# RadiusSecuritySecretConstruct

- Kind: `class`
- Package: [Aspire.Hosting.Radius](/reference/api/csharp/aspire.hosting.radius.md)
- Version: `13.6.0-preview.1.26478.8`
- Namespace: `Aspire.Hosting.Radius.Publishing.Constructs`
- Target framework: `net10.0`
- Source: [GitHub](https://github.com/microsoft/aspire/blob/f4c27f2d43ddc1cacd0dd083b30d1fea1cee7a62/src/Aspire.Hosting.Radius/Publishing/Constructs/RadiusSecuritySecretConstruct.cs)
- Inherits: `ProvisionableResource`

Represents a `Radius.Security/secrets` resource in the Bicep AST -- the `Radius.*` UDT replacement for `Applications.Core/secretStores`.

## Definition

```csharp
namespace Aspire.Hosting.Radius.Publishing.Constructs;

public sealed class RadiusSecuritySecretConstruct
    : Azure.Provisioning.Primitives.ProvisionableResource
{
    // ...
}
```

## Remarks

Unlike the legacy secret-store type, which is scoped by exactly one of `properties.environment` / `properties.application`, this type requires [RadiusSecuritySecretConstruct.EnvironmentId](/reference/api/csharp/aspire.hosting.radius/radiussecuritysecretconstruct/properties.md#environmentid) and treats [RadiusSecuritySecretConstruct.ApplicationId](/reference/api/csharp/aspire.hosting.radius/radiussecuritysecretconstruct/properties.md#applicationid) as optional. `data` is required, so there is no "reference an existing cluster Secret" mode: every entry carries its own value.

This construct is the canonical secret primitive for the `Radius.*` surface, used for both kinds of secret the publisher emits: credentials a UDT backing resource consumes by resource ID (for example the RabbitMQ `properties.password`), and credential-bearing container environment variables, which are written here and referenced from the container's `env` block so the resolved value never reaches the Deployment spec.

## Constructors

- [RadiusSecuritySecretConstruct(string)](/reference/api/csharp/aspire.hosting.radius/radiussecuritysecretconstruct/constructors.md#constructor-string) -- Initializes a new [RadiusSecuritySecretConstruct](/reference/api/csharp/aspire.hosting.radius/radiussecuritysecretconstruct.md) with the given Bicep identifier.

## Properties

- [ApplicationId](/reference/api/csharp/aspire.hosting.radius/radiussecuritysecretconstruct/properties.md#applicationid) : `BicepValue<string>` `get; set` -- The optional application scope reference ( `properties.application`).
- [Data](/reference/api/csharp/aspire.hosting.radius/radiussecuritysecretconstruct/properties.md#data) : `BicepDictionary<RadiusSecuritySecretDataEntryConstruct>` `get; set` -- The `data` map keyed by secret key name.
- [EnvironmentId](/reference/api/csharp/aspire.hosting.radius/radiussecuritysecretconstruct/properties.md#environmentid) : `BicepValue<string>` `get; set` -- The environment scope reference ( `properties.environment`). Required by the type.
- [Kind](/reference/api/csharp/aspire.hosting.radius/radiussecuritysecretconstruct/properties.md#kind) : `BicepValue<string>` `get; set` -- The secret `kind` (e.g. `generic`). Emitted only when assigned.
- [SecretName](/reference/api/csharp/aspire.hosting.radius/radiussecuritysecretconstruct/properties.md#secretname) : `BicepValue<string>` `get; set` -- The resource name.