener's REFUSALS, then the web side's own: not_in_workflow · opener_unbound · opener_unreachable.",
      "type": "string",
      "enum": [
        "no_key",
        "bad_signature",
        "cannot_verify",
        "stopped",
        "expired",
        "over_limit",
        "path_not_allowed",
        "redirect",
        "unknown_provider",
        "bad_key",
        "not_in_workflow",
        "opener_unbound",
        "opener_unreachable"
      ]
    }
  },
  "required": [
    "provider"
  ]
}

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "properties": {
    "ok": {
      "type": "boolean"
    },
    "closed": {
      "type": "string",
      "enum": [
        "mark",
        "warn"
      ]
    },
    "actor": {
      "type": "string"
    },
    "provider": {
      "type": "string"
    },
    "error": {
      "type": "string"
    }
  },
  "required": [
    "ok"
  ]
}