Barbican API supports omitting the SecretRefs dict and modifying it later on. https://docs.openstack.org/barbican/stein/api/reference/containers.html https://github.com/openstack/barbican/blob/3c2a99604a4eeca9cd37d3d1986276dcbed8b455/barbican/common/validators.py#L781 https://github.com/openstack/barbican/blob/3c2a99604a4eeca9cd37d3d1986276dcbed8b455/barbican/common/validators.py#L753