public sealed class Secret : IMessage<Secret>, IEquatable<Secret>, IDeepCloneable<Secret>, IBufferMessage, IMessage
Reference documentation and code samples for the Secret Manager v1 API class Secret.
A [Secret][google.cloud.secretmanager.v1.Secret] is a logical secret whose
value and versions can be accessed.
A [Secret][google.cloud.secretmanager.v1.Secret] is made up of zero or more
[SecretVersions][google.cloud.secretmanager.v1.SecretVersion] that represent
the secret data.
public MapField<string, string> Annotations { get; }
Optional. Custom metadata about the secret.
Annotations are distinct from various forms of labels.
Annotations exist to allow client tools to store their own state
information without requiring a database.
Annotation keys must be between 1 and 63 characters long, have a UTF-8
encoding of maximum 128 bytes, begin and end with an alphanumeric character
([a-z0-9A-Z]), and may have dashes (-), underscores (_), dots (.), and
alphanumerics in between these symbols.
The total size of annotation keys and values must be less than 16KiB.
public CustomerManagedEncryption CustomerManagedEncryption { get; set; }
Optional. The customer-managed encryption configuration of the regionalized
secrets. If no configuration is provided, Google-managed default encryption
is used.
Updates to the [Secret][google.cloud.secretmanager.v1.Secret] encryption
configuration only apply to
[SecretVersions][google.cloud.secretmanager.v1.SecretVersion] added
afterwards. They do not apply retroactively to existing
[SecretVersions][google.cloud.secretmanager.v1.SecretVersion].
Optional. Timestamp in UTC when the
[Secret][google.cloud.secretmanager.v1.Secret] is scheduled to expire.
This is always provided on output, regardless of what was sent on input.
Label keys must be between 1 and 63 characters long, have a UTF-8 encoding
of maximum 128 bytes, and must conform to the following PCRE regular
expression: [\p{Ll}\p{Lo}][\p{Ll}\p{Lo}\p{N}_-]{0,62}
Label values must be between 0 and 63 characters long, have a UTF-8
encoding of maximum 128 bytes, and must conform to the following PCRE
regular expression: [\p{Ll}\p{Lo}\p{N}_-]{0,63}
No more than 64 labels can be assigned to a given resource.
Optional. Input only. Immutable. Mapping of Tag keys/values directly bound
to this resource. For example:
"123/environment": "production",
"123/costCenter": "marketing"
Tags are used to organize and group resources.
Tags can be used to control policy evaluation for the resource.
public MapField<string, long> VersionAliases { get; }
Optional. Mapping from version alias to version name.
A version alias is a string with a maximum length of 63 characters and can
contain uppercase and lowercase letters, numerals, and the hyphen (-)
and underscore ('_') characters. An alias string must start with a
letter and cannot be the string 'latest' or 'NEW'.
No more than 50 aliases can be assigned to a given secret.
Version-Alias pairs will be viewable via GetSecret and modifiable via
UpdateSecret. Access by alias is only be supported on
GetSecretVersion and AccessSecretVersion.
Optional. Secret Version TTL after destruction request
This is a part of the Delayed secret version destroy feature.
For secret with TTL>0, version destruction doesn't happen immediately
on calling destroy instead the version goes to a disabled state and
destruction happens after the TTL expires.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-28 UTC."],[[["\u003cp\u003eThis page provides reference documentation for the \u003ccode\u003eSecret\u003c/code\u003e class within the Google Cloud Secret Manager v1 API, detailing its properties, constructors, and usage.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003eSecret\u003c/code\u003e class represents a logical secret composed of multiple \u003ccode\u003eSecretVersion\u003c/code\u003e instances, which hold the actual secret data.\u003c/p\u003e\n"],["\u003cp\u003eThe latest version of the Secret class available is 2.5.0, with older versions from 2.4.0 down to 1.3.0 also accessible.\u003c/p\u003e\n"],["\u003cp\u003eKey properties of a \u003ccode\u003eSecret\u003c/code\u003e include metadata like \u003ccode\u003eAnnotations\u003c/code\u003e, \u003ccode\u003eLabels\u003c/code\u003e, \u003ccode\u003eCreateTime\u003c/code\u003e, and configurations for replication, rotation, and encryption, among others.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003eSecret\u003c/code\u003e class allows for setting expiration, version aliasing, and integration with Pub/Sub topics for notifications on operations.\u003c/p\u003e\n"]]],[],null,["# Secret Manager v1 API - Class Secret (2.6.0)\n\nVersion latestkeyboard_arrow_down\n\n- [2.6.0 (latest)](/dotnet/docs/reference/Google.Cloud.SecretManager.V1/latest/Google.Cloud.SecretManager.V1.Secret)\n- [2.5.0](/dotnet/docs/reference/Google.Cloud.SecretManager.V1/2.5.0/Google.Cloud.SecretManager.V1.Secret)\n- [2.4.0](/dotnet/docs/reference/Google.Cloud.SecretManager.V1/2.4.0/Google.Cloud.SecretManager.V1.Secret)\n- [2.3.0](/dotnet/docs/reference/Google.Cloud.SecretManager.V1/2.3.0/Google.Cloud.SecretManager.V1.Secret)\n- [2.2.0](/dotnet/docs/reference/Google.Cloud.SecretManager.V1/2.2.0/Google.Cloud.SecretManager.V1.Secret)\n- [2.1.0](/dotnet/docs/reference/Google.Cloud.SecretManager.V1/2.1.0/Google.Cloud.SecretManager.V1.Secret)\n- [2.0.0](/dotnet/docs/reference/Google.Cloud.SecretManager.V1/2.0.0/Google.Cloud.SecretManager.V1.Secret)\n- [1.9.0](/dotnet/docs/reference/Google.Cloud.SecretManager.V1/1.9.0/Google.Cloud.SecretManager.V1.Secret)\n- [1.8.0](/dotnet/docs/reference/Google.Cloud.SecretManager.V1/1.8.0/Google.Cloud.SecretManager.V1.Secret)\n- [1.7.0](/dotnet/docs/reference/Google.Cloud.SecretManager.V1/1.7.0/Google.Cloud.SecretManager.V1.Secret)\n- [1.6.0](/dotnet/docs/reference/Google.Cloud.SecretManager.V1/1.6.0/Google.Cloud.SecretManager.V1.Secret)\n- [1.5.0](/dotnet/docs/reference/Google.Cloud.SecretManager.V1/1.5.0/Google.Cloud.SecretManager.V1.Secret)\n- [1.4.0](/dotnet/docs/reference/Google.Cloud.SecretManager.V1/1.4.0/Google.Cloud.SecretManager.V1.Secret)\n- [1.3.0](/dotnet/docs/reference/Google.Cloud.SecretManager.V1/1.3.0/Google.Cloud.SecretManager.V1.Secret) \n\n public sealed class Secret : IMessage\u003cSecret\u003e, IEquatable\u003cSecret\u003e, IDeepCloneable\u003cSecret\u003e, IBufferMessage, IMessage\n\nReference documentation and code samples for the Secret Manager v1 API class Secret.\n\nA \\[Secret\\]\\[google.cloud.secretmanager.v1.Secret\\] is a logical secret whose\nvalue and versions can be accessed.\n\nA \\[Secret\\]\\[google.cloud.secretmanager.v1.Secret\\] is made up of zero or more\n\\[SecretVersions\\]\\[google.cloud.secretmanager.v1.SecretVersion\\] that represent\nthe secret data. \n\nInheritance\n-----------\n\n[object](https://learn.microsoft.com/dotnet/api/system.object) \\\u003e Secret \n\nImplements\n----------\n\n[IMessage](https://cloud.google.com/dotnet/docs/reference/Google.Protobuf/latest/Google.Protobuf.IMessage-1.html)[Secret](/dotnet/docs/reference/Google.Cloud.SecretManager.V1/latest/Google.Cloud.SecretManager.V1.Secret), [IEquatable](https://learn.microsoft.com/dotnet/api/system.iequatable-1)[Secret](/dotnet/docs/reference/Google.Cloud.SecretManager.V1/latest/Google.Cloud.SecretManager.V1.Secret), [IDeepCloneable](https://cloud.google.com/dotnet/docs/reference/Google.Protobuf/latest/Google.Protobuf.IDeepCloneable-1.html)[Secret](/dotnet/docs/reference/Google.Cloud.SecretManager.V1/latest/Google.Cloud.SecretManager.V1.Secret), [IBufferMessage](https://cloud.google.com/dotnet/docs/reference/Google.Protobuf/latest/Google.Protobuf.IBufferMessage.html), [IMessage](https://cloud.google.com/dotnet/docs/reference/Google.Protobuf/latest/Google.Protobuf.IMessage.html) \n\nInherited Members\n-----------------\n\n[object.GetHashCode()](https://learn.microsoft.com/dotnet/api/system.object.gethashcode) \n[object.GetType()](https://learn.microsoft.com/dotnet/api/system.object.gettype) \n[object.ToString()](https://learn.microsoft.com/dotnet/api/system.object.tostring)\n\nNamespace\n---------\n\n[Google.Cloud.SecretManager.V1](/dotnet/docs/reference/Google.Cloud.SecretManager.V1/latest/Google.Cloud.SecretManager.V1)\n\nAssembly\n--------\n\nGoogle.Cloud.SecretManager.V1.dll\n\nConstructors\n------------\n\n### Secret()\n\n public Secret()\n\n### Secret(Secret)\n\n public Secret(Secret other)\n\nProperties\n----------\n\n### Annotations\n\n public MapField\u003cstring, string\u003e Annotations { get; }\n\nOptional. Custom metadata about the secret.\n\nAnnotations are distinct from various forms of labels.\nAnnotations exist to allow client tools to store their own state\ninformation without requiring a database.\n\nAnnotation keys must be between 1 and 63 characters long, have a UTF-8\nencoding of maximum 128 bytes, begin and end with an alphanumeric character\n(\\[a-z0-9A-Z\\]), and may have dashes (-), underscores (_), dots (.), and\nalphanumerics in between these symbols.\n\nThe total size of annotation keys and values must be less than 16KiB.\n\n### CreateTime\n\n public Timestamp CreateTime { get; set; }\n\nOutput only. The time at which the\n\\[Secret\\]\\[google.cloud.secretmanager.v1.Secret\\] was created.\n\n### CustomerManagedEncryption\n\n public CustomerManagedEncryption CustomerManagedEncryption { get; set; }\n\nOptional. The customer-managed encryption configuration of the regionalized\nsecrets. If no configuration is provided, Google-managed default encryption\nis used.\n\nUpdates to the \\[Secret\\]\\[google.cloud.secretmanager.v1.Secret\\] encryption\nconfiguration only apply to\n\\[SecretVersions\\]\\[google.cloud.secretmanager.v1.SecretVersion\\] added\nafterwards. They do not apply retroactively to existing\n\\[SecretVersions\\]\\[google.cloud.secretmanager.v1.SecretVersion\\].\n\n### Etag\n\n public string Etag { get; set; }\n\nOptional. Etag of the currently stored\n\\[Secret\\]\\[google.cloud.secretmanager.v1.Secret\\].\n\n### ExpirationCase\n\n public Secret.ExpirationOneofCase ExpirationCase { get; }\n\n### ExpireTime\n\n public Timestamp ExpireTime { get; set; }\n\nOptional. Timestamp in UTC when the\n\\[Secret\\]\\[google.cloud.secretmanager.v1.Secret\\] is scheduled to expire.\nThis is always provided on output, regardless of what was sent on input.\n\n### Labels\n\n public MapField\u003cstring, string\u003e Labels { get; }\n\nThe labels assigned to this Secret.\n\nLabel keys must be between 1 and 63 characters long, have a UTF-8 encoding\nof maximum 128 bytes, and must conform to the following PCRE regular\nexpression: `[\\p{Ll}\\p{Lo}][\\p{Ll}\\p{Lo}\\p{N}_-]{0,62}`\n\nLabel values must be between 0 and 63 characters long, have a UTF-8\nencoding of maximum 128 bytes, and must conform to the following PCRE\nregular expression: `[\\p{Ll}\\p{Lo}\\p{N}_-]{0,63}`\n\nNo more than 64 labels can be assigned to a given resource.\n\n### Name\n\n public string Name { get; set; }\n\nOutput only. The resource name of the\n\\[Secret\\]\\[google.cloud.secretmanager.v1.Secret\\] in the format\n`projects/*/secrets/*`.\n\n### Replication\n\n public Replication Replication { get; set; }\n\nOptional. Immutable. The replication policy of the secret data attached to\nthe \\[Secret\\]\\[google.cloud.secretmanager.v1.Secret\\].\n\nThe replication policy cannot be changed after the Secret has been created.\n\n### Rotation\n\n public Rotation Rotation { get; set; }\n\nOptional. Rotation policy attached to the\n\\[Secret\\]\\[google.cloud.secretmanager.v1.Secret\\]. May be excluded if there is\nno rotation policy.\n\n### SecretName\n\n public SecretName SecretName { get; set; }\n\n[SecretName](/dotnet/docs/reference/Google.Cloud.SecretManager.V1/latest/Google.Cloud.SecretManager.V1.SecretName)-typed view over the [Name](/dotnet/docs/reference/Google.Cloud.SecretManager.V1/latest/Google.Cloud.SecretManager.V1.Secret#Google_Cloud_SecretManager_V1_Secret_Name) resource name property.\n\n### Tags\n\n public MapField\u003cstring, string\u003e Tags { get; }\n\nOptional. Input only. Immutable. Mapping of Tag keys/values directly bound\nto this resource. For example:\n\"123/environment\": \"production\",\n\"123/costCenter\": \"marketing\"\n\nTags are used to organize and group resources.\n\nTags can be used to control policy evaluation for the resource.\n\n### Topics\n\n public RepeatedField\u003cTopic\u003e Topics { get; }\n\nOptional. A list of up to 10 Pub/Sub topics to which messages are published\nwhen control plane operations are called on the secret or its versions.\n\n### Ttl\n\n public Duration Ttl { get; set; }\n\nInput only. The TTL for the\n\\[Secret\\]\\[google.cloud.secretmanager.v1.Secret\\].\n\n### VersionAliases\n\n public MapField\u003cstring, long\u003e VersionAliases { get; }\n\nOptional. Mapping from version alias to version name.\n\nA version alias is a string with a maximum length of 63 characters and can\ncontain uppercase and lowercase letters, numerals, and the hyphen (`-`)\nand underscore ('_') characters. An alias string must start with a\nletter and cannot be the string 'latest' or 'NEW'.\nNo more than 50 aliases can be assigned to a given secret.\n\nVersion-Alias pairs will be viewable via GetSecret and modifiable via\nUpdateSecret. Access by alias is only be supported on\nGetSecretVersion and AccessSecretVersion.\n\n### VersionDestroyTtl\n\n public Duration VersionDestroyTtl { get; set; }\n\nOptional. Secret Version TTL after destruction request\n\nThis is a part of the Delayed secret version destroy feature.\nFor secret with TTL\\\u003e0, version destruction doesn't happen immediately\non calling destroy instead the version goes to a disabled state and\ndestruction happens after the TTL expires."]]
