# Create

Launch stage: GA

`POST /api/2.1/unity-catalog/secrets`

Creates a new secret in Unity Catalog.

 You must be the owner of the parent schema or have the **CREATE_SECRET** and **USE SCHEMA**
 privileges on the parent schema and **USE CATALOG** on the parent catalog.

 The secret is stored in the specified catalog and schema, and the **value** field
 contains the sensitive data to be securely stored.

API scopes: unity-catalog

## Request body

- `secret` (object, optional)
  The secret object to create. The **name**, **catalog_name**, **schema_name**, and **value**
   fields are required.
  - `name` (string, optional)
    The name of the secret, relative to its parent schema.
  - `owner` (string, optional)
    The owner of the secret. Defaults to the creating principal on creation. Can be updated to
     transfer ownership of the secret to another principal.
  - `effective_owner` (string, optional)
    The effective owner of the secret, which may differ from the directly-set **owner** due to
     inheritance.
  - `metastore_id` (string, optional)
    Unique identifier of the metastore hosting the secret.
  - `create_time` (string, optional)
    The time at which this secret was created.
  - `created_by` (string, optional)
    The principal that created the secret.
  - `update_time` (string, optional)
    The time at which this secret was last updated.
  - `updated_by` (string, optional)
    The principal that last updated the secret.
  - `comment` (string, optional)
    User-provided free-form text description of the secret.
    Constraints: `[ 1 .. 65536 ] characters`
  - `full_name` (string, optional)
    The three-level (fully qualified) name of the secret, in the form of **catalog_name.schema_name.secret_name**.
  - `catalog_name` (string, optional)
    The name of the catalog where the schema and the secret reside.
  - `schema_name` (string, optional)
    The name of the schema where the secret resides.
  - `value` (string, optional)
    The secret value to store. This field is input-only and is not returned in responses — use
     the **effective_value** field (via GetSecret with **include_value** set to true) to read the
     secret value. The maximum size is 60 KiB (pre-encryption). Accepted content includes
     passwords, tokens, keys, and other sensitive credential data.
    Constraints: `[ 1 .. 61440 ] characters`
  - `effective_value` (string, optional)
    The secret value. Only populated in responses when you have the **READ_SECRET**
     privilege and **include_value** is set to true in the request. The maximum size is 60 KiB.
    Constraints: `[ 1 .. 61440 ] characters`
  - `expire_time` (string, optional)
    User-provided expiration time of the secret. This field indicates when the secret should no
     longer be used and may be displayed as a warning in the UI. It is purely informational and
     does not trigger any automatic actions or affect the secret's lifecycle.

## Returns

Returns the Secret object.

## Response

```json
{
  "name": "string",
  "owner": "string",
  "effective_owner": "string",
  "metastore_id": "string",
  "create_time": "string",
  "created_by": "string",
  "update_time": "string",
  "updated_by": "string",
  "comment": "string",
  "full_name": "string",
  "catalog_name": "string",
  "schema_name": "string",
  "value": "string",
  "effective_value": "string",
  "expire_time": "string"
}
```