Environment schema

An agent working on your code often needs to know which secrets exist, for example to wire up a new DATABASE_URL or explain why a request fails without STRIPE_KEY. Give it the schema, not the values.

stashbase secrets schema pull writes a YAML file with the project and environment metadata plus each secret's name and comment. Secret values are never included.

stashbase secrets schema pull --project my-project --environment api-dev

This writes env.schema.yaml in the current directory:

project:
  id: prj_...
  name: my-project
  description: Application secrets
environment:
  id: env_...
  name: api-dev
  description: Development environment
  is_production: false
secrets:
  - name: DATABASE_URL
    comment: PostgreSQL connection string
  - name: JWT_KEY

Keep the file in the repository or point your agent to it. Secret comments become the agent's documentation, so describe what each secret is for.

The schema only describes the environment. To let the agent use a secret, bind it in an agent profile, where it gets a placeholder that works only for approved requests.

See the secrets schema pull reference for all options.