Environment Variables API

Environment variables are stored as Kubernetes Secrets in your organization's namespace and are automatically injected into every job pod at runtime. Sensitive variables have their values masked in list and get responses.

Variables can optionally be mounted as files rather than (or in addition to) environment variables — useful for private keys and credential files that tools expect at a specific path.

Variable name normalization

Variable names are normalized to uppercase automatically on creation.

GET /api/v1/environment-variables

Returns all environment variables for your organization.

Response

{
  "environment_variables": [
    {
      "name": "SNOWFLAKE_ACCOUNT",
      "value": "xy12345.us-east-1",
      "is_sensitive": false,
      "mount_as_file": false,
      "created_at": "2026-01-15T09:00:00Z",
      "updated_at": "2026-01-15T09:00:00Z"
    },
    {
      "name": "SNOWFLAKE_PASSWORD",
      "value": "***",
      "is_sensitive": true,
      "mount_as_file": false,
      "created_at": "2026-01-15T09:00:00Z",
      "updated_at": "2026-03-10T14:00:00Z"
    }
  ],
  "total": 2
}

Sensitive values

When is_sensitive is true, the value field is masked ("***") in all read responses. The actual value is only used at pod injection time and is never returned by the API.

GET /api/v1/environment-variables/:name

Returns a single environment variable by name.

Path Parameters

Parameter	Type	Description
`name`	string	Variable name (case-insensitive lookup; stored as uppercase)

Response

Returns a single environment variable object (same shape as list items above).

POST /api/v1/environment-variables

Creates a new environment variable.

Request Body

{
  "name": "SNOWFLAKE_PRIVATE_KEY",
  "value": "-----BEGIN PRIVATE KEY-----\n...",
  "is_sensitive": true,
  "mount_as_file": true,
  "file_mount_path": "/secrets/snowflake/rsa_key.p8",
  "file_permissions": 384
}

Field	Type	Required	Description
`name`	string	yes	Variable name. Normalized to uppercase.
`value`	string	yes	Variable value
`is_sensitive`	boolean	no	Mask the value in API responses (default: `false`)
`mount_as_file`	boolean	no	Also mount this value as a file inside job pods (default: `false`)
`file_mount_path`	string	no	Absolute path where the file should be mounted (required when `mount_as_file` is `true`)
`file_permissions`	integer	no	Unix file permissions as a decimal integer. `384` = `0600`, `420` = `0644`

Response

{
  "message": "Environment variable created successfully",
  "environment_variable": {
    "name": "SNOWFLAKE_PRIVATE_KEY",
    "value": "***",
    "is_sensitive": true,
    "mount_as_file": true,
    "file_mount_path": "/secrets/snowflake/rsa_key.p8",
    "file_permissions": 384,
    "created_at": "2026-04-28T10:00:00Z",
    "updated_at": "2026-04-28T10:00:00Z"
  }
}

PUT /api/v1/environment-variables/:name

Updates an existing environment variable. To change the name, delete and recreate the variable.

Path Parameters

Parameter	Type	Description
`name`	string	Variable name

Request Body

{
  "value": "new-value",
  "is_sensitive": true,
  "mount_as_file": false
}

Field	Type	Required	Description
`value`	string	yes	New variable value
`is_sensitive`	boolean	no	Update sensitivity flag
`mount_as_file`	boolean	no	Update file mount flag
`file_mount_path`	string	no	Update file mount path
`file_permissions`	integer	no	Update file permissions

Response

{
  "message": "Environment variable updated successfully",
  "environment_variable": { }
}

DELETE /api/v1/environment-variables/:name

Deletes an environment variable. The change takes effect for new pod starts; running pods are not affected.

Path Parameters

Parameter	Type	Description
`name`	string	Variable name

Response

{
  "message": "Environment variable deleted successfully"
}