> For the complete documentation index, see [llms.txt](https://docs.siit.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.siit.io/workflow/variables-and-secrets.md).

# Variables & Secrets

Store a value once and reference it from any workflow. Variables stay readable for your team; secrets encrypt at rest and are never returned by the API

#### Why it matters

Workflows often need the same value in more than one place: an API key for an external request, a base URL, a channel ID. Until now, that value lived inline in every Workflow that used it. Rotating it meant hunting down each occurrence.

Variables & secrets give you one place to store a value and reference it from any Workflow. Plain variables stay visible so your team can read them at a glance. Secrets encrypt at rest and are never returned by the API, so credentials stop living in plain text inside your Workflow configuration.

#### What you get

* **One settings page for both kinds.** Every variable and secret lives in the same list, with its name, kind, description, and when its value was last updated.
* **A ready-to-use reference.** Each entry shows how it will resolve inside a Workflow: `{{variables.name}}` for a plain value, `{{secrets.name}}` for a secret. Insert it from the picker `/` rather than typing it out; typing the raw string into a field doesn't work.
* **Write-only secrets.** Siit shows only the last four characters of a secret. Rotating one means typing a new value; leaving the field empty keeps the current one.
* **A picker built into the Workflow editor.** Custom variables are available on supported actions. Custom secrets appear only on the **Send External Request** action, so a secret can never end up in a Slack message, a note, or a reply.
* **A dedicated permission.** Every admin can read the list, since building a Workflow requires it. Creating, editing, and deleting a variable or secret requires the `Manage company variables` permission, on by default for owners and admins.

#### How it works

1. An admin creates a variable or secret once, giving it a name, a value, and an optional description.
2. Siit generates a reference string for it (`{{variables.name}}` or `{{secrets.name}}`).
3. That reference is selectable in any Workflow action that supports it.
4. At runtime, Siit resolves the reference to the stored value. Rotating the stored value updates every Workflow that references it, with no need to open each one individually.

#### Where you can use them

| Location                                                  | Custom variables | Custom secrets |
| --------------------------------------------------------- | ---------------- | -------------- |
| Send External Request (URL, headers, body)                | ✓                | ✓              |
| Other Workflow actions (Slack message, note, reply, etc.) | ✓                | —              |
| Message templates                                         | ✓                | —              |

> **Note:** Secrets are intentionally excluded from any action that renders content a person will read, such as a message or note. This keeps a secret from ever appearing in visible text.

#### Setting it up

1. Go to **Settings → Requests → Variables & secrets** and click **+ New**. Choose the kind: **plain** or **secret**. The kind can't be changed after creation.
2. Give it a name (letters, numbers, and underscores, starting with a letter or underscore), a value, and an optional description.
3. Save. Siit shows the reference string to use into your Workflows: `{{variables.name}}` or `{{secrets.name}}`.
4. In any supported Workflow action, open the variable picker and select the entry you need.

#### Rotating a value

Open the variable or secret and enter a new value. Leaving the value field empty keeps the current one, so you don't need to re-enter a plain variable's value just to update its description.

> **Tip:** Rotating a secret used in several Workflows is a single change. Every reference picks up the new value automatically, so there's no need to edit each Workflow that uses it.

#### Built-in variables

Siit also provides variables from your request, people, and Workflow context. Insert them from the `/` picker; they don't need to be created in Settings. The available groups depend on the trigger and action.

Missing values generally resolve to empty text; in message templates, a missing requester or assignee resolves to `-`. Google Workspace, Okta, and Microsoft Entra group name fields accept only form fields.

**Request**

Available on request and application access triggers, and in message templates.

| Display name                   | Placeholder                                  | Resolves to                                      |
| ------------------------------ | -------------------------------------------- | ------------------------------------------------ |
| Title                          | `{{request.title}}`                          | The request subject                              |
| Description                    | `{{request.description}}`                    | The request body                                 |
| Sequential number              | `{{request.sequential_number}}`              | The request number shown in the inbox            |
| Permalink                      | `{{request.admin_permalink_url}}`            | Link to the request in the admin app             |
| Status                         | `{{request.status}}`                         | Current status                                   |
| Priority                       | `{{request.priority}}`                       | Current priority                                 |
| Service                        | `{{request.associated_to}}`                  | Name of the service the request was submitted on |
| Service category               | `{{request.service_category}}`               | Category of that service                         |
| Requester                      | `{{request.requester}}`                      | Requester's display name                         |
| Author uid                     | `{{request.author_uid\|full_name}}`          | Full name of the person who created the request  |
| Assigned to                    | `{{request.assigned_to}}`                    | Display name of the assignee                     |
| Assignee admin                 | `{{request.assignee_admin}}`                 | Display name of the assigned admin               |
| Assignee inbox                 | `{{request.assignee_inbox}}`                 | Name of the assigned inbox                       |
| Followers                      | `{{request.followers}}`                      | Comma-separated list of followers                |
| Tags                           | `{{request.tags_uids\|tag_names}}`           | Comma-separated list of tag names                |
| Created at                     | `{{request.created_at}}`                     | Creation date                                    |
| First replied at               | `{{request.first_replied_at}}`               | Date of the first reply                          |
| First completed at             | `{{request.first_completed_at}}`             | Date the request was first resolved              |
| Completed at                   | `{{request.completed_at}}`                   | Date the request was last resolved               |
| Sla first response time due at | `{{request.sla_first_response_time_due_at}}` | Deadline of the first-response SLA               |
| Sla time to resolve due at     | `{{request.sla_time_to_resolve_due_at}}`     | Deadline of the resolution SLA                   |
| Satisfaction survey rating     | `{{request.satisfaction_survey_rating}}`     | Rating left by the requester, if any             |
| UID                            | `{{request.uid}}`                            | Technical identifier of the request              |

**Requester**

Available on request and application access triggers, and in message templates. Values come from the requester's People record; HRIS fields depend on synced data.

| Display name        | Placeholder                                | Resolves to                                                                    |
| ------------------- | ------------------------------------------ | ------------------------------------------------------------------------------ |
| First name          | `{{requester.first_name}}`                 |                                                                                |
| Last name           | `{{requester.last_name}}`                  |                                                                                |
| Full name           | `{{requester.full_name}}`                  |                                                                                |
| Email               | `{{requester.email}}`                      | Work email                                                                     |
| Personal email      | `{{requester.personal_email}}`             |                                                                                |
| Mention             | `{{requester.mention}}`                    | An @mention in Slack or Teams, the full name elsewhere                         |
| Report to           | `{{requester.report_to\|full_name}}`       | Full name of the requester's manager, as set in People                         |
| Job title           | `{{requester.job_title}}`                  |                                                                                |
| Department          | `{{requester.department\|tag_names}}`      |                                                                                |
| Teams               | `{{requester.teams\|tag_names}}`           | Comma-separated list of teams                                                  |
| Office location     | `{{requester.office_location\|tag_names}}` |                                                                                |
| Legal entity        | `{{requester.legal_entity\|tag_names}}`    |                                                                                |
| City                | `{{requester.city}}`                       |                                                                                |
| State               | `{{requester.state}}`                      |                                                                                |
| Country             | `{{requester.country}}`                    |                                                                                |
| Type                | `{{requester.status}}`                     | Employee, External, and so on                                                  |
| Lifecycle           | `{{requester.lifecycle}}`                  | Onboarding, Active, Offboarding, and so on                                     |
| Start date          | `{{requester.job_start_date}}`             |                                                                                |
| End date            | `{{requester.job_leave_date}}`             |                                                                                |
| Probation end date  | `{{requester.probation_end_date}}`         |                                                                                |
| Tenure duration     | `{{requester.tenure}}`                     | Duration between the start date and end date, or today when no end date is set |
| Active applications | `{{requester.company_service_names}}`      | Comma-separated list of applications the person has access to                  |
| Equipments          | `{{requester.equipment_labels}}`           | Comma-separated list of assigned equipment                                     |
| UID                 | `{{requester.uid}}`                        | Technical identifier of the person                                             |

**Assignee Admin**

Available on request and application access triggers, and in message templates. Empty while the request is unassigned.

| Display name | Placeholder                     |
| ------------ | ------------------------------- |
| First name   | `{{assignee_admin.first_name}}` |
| Last name    | `{{assignee_admin.last_name}}`  |
| Full name    | `{{assignee_admin.full_name}}`  |
| Email        | `{{assignee_admin.email}}`      |
| Mention      | `{{assignee_admin.mention}}`    |

**User**

Available on People triggers. The triggering person has the same fields as Requester, using `user.` instead of `requester.`, plus **Age** (`{{user.age}}`).

**Recipient**

Available on **Send message to a person** actions. Values describe the recipient.

| Display name | Placeholder                |
| ------------ | -------------------------- |
| First name   | `{{recipient.first_name}}` |
| Last name    | `{{recipient.last_name}}`  |
| Full name    | `{{recipient.full_name}}`  |
| Email        | `{{recipient.email}}`      |
| Mention      | `{{recipient.mention}}`    |

**Company**

Available in text actions, under **Requester** for request and application access triggers, **User** for People triggers, and **Company** for Date triggers.

| Display name | Placeholder                | Resolves to                                                                   |
| ------------ | -------------------------- | ----------------------------------------------------------------------------- |
| People alias | `{{company.people_alias}}` | The word your company uses for its people, such as "employees" or "teammates" |

**Application access request**

Available on application access triggers only.

| Display name      | Placeholder                               |
| ----------------- | ----------------------------------------- |
| Application       | `{{app_access_request.application_name}}` |
| Role              | `{{app_access_request.role_name}}`        |
| Business reason   | `{{app_access_request.business_reason}}`  |
| App access status | `{{app_access_request.status}}`           |
| App access UID    | `{{app_access_request.uid}}`              |

**Context**

Available on Date triggers, which run on a schedule rather than for a given person or request.

| Display name | Placeholder           | Resolves to                                 |
| ------------ | --------------------- | ------------------------------------------- |
| Date         | `{{context.date}}`    | Today's date, in your company's language    |
| Weekday      | `{{context.weekday}}` | Day of the week as a number, Sunday being 0 |
| Hour         | `{{context.hour}}`    | Current hour, 0 to 23                       |
| Month        | `{{context.month}}`   | Current month as a number                   |
| Year         | `{{context.year}}`    | Current year                                |

**Form fields**

Available when a request trigger is scoped to a service with a form. Single-value fields appear under their labels; multi-select fields are unavailable.

* Text, number, date, and dropdown fields resolve to the value the requester entered.
* A **People** field exposes the User fields under its label, such as `Approver: Full name`.
* An **Application** field exposes the application's **Name**, **Link**, **Owner**, **Backup owner**, **Lifecycle**, **Status**, and **Teams**.
* An **Equipment** field resolves to the equipment label.

**Action outputs**

Available in later actions that accept outputs.

| Action                 | Outputs                                  |
| ---------------------- | ---------------------------------------- |
| Send External Request  | HTTP status code of the response         |
| Create request         | UID and sequential number of the request |
| Send Slack message     | Link to the message                      |
| Create Slack channel   | Channel ID and channel name              |
| Create external ticket | Ticket ID, name, type, and URL           |

The response body of an external request is not exposed.

#### Troubleshooting

* **A Workflow reference isn't resolving.** Check that the variable or secret still exists under **Settings → Requests → Variables & secrets**. Deleting or renaming a variable does not update the Workflows that reference it; the reference resolves to an empty value at runtime instead.
* **I can't create or edit a variable.** You need the `Manage company variables` permission. Any admin can view the list, but changes require this permission to be enabled on your role.