Record a secret being shown, without recording the secret
When the standard resource response reveals a marked one-time credential, Wildo records the disclosure: who received it, which field was shown and which record it belonged to. The evidence contains the fact of disclosure, not a second copy of the credential.
Example — Record a secret being shown without copying it
An administrator creates an API key. The response shows the key once; the trail records that the key was disclosed without storing its plaintext in the event.
For engineers
API-key creation uses an ephemeral field in its custom response:
Selected source from api-keys-organization.shared.resources-config.schemas.ts:
variantType: ResourceOperationVariantType.API_CALL,
isDefault: true,
roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can create keys
riskLevel: ResourceOperationRiskLevel.HIGH,
// requestDto auto-derived from decorators
customResponseDto: ApiKeyOrganizationSchema.extend({
plainKey: z.string().min(1).isEphemeral()
}),
The resource is registered with this response DTO, and the create handler adds plainKey only to that response. The controller’s shared disclosure helper examines the output schema and actual result before recording FIELD_ACCESS.
| Marker | Disclosure it describes |
|---|---|
.isEphemeral() | A marked value returned by an operation, including reissue |
.isBackendOnly({ isReturnedAtCreation: true }) | A stored field explicitly returned at creation |
The two markers answer different questions. Backend-only handling takes precedence; an ephemeral response value should not also be declared as a stored backend-only field. Ordinary masked write-only credentials use a different display contract.
Put the marker at the returned field
The helper inspects the top-level output shape and handles returned records individually. Mark a one-time secret where that field is actually returned; do not assume a marker buried inside an arbitrary nested object becomes a disclosure event.
The same disclosure semantics are used by the HTTP and outbound-webhook boundaries. The event records field names, record identity and actor; the secret value is never an event payload. A receiver’s handling of the credential remains separate from proving that the application disclosed it.