diff --git a/app/web/package.json b/app/web/package.json
index 0eb07d6ed1..f5cfef9c36 100644
--- a/app/web/package.json
+++ b/app/web/package.json
@@ -56,11 +56,13 @@
     "fontfaceobserver": "^2.3.0",
     "is-promise": "^4.0.0",
     "javascript-time-ago": "^2.5.7",
+    "js-base64": "^3.7.5",
     "js-beautify": "^1.14.9",
     "js-confetti": "^0.11.0",
     "jwt-decode": "^3.1.2",
     "konva": "^8.3.13",
     "less": "^4.1.3",
+    "libsodium-wrappers": "^0.7.13",
     "local-storage-fallback": "^4.1.2",
     "lodash-es": "^4.17.21",
     "pinia": "^2.1.3",
@@ -84,6 +86,7 @@
     "@types/fontfaceobserver": "^2.1.0",
     "@types/javascript-time-ago": "^2.0.3",
     "@types/js-beautify": "^1.14.1",
+    "@types/libsodium-wrappers": "^0.7.11",
     "@types/lodash-es": "^4.17.7",
     "@types/node": "^18.15.11",
     "@types/tinycolor2": "^1.4.3",
diff --git a/app/web/src/api/sdf/dal/key_pair.ts b/app/web/src/api/sdf/dal/key_pair.ts
index 7e609ae0f5..2c0a8b4f90 100644
--- a/app/web/src/api/sdf/dal/key_pair.ts
+++ b/app/web/src/api/sdf/dal/key_pair.ts
@@ -1,3 +1,5 @@
+// TODO(fnichol): delete this!
+
 import { StandardModel } from "@/api/sdf/dal/standard_model";
 
 /**
diff --git a/app/web/src/api/sdf/dal/secret.ts b/app/web/src/api/sdf/dal/secret.ts
deleted file mode 100644
index a95abd1fe9..0000000000
--- a/app/web/src/api/sdf/dal/secret.ts
+++ /dev/null
@@ -1,32 +0,0 @@
-import { StandardModel } from "@/api/sdf/dal/standard_model";
-
-export interface Secret extends StandardModel {
-  name: string;
-  objectType: SecretObjectType;
-  kind: SecretKind;
-}
-
-export enum SecretObjectType {
-  Credential = "credential",
-}
-
-export enum SecretKind {
-  DockerHub = "dockerHub",
-  AwsAccessKey = "awsAccessKey",
-  HelmRepo = "helmRepo",
-  AzureServicePrincipal = "azureServicePrincipal",
-}
-
-export enum SecretVersion {
-  V1 = "v1",
-}
-
-export enum SecretAlgorithm {
-  Sealedbox = "sealedbox",
-}
-
-export interface SecretKindFields {
-  secretKind: SecretKind;
-  displayName: string;
-  fields: { keyName: string; displayName: string; password: boolean }[];
-}
diff --git a/app/web/src/components/AddSecretForm.vue b/app/web/src/components/AddSecretForm.vue
index dd7d3b8e40..d7464bf763 100644
--- a/app/web/src/components/AddSecretForm.vue
+++ b/app/web/src/components/AddSecretForm.vue
@@ -32,7 +32,7 @@
             </div>
           </template>
         </VormInput>
-        <VormInput
+        <!--VormInput
           v-model="secretFormData.expiration"
           type="date"
           label="Expiration"
@@ -42,7 +42,7 @@
               Optional: Set an expiration date for this secret
             </div>
           </template>
-        </VormInput>
+        </VormInput-->
         <VormInput
           v-for="(field, index) in fields"
           :key="index"
@@ -91,7 +91,7 @@ import {
   useValidatedInputGroup,
   ErrorMessage,
 } from "@si/vue-lib/design-system";
-import { PropType, reactive, computed } from "vue";
+import { PropType, ref, computed } from "vue";
 import * as _ from "lodash-es";
 import clsx from "clsx";
 import {
@@ -124,20 +124,18 @@ const secretFormEmpty = {
   name: "",
   description: "",
   value: {} as Record<string, string>,
-  expiration: "",
 };
 
-const secretFormData = reactive(_.clone(secretFormEmpty));
+const secretFormData = ref(_.cloneDeep(secretFormEmpty));
 
 const saveSecret = async () => {
   if (validationMethods.hasError()) return;
 
   const res = await secretsStore.SAVE_SECRET(
     props.definitionId,
-    secretFormData.name,
-    secretFormData.value,
-    secretFormData.description,
-    secretFormData.expiration,
+    secretFormData.value.name,
+    secretFormData.value.value,
+    secretFormData.value.description,
   );
 
   if (res.result.success) {
@@ -145,7 +143,7 @@ const saveSecret = async () => {
     setTimeout(() => {
       secretsStore.clearRequestStatus("SAVE_SECRET");
 
-      _.assign(secretFormData, secretFormEmpty);
+      secretFormData.value = _.cloneDeep(secretFormEmpty);
 
       validationMethods.resetAll();
 
diff --git a/app/web/src/components/Workspace/WorkspaceCustomizeSecrets.vue b/app/web/src/components/Workspace/WorkspaceCustomizeSecrets.vue
index bb3f6e773e..545f84e7ad 100644
--- a/app/web/src/components/Workspace/WorkspaceCustomizeSecrets.vue
+++ b/app/web/src/components/Workspace/WorkspaceCustomizeSecrets.vue
@@ -4,34 +4,55 @@
     <div class="flex flex-col h-full">
       <div class="relative flex-grow">
         <CustomizeTabs tabContentSlug="secrets">
-          <AddSecretForm definitionId="Mocks" class="h-auto" />
-          <ul class="m-xs">
-            <li v-for="(definition, index) in secretDefinitions" :key="index">
-              <span>{{ definition }}</span>
-              <ul class="ml-md flex flex-col gap-1">
-                <li
-                  v-for="secret in secretsStore.secretsByDefinitionId[
-                    definition
-                  ]"
-                  :key="secret.id"
-                  class="text-sm"
-                >
-                  <b>{{ secret.name }}</b>
-                  <i class="text-xs text-neutral-500">
-                    by {{ secret.createdInfo.actor.label }}
-                  </i>
-                  <VButton
-                    :disabled="secretsStore.secretIsTransitioning[secret.id]"
-                    class="ml-2"
-                    size="xs"
-                    tone="neutral"
-                    icon="x-circle"
-                    @click="secretsStore.DELETE_SECRET(secret.id)"
-                  />
-                </li>
-              </ul>
-            </li>
-          </ul>
+          <template v-if="secretsStore.definitions.length > 0">
+            <VormInput
+              v-model="selectedDef"
+              class="mx-sm mt-sm"
+              label="Secret Definition"
+              type="dropdown"
+              :options="
+                _.map(secretsStore.definitions, (d) => ({ value: d, label: d }))
+              "
+            />
+            <AddSecretForm
+              v-if="selectedDef"
+              :definitionId="selectedDef"
+              class="h-auto"
+            />
+            <p v-else>Please select a secret definition above</p>
+            <ul class="m-xs">
+              <li v-for="(definition, index) in secretDefinitions" :key="index">
+                <span>{{ definition }}</span>
+                <ul class="ml-md flex flex-col gap-1">
+                  <li
+                    v-for="secret in secretsStore.secretsByDefinitionId[
+                      definition
+                    ]"
+                    :key="secret.id"
+                    class="text-sm"
+                  >
+                    <b>{{ secret.name }}</b>
+                    <i class="text-xs text-neutral-500">
+                      by {{ secret.createdInfo?.actor?.label || "UNDEF" }}
+                    </i>
+                    <VButton
+                      :disabled="secretsStore.secretIsTransitioning[secret.id]"
+                      class="ml-2"
+                      size="xs"
+                      tone="neutral"
+                      icon="x-circle"
+                      @click="secretsStore.DELETE_SECRET(secret.id)"
+                    />
+                  </li>
+                </ul>
+              </li>
+            </ul>
+          </template>
+          <template v-else>
+            <p>
+              You need to create secret defining schema before using this page
+            </p>
+          </template>
         </CustomizeTabs>
       </div>
     </div>
@@ -50,8 +71,9 @@
 </template>
 
 <script lang="ts" setup>
-import { computed } from "vue";
-import { ResizablePanel, VButton } from "@si/vue-lib/design-system";
+import { computed, ref } from "vue";
+import { ResizablePanel, VButton, VormInput } from "@si/vue-lib/design-system";
+import * as _ from "lodash-es";
 import { useFeatureFlagsStore } from "@/store/feature_flags.store";
 import SidebarSubpanelTitle from "@/components/SidebarSubpanelTitle.vue";
 import { useSecretsStore } from "@/store/secrets.store";
@@ -61,6 +83,8 @@ import CustomizeTabs from "../CustomizeTabs.vue";
 const secretsStore = useSecretsStore();
 const featureFlagsStore = useFeatureFlagsStore();
 
+const selectedDef = ref<string>();
+
 const FF_SECRETS = computed(() => featureFlagsStore.SECRETS);
 
 const secretDefinitions = computed(() => secretsStore.definitions);
diff --git a/app/web/src/store/secrets.store.ts b/app/web/src/store/secrets.store.ts
index 9aebfd89bc..6a7fb0eff7 100644
--- a/app/web/src/store/secrets.store.ts
+++ b/app/web/src/store/secrets.store.ts
@@ -6,11 +6,55 @@ import { useAuthStore } from "@/store/auth.store";
 import { useChangeSetsStore, ChangeSetId } from "@/store/change_sets.store";
 import { useWorkspacesStore } from "@/store/workspaces.store";
 import { LabelList } from "@/api/sdf/dal/label_list";
+import { encryptMessage } from "@/utils/messageEncryption";
 import { ActorAndTimestamp } from "./components.store";
+import { useRealtimeStore } from "./realtime/realtime.store";
+
+/**
+ * A public key with metadata, used to encrypt secrets
+ */
+export interface PublicKey {
+  /**
+   * The PK of the public key
+   */
+  pk: string;
+  /**
+   * The name of the public key
+   */
+  name: string;
+  /**
+   * The public key contents, encoded as a Base64 string
+   *
+   * # Examples
+   *
+   * Decoding a public key into a `Uint8Array` type:
+   *
+   * ```ts
+   * Base64.toUint8Array(key.public_key);
+   * ```
+   */
+  public_key: string;
+  /**
+   * A created lamport clock, used to sort multiple generations of key pairs
+   */
+  created_lamport_clock: string;
+
+  created_at: string;
+  updated_at: string;
+}
+
+export enum SecretVersion {
+  V1 = "v1",
+}
+
+export enum SecretAlgorithm {
+  Sealedbox = "sealedbox",
+}
 
 export type SecretId = string;
 export type SecretDefinitionId = string;
 
+// TODO: Store description on the secrets table
 export type Secret = {
   id: SecretId;
   definition: SecretDefinitionId;
@@ -74,6 +118,7 @@ export function useSecretsStore() {
       state: () => ({
         secretDefinitionByDefinitionId: {} as SecretsDefinitionHashMap,
         secretIsTransitioning: {} as Record<SecretId, boolean>,
+        publicKey: null as PublicKey | null,
       }),
       getters: {
         secretsByDefinitionId(state): SecretsHashMap {
@@ -115,17 +160,16 @@ export function useSecretsStore() {
           });
         },
         async SAVE_SECRET(
-          definition: SecretDefinitionId,
+          definitionId: SecretDefinitionId,
           name: string,
           value: Record<string, string>,
           description?: string,
-          expiration?: string,
         ) {
           if (_.isEmpty(name)) {
             throw new Error("All secrets must have a name.");
           }
 
-          if (this.secretsByDefinitionId[definition] === undefined) {
+          if (this.secretsByDefinitionId[definitionId] === undefined) {
             throw new Error(
               "All secrets must be created based on a definition.",
             );
@@ -141,6 +185,18 @@ export function useSecretsStore() {
             Math.random() * 899999 + 100000,
           ).toString()}`;
 
+          // Encrypt Value
+          if (_.isNil(this.publicKey)) {
+            throw new Error("Couldn't fetch publicKey.");
+          }
+
+          const algorithm = SecretAlgorithm.Sealedbox;
+          const version = SecretVersion.V1;
+
+          const keyPairPk = this.publicKey.pk;
+
+          const crypted = await encryptMessage(value, this.publicKey);
+
           return new ApiRequest<Secret>({
             method: "post",
             url: "secret",
@@ -148,40 +204,46 @@ export function useSecretsStore() {
               ...visibilityParams,
               name,
               description,
-              definition,
-              expiration,
+              definition: definitionId,
+              crypted,
+              keyPairPk,
+              version,
+              algorithm,
             },
             optimistic: () => {
               const { pk: userId, name: userName } = user;
 
-              this.secretsByDefinitionId[definition]?.push({
+              this.secretDefinitionByDefinitionId[definitionId]?.secrets?.push({
                 id: tempId,
-                definition,
+                definition: definitionId,
                 name,
                 description,
                 createdInfo: {
                   actor: { kind: "user", label: userName, id: userId },
                   timestamp: Date(),
                 },
-                expiration,
               });
               this.secretIsTransitioning[tempId] = true;
 
               return () => {
-                const secretsOnDef = this.secretsByDefinitionId[definition];
-                if (secretsOnDef === undefined) return;
+                const definition =
+                  this.secretDefinitionByDefinitionId[definitionId];
 
-                this.secretsByDefinitionId[definition] = secretsOnDef.filter(
+                if (definition === undefined) return;
+
+                definition.secrets = definition.secrets.filter(
                   (s) => s.id !== tempId,
                 );
                 this.secretIsTransitioning[tempId] = false;
               };
             },
             onSuccess: (response) => {
-              const secretsOnDef = this.secretsByDefinitionId[definition];
-              if (secretsOnDef === undefined) return;
+              const definition =
+                this.secretDefinitionByDefinitionId[definitionId];
 
-              this.secretsByDefinitionId[definition] = secretsOnDef.map((s) =>
+              if (definition === undefined) return;
+
+              definition.secrets = definition.secrets.map((s) =>
                 s.id === tempId ? response : s,
               );
               this.secretIsTransitioning[tempId] = false;
@@ -219,10 +281,38 @@ export function useSecretsStore() {
             },
           });
         },
+        async GET_PUBLIC_KEY() {
+          return new ApiRequest<PublicKey>({
+            url: "secret/get_public_key",
+            params: {
+              ...visibilityParams,
+            },
+            onSuccess: (response) => {
+              this.publicKey = response;
+            },
+          });
+        },
       },
       onActivated() {
         // TODO Run load secrets on websocket message too
         this.LOAD_SECRETS();
+        this.GET_PUBLIC_KEY();
+
+        const realtimeStore = useRealtimeStore();
+        realtimeStore.subscribe(this.$id, `changeset/${changeSetId}`, [
+          {
+            eventType: "ChangeSetWritten",
+            callback: (writtenChangeSetId) => {
+              // ideally we wouldn't have to check this - since the topic subscription
+              // would mean we only receive the event for this changeset already...
+              // but this is fine for now
+              if (writtenChangeSetId !== changeSetId) return;
+
+              // probably want to get pushed updates instead of blindly re-fetching, but this is the first step of getting things working
+              this.LOAD_SECRETS();
+            },
+          },
+        ]);
       },
     }),
   )();
diff --git a/app/web/src/utils/messageEncryption.ts b/app/web/src/utils/messageEncryption.ts
new file mode 100644
index 0000000000..eecdaaf279
--- /dev/null
+++ b/app/web/src/utils/messageEncryption.ts
@@ -0,0 +1,26 @@
+import { Base64 } from "js-base64";
+import _sodium from "libsodium-wrappers";
+
+import { PublicKey } from "@/store/secrets.store";
+
+export async function encryptMessage(
+  message: Record<string, string>,
+  publicKey: PublicKey,
+): Promise<number[]> {
+  await _sodium.ready;
+  const sodium = _sodium;
+
+  // Base64 decode the key into a Uint8Array (i.e. "bytes")
+  const pkey = Base64.toUint8Array(publicKey.public_key);
+
+  return Array.from(sodium.crypto_box_seal(serializeMessage(message), pkey));
+}
+
+function serializeMessage(message: Record<string, string>): Uint8Array {
+  const json = JSON.stringify(message, null, 0);
+  const result = new Uint8Array(json.length);
+  for (let i = 0; i < json.length; i++) {
+    result[i] = json.charCodeAt(i);
+  }
+  return result;
+}
diff --git a/lib/dal-test/src/test_harness.rs b/lib/dal-test/src/test_harness.rs
index b1cb7202c7..89a4845084 100644
--- a/lib/dal-test/src/test_harness.rs
+++ b/lib/dal-test/src/test_harness.rs
@@ -7,8 +7,7 @@ use dal::{
     socket::{Socket, SocketArity, SocketEdgeKind, SocketKind},
     ChangeSet, ChangeSetPk, Component, DalContext, DiagramKind, EncryptedSecret, Func,
     FuncBackendKind, FuncBackendResponseType, KeyPair, Node, Schema, SchemaId, SchemaVariantId,
-    Secret, SecretKind, SecretObjectType, StandardModel, User, UserPk, Visibility, Workspace,
-    WorkspacePk,
+    Secret, StandardModel, User, UserPk, Visibility, Workspace, WorkspacePk,
 };
 use names::{Generator, Name};
 
@@ -186,8 +185,8 @@ pub async fn create_secret(ctx: &DalContext, key_pair_pk: KeyPairPk) -> Secret {
     EncryptedSecret::new(
         ctx,
         &name,
-        SecretObjectType::Credential,
-        SecretKind::DockerHub,
+        "Mock".to_owned(),
+        Some("Description".to_owned()),
         &encrypt_message(ctx, key_pair_pk, &serde_json::json!({ "name": name })).await,
         key_pair_pk,
         Default::default(),
@@ -206,8 +205,8 @@ pub async fn create_secret_with_message(
     EncryptedSecret::new(
         ctx,
         &name,
-        SecretObjectType::Credential,
-        SecretKind::DockerHub,
+        "Mock".to_owned(),
+        Some("Description".to_owned()),
         &encrypt_message(ctx, key_pair_pk, message).await,
         key_pair_pk,
         Default::default(),
diff --git a/lib/dal/src/lib.rs b/lib/dal/src/lib.rs
index 175de797fe..a813b33cda 100644
--- a/lib/dal/src/lib.rs
+++ b/lib/dal/src/lib.rs
@@ -149,8 +149,8 @@ pub use schema::variant::root_prop::RootPropChild;
 pub use schema::variant::SchemaVariantError;
 pub use schema::{Schema, SchemaError, SchemaId, SchemaPk, SchemaVariant, SchemaVariantId};
 pub use secret::{
-    DecryptedSecret, EncryptedSecret, Secret, SecretAlgorithm, SecretError, SecretId, SecretKind,
-    SecretObjectType, SecretPk, SecretResult, SecretVersion,
+    DecryptedSecret, EncryptedSecret, Secret, SecretAlgorithm, SecretError, SecretId, SecretPk,
+    SecretResult, SecretVersion,
 };
 pub use socket::{Socket, SocketArity, SocketId};
 pub use standard_model::{StandardModel, StandardModelError, StandardModelResult};
diff --git a/lib/dal/src/migrations/U0054__secrets.sql b/lib/dal/src/migrations/U0054__secrets.sql
index 968f3f8403..e04b282980 100644
--- a/lib/dal/src/migrations/U0054__secrets.sql
+++ b/lib/dal/src/migrations/U0054__secrets.sql
@@ -1,19 +1,21 @@
 CREATE TABLE encrypted_secrets
 (
-    pk                          ident primary key default ident_create_v1(),
-    id                          ident not null default ident_create_v1(),
-    tenancy_workspace_pk        ident,
-    visibility_change_set_pk    ident                    NOT NULL DEFAULT ident_nil_v1(),
-    visibility_deleted_at       timestamp with time zone,
-    created_at                  timestamp with time zone NOT NULL DEFAULT CLOCK_TIMESTAMP(),
-    updated_at                  timestamp with time zone NOT NULL DEFAULT CLOCK_TIMESTAMP(),
-    name                        text                     NOT NULL,
-    object_type                 text                     NOT NULL,
-    kind                        text                     NOT NULL,
-    key_pair_pk                 ident                    NOT NULL,
-    crypted                     text                     NOT NULL,
-    version                     text                     NOT NULL,
-    algorithm                   text                     NOT NULL
+    pk                       ident primary key                 default ident_create_v1(),
+    id                       ident                    not null default ident_create_v1(),
+    tenancy_workspace_pk     ident,
+    visibility_change_set_pk ident                    NOT NULL DEFAULT ident_nil_v1(),
+    visibility_deleted_at    timestamp with time zone,
+    created_at               timestamp with time zone NOT NULL DEFAULT CLOCK_TIMESTAMP(),
+    created_by               ident,
+    updated_at               timestamp with time zone NOT NULL DEFAULT CLOCK_TIMESTAMP(),
+    updated_by               ident,
+    name                     text                     NOT NULL,
+    definition               text                     NOT NULL,
+    description              text,
+    key_pair_pk              ident                    NOT NULL,
+    crypted                  text                     NOT NULL,
+    version                  text                     NOT NULL,
+    algorithm                text                     NOT NULL
 );
 SELECT standard_model_table_constraints_v1('encrypted_secrets');
 
@@ -30,77 +32,82 @@ SELECT pk,
        visibility_deleted_at,
        key_pair_pk,
        created_at,
+       created_by,
        updated_at,
+       updated_by,
        name,
-       object_type,
-       kind
+       definition,
+       description
 FROM encrypted_secrets;
 
 -- We need to create the following tenancy and visibility related functions by hand
 -- because we're trying to pretend that the secrets view is a "normal" standard model
 -- table.
 CREATE OR REPLACE FUNCTION in_tenancy_v1(
-    this_tenancy      jsonb,
-    record_to_check   secrets
+    this_tenancy jsonb,
+    record_to_check secrets
 )
-RETURNS bool
-LANGUAGE sql
-IMMUTABLE PARALLEL SAFE CALLED ON NULL INPUT
-AS $$
-    SELECT in_tenancy_v1(
-        this_tenancy,
-        record_to_check.tenancy_workspace_pk
-    )
+    RETURNS bool
+    LANGUAGE sql
+    IMMUTABLE PARALLEL SAFE CALLED ON NULL INPUT
+AS
+$$
+SELECT in_tenancy_v1(
+               this_tenancy,
+               record_to_check.tenancy_workspace_pk
+           )
 $$;
 
 CREATE OR REPLACE FUNCTION is_visible_v1(
     this_visibility jsonb,
     record_to_check secrets
 )
-RETURNS bool
-LANGUAGE sql
-IMMUTABLE PARALLEL SAFE CALLED ON NULL INPUT
-AS $$
-    SELECT is_visible_v1(
-        this_visibility,
-        record_to_check.visibility_change_set_pk,
-        record_to_check.visibility_deleted_at
-    )
+    RETURNS bool
+    LANGUAGE sql
+    IMMUTABLE PARALLEL SAFE CALLED ON NULL INPUT
+AS
+$$
+SELECT is_visible_v1(
+               this_visibility,
+               record_to_check.visibility_change_set_pk,
+               record_to_check.visibility_deleted_at
+           )
 $$;
 
 CREATE OR REPLACE FUNCTION in_tenancy_and_visible_v1(
-    this_tenancy      jsonb,
-    this_visibility   jsonb,
-    record_to_check   secrets
+    this_tenancy jsonb,
+    this_visibility jsonb,
+    record_to_check secrets
 )
-RETURNS bool
-LANGUAGE sql
-IMMUTABLE PARALLEL SAFE CALLED ON NULL INPUT
-AS $$
-    SELECT
-        in_tenancy_v1(
-            this_tenancy,
-            record_to_check.tenancy_workspace_pk
-        )
-        AND is_visible_v1(
-            this_visibility,
-            record_to_check.visibility_change_set_pk,
-            record_to_check.visibility_deleted_at
-        )
+    RETURNS bool
+    LANGUAGE sql
+    IMMUTABLE PARALLEL SAFE CALLED ON NULL INPUT
+AS
+$$
+SELECT in_tenancy_v1(
+               this_tenancy,
+               record_to_check.tenancy_workspace_pk
+           )
+           AND is_visible_v1(
+               this_visibility,
+               record_to_check.visibility_change_set_pk,
+               record_to_check.visibility_deleted_at
+           )
 $$;
 
 CREATE OR REPLACE FUNCTION secrets_v1(
-    this_tenancy      jsonb,
-    this_visibility   jsonb
+    this_tenancy jsonb,
+    this_visibility jsonb
 )
-RETURNS SETOF secrets
-LANGUAGE sql
-STABLE PARALLEL SAFE CALLED ON NULL INPUT
-AS $$
-    SELECT DISTINCT ON (id) secrets.*
-    FROM secrets
-    WHERE in_tenancy_and_visible_v1(this_tenancy, this_visibility, secrets)
-    ORDER BY id, visibility_change_set_pk DESC, visibility_deleted_at DESC NULLS FIRST
+    RETURNS SETOF secrets
+    LANGUAGE sql
+    STABLE PARALLEL SAFE CALLED ON NULL INPUT
+AS
+$$
+SELECT DISTINCT ON (id) secrets.*
+FROM secrets
+WHERE in_tenancy_and_visible_v1(this_tenancy, this_visibility, secrets)
+ORDER BY id, visibility_change_set_pk DESC, visibility_deleted_at DESC NULLS FIRST
 $$;
 
 
@@ -108,12 +115,13 @@ CREATE OR REPLACE FUNCTION encrypted_secret_create_v1(
     this_tenancy jsonb,
     this_visibility jsonb,
     this_name text,
-    this_object_type text,
-    this_kind text,
+    this_definition text,
+    this_description text,
     this_crypted text,
     this_version text,
     this_algorithm text,
     this_key_pair_pk ident,
+    this_created_by ident,
     OUT object json) AS
 $$
 DECLARE
@@ -127,21 +135,25 @@ BEGIN
     INSERT INTO encrypted_secrets (tenancy_workspace_pk,
                                    visibility_change_set_pk,
                                    name,
-                                   object_type,
-                                   kind,
+                                   definition,
+                                   description,
                                    crypted,
                                    version,
                                    algorithm,
-			           key_pair_pk)
+                                   key_pair_pk,
+                                   created_by,
+                                   updated_by)
     VALUES (this_tenancy_record.tenancy_workspace_pk,
             this_visibility_record.visibility_change_set_pk,
             this_name,
-            this_object_type,
-            this_kind,
+            this_definition,
+            this_description,
             this_crypted,
             this_version,
             this_algorithm,
-            this_key_pair_pk)
+            this_key_pair_pk,
+            this_created_by,
+            this_created_by)
     RETURNING * INTO this_new_row;
 
     -- Purge the returning record of sensitive data to avoid accidentally
diff --git a/lib/dal/src/secret.rs b/lib/dal/src/secret.rs
index 1f5b364a32..0074196818 100644
--- a/lib/dal/src/secret.rs
+++ b/lib/dal/src/secret.rs
@@ -1,4 +1,3 @@
-use crate::{Tenancy, TransactionsError};
 use std::fmt;
 
 use base64::{engine::general_purpose, Engine};
@@ -14,6 +13,7 @@ use telemetry::prelude::*;
 use thiserror::Error;
 use veritech_client::SensitiveContainer;
 
+use crate::diagram::node::HistoryEventMetadata;
 use crate::standard_model::objects_from_rows;
 use crate::{
     impl_standard_model,
@@ -24,6 +24,7 @@ use crate::{
     HistoryEventError, KeyPair, KeyPairError, StandardModel, StandardModelError, Timestamp,
     Visibility,
 };
+use crate::{ActorView, HistoryActor, Tenancy, TransactionsError, UserPk};
 
 const LIST_SECRET_DEFINITIONS: &str = include_str!("queries/secrets/list_secret_definitions.sql");
 
@@ -64,13 +65,15 @@ pub struct Secret {
     pk: SecretPk,
     id: SecretId,
     name: String,
-    object_type: SecretObjectType,
     key_pair_pk: KeyPairPk,
-    kind: SecretKind,
+    definition: String,
+    description: Option<String>,
     #[serde(flatten)]
     tenancy: Tenancy,
     #[serde(flatten)]
     timestamp: Timestamp,
+    created_by: Option<UserPk>,
+    updated_by: Option<UserPk>,
     #[serde(flatten)]
     visibility: Visibility,
 }
@@ -118,8 +121,8 @@ impl Secret {
     }
 
     // Once created, these object fields are to be considered immutable
-    standard_model_accessor_ro!(object_type, SecretObjectType);
-    standard_model_accessor_ro!(kind, SecretKind);
+    standard_model_accessor_ro!(definition, String);
+    standard_model_accessor_ro!(description, Option<String>);
 
     pub async fn key_pair(&self, ctx: &DalContext) -> SecretResult<KeyPair> {
         Ok(KeyPair::get_by_pk(ctx, self.key_pair_pk).await?)
@@ -131,18 +134,54 @@ impl Secret {
 pub struct SecretView {
     pub id: SecretId,
     pub name: String,
-    pub object_type: SecretObjectType,
-    pub kind: SecretKind,
+    pub definition: String,
+    pub description: Option<String>,
+    pub created_info: HistoryEventMetadata,
+    pub updated_info: Option<HistoryEventMetadata>,
 }
 
-impl From<Secret> for SecretView {
-    fn from(secret: Secret) -> Self {
-        Self {
-            id: *secret.id(),
-            name: secret.name().to_owned(),
-            object_type: *secret.object_type(),
-            kind: *secret.kind(),
-        }
+impl SecretView {
+    pub async fn from_secret(ctx: &DalContext, secret: Secret) -> SecretResult<Self> {
+        let created_info = {
+            let actor = match secret.created_by {
+                None => HistoryActor::SystemInit,
+                Some(user_pk) => HistoryActor::from(user_pk),
+            };
+
+            let view = ActorView::from_history_actor(ctx, actor).await?;
+
+            HistoryEventMetadata {
+                actor: view,
+                timestamp: secret.timestamp.created_at,
+            }
+        };
+
+        let updated_info = {
+            let actor = match secret.updated_by {
+                None => HistoryActor::SystemInit,
+                Some(user_pk) => HistoryActor::from(user_pk),
+            };
+
+            let view = ActorView::from_history_actor(ctx, actor).await?;
+
+            if secret.timestamp.created_at == secret.timestamp.updated_at {
+                None
+            } else {
+                Some(HistoryEventMetadata {
+                    actor: view,
+                    timestamp: secret.timestamp.updated_at,
+                })
+            }
+        };
+
+        Ok(Self {
+            id: secret.id,
+            name: secret.name,
+            definition: secret.definition,
+            description: secret.description,
+            created_info,
+            updated_info,
+        })
     }
 }
 
@@ -158,8 +197,8 @@ pub struct EncryptedSecret {
     pk: SecretPk,
     id: SecretId,
     name: String,
-    object_type: SecretObjectType,
-    kind: SecretKind,
+    definition: String,
+    description: Option<String>,
     key_pair_pk: KeyPairPk,
     #[serde(with = "crypted_serde")]
     crypted: Vec<u8>,
@@ -169,6 +208,8 @@ pub struct EncryptedSecret {
     tenancy: Tenancy,
     #[serde(flatten)]
     timestamp: Timestamp,
+    created_by: Option<UserPk>,
+    updated_by: Option<UserPk>,
     #[serde(flatten)]
     visibility: Visibility,
 }
@@ -179,8 +220,8 @@ impl fmt::Debug for EncryptedSecret {
             .field("pk", &self.pk)
             .field("id", &self.id)
             .field("name", &self.name)
-            .field("object_type", &self.object_type)
-            .field("kind", &self.kind)
+            .field("definition", &self.definition)
+            .field("description", &self.description)
             .field("version", &self.version)
             .field("algorithm", &self.algorithm)
             .field("tenancy", &self.tenancy)
@@ -200,13 +241,13 @@ impl_standard_model! {
 }
 
 impl EncryptedSecret {
-    /// Creates a new encypted secret and returns a corresponding [`Secret`] representation.
+    /// Creates a new encrypted secret and returns a corresponding [`Secret`] representation.
     #[allow(clippy::too_many_arguments, clippy::new_ret_no_self)]
     pub async fn new(
         ctx: &DalContext,
         name: impl AsRef<str>,
-        object_type: SecretObjectType,
-        kind: SecretKind,
+        definition: String,
+        description: Option<String>,
         crypted: &[u8],
         key_pair_pk: KeyPairPk,
         version: SecretVersion,
@@ -214,22 +255,28 @@ impl EncryptedSecret {
     ) -> SecretResult<Secret> {
         let name = name.as_ref();
 
+        let maybe_actor = match ctx.history_actor() {
+            HistoryActor::SystemInit => None,
+            HistoryActor::User(user_pk) => Some(user_pk),
+        };
+
         let row = ctx
             .txns()
             .await?
             .pg()
             .query_one(
-                "SELECT object FROM encrypted_secret_create_v1($1, $2, $3, $4, $5, $6, $7, $8, $9)",
+                "SELECT object FROM encrypted_secret_create_v1($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)",
                 &[
                     ctx.tenancy(),
                     ctx.visibility(),
                     &name,
-                    &object_type.as_ref(),
-                    &kind.as_ref(),
+                    &definition,
+                    &description,
                     &encode_crypted(crypted),
                     &version.as_ref(),
                     &algorithm.as_ref(),
                     &key_pair_pk,
+                    &maybe_actor,
                 ],
             )
             .await?;
@@ -239,10 +286,10 @@ impl EncryptedSecret {
     }
 
     standard_model_accessor!(name, String, SecretResult);
+    standard_model_accessor_ro!(description, Option<String>);
 
     // Once created, these object fields are to be considered immutable
-    standard_model_accessor_ro!(object_type, SecretObjectType);
-    standard_model_accessor_ro!(kind, SecretKind);
+    standard_model_accessor_ro!(definition, String);
     standard_model_accessor_ro!(version, SecretVersion);
     standard_model_accessor_ro!(algorithm, SecretAlgorithm);
 
@@ -259,8 +306,7 @@ impl EncryptedSecret {
         match (self.version, self.algorithm) {
             (SecretVersion::V1, SecretAlgorithm::Sealedbox) => Ok(DecryptedSecret {
                 name: self.name,
-                object_type: self.object_type,
-                secret_kind: self.kind,
+                definition: self.definition,
                 message: serde_json::from_slice(
                     &sealedbox::open(&self.crypted, pkey, skey)
                         .map_err(|_| SecretError::DecryptionFailed)?,
@@ -281,13 +327,12 @@ impl EncryptedSecret {
 /// decrypted message, and without the encrypted payload and other metadata. It is not persistable
 /// and is only intended to be used internally when passing secrets through to Cyclone.
 //
-// NOTE: We're being a bit careful here as to which traits are derrived in an effort to minimize
+// NOTE: We're being a bit careful here as to which traits are drrived in an effort to minimize
 // leaking sensitive data.
 #[derive(Serialize)]
 pub struct DecryptedSecret {
     name: String,
-    object_type: SecretObjectType,
-    secret_kind: SecretKind,
+    definition: String,
     message: Value,
 }
 
@@ -301,14 +346,9 @@ impl DecryptedSecret {
         self.message.clone().into()
     }
 
-    /// Gets the decrypted secret's object type.
-    pub fn object_type(&self) -> SecretObjectType {
-        self.object_type
-    }
-
-    /// Gets the decrypted secret's kind.
-    pub fn kind(&self) -> SecretKind {
-        self.secret_kind
+    /// Gets the decrypted secret's definition.
+    pub fn definition(&self) -> &str {
+        self.definition.as_ref()
     }
 }
 
@@ -316,8 +356,7 @@ impl fmt::Debug for DecryptedSecret {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         f.debug_struct("DecryptedSecret")
             .field("name", &self.name)
-            .field("object_type", &self.object_type)
-            .field("secret_kind", &self.secret_kind)
+            .field("definition", &self.definition)
             .finish_non_exhaustive()
     }
 }
@@ -358,36 +397,6 @@ impl Default for SecretAlgorithm {
     }
 }
 
-/// The object type of a secret.
-#[remain::sorted]
-#[derive(
-    AsRefStr, Clone, Copy, Debug, Deserialize, Display, EnumString, Eq, PartialEq, Serialize,
-)]
-#[serde(rename_all = "camelCase")]
-#[strum(serialize_all = "camelCase")]
-pub enum SecretObjectType {
-    /// Represents a secret which is a credential
-    Credential,
-}
-
-/// The kind of a secret.
-#[remain::sorted]
-#[derive(
-    AsRefStr, Clone, Copy, Debug, Deserialize, Display, EnumString, Eq, PartialEq, Serialize,
-)]
-#[serde(rename_all = "camelCase")]
-#[strum(serialize_all = "camelCase")]
-pub enum SecretKind {
-    /// An AWS access key
-    AwsAccessKey,
-    /// An Azure service principal
-    AzureServicePrincipal,
-    /// A Docker Hub credential
-    DockerHub,
-    /// A Helm repository credential
-    HelmRepo,
-}
-
 #[derive(Deserialize, Serialize, Debug)]
 #[serde(rename_all(serialize = "camelCase"))]
 pub struct SecretFormDataView {
@@ -404,15 +413,17 @@ pub struct SecretDefinitionView {
     form_data: Vec<SecretFormDataView>,
 }
 
-pub async fn list_secret_definitions(ctx: &DalContext) -> SecretResult<Vec<SecretDefinitionView>> {
-    let rows = ctx
-        .txns()
-        .await?
-        .pg()
-        .query(LIST_SECRET_DEFINITIONS, &[ctx.tenancy(), ctx.visibility()])
-        .await?;
+impl SecretDefinitionView {
+    pub async fn list(ctx: &DalContext) -> SecretResult<Vec<SecretDefinitionView>> {
+        let rows = ctx
+            .txns()
+            .await?
+            .pg()
+            .query(LIST_SECRET_DEFINITIONS, &[ctx.tenancy(), ctx.visibility()])
+            .await?;
 
-    Ok(objects_from_rows(rows)?)
+        Ok(objects_from_rows(rows)?)
+    }
 }
 
 fn encode_crypted(crypted: &[u8]) -> String {
@@ -457,8 +468,8 @@ mod tests {
 
         fn encrypted_secret(
             name: impl Into<String>,
-            object_type: SecretObjectType,
-            kind: SecretKind,
+            definition: String,
+            description: Option<String>,
             crypted: impl Into<Vec<u8>>,
             wid: WorkspacePk,
         ) -> EncryptedSecret {
@@ -469,14 +480,16 @@ mod tests {
                 pk: SecretPk::NONE,
                 id: SecretId::NONE,
                 name,
-                object_type,
-                kind,
+                definition,
+                description,
                 key_pair_pk: KeyPairPk::NONE,
                 crypted,
                 version: Default::default(),
                 algorithm: Default::default(),
                 tenancy: Tenancy::new(wid),
                 timestamp: Timestamp::now(),
+                created_by: None,
+                updated_by: None,
                 visibility: Visibility::new_head(false),
             }
         }
@@ -502,8 +515,8 @@ mod tests {
 
             let encrypted = encrypted_secret(
                 "the-cadillac-three",
-                SecretObjectType::Credential,
-                SecretKind::DockerHub,
+                "dockerHub".to_owned(),
+                None,
                 crypted,
                 WorkspacePk::NONE,
             );
@@ -512,106 +525,11 @@ mod tests {
                 .expect("could not decrypt secret");
 
             assert_eq!("the-cadillac-three", decrypted.name);
-            assert_eq!(SecretObjectType::Credential, decrypted.object_type);
-            assert_eq!(SecretKind::DockerHub, decrypted.secret_kind);
+            assert_eq!("dockerHub", decrypted.definition);
             assert_eq!(message, decrypted.message);
         }
     }
 
-    mod secret_object_type {
-        use super::*;
-
-        #[derive(Debug, Deserialize, Eq, PartialEq, Serialize)]
-        #[serde(rename_all = "camelCase")]
-        struct Object {
-            object_type: SecretObjectType,
-        }
-
-        fn str() -> &'static str {
-            r#"{"objectType":"credential"}"#
-        }
-
-        fn invalid() -> &'static str {
-            r#"{"objectType":"nope"}"#
-        }
-
-        fn object() -> Object {
-            Object {
-                object_type: SecretObjectType::Credential,
-            }
-        }
-
-        #[test]
-        fn serialize() {
-            assert_eq!(
-                str(),
-                serde_json::to_string(&object()).expect("failed to serialize")
-            );
-        }
-
-        #[test]
-        fn deserialize() {
-            assert_eq!(
-                object(),
-                serde_json::from_str(str()).expect("failed to deserialize")
-            );
-        }
-
-        #[test]
-        fn deserialize_invalid() {
-            if serde_json::from_str::<Object>(invalid()).is_ok() {
-                panic!("deserialize should not succeed")
-            }
-        }
-    }
-
-    mod secret_kind {
-        use super::*;
-
-        #[derive(Debug, Deserialize, Eq, PartialEq, Serialize)]
-        #[serde(rename_all = "camelCase")]
-        struct Object {
-            kind: SecretKind,
-        }
-
-        fn str() -> &'static str {
-            r#"{"kind":"dockerHub"}"#
-        }
-
-        fn invalid() -> &'static str {
-            r#"{"kind":"nope"}"#
-        }
-
-        fn object() -> Object {
-            Object {
-                kind: SecretKind::DockerHub,
-            }
-        }
-
-        #[test]
-        fn serialize() {
-            assert_eq!(
-                str(),
-                serde_json::to_string(&object()).expect("failed to serialize")
-            );
-        }
-
-        #[test]
-        fn deserialize() {
-            assert_eq!(
-                object(),
-                serde_json::from_str(str()).expect("failed to deserialize")
-            );
-        }
-
-        #[test]
-        fn deserialize_invalid() {
-            if serde_json::from_str::<Object>(invalid()).is_ok() {
-                panic!("deserialize should not succeed")
-            }
-        }
-    }
-
     mod secret_version {
         use super::*;
 
diff --git a/lib/dal/tests/integration_test/internal/secret.rs b/lib/dal/tests/integration_test/internal/secret.rs
index 8e8a9729da..a8ba7e3a22 100644
--- a/lib/dal/tests/integration_test/internal/secret.rs
+++ b/lib/dal/tests/integration_test/internal/secret.rs
@@ -1,6 +1,6 @@
 use dal::{
-    DalContext, EncryptedSecret, Secret, SecretAlgorithm, SecretKind, SecretObjectType,
-    SecretVersion, StandardModel, WorkspaceSignup,
+    DalContext, EncryptedSecret, Secret, SecretAlgorithm, SecretVersion, StandardModel,
+    WorkspaceSignup,
 };
 use dal_test::{
     test,
@@ -14,8 +14,8 @@ async fn new_encrypted_secret(ctx: &DalContext, nw: &WorkspaceSignup) {
     let secret = EncryptedSecret::new(
         ctx,
         &name,
-        SecretObjectType::Credential,
-        SecretKind::DockerHub,
+        "Mock".to_owned(),
+        Some("Description".to_owned()),
         "im-crypted-bytes-maybe".as_bytes(),
         nw.key_pair.pk(),
         SecretVersion::V1,
@@ -25,8 +25,8 @@ async fn new_encrypted_secret(ctx: &DalContext, nw: &WorkspaceSignup) {
     .expect("failed to create secret");
 
     assert_eq!(secret.name(), name);
-    assert_eq!(secret.object_type(), &SecretObjectType::Credential);
-    assert_eq!(secret.kind(), &SecretKind::DockerHub);
+    assert_eq!(secret.definition(), "Mock");
+    assert_eq!(secret.description().as_deref(), Some("Description"));
 
     let key_pair = secret
         .key_pair(ctx)
@@ -57,8 +57,8 @@ async fn encrypted_secret_get_by_id(ctx: &DalContext, nw: &WorkspaceSignup) {
     assert_eq!(secret.id(), encrypted_secret.id());
     assert_eq!(secret.pk(), encrypted_secret.pk());
     assert_eq!(secret.name(), encrypted_secret.name());
-    assert_eq!(secret.object_type(), encrypted_secret.object_type());
-    assert_eq!(secret.kind(), encrypted_secret.kind());
+    assert_eq!(secret.description(), encrypted_secret.description());
+    assert_eq!(secret.definition(), encrypted_secret.definition());
 }
 
 #[test]
@@ -89,8 +89,8 @@ async fn encrypt_decrypt_round_trip(ctx: &DalContext, nw: &WorkspaceSignup) {
     let secret = EncryptedSecret::new(
         ctx,
         &name,
-        SecretObjectType::Credential,
-        SecretKind::DockerHub,
+        "imasecret".to_owned(),
+        None,
         &crypted,
         nw.key_pair.pk(),
         Default::default(),
@@ -107,8 +107,7 @@ async fn encrypt_decrypt_round_trip(ctx: &DalContext, nw: &WorkspaceSignup) {
         .await
         .expect("failed to decrypt encrypted secret");
     assert_eq!(decrypted.name(), secret.name());
-    assert_eq!(decrypted.object_type(), *secret.object_type());
-    assert_eq!(decrypted.kind(), *secret.kind());
+    assert_eq!(decrypted.definition(), secret.definition());
 
     // We don't provide a direct getter for the raw decrypted message (higher effort should mean
     // less chance of developer error when handling `DecryptedSecret` types), so we'll serialize to
diff --git a/lib/sdf-server/src/server/service/secret.rs b/lib/sdf-server/src/server/service/secret.rs
index 01608dfef5..2c8d36a340 100644
--- a/lib/sdf-server/src/server/service/secret.rs
+++ b/lib/sdf-server/src/server/service/secret.rs
@@ -13,7 +13,7 @@ use thiserror::Error;
 use tokio::sync::Mutex;
 
 use dal::diagram::node::HistoryEventMetadata;
-use dal::secret::{list_secret_definitions, SecretDefinitionView};
+use dal::secret::SecretDefinitionView;
 use dal::{
     DiagramError, HistoryActorTimestamp, KeyPairError, SecretId, StandardModelError,
     TransactionsError, UserError, Visibility, WorkspacePk, WsEventError,
@@ -21,8 +21,11 @@ use dal::{
 
 use crate::server::extract::{AccessBuilder, HandlerContext};
 use crate::server::state::AppState;
+use crate::service::secret::list_secrets::{ListSecretResponse, SecretDefinitionViewWithSecrets};
 
+pub mod create_secret;
 pub mod get_public_key;
+pub mod list_secrets;
 
 #[remain::sorted]
 #[derive(Debug, Error)]
@@ -39,6 +42,8 @@ pub enum SecretError {
     Pg(#[from] si_data_pg::PgError),
     #[error(transparent)]
     Secret(#[from] dal::SecretError),
+    #[error("definition not found for secret: {0}")]
+    SecretWithInvalidDefinition(SecretId),
     #[error(transparent)]
     StandardModel(#[from] StandardModelError),
     #[error(transparent)]
@@ -86,18 +91,11 @@ impl IntoResponse for SecretError {
 pub fn routes() -> Router<AppState> {
     Router::new()
         .route("/get_public_key", get(get_public_key::get_public_key))
-        .route("/", post(create_secret))
-        .route("/", get(list_secrets))
+        .route("/", post(create_secret::create_secret))
+        .route("/", get(list_secrets::list_secrets))
         .route("/", delete(delete_secrets))
 }
 
-#[derive(Deserialize, Serialize, Debug)]
-#[serde(rename_all = "camelCase")]
-pub struct SecretDefinitionViewWithSecrets {
-    definition: SecretDefinitionView,
-    secrets: Vec<Secret>,
-}
-
 #[derive(Deserialize, Serialize, Debug)]
 #[serde(rename_all = "camelCase")]
 pub struct CreateSecretRequest {
@@ -110,7 +108,7 @@ pub struct CreateSecretRequest {
 
 pub type CreateSecretResponse = Secret;
 
-pub async fn create_secret(
+pub async fn _create_secret(
     HandlerContext(builder): HandlerContext,
     AccessBuilder(access_builder): AccessBuilder,
     Json(request): Json<CreateSecretRequest>,
@@ -152,9 +150,6 @@ pub struct ListSecretRequest {
     #[serde(flatten)]
     pub visibility: Visibility,
 }
-
-pub type ListSecretResponse = HashMap<String, SecretDefinitionViewWithSecrets>;
-
 pub async fn list_secrets(
     HandlerContext(builder): HandlerContext,
     AccessBuilder(request_ctx): AccessBuilder,
@@ -162,8 +157,7 @@ pub async fn list_secrets(
 ) -> SecretResult<Json<ListSecretResponse>> {
     let ctx = builder.build(request_ctx.build(request.visibility)).await?;
 
-    let definitions = list_secret_definitions(&ctx).await?;
-    let secrets = SECRETOS.lock().await;
+    let definitions = SecretDefinitionView::list(&ctx).await?;
 
     Ok(Json(
         definitions
@@ -173,9 +167,7 @@ pub async fn list_secrets(
 
                 let view = SecretDefinitionViewWithSecrets {
                     definition: def,
-                    secrets: secrets
-                        .get(&secret_definition)
-                        .map_or_else(Vec::new, |view| view.clone()),
+                    secrets: Vec::new(),
                 };
 
                 (secret_definition, view)
diff --git a/lib/sdf-server/src/server/service/secret/create_secret.rs b/lib/sdf-server/src/server/service/secret/create_secret.rs
index 2f6e59d395..ab308bab44 100644
--- a/lib/sdf-server/src/server/service/secret/create_secret.rs
+++ b/lib/sdf-server/src/server/service/secret/create_secret.rs
@@ -1,7 +1,7 @@
 use axum::Json;
+use dal::secret::SecretView;
 use dal::{
-    key_pair::KeyPairPk, EncryptedSecret, Secret, SecretAlgorithm, SecretKind, SecretObjectType,
-    SecretVersion, Visibility, WsEvent,
+    key_pair::KeyPairPk, EncryptedSecret, SecretAlgorithm, SecretVersion, Visibility, WsEvent,
 };
 use serde::{Deserialize, Serialize};
 
@@ -13,8 +13,8 @@ use super::SecretResult;
 #[serde(rename_all = "camelCase")]
 pub struct CreateSecretRequest {
     pub name: String,
-    pub object_type: SecretObjectType,
-    pub kind: SecretKind,
+    pub definition: String,
+    pub description: Option<String>,
     pub crypted: Vec<u8>,
     pub key_pair_pk: KeyPairPk,
     pub version: SecretVersion,
@@ -23,11 +23,7 @@ pub struct CreateSecretRequest {
     pub visibility: Visibility,
 }
 
-#[derive(Deserialize, Serialize, Debug)]
-#[serde(rename_all = "camelCase")]
-pub struct CreateSecretResponse {
-    pub secret: Secret,
-}
+pub type CreateSecretResponse = SecretView;
 
 pub async fn create_secret(
     HandlerContext(builder): HandlerContext,
@@ -39,8 +35,8 @@ pub async fn create_secret(
     let secret = EncryptedSecret::new(
         &ctx,
         request.name,
-        request.object_type,
-        request.kind,
+        request.definition,
+        request.description,
         &request.crypted,
         request.key_pair_pk,
         request.version,
@@ -55,5 +51,5 @@ pub async fn create_secret(
 
     ctx.commit().await?;
 
-    Ok(Json(CreateSecretResponse { secret }))
+    Ok(Json(SecretView::from_secret(&ctx, secret).await?))
 }
diff --git a/lib/sdf-server/src/server/service/secret/list_secrets.rs b/lib/sdf-server/src/server/service/secret/list_secrets.rs
index 984214ac58..fc99c06f14 100644
--- a/lib/sdf-server/src/server/service/secret/list_secrets.rs
+++ b/lib/sdf-server/src/server/service/secret/list_secrets.rs
@@ -1,10 +1,16 @@
+use std::collections::HashMap;
+
 use axum::extract::Query;
 use axum::Json;
-use dal::{secret::SecretView, Secret, StandardModel, Visibility};
 use serde::{Deserialize, Serialize};
 
-use super::SecretResult;
+use dal::secret::{SecretDefinitionView, SecretView};
+use dal::{Secret, StandardModel, Visibility};
+
 use crate::server::extract::{AccessBuilder, HandlerContext};
+use crate::service::secret::SecretError;
+
+use super::SecretResult;
 
 #[derive(Deserialize, Serialize, Debug)]
 #[serde(rename_all = "camelCase")]
@@ -15,10 +21,13 @@ pub struct ListSecretRequest {
 
 #[derive(Deserialize, Serialize, Debug)]
 #[serde(rename_all = "camelCase")]
-pub struct ListSecretResponse {
-    pub list: Vec<SecretView>,
+pub struct SecretDefinitionViewWithSecrets {
+    pub definition: SecretDefinitionView,
+    pub secrets: Vec<SecretView>,
 }
 
+pub type ListSecretResponse = HashMap<String, SecretDefinitionViewWithSecrets>;
+
 pub async fn list_secrets(
     HandlerContext(builder): HandlerContext,
     AccessBuilder(request_ctx): AccessBuilder,
@@ -26,12 +35,29 @@ pub async fn list_secrets(
 ) -> SecretResult<Json<ListSecretResponse>> {
     let ctx = builder.build(request_ctx.build(request.visibility)).await?;
 
-    let list: Vec<SecretView> = Secret::list(&ctx)
-        .await?
+    let definitions = SecretDefinitionView::list(&ctx).await?;
+
+    let mut hash_map = definitions
         .into_iter()
-        .map(Into::into)
-        .collect();
-    let response = ListSecretResponse { list };
+        .map(|def| {
+            let secret_definition = def.secret_definition.clone();
+
+            let view = SecretDefinitionViewWithSecrets {
+                definition: def,
+                secrets: vec![],
+            };
+
+            (secret_definition, view)
+        })
+        .collect::<HashMap<_, _>>();
+
+    for secret in Secret::list(&ctx).await? {
+        hash_map
+            .get_mut(secret.definition())
+            .ok_or(SecretError::SecretWithInvalidDefinition(*secret.id()))?
+            .secrets
+            .push(SecretView::from_secret(&ctx, secret).await?);
+    }
 
-    Ok(Json(response))
+    Ok(Json(hash_map))
 }
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 68683e2b02..ad62be8b4d 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -188,6 +188,9 @@ importers:
       javascript-time-ago:
         specifier: ^2.5.7
         version: 2.5.9
+      js-base64:
+        specifier: ^3.7.5
+        version: 3.7.5
       js-beautify:
         specifier: ^1.14.9
         version: 1.14.9
@@ -203,6 +206,9 @@ importers:
       less:
         specifier: ^4.1.3
         version: 4.1.3
+      libsodium-wrappers:
+        specifier: ^0.7.13
+        version: 0.7.13
       local-storage-fallback:
         specifier: ^4.1.2
         version: 4.1.2
@@ -267,6 +273,9 @@ importers:
       '@types/js-beautify':
         specifier: ^1.14.1
         version: 1.14.1
+      '@types/libsodium-wrappers':
+        specifier: ^0.7.11
+        version: 0.7.11
       '@types/lodash-es':
         specifier: ^4.17.7
         version: 4.17.7
@@ -3628,6 +3637,10 @@ packages:
       '@types/koa': 2.13.5
     dev: true
 
+  /@types/libsodium-wrappers@0.7.11:
+    resolution: {integrity: sha512-8avZYJny690B6lFZQEDz4PEdCgC8D8qmGE/mhJBzCwzZvsqne61tCRbtJOhxsjYMItEZd3k4SoR4xKKLnI9Ztg==}
+    dev: true
+
   /@types/lodash-es@4.17.7:
     resolution: {integrity: sha512-z0ptr6UI10VlU6l5MYhGwS4mC8DZyYer2mCoyysZtSF7p26zOX8UpbrV0YpNYLGS8K4PUFIyEr62IMFFjveSiQ==}
     dependencies:
@@ -10675,6 +10688,10 @@ packages:
     resolution: {integrity: sha512-MSJQC5vXco5Br38mzaQKiq9mwt7lwj2eXpgpRyQYNHYt2lq1PjkWa7DLXX0WVcQLE9HhMh3jPiufS7fhJf+CLQ==}
     dev: false
 
+  /js-base64@3.7.5:
+    resolution: {integrity: sha512-3MEt5DTINKqfScXKfJFrRbxkrnk2AxPWGBL/ycjz4dK8iqiSJ06UxD8jh8xuh6p10TX4t2+7FsBYVxxQbMg+qA==}
+    dev: false
+
   /js-beautify@1.14.9:
     resolution: {integrity: sha512-coM7xq1syLcMyuVGyToxcj2AlzhkDjmfklL8r0JgJ7A76wyGMpJ1oA35mr4APdYNO/o/4YY8H54NQIJzhMbhBg==}
     engines: {node: '>=12'}
@@ -11125,6 +11142,16 @@ packages:
       type-check: 0.4.0
     dev: true
 
+  /libsodium-wrappers@0.7.13:
+    resolution: {integrity: sha512-kasvDsEi/r1fMzKouIDv7B8I6vNmknXwGiYodErGuESoFTohGSKZplFtVxZqHaoQ217AynyIFgnOVRitpHs0Qw==}
+    dependencies:
+      libsodium: 0.7.13
+    dev: false
+
+  /libsodium@0.7.13:
+    resolution: {integrity: sha512-mK8ju0fnrKXXfleL53vtp9xiPq5hKM0zbDQtcxQIsSmxNgSxqCj6R7Hl9PkrNe2j29T4yoDaF7DJLK9/i5iWUw==}
+    dev: false
+
   /libtap@1.4.0:
     resolution: {integrity: sha512-STLFynswQ2A6W14JkabgGetBNk6INL1REgJ9UeNKw5llXroC2cGLgKTqavv0sl8OLVztLLipVKMcQ7yeUcqpmg==}
     engines: {node: '>=10'}
@@ -11865,6 +11892,7 @@ packages:
 
   /ms@2.1.3:
     resolution: {integrity: sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==}
+    requiresBuild: true
 
   /muggle-string@0.2.2:
     resolution: {integrity: sha512-YVE1mIJ4VpUMqZObFndk9CJu6DBJR/GB13p3tXuNbwD4XExaI5EOuRl6BHeIDxIqXZVxSfAC+y6U1Z/IxCfKUg==}