> ## Documentation Index > Fetch the complete documentation index at: https://docs.ankra.ai/llms.txt > Use this file to discover all available pages before exploring further. # Apply Application Env Secrets > Apply the application's stored environment secrets to what is already running: re-seal them into the -env Secret of every deployment and roll the workloads that read it. The values only reach a running workload at deploy time otherwise, so this is the explicit one-click close of that gap - it is never triggered implicitly by setting a value. It takes no body (the values it applies are the ones already stored) and returns none. The deploy parameters of each deployment are left untouched: only the environment-secret manifest and the pod templates that read it are written. A browser session twin is mounted at the same path without the /api/v1 prefix (cookie authentication plus the X-Ankra-CSRF double-submit header). ## OpenAPI ````yaml https://platform.ankra.app/openapi.json post /api/v1/org/applications/{application_id}/env-secrets/apply openapi: 3.1.0 info: title: FastAPI version: 0.1.0 servers: - url: https://platform.ankra.app security: [] paths: /api/v1/org/applications/{application_id}/env-secrets/apply: post: tags: - Applications API summary: Apply Application Env Secrets description: >- Apply the application's stored environment secrets to what is already running: re-seal them into the -env Secret of every deployment and roll the workloads that read it. The values only reach a running workload at deploy time otherwise, so this is the explicit one-click close of that gap - it is never triggered implicitly by setting a value. It takes no body (the values it applies are the ones already stored) and returns none. The deploy parameters of each deployment are left untouched: only the environment-secret manifest and the pod templates that read it are written. A browser session twin is mounted at the same path without the /api/v1 prefix (cookie authentication plus the X-Ankra-CSRF double-submit header). operationId: >- apply_application_env_secrets_api_v1_org_applications__application_id__env_secrets_apply_post parameters: - in: path name: application_id required: true schema: title: Application Id type: string - in: header name: authorization required: false schema: anyOf: - type: string - type: 'null' title: Authorization - in: header name: x-ankra-organisation-id required: false schema: anyOf: - type: string - type: 'null' title: X-Ankra-Organisation-Id responses: '200': content: application/json: schema: $ref: '#/components/schemas/ApplyApplicationEnvSecretsResponse' description: Successful Response '401': description: Unauthorized '403': content: application/json: schema: $ref: '#/components/schemas/DemoDetailError' description: >- The member may not deploy this application, or (browser twin only) the CSRF check failed '404': content: application/json: schema: $ref: '#/components/schemas/DemoDetailError' description: Not found ("Application not found") '409': content: application/json: schema: $ref: '#/components/schemas/DemoDetailError' description: >- Nothing to apply: no environment secrets are set, the application is not deployed anywhere, every deployment of it is being removed, or the organisation has no enabled SOPS configuration to seal them with '422': content: application/json: schema: $ref: '#/components/schemas/HTTPValidationError' description: Validation Error '503': content: application/json: schema: $ref: '#/components/schemas/DemoDetailError' description: >- The secret store, the encryptor or the stack-write lane is not available on this deployment of the platform components: schemas: ApplyApplicationEnvSecretsResponse: description: >- The result of re-sealing an application's stored environment secrets into every deployment of it. No stored value appears in this model - the surface has no route that returns one. properties: revision: description: The catalogue revision this apply sealed. title: Revision type: string applied_count: title: Applied Count type: integer skipped_count: title: Skipped Count type: integer failed_count: title: Failed Count type: integer deployments: items: $ref: '#/components/schemas/ApplyApplicationEnvSecretOutcome' title: Deployments type: array required: - revision - applied_count - skipped_count - failed_count - deployments title: ApplyApplicationEnvSecretsResponse type: object DemoDetailError: description: >- The FastAPI-style detail envelope the demo routes use for 400/403/404/409/502 responses. properties: detail: type: string required: - detail type: object HTTPValidationError: properties: detail: items: $ref: '#/components/schemas/ValidationError' title: Detail type: array title: HTTPValidationError type: object ApplyApplicationEnvSecretOutcome: description: What one apply did to one deployment. properties: installation_id: title: Installation Id type: string cluster_id: title: Cluster Id type: string namespace: title: Namespace type: string status: description: >- "applied" - the deployment's stack now carries the current values, and the cluster reconcile rolls the stamped workloads onto them. "skipped" - a deploy of it is already running and seals the same values itself. "failed" - the apply could not reach it; see message. enum: - applied - skipped - failed title: Status type: string message: anyOf: - type: string - type: 'null' description: >- What there is to say about this deployment: the reason for a skip or a failure, or - on an apply that landed but rolled nothing - why. Never carries a stored value. title: Message rolled_workloads: description: >- How many pod templates this apply stamped, which is how many workloads Kubernetes restarts onto the new values. Zero on a landed apply means every workload already carried this revision, no workload reads the Secret, or the deployment has no rendered manifest to check; the last two say so in message. title: Rolled Workloads type: integer required: - installation_id - cluster_id - namespace - status - message - rolled_workloads title: ApplyApplicationEnvSecretOutcome type: object ValidationError: properties: loc: items: anyOf: - type: string - type: integer title: Location type: array msg: title: Message type: string type: title: Error Type type: string required: - loc - msg - type title: ValidationError type: object ````