## Update a workspace secret

`$ cadenya workspace-secrets update`

**patch** `/v1/workspace_secrets/{id}`

Updates a workspace secret in the workspace

### Parameters

- `--id: string`

  Workspace Secret ID (from path)

- `--metadata: optional object { name, externalId, labels }`

  UpdateResourceMetadata contains the user-provided fields for updating
  a workspace-scoped resource. Read-only fields (id, account_id, workspace_id, profile_id,
  created_at) are excluded since they are set by the server.

- `--spec: optional object { value }`

- `--update-mask: optional string`

  Fields to update

### Returns

- `workspace_secret: object { metadata, spec, info }`

  - `metadata: object { id, accountId, createdAt, 5 more }`

    Standard metadata for persistent, named resources (e.g., agents, tools, prompts)

    - `id: string`

      Unique identifier for the resource (prefixed ULID, e.g., "agent_01HXK...")

    - `accountId: string`

      Account this resource belongs to for multi-tenant isolation (prefixed ULID)

    - `createdAt: string`

      Timestamp when this resource was created

    - `name: string`

      Human-readable name for the resource (e.g., "Customer Support Agent", "Email Tool")
      Required for resources that users interact with directly

    - `profileId: string`

      ID of the actor (user or service account) that created this resource

    - `workspaceId: string`

      Workspace this resource belongs to for organizational grouping (prefixed ULID)

    - `externalId: optional string`

      External ID for the resource (e.g., a workflow ID from an external system)

    - `labels: optional map[string]`

      Arbitrary key-value pairs for categorization and filtering
      Examples: {"environment": "production", "team": "platform", "version": "v2"}

  - `spec: object { value }`

    - `value: optional string`

  - `info: optional object { createdBy, lastUsedAt }`

    Workspace secret information

    - `createdBy: optional object { metadata, spec }`

      Profile represents a human user at the account level.
      Profiles are account-scoped resources that can be associated with multiple workspaces
      through the Actor model. Authentication for profiles is handled via SSO/OAuth (WorkOS).

      - `metadata: object { id, accountId, name, 3 more }`

        AccountResourceMetadata is used to represent a resource that is associated to an account but not to a workspace.

        - `id: string`

          Unique identifier for the resource (prefixed ULID, e.g., "apikey_01HXK...")

        - `accountId: string`

          Account this resource belongs to for multi-tenant isolation (prefixed ULID)

        - `name: string`

          Human-readable name for the resource (e.g., "Customer Support Agent", "Email Tool")
          Required for resources that users interact with directly

        - `profileId: string`

        - `externalId: optional string`

          External ID for the resource (e.g., a workflow ID from an external system)

        - `labels: optional map[string]`

          Arbitrary key-value pairs for categorization and filtering
          Examples: {"environment": "production", "team": "platform", "version": "v2"}

      - `spec: object { type, email, name }`

        ProfileSpec contains the profile-specific fields

        - `type: "PROFILE_TYPE_USER" or "PROFILE_TYPE_API_KEY" or "PROFILE_TYPE_SYSTEM"`

          Type is the type of profile. User's are humans, API keys are computers. You know the deal.

          - `"PROFILE_TYPE_USER"`

          - `"PROFILE_TYPE_API_KEY"`

          - `"PROFILE_TYPE_SYSTEM"`

        - `email: optional string`

          Email address of the user (required, unique per account)

        - `name: optional string`

          Display name for the user (e.g., "Bobby Tables")

    - `lastUsedAt: optional string`

### Example

```cli
cadenya workspace-secrets update \
  --api-key 'My API Key' \
  --id id
```

#### Response

```json
{
  "metadata": {
    "id": "id",
    "accountId": "accountId",
    "createdAt": "2019-12-27T18:11:19.117Z",
    "name": "name",
    "profileId": "profileId",
    "workspaceId": "workspaceId",
    "externalId": "externalId",
    "labels": {
      "foo": "string"
    }
  },
  "spec": {
    "value": "value"
  },
  "info": {
    "createdBy": {
      "metadata": {
        "id": "id",
        "accountId": "accountId",
        "name": "name",
        "profileId": "profileId",
        "externalId": "externalId",
        "labels": {
          "foo": "string"
        }
      },
      "spec": {
        "type": "PROFILE_TYPE_USER",
        "email": "email",
        "name": "name"
      }
    },
    "lastUsedAt": "2019-12-27T18:11:19.117Z"
  }
}
```