Secrets

Encrypted secret items across nine categories with per-category detail schemas and shared-folder key wrapping.

Service: passwords.secrets

Encrypted secret items supporting nine categories: logins, passwords, credit cards, identities, secure notes, bank accounts, crypto wallets, SSH keys, and API credentials. Each secret stores two encrypted blobs: enc_overview (always loaded, drives list rendering) and enc_details (lazy-loaded on the detail screen). The secret category (type) lives inside the encrypted overview — the server never learns what kind of secret it is.

Fields

Field	Type	Required	Description
`id`	`string`	—	Primary key. Read-only, auto-generated
`folder_id`	`string?`		Parent folder id. `null` = unfiled
`owner_id`	`string`	—	Owner user id. Read-only
`owner_wrapped_key`	`string`	✅	Content key wrapped by owner’s account key (base64)
`folder_wrapped_key`	`string?`		Content key wrapped by folder key. `null` when not in a shared folder
`favorite`	`boolean`		Marked as favorite. Default `false`
`trashed`	`boolean`		Moved to trash. Default `false`
`shared`	`boolean`		Shared with other users. Default `false`
`position`	`float`		Fractional drag-sort position within a folder
`enc_overview`	`string`	✅	Encrypted overview object. See SecretOverview. Always loaded in list and detail views
`enc_details`	`string?`		Encrypted details object. See SecretDetails. Nullable — loaded via detail projection only
`created_at`	`string`	—	ISO 8601 creation timestamp. Read-only
`updated_at`	`string`	—	ISO 8601 last update timestamp. Read-only
`secret_tag`	`string[]`		Assigned tag IDs

Filterable: folder_id · favorite · trashed · shared

Encrypted field schemas

Each enc_* column is an AES-GCM blob. After decryption the plaintext is a JSON value whose structure is documented below.

Danger: The server cannot validate encrypted field structures. Writing an incorrect schema will produce corrupted data for all clients. Follow the type definitions below exactly.

SecretOverview

Decrypted content of enc_overview. Object. Always loaded for list rendering.

Field	Type	Required	Allowed values	Description
`type`	`string`	✅	`login` · `password` · `card` · `identity` · `note` · `bank` · `crypto` · `ssh` · `api`	Secret category. Determines which fields are used in `enc_details`
`title`	`string`	✅	—	Primary display label (e.g. site name, card name)
`subtitle`	`string`	✅	—	Secondary display line (e.g. username, card ending `"•••• 4242"`)

Warning: All three fields are required. Use "" for title and subtitle when no value is available. The type field determines the structure of enc_details — see the per-category schemas below.

SecretDetails

Decrypted content of enc_details. Object. Nullable — null until the detail view requests it.

The fields present in the object depend on the type stored in SecretOverview. Each category uses a specific subset of the fields listed below. Include only the fields relevant to the category — omit fields that don’t apply.

Warning: All string fields within a category should be present in the object. Use "" for fields without a value. The notes field is shared across all categories.

Login (`type: "login"`)

Credentials for a website or application.

Field	Type	Required	Description
`username`	`string`	✅	Login username or email
`password`	`string`	✅	Login password
`url`	`string`	✅	Website URL
`totpSecret`	`string?`		TOTP secret key (base32). `null` if 2FA is not configured
`passwordChangedAt`	`string`		ISO 8601 timestamp of last password change
`history`	PasswordHistory[]		Previous password values
`notes`	`string`		Free-text notes

Password (`type: "password"`)

Standalone password without a login context.

Field	Type	Required	Description
`password`	`string`	✅	The password
`passwordChangedAt`	`string`		ISO 8601 timestamp of last password change
`history`	PasswordHistory[]		Previous password values
`notes`	`string`		Free-text notes

Credit Card (`type: "card"`)

Payment card details.

Field	Type	Required	Description
`cardholder`	`string`	✅	Name on the card
`cardNumber`	`string`	✅	Full card number
`expMonth`	`string`	✅	Expiration month (`"01"` – `"12"`)
`expYear`	`string`	✅	Expiration year (4-digit, e.g. `"2028"`)
`cvv`	`string`	✅	Card verification value
`pin`	`string`		ATM PIN code
`bank`	`string`		Issuing bank name
`notes`	`string`		Free-text notes

Identity (`type: "identity"`)

Personal identity document or profile.

Field	Type	Required	Description
`firstName`	`string`	✅	First name
`lastName`	`string`	✅	Last name
`email`	`string`		Email address
`phone`	`string`		Phone number
`address`	`string`		Postal address (free-form)
`notes`	`string`		Free-text notes

Secure Note (`type: "note"`)

Free-form encrypted note.

Field	Type	Required	Description
`notes`	`string`	✅	Note content (plain text)

Bank Account (`type: "bank"`)

Bank account details.

Field	Type	Required	Description
`bank`	`string`	✅	Bank name
`cardNumber`	`string`	✅	Account number / IBAN
`routing`	`string`		Routing number / BIC / SWIFT
`pin`	`string`		Online banking PIN
`notes`	`string`		Free-text notes

Crypto Wallet (`type: "crypto"`)

Cryptocurrency wallet credentials.

Field	Type	Required	Description
`walletAddress`	`string`	✅	Public wallet address
`password`	`string`		Wallet password
`recovery`	`string`		Seed phrase / recovery key
`notes`	`string`		Free-text notes

Warning: The recovery field typically contains a 12- or 24-word mnemonic seed phrase. Treat this as the most sensitive field — loss or exposure is irreversible.

SSH Key (`type: "ssh"`)

SSH key pair and passphrase.

Field	Type	Required	Description
`publicKey`	`string`	✅	Public key (e.g. `"ssh-ed25519 AAAA..."`)
`privateKey`	`string`	✅	Private key (PEM format)
`passphrase`	`string`		Private key passphrase
`passwordChangedAt`	`string`		ISO 8601 timestamp of last key rotation
`history`	PasswordHistory[]		Previous private key values
`notes`	`string`		Free-text notes

API Credential (`type: "api"`)

API keys and secrets.

Field	Type	Required	Description
`endpoint`	`string`	✅	API base URL or endpoint
`apiKey`	`string`	✅	API key / client ID
`apiSecret`	`string`		API secret / client secret
`notes`	`string`		Free-text notes

PasswordHistory

Array of previous password/key values, ordered newest first.

Field	Type	Required	Description
`value`	`string`	✅	Previous password or key value
`changedAt`	`string`	✅	ISO 8601 timestamp when this value was replaced

find

List secrets with filtering, sorting, and pagination. Uses list projection — enc_details is excluded for performance.

WebSocket

Request

{
  "jsonrpc": "2.0",
  "method": "passwords.secrets.find",
  "params": {
    "filter": { "trashed": { "$eq": false } },
    "sort": [{ "field": "created_at", "dir": "desc" }],
    "limit": 100,
    "fields": [
      "id", "folder_id", "favorite", "trashed", "shared", "position",
      "created_at", "updated_at",
      "enc_overview",
      "owner_id", "owner_wrapped_key", "folder_wrapped_key",
      "secret_tag"
    ]
  },
  "id": 1
}

Response

{
  "jsonrpc": "2.0",
  "result": {
    "items": [
      {
        "id": "1920438291738",
        "folder_id": "1920438291700",
        "favorite": false,
        "trashed": false,
        "shared": false,
        "position": 1000.0,
        "created_at": "2026-05-01T10:30:00Z",
        "updated_at": "2026-05-13T18:30:00Z",
        "enc_overview": "<base64>",
        "owner_id": "42",
        "owner_wrapped_key": "<base64>",
        "folder_wrapped_key": null,
        "secret_tag": ["1920438291800"]
      }
    ],
    "total": 47
  },
  "id": 1
}

findOneById

Fetch a single secret with full detail including the encrypted details blob.

WebSocket

Request

{
  "jsonrpc": "2.0",
  "method": "passwords.secrets.findOneById",
  "params": {
    "id": "1920438291738",
    "fields": [
      "id", "folder_id", "favorite", "trashed", "shared", "position",
      "created_at", "updated_at",
      "enc_overview", "enc_details",
      "owner_id", "owner_wrapped_key", "folder_wrapped_key",
      "secret_tag"
    ]
  },
  "id": 2
}

Response

{
  "jsonrpc": "2.0",
  "result": {
    "id": "1920438291738",
    "folder_id": "1920438291700",
    "favorite": false,
    "trashed": false,
    "shared": false,
    "position": 1000.0,
    "created_at": "2026-05-01T10:30:00Z",
    "updated_at": "2026-05-13T18:30:00Z",
    "enc_overview": "<base64>",
    "enc_details": "<base64>",
    "owner_id": "42",
    "owner_wrapped_key": "<base64>",
    "folder_wrapped_key": null,
    "secret_tag": ["1920438291800"]
  },
  "id": 2
}

create

Create a new secret. The server assigns id, created_at, and updated_at.

WebSocket

Request

{
  "jsonrpc": "2.0",
  "method": "passwords.secrets.create",
  "params": {
    "document": {
      "folder_id": "1920438291700",
      "favorite": false,
      "position": 1000.0,
      "enc_overview": "<base64>",
      "enc_details": "<base64>",
      "owner_wrapped_key": "<base64>",
      "secret_tag": ["1920438291800"]
    }
  },
  "id": 3
}

Response

{
  "jsonrpc": "2.0",
  "result": {
    "id": "1920438291738",
    "enc_overview": "<base64>",
    "created_at": "2026-05-13T18:30:00Z"
  },
  "id": 3
}

updateOneById

Partial update — only specified fields change; omitted fields are untouched. Nested collections are updated automatically: items with id are updated, items without id are created, items missing from the array are deleted.

WebSocket

Request

{
  "jsonrpc": "2.0",
  "method": "passwords.secrets.updateOneById",
  "params": {
    "id": "1920438291738",
    "document": {
      "enc_overview": "<base64-new>",
      "enc_details": "<base64-new>"
    }
  },
  "id": 4
}

Response

{
  "jsonrpc": "2.0",
  "result": {
    "id": "1920438291738",
    "enc_overview": "<base64-new>",
    "updated_at": "2026-05-13T18:45:00Z"
  },
  "id": 4
}

replaceOneById

Full replacement — all writable fields must be provided. Unlike updateOneById, omitted fields are reset to defaults.

WebSocket

Request

{
  "jsonrpc": "2.0",
  "method": "passwords.secrets.replaceOneById",
  "params": {
    "id": "1920438291738",
    "document": {
      "folder_id": "1920438291700",
      "favorite": false,
      "position": 1000.0,
      "enc_overview": "<base64>",
      "enc_details": "<base64>"
    }
  },
  "id": 4
}

deleteOneById

Delete a secret. All tag assignments are deleted with it.

WebSocket

Request

{
  "jsonrpc": "2.0",
  "method": "passwords.secrets.deleteOneById",
  "params": {
    "id": "1920438291738"
  },
  "id": 6
}

Response

{
  "jsonrpc": "2.0",
  "result": {
    "id": "1920438291738",
    "enc_overview": "<base64>"
  },
  "id": 6
}

update

Batch update multiple secrets in a single transaction (all-or-nothing). See Batch operations.

WebSocket

Request

{
  "jsonrpc": "2.0",
  "method": "passwords.secrets.update",
  "params": {
    "items": [
      { "id": "1920438291738", "document": { "favorite": true } },
      { "id": "1920438291739", "document": { "favorite": true } }
    ]
  },
  "id": 5
}

Response

{
  "jsonrpc": "2.0",
  "result": {
    "affected": 2,
    "items": [
      { "id": "1920438291738", "favorite": true },
      { "id": "1920438291739", "favorite": true }
    ]
  },
  "id": 5
}

delete

Batch delete secrets in a single transaction (all-or-nothing). See Batch operations.

WebSocket

Request

{
  "jsonrpc": "2.0",
  "method": "passwords.secrets.delete",
  "params": {
    "items": [
      { "id": "1920438291738" },
      { "id": "1920438291739" }
    ]
  },
  "id": 7
}

Response

{
  "jsonrpc": "2.0",
  "result": {
    "affected": 2,
    "items": [
      { "id": "1920438291738" },
      { "id": "1920438291739" }
    ]
  },
  "id": 7
}

Secrets

Fields

Encrypted field schemas

SecretOverview

SecretDetails

Login (type: "login")

Password (type: "password")

Credit Card (type: "card")

Identity (type: "identity")

Secure Note (type: "note")

Bank Account (type: "bank")

Crypto Wallet (type: "crypto")

SSH Key (type: "ssh")

API Credential (type: "api")

PasswordHistory

find

WebSocket

Request

Response

findOneById

WebSocket

Request

Response

create

WebSocket

Request

Response

updateOneById

WebSocket

Request

Response

replaceOneById

WebSocket

Request

deleteOneById

WebSocket

Request

Response

update

WebSocket

Request

Response

delete

WebSocket

Request

Response

Login (`type: "login"`)

Password (`type: "password"`)

Credit Card (`type: "card"`)

Identity (`type: "identity"`)

Secure Note (`type: "note"`)

Bank Account (`type: "bank"`)

Crypto Wallet (`type: "crypto"`)

SSH Key (`type: "ssh"`)

API Credential (`type: "api"`)