User Guide

Endpoints

Plain HTTP, header-based auth, no request bodies. See Rate & Request Limits for throttling and size caps, and Error Reference for the full error catalog.

Authentication headers

Header	Required	Description
`access-key`	Yes	Your access key
`secret-name`	Yes	Name of the secret
`fernet-key`	No	Custom Fernet key, only if that secret used BYOK

GET /

Redirects to this dashboard site — anyone landing on the bare API domain in a browser ends up somewhere useful instead of a JSON blob.

GET /health

Pings the database directly (not through the pool). Used by the Docker HEALTHCHECK and any external uptime monitor.

200  {"status": "ok"}
500  {"status": "db_down"}

GET /api/get-secret/

Rate limited to 60 requests/minute per key.

curl https://airlock.fastapicloud.dev/api/get-secret/ \
  -H "access-key: your-access-key" \
  -H "secret-name: DATABASE_PASSWORD" \
  -H "fernet-key: optional-custom-key"

200 OK

{"success": "your-secret-value"}

401 / 404 / 500 — see Error Reference for exact messages.

POST /api/create-secret/

Rate limited to 5 requests/minute per key. 201 on success — this is the only endpoint that creates a new row rather than acting on an existing one.

curl -X POST https://airlock.fastapicloud.dev/api/create-secret/ \
  -H "access-key: your-access-key" \
  -H "secret-name: DATABASE_PASSWORD" \
  -H "secret-value: super-secret-password" \
  -H "fernet-key: optional-custom-key"

201 Created

{"success": "Secret has been added successfully! Owner set as my-app-key."}

400 / 401 / 500 — see Error Reference.

PUT /api/update-secret/

curl -X PUT https://airlock.fastapicloud.dev/api/update-secret/ \
  -H "access-key: your-access-key" \
  -H "secret-name: DATABASE_PASSWORD" \
  -H "secret-value: new-super-secret-password" \
  -H "fernet-key: optional-custom-key"

200 OK

{"success": "Success! Updated Secret: DATABASE_PASSWORD"}

404 / 401 / 500 — see Error Reference.

DELETE /api/delete-secret/

curl -X DELETE https://airlock.fastapicloud.dev/api/delete-secret/ \
  -H "access-key: your-access-key" \
  -H "secret-name: DATABASE_PASSWORD"

200 OK

{"success": "Success! Deleted Secret: DATABASE_PASSWORD"}

404 / 401 / 500 — see Error Reference.

Asymmetry worth knowing: invalid-input errors (e.g. a secret name over 255 characters) return 400 on create-secret, but 404 on get-secret, update-secret, and delete-secret — all four routes share the same validate_input() check, but each route's exception handler maps ValueError to a different status code. See Error Reference.