Environment Variables API

Environment variables are stored in your organization's namespace and automatically injected into every job pod at runtime. Storage depends on the is_sensitive flag: sensitive variables are written to a Kubernetes Secret, non-sensitive variables to a ConfigMap in plaintext. Sensitive variables also have their values masked in list and get responses.

Variables can optionally be mounted as files rather than as environment variables — useful for private keys and credential files that tools expect at a specific path. File mounting requires is_sensitive to be true; otherwise the setting is ignored and no file is created.

Variable name normalization

Variable names are normalized to uppercase automatically on creation.

GET /api/v1/environment-variables

Returns all environment variables for your organization.

Response

{
  "environment_variables": [
    {
      "name": "SNOWFLAKE_ACCOUNT",
      "value": "xy12345.us-east-1",
      "is_sensitive": false,
      "mount_as_file": false,
      "created_at": "2026-01-15T09:00:00Z",
      "updated_at": "2026-01-15T09:00:00Z"
    },
    {
      "name": "SNOWFLAKE_PASSWORD",
      "value": "***",
      "is_sensitive": true,
      "mount_as_file": false,
      "created_at": "2026-01-15T09:00:00Z",
      "updated_at": "2026-03-10T14:00:00Z"
    }
  ],
  "total": 2
}

Sensitive values

When is_sensitive is true, the value field is masked ("***") in all read responses. The actual value is only used at pod injection time and is never returned by the API.

GET /api/v1/environment-variables/:name

Returns a single environment variable by name.

Path Parameters

Parameter	Type	Description
`name`	string	Variable name (case-insensitive lookup; stored as uppercase)

Response

Returns a single environment variable object (same shape as list items above).

POST /api/v1/environment-variables

Creates a new environment variable.

Request Body

{
  "name": "SNOWFLAKE_PRIVATE_KEY",
  "value": "-----BEGIN PRIVATE KEY-----\n...",
  "is_sensitive": true,
  "mount_as_file": true,
  "file_mount_path": "/secrets/rsa_key.p8",
  "file_permissions": 384
}

Field	Type	Required	Description
`name`	string	yes	Variable name. Normalized to uppercase.
`value`	string	yes	Variable value
`is_sensitive`	boolean	no	Store in a Secret and mask the value in API responses (default: `false`). Required for file mounting.
`mount_as_file`	boolean	no	Mount this value as a file inside job pods (default: `false`). Ignored unless `is_sensitive` is `true`.
`file_mount_path`	string	no	Path for the mounted file (required when `mount_as_file` is `true`). Only the filename is used — see the note below.
`file_permissions`	integer	no	Recorded on the variable but not applied to the mounted file. Files are mounted with the Kubernetes default of `0644`.

Mounted files always land in /secrets/

Only the filename portion of file_mount_path is used as the mount target. A path of /etc/credentials/rsa_key.p8 produces a file at /secrets/rsa_key.p8.

Set file_mount_path to /secrets/<filename> so the value you send matches where the file actually appears, and reference that path in your project configuration.

Response

{
  "message": "Environment variable created successfully",
  "environment_variable": {
    "name": "SNOWFLAKE_PRIVATE_KEY",
    "value": "***",
    "is_sensitive": true,
    "mount_as_file": true,
    "file_mount_path": "/secrets/rsa_key.p8",
    "file_permissions": 384,
    "created_at": "2026-04-28T10:00:00Z",
    "updated_at": "2026-04-28T10:00:00Z"
  }
}

PUT /api/v1/environment-variables/:name

Updates an existing environment variable. To change the name, delete and recreate the variable.

Path Parameters

Parameter	Type	Description
`name`	string	Variable name

Request Body

{
  "value": "new-value",
  "is_sensitive": true,
  "mount_as_file": false
}

Field	Type	Required	Description
`value`	string	yes	New variable value
`is_sensitive`	boolean	no	Update sensitivity flag
`mount_as_file`	boolean	no	Update file mount flag
`file_mount_path`	string	no	Update file mount path
`file_permissions`	integer	no	Update file permissions

Response

{
  "message": "Environment variable updated successfully",
  "environment_variable": { }
}

DELETE /api/v1/environment-variables/:name

Deletes an environment variable. The change takes effect for new pod starts; running pods are not affected.

Path Parameters

Parameter	Type	Description
`name`	string	Variable name

Response

{
  "message": "Environment variable deleted successfully"
}