Thanks for the answer here Chris M. - There was some additional discussion on this internally in another channel.
I took that slack thread and ran it through my agent to digest it into an answer for you.
Hi! Great question, and a fair one to ask.
What's true today: there's no API to configure External Secrets Manager (AWS) on a customer workspace, at either the workspace or project level. The only API that touches secrets management right now is the clear cache endpoint, which refreshes cached credentials after you've already set things up manually in the UI. Docs here: Clear secrets management cache
Why it's not there yet: it's not an oversight, it's a real security tradeoff. An API like this would need its own scoped endpoint and permission model under managed_users, since a single Embedded workspace can control many customer workspaces. Getting that wrong means one compromised API token could expose credentials across all of them. Worth building right, not worth rushing.
What to do in the meantime: if programmatic setup matters for your use case, loop in your CSM. They'll bring in a technical team member to either find a better path for what you're trying to do, or log it as a product enhancement request so it's tracked properly.
