Secrets provider binding

secrets:multi-vault

A secrets provider binding declares which secrets provider serves which estate subtree: / binds the estate default, project and environment scopes override it down the node tree, and the deepest covering scope wins at resolution. Writing bindings requires the secrets:multi-vault feature. Served by the v2 SecretsProviderService (ListSecretsProviderBindings, SetSecretsProviderBinding, DeleteSecretsProviderBinding, ResolveSecretsProviderBinding — the last answers which provider a node path resolves through and why).

SecretsProviderBinding

SecretsProviderBinding is one declared scope-path → provider mapping: '/' binds the estate default, '/projects/

' and '/projects/
/environments/' override it down the node tree, deepest scope winning. The provider_* health fields join the bound provider's recorded test outcome for the posture view.

Field
Type
Meaning
created_at
timestamp
When the record was created.
id
string
The record's identity.
provider_code
string
The bound provider's code.
provider_enabled
boolean
The bound provider's enabled state, carried so the posture view shows a dead binding at a glance.
provider_id
string
The bound provider's identity.
provider_last_test_at
timestamp
The bound provider's most recent test instant; unset until the first test.
provider_last_test_error
string
The bound provider's most recent test failure reason; empty when it succeeded or none ran.
provider_last_test_success
boolean
Whether the bound provider's most recent test succeeded.
scope_path
string
The scope path: "/" (the estate default), "/projects/
" or "/projects/
/environments/".
updated_at
timestamp
When the record was last updated.
Related pages

opschain docs resources/secrets_provider — the provider record a binding points at.
opschain docs secrets-providers — the component page: resolution order and multi-vault posture.