Replace the secret bindings of a release alias
Replace the complete set of {{secret:NAME}} values executions resolve when they reach this agent through this pointer. A binding wins over the organization secret of the same name, so one preview per pull request can aim its HTTP tools at that pull request environment while the version content stays byte-identical to what live runs. Whole-set replacement: a name you stop sending stops resolving. Values are encrypted at rest and never returned. Names beginning RUNTYPE_, PLATFORM_, CLOUDFLARE_ or INTERNAL_ are refused because they are platform-resolved before the alias plane. A change bumps the alias revision and appends a bind receipt; an identical set writes nothing. Requires the same deploy scope as activating this alias.
Authentication
Path parameters
Headers
The alias revision this write expects. Required on a live alias that already exists (428 without it) and refused with 412 when the stored revision has moved on. Optional on preview aliases and on the first live deployment, which has no revision yet.
Request
Response
Present on a write: false when the set was already identical and nothing moved.
The bind receipt this write appended, or null when it changed nothing.