published on Friday, Sep 11, 2026 by incident-io
published on Friday, Sep 11, 2026 by incident-io
Manage secrets: named credentials that workflows can reference. A secret’s value can be set and rotated but is never returned by the API.
Use this data source to look up an existing secret, either by id or by name. This is how you reference a secret somebody created in the dashboard without managing it as an incident.Secret resource. Set exactly one of the two lookup attributes; setting both, or neither, is rejected at plan time.
A secret’s value is never returned by the API, so there is no value attribute here: last_four_chars and version are all a read can tell you about it.
Example Usage
import * as pulumi from "@pulumi/pulumi";
import * as incident from "@pulumi/incident";
// Look up an existing secret by name, such as one created in the dashboard.
const pagerdutyWebhookToken = incident.getSecret({
name: "PagerDuty webhook token",
});
// Or by ID, to reference a secret another module manages.
const billingApiKey = incident.getSecret({
id: "01G0J1EXE7AXZ2C93K61WBPYEH",
});
export const pagerdutyTokenVersion = pagerdutyWebhookToken.then(pagerdutyWebhookToken => pagerdutyWebhookToken.version);
import pulumi
import pulumi_incident as incident
# Look up an existing secret by name, such as one created in the dashboard.
pagerduty_webhook_token = incident.get_secret(name="PagerDuty webhook token")
# Or by ID, to reference a secret another module manages.
billing_api_key = incident.get_secret(id="01G0J1EXE7AXZ2C93K61WBPYEH")
pulumi.export("pagerdutyTokenVersion", pagerduty_webhook_token.version)
package main
import (
"github.com/pulumi/pulumi-terraform-provider/sdks/go/incident/v7/incident"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
// Look up an existing secret by name, such as one created in the dashboard.
pagerdutyWebhookToken, err := incident.LookupSecret(ctx, &incident.LookupSecretArgs{
Name: pulumi.StringRef("PagerDuty webhook token"),
}, nil)
if err != nil {
return err
}
// Or by ID, to reference a secret another module manages.
_, err = incident.LookupSecret(ctx, &incident.LookupSecretArgs{
Id: pulumi.StringRef("01G0J1EXE7AXZ2C93K61WBPYEH"),
}, nil)
if err != nil {
return err
}
ctx.Export("pagerdutyTokenVersion", pagerdutyWebhookToken.Version)
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Incident = Pulumi.Incident;
return await Deployment.RunAsync(() =>
{
// Look up an existing secret by name, such as one created in the dashboard.
var pagerdutyWebhookToken = Incident.GetSecret.Invoke(new()
{
Name = "PagerDuty webhook token",
});
// Or by ID, to reference a secret another module manages.
var billingApiKey = Incident.GetSecret.Invoke(new()
{
Id = "01G0J1EXE7AXZ2C93K61WBPYEH",
});
return new Dictionary<string, object?>
{
["pagerdutyTokenVersion"] = pagerdutyWebhookToken.Apply(getSecretResult => getSecretResult.Version),
};
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.incident.IncidentFunctions;
import com.pulumi.incident.inputs.GetSecretArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
// Look up an existing secret by name, such as one created in the dashboard.
final var pagerdutyWebhookToken = IncidentFunctions.getSecret(GetSecretArgs.builder()
.name("PagerDuty webhook token")
.build());
// Or by ID, to reference a secret another module manages.
final var billingApiKey = IncidentFunctions.getSecret(GetSecretArgs.builder()
.id("01G0J1EXE7AXZ2C93K61WBPYEH")
.build());
ctx.export("pagerdutyTokenVersion", pagerdutyWebhookToken.version());
}
}
variables:
# Look up an existing secret by name, such as one created in the dashboard.
pagerdutyWebhookToken:
fn::invoke:
function: incident:getSecret
arguments:
name: PagerDuty webhook token
# Or by ID, to reference a secret another module manages.
billingApiKey:
fn::invoke:
function: incident:getSecret
arguments:
id: 01G0J1EXE7AXZ2C93K61WBPYEH
outputs:
# A secret's value is never returned by the API, so a lookup can only tell you about it:
# which version is current, and the last four characters of that version's value.
pagerdutyTokenVersion: ${pagerdutyWebhookToken.version}
Example coming soon!
Using getSecret
Two invocation forms are available. The direct form accepts plain arguments and either blocks until the result value is available, or returns a Promise-wrapped result. The output form accepts Input-wrapped arguments and returns an Output-wrapped result.
function getSecret(args: GetSecretArgs, opts?: InvokeOptions): Promise<GetSecretResult>
function getSecretOutput(args: GetSecretOutputArgs, opts?: InvokeOutputOptions): Output<GetSecretResult>def get_secret(id: Optional[str] = None,
name: Optional[str] = None,
opts: Optional[InvokeOptions] = None) -> GetSecretResult
def get_secret_output(id: pulumi.Input[Optional[str]] = None,
name: pulumi.Input[Optional[str]] = None,
opts: Optional[InvokeOutputOptions] = None) -> Output[GetSecretResult]func LookupSecret(ctx *Context, args *LookupSecretArgs, opts ...InvokeOption) (*LookupSecretResult, error)
func LookupSecretOutput(ctx *Context, args *LookupSecretOutputArgs, opts ...InvokeOption) LookupSecretResultOutput> Note: This function is named LookupSecret in the Go SDK.
public static class GetSecret
{
public static Task<GetSecretResult> InvokeAsync(GetSecretArgs args, InvokeOptions? opts = null)
public static Output<GetSecretResult> Invoke(GetSecretInvokeArgs args, InvokeOptions? opts = null)
public static Output<GetSecretResult> Invoke(GetSecretInvokeArgs args, InvokeOutputOptions opts)
}public static CompletableFuture<GetSecretResult> getSecret(GetSecretArgs args, InvokeOptions options)
public static Output<GetSecretResult> getSecret(GetSecretArgs args, InvokeOptions options)
public static Output<GetSecretResult> getSecret(GetSecretArgs args, InvokeOutputOptions options)
fn::invoke:
function: incident:index/getSecret:getSecret
arguments:
# arguments dictionarydata "incident_get_secret" "name" {
# arguments
}The following arguments are supported:
getSecret Result
The following output properties are available:
- Created
At string - When this secret was created.
- Description string
- Optional description of what this secret is for
- Id string
- Unique identifier for this secret
- Last
Four stringChars - The last four characters of the current value, for masked display. Absent when the value is four characters or shorter.
- Name string
- Human-readable name, unique within the organisation amongst unarchived secrets
- Owning
Team List<string>Ids - IDs of the teams that own this secret. Empty means the secret is owned by the whole organisation.
- Updated
At string - When this secret was last changed, which includes being rotated as well as having its metadata edited.
- Version double
- The current version number, incremented on each rotation
- Created
At string - When this secret was created.
- Description string
- Optional description of what this secret is for
- Id string
- Unique identifier for this secret
- Last
Four stringChars - The last four characters of the current value, for masked display. Absent when the value is four characters or shorter.
- Name string
- Human-readable name, unique within the organisation amongst unarchived secrets
- Owning
Team []stringIds - IDs of the teams that own this secret. Empty means the secret is owned by the whole organisation.
- Updated
At string - When this secret was last changed, which includes being rotated as well as having its metadata edited.
- Version float64
- The current version number, incremented on each rotation
- created_
at string - When this secret was created.
- description string
- Optional description of what this secret is for
- id string
- Unique identifier for this secret
- last_
four_ stringchars - The last four characters of the current value, for masked display. Absent when the value is four characters or shorter.
- name string
- Human-readable name, unique within the organisation amongst unarchived secrets
- owning_
team_ list(string)ids - IDs of the teams that own this secret. Empty means the secret is owned by the whole organisation.
- updated_
at string - When this secret was last changed, which includes being rotated as well as having its metadata edited.
- version number
- The current version number, incremented on each rotation
- created
At String - When this secret was created.
- description String
- Optional description of what this secret is for
- id String
- Unique identifier for this secret
- last
Four StringChars - The last four characters of the current value, for masked display. Absent when the value is four characters or shorter.
- name String
- Human-readable name, unique within the organisation amongst unarchived secrets
- owning
Team List<String>Ids - IDs of the teams that own this secret. Empty means the secret is owned by the whole organisation.
- updated
At String - When this secret was last changed, which includes being rotated as well as having its metadata edited.
- version Double
- The current version number, incremented on each rotation
- created
At string - When this secret was created.
- description string
- Optional description of what this secret is for
- id string
- Unique identifier for this secret
- last
Four stringChars - The last four characters of the current value, for masked display. Absent when the value is four characters or shorter.
- name string
- Human-readable name, unique within the organisation amongst unarchived secrets
- owning
Team string[]Ids - IDs of the teams that own this secret. Empty means the secret is owned by the whole organisation.
- updated
At string - When this secret was last changed, which includes being rotated as well as having its metadata edited.
- version number
- The current version number, incremented on each rotation
- created_
at str - When this secret was created.
- description str
- Optional description of what this secret is for
- id str
- Unique identifier for this secret
- last_
four_ strchars - The last four characters of the current value, for masked display. Absent when the value is four characters or shorter.
- name str
- Human-readable name, unique within the organisation amongst unarchived secrets
- owning_
team_ Sequence[str]ids - IDs of the teams that own this secret. Empty means the secret is owned by the whole organisation.
- updated_
at str - When this secret was last changed, which includes being rotated as well as having its metadata edited.
- version float
- The current version number, incremented on each rotation
- created
At String - When this secret was created.
- description String
- Optional description of what this secret is for
- id String
- Unique identifier for this secret
- last
Four StringChars - The last four characters of the current value, for masked display. Absent when the value is four characters or shorter.
- name String
- Human-readable name, unique within the organisation amongst unarchived secrets
- owning
Team List<String>Ids - IDs of the teams that own this secret. Empty means the secret is owned by the whole organisation.
- updated
At String - When this secret was last changed, which includes being rotated as well as having its metadata edited.
- version Number
- The current version number, incremented on each rotation
Package Details
- Repository
- incident incident-io/terraform-provider-incident
- License
- Notes
- This Pulumi package is based on the
incidentTerraform Provider.
published on Friday, Sep 11, 2026 by incident-io