The API introduces ParameterConfig and a new secretManagerManagedParams array. This allows you to specify which keys in your transfer params should be treated as Secret Manager resource names rather than literal values. The service will automatically fetch the secret during execution. Note that TransferRun.parameterConfig and DataSourceParameter.secretManagerAllowed are now explicitly marked as readOnly in the discovery document. If your integration logic or generated code attempts to write to these fields during a request, it will now fail validation.
Breaking Change
Docs