MCP servers and secrets

Your MCP servers and the tools they offer, and the secrets Bash uses but never shows.

Send Authorization: Bearer vk_test_... on every call. Every route of MCP servers and secrets.

DELETE/v1/secrets/{name}Remove one: the company's, or one user's (user_id).

Your API key, scope setup or all. On the card: secrets. Every call here is a checked sample.

Request2 fields

Path

namestringrequiredThe secret's name: capitals, digits and underscores, starting with a capital.

Type: string

Query

user_idstringWhose secret: your id for the user, for their own (read as ${user_secret:NAME}). Absent: your company's (read as ${secret:NAME}).

Type: string

Answers 2004 fields

object"secret"Always secret.

Type: "secret"

namestringThe secret's name.

Example: PNR_API_KEY

user_idstring | nullYour id for the user whose secret it is; null for your company's.

Type: string | null

deletedtrueAlways true: it is gone.

Type: true

TypeScript

await vestra.secrets.delete('TRIPNEST_MCP_TOKEN');

Python

vestra.secrets.delete("TRIPNEST_MCP_TOKEN")

CLI

vestra secrets delete TRIPNEST_MCP_TOKEN

HTTP

# Store a company secret. Your MCP servers refer to it as ${secret:TRIPNEST_MCP_TOKEN}.curl -X PUT "$VESTRA_BASE_URL/v1/secrets/TRIPNEST_MCP_TOKEN" \  -H "Authorization: Bearer $VESTRA_API_KEY" \  -H "Content-Type: application/json" \  -d '{ "value": "your-token" }' # Store a user's secret. It is for their own account, as ${user_secret:IRCTC_TOKEN}.curl -X PUT "$VESTRA_BASE_URL/v1/secrets/IRCTC_TOKEN" \  -H "Authorization: Bearer $VESTRA_API_KEY" \  -H "Content-Type: application/json" \  -d '{ "user_id": "traveller-42", "value": "token-from-their-account" }' # List and delete secrets. The list shows names only, never values.curl "$VESTRA_BASE_URL/v1/secrets" \  -H "Authorization: Bearer $VESTRA_API_KEY" curl -X DELETE "$VESTRA_BASE_URL/v1/secrets/TRIPNEST_MCP_TOKEN" \  -H "Authorization: Bearer $VESTRA_API_KEY"

HTTP

No sample in your language for this route, so here it is over HTTP.

# Store a company secret. Your MCP servers refer to it as ${secret:TRIPNEST_MCP_TOKEN}.curl -X PUT "$VESTRA_BASE_URL/v1/secrets/TRIPNEST_MCP_TOKEN" \  -H "Authorization: Bearer $VESTRA_API_KEY" \  -H "Content-Type: application/json" \  -d '{ "value": "your-token" }' # Store a user's secret. It is for their own account, as ${user_secret:IRCTC_TOKEN}.curl -X PUT "$VESTRA_BASE_URL/v1/secrets/IRCTC_TOKEN" \  -H "Authorization: Bearer $VESTRA_API_KEY" \  -H "Content-Type: application/json" \  -d '{ "user_id": "traveller-42", "value": "token-from-their-account" }' # List and delete secrets. The list shows names only, never values.curl "$VESTRA_BASE_URL/v1/secrets" \  -H "Authorization: Bearer $VESTRA_API_KEY" curl -X DELETE "$VESTRA_BASE_URL/v1/secrets/TRIPNEST_MCP_TOKEN" \  -H "Authorization: Bearer $VESTRA_API_KEY"