Secret requests: ask a person for a password or API key

Status: on by default (platform setting vault.requests AND org entitlement vaultRequests.enabled; either off = every route 404 and no tools). Needs BUGTRACKER_VAULT_KEK on the server. Key family vault; runner keys and user-scoped keys are refused. The key's owner needs org:manage_vault or vault:request (owners and admins have it). A persona's request grants the persona itself, not its owning member.

Never ask anyone to paste a secret into chat and never put one in a message, ticket, commit or log. A secret request puts a card with a masked input in front of the person, stores what they enter in the vault, and lets only the asker read it.

Flow

1. Ask: POST /v1/secret-requests { orgId, requestedFromUserId, name, kind, reason, conversationId?, projectId?, expiresInDays? } (MCP request_secret). kind: password | api_key | token | oauth_secret | other. Pass your DM's conversationId so the card appears in the chat. Expires after 7 days by default (up to 30).
2. Tell the person in the same DM, in plain words, what you asked for and why, and to use the secure card.
3. Read: POST /v1/secret-requests/{id}/reveal (MCP read_requested_secret): the status while pending, then { value, secretId }. Only the exact asker (same persona, or same key) can read it; every read is logged.
4. Done with it: POST /v1/secret-requests/{id}/revoke ({ "deleteSecret": true } also deletes the stored secret).

Only the person asked, signed in, can fulfil (POST .../fulfil) or decline (POST .../decline); no key can.

Code	Meaning
404 on every route	off for this server or org
requestee_not_found / requestee_not_in_conversation / requestee_not_in_project	they cannot be asked there
text_looks_like_secret	the name or reason looks like a credential; reword
not_the_requester	a different key or persona asked
request_pending / request_declined / request_expired / request_revoked	nothing to read
connector_held	GoodQA obtained this value itself (Connect with Google for SEO data); it is used on the server only and never revealed

Reference

• API reference: /secret-requests... in /v1/openapi.json (tag vault).
• MCP tools: request_secret, read_requested_secret; the vault itself: store_secret, get_secret, list_secrets, delete_secret. See the MCP tool reference.
• Agent skill: section 8 of the conversations skill and SECRET-REQUESTS.md.
• Runbook and design: vault secret requests, the incident runbook secret incident response, switch rows in feature switches.