Secrets provider binding

secrets:multi-vault

A secrets provider binding declares which secrets provider serves which estate subtree: / binds the estate default, project and environment scopes override it down the node tree, and the deepest covering scope wins at resolution. Writing bindings requires the secrets:multi-vault feature. Served by the v2 SecretsProviderService (ListSecretsProviderBindings, SetSecretsProviderBinding, DeleteSecretsProviderBinding, ResolveSecretsProviderBinding — the last answers which provider a node path resolves through and why, and with origin_path which provider the node that supplied a value resolves through). Which node a reference is routed by follows the layer that supplied its value: a value entered in a node's own properties routes by that node's binding, a value committed in the template's repository or supplied per run routes by the resolving node's; secret-vault://origin@… and secret-vault://here@… pin a reference to the supplying or the resolving node, and secret-vault://<code>@… names its provider outright. origin and here are reserved and refused as provider codes.

SecretsProviderBinding

SecretsProviderBinding is one declared scope-path → provider mapping: '/' binds the estate default, '/projects/

' and '/projects/
/environments/' override it down the node tree, deepest scope winning. The provider_* health fields join the bound provider's recorded test outcome for the posture view.

Field
Type
Meaning
created_at
timestamp
When the record was created.
id
string
The record's identity.
provider_code
string
The bound provider's code.
provider_enabled
boolean
The bound provider's enabled state, carried so the posture view shows a dead binding at a glance.
provider_id
string
The bound provider's identity.
provider_last_test_at
timestamp
The bound provider's most recent test instant; unset until the first test.
provider_last_test_error
string
The bound provider's most recent test failure reason; empty when it succeeded or none ran.
provider_last_test_success
boolean
Whether the bound provider's most recent test succeeded.
scope_path
string
The scope path: "/" (the estate default), "/projects/
" or "/projects/
/environments/".
updated_at
timestamp
When the record was last updated.
Related pages

opschain docs resources/secrets_provider — the provider record a binding points at.
opschain docs secrets-providers — the component page: resolution order and multi-vault posture.