diff --git a/packages/arcgis-rest-items/src/add.ts b/packages/arcgis-rest-items/src/add.ts
index a15690aad0..54a09bd757 100644
--- a/packages/arcgis-rest-items/src/add.ts
+++ b/packages/arcgis-rest-items/src/add.ts
@@ -95,7 +95,7 @@ export function addItemResource(
     file: requestOptions.resource,
     fileName: requestOptions.name,
     text: requestOptions.content,
-    access: requestOptions.access,
+    access: requestOptions.private ? "private" : "inherit",
     ...requestOptions.params
   };
 
diff --git a/packages/arcgis-rest-items/src/helpers.ts b/packages/arcgis-rest-items/src/helpers.ts
index bad74fa146..c6f69f2aca 100644
--- a/packages/arcgis-rest-items/src/helpers.ts
+++ b/packages/arcgis-rest-items/src/helpers.ts
@@ -32,10 +32,9 @@ export interface IItemResourceRequestOptions extends IItemIdRequestOptions {
    */
   content?: string;
   /**
-   * Set file resource to be private regardless of the item access level, or revert it by setting
-   * it to inherit which makes the item resource have the same access as the item.
+   * Controls whether access to the file resource is restricted to the owner or inherited from the sharing permissions set for the associated item.
    */
-  access?: "private" | "inherit";
+  private?: boolean;
   resource?: any;
 }
 
diff --git a/packages/arcgis-rest-items/src/update.ts b/packages/arcgis-rest-items/src/update.ts
index 8c5f9a9d7c..b1f7ae2214 100644
--- a/packages/arcgis-rest-items/src/update.ts
+++ b/packages/arcgis-rest-items/src/update.ts
@@ -82,12 +82,18 @@ export function updateItemResource(
 
   // mix in user supplied params
   requestOptions.params = {
-    ...requestOptions.params,
     fileName: requestOptions.name,
     text: requestOptions.content,
-    access: requestOptions.access
+    ...requestOptions.params
   };
 
+  // only override whatever access was specified previously if 'private' was passed explicitly
+  if (typeof requestOptions.private !== "undefined") {
+    requestOptions.params.access = requestOptions.private
+      ? "private"
+      : "inherit";
+  }
+
   return request(url, requestOptions);
 }
 
diff --git a/packages/arcgis-rest-items/test/add.test.ts b/packages/arcgis-rest-items/test/add.test.ts
index 88dc1fc886..a239e1f774 100644
--- a/packages/arcgis-rest-items/test/add.test.ts
+++ b/packages/arcgis-rest-items/test/add.test.ts
@@ -187,7 +187,6 @@ describe("search", () => {
         id: "3ef",
         // File() is only available in the browser
         resource: file,
-        access: "inherit",
         name: "thebigkahuna",
         ...MOCK_USER_REQOPTS
       })
@@ -214,5 +213,44 @@ describe("search", () => {
           fail(e);
         });
     });
+
+    it("should add a binary resource to a secret item", done => {
+      fetchMock.once("*", {
+        success: true
+      });
+
+      const file = attachmentFile();
+
+      addItemResource({
+        id: "3ef",
+        // File() is only available in the browser
+        resource: file,
+        name: "thebigkahuna",
+        private: true,
+        ...MOCK_USER_REQOPTS
+      })
+        .then(() => {
+          expect(fetchMock.called()).toEqual(true);
+          const [url, options]: [string, RequestInit] = fetchMock.lastCall("*");
+          expect(url).toEqual(
+            "https://myorg.maps.arcgis.com/sharing/rest/content/users/casey/items/3ef/addResources"
+          );
+          expect(options.method).toBe("POST");
+          expect(options.body instanceof FormData).toBeTruthy();
+          const params = options.body as FormData;
+          if (params.get) {
+            expect(params.get("token")).toEqual("fake-token");
+            expect(params.get("f")).toEqual("json");
+            expect(params.get("file")).toEqual(file);
+            expect(params.get("access")).toEqual("inherit");
+            expect(params.get("fileName")).toEqual("thebigkahuna");
+          }
+
+          done();
+        })
+        .catch(e => {
+          fail(e);
+        });
+    });
   }); // auth requests
 });
diff --git a/packages/arcgis-rest-items/test/update.test.ts b/packages/arcgis-rest-items/test/update.test.ts
index 6a191058b1..d7d434b100 100644
--- a/packages/arcgis-rest-items/test/update.test.ts
+++ b/packages/arcgis-rest-items/test/update.test.ts
@@ -155,7 +155,6 @@ describe("search", () => {
         owner: "dbouwman",
         name: "image/banner.png",
         content: "jumbotron",
-        access: "inherit",
         ...MOCK_USER_REQOPTS
       })
         .then(response => {
@@ -169,7 +168,7 @@ describe("search", () => {
             encodeParam("fileName", "image/banner.png")
           );
           expect(options.body).toContain(encodeParam("text", "jumbotron"));
-          expect(options.body).toContain(encodeParam("access", "inherit"));
+          expect(options.body).not.toContain(encodeParam("access", "inherit"));
           expect(options.body).toContain(encodeParam("token", "fake-token"));
           done();
         })
@@ -216,7 +215,7 @@ describe("search", () => {
           resourcesPrefix: "foolder"
         }
       })
-        .then(response => {
+        .then(() => {
           const [url, options]: [string, RequestInit] = fetchMock.lastCall("*");
           expect(url).toEqual(
             "https://myorg.maps.arcgis.com/sharing/rest/content/users/casey/items/3ef/updateResources"
@@ -229,6 +228,65 @@ describe("search", () => {
           expect(options.body).toContain("resourcesPrefix=foolder");
           expect(options.body).toContain(encodeParam("text", "jumbotron"));
           expect(options.body).toContain(encodeParam("token", "fake-token"));
+          expect(options.body).not.toContain(encodeParam("access", "inherit"));
+          done();
+        })
+        .catch(e => {
+          fail(e);
+        });
+    });
+
+    it("update an item resource to make it secret", done => {
+      fetchMock.once("*", UpdateItemResourceResponse);
+      updateItemResource({
+        id: "3ef",
+        name: "image/banner.png",
+        content: "jumbotron",
+        private: true,
+        ...MOCK_USER_REQOPTS
+      })
+        .then(() => {
+          const [url, options]: [string, RequestInit] = fetchMock.lastCall("*");
+          expect(url).toEqual(
+            "https://myorg.maps.arcgis.com/sharing/rest/content/users/casey/items/3ef/updateResources"
+          );
+          expect(options.method).toBe("POST");
+          expect(options.body).toContain("f=json");
+          expect(options.body).toContain(
+            encodeParam("fileName", "image/banner.png")
+          );
+          expect(options.body).toContain(encodeParam("text", "jumbotron"));
+          expect(options.body).toContain(encodeParam("token", "fake-token"));
+          expect(options.body).toContain(encodeParam("access", "private"));
+          done();
+        })
+        .catch(e => {
+          fail(e);
+        });
+    });
+
+    it("update an item resource to spill the beans", done => {
+      fetchMock.once("*", UpdateItemResourceResponse);
+      updateItemResource({
+        id: "3ef",
+        name: "image/banner.png",
+        content: "jumbotron",
+        private: false,
+        ...MOCK_USER_REQOPTS
+      })
+        .then(() => {
+          const [url, options]: [string, RequestInit] = fetchMock.lastCall("*");
+          expect(url).toEqual(
+            "https://myorg.maps.arcgis.com/sharing/rest/content/users/casey/items/3ef/updateResources"
+          );
+          expect(options.method).toBe("POST");
+          expect(options.body).toContain("f=json");
+          expect(options.body).toContain(
+            encodeParam("fileName", "image/banner.png")
+          );
+          expect(options.body).toContain(encodeParam("text", "jumbotron"));
+          expect(options.body).toContain(encodeParam("token", "fake-token"));
+          expect(options.body).toContain(encodeParam("access", "inherit"));
           done();
         })
         .catch(e => {