{ "id": "@itentialopensource/adapter-hashicorp_vault", "type": "Adapter", "export": "HashiCorpVault", "title": "HashiCorpVault", "src": "adapter.js", "roles": [ "admin" ], "methods": [ { "name": "iapUpdateAdapterConfiguration", "summary": "Updates the adapter configuration", "description": "Updates the adapter configuration file with the provided changes", "input": [ { "name": "configFile", "type": "string", "info": "The name of the file to change", "required": true, "schema": { "title": "configFile", "type": "string" } }, { "name": "changes", "type": "object", "info": "JSON object containing the configuration changes", "required": true, "schema": { "title": "changes", "type": "object" } }, { "name": "entity", "type": "string", "info": "The entity in which the changes are being made", "required": false, "schema": { "title": "entity", "type": "string" } }, { "name": "type", "type": "string", "info": "The type of file to change - action, schema, or mock", "required": false, "schema": { "title": "type", "type": "string" } }, { "name": "action", "type": "string", "info": "The action to be changed", "required": false, "schema": { "title": "action", "type": "string" } }, { "name": "replace", "type": "boolean", "info": "True to replace entire mock data, false to merge/append", "required": false, "schema": { "title": "replace", "type": "boolean" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/iapUpdateAdapterConfiguration" }, "task": true }, { "name": "iapSuspendAdapter", "summary": "Suspends the adapter", "description": "Suspends the adapter", "input": [ { "name": "mode", "type": "enum", "enumerals": [ "pause", "error" ], "info": "How incoming requests are handled. Defaults to 'pause'", "description": "How incoming requests are handled. Defaults to 'pause'", "schema": { "title": "mode", "type": "string" }, "required": false } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing the adapter suspended status", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/iapSuspendAdapter" }, "task": true }, { "name": "iapUnsuspendAdapter", "summary": "Unsuspends the adapter", "description": "Unsuspends the adapter", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing the adapter suspended status", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/iapUnsuspendAdapter" }, "task": true }, { "name": "iapGetAdapterQueue", "summary": "Return the requests that are waiting in the queue if throttling is enabled", "description": "Return the requests that are waiting in the queue if throttling is enabled", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing the adapter queue", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/iapGetAdapterQueue" }, "task": true }, { "name": "iapFindAdapterPath", "summary": "Provides the ability to see if a particular API path is supported by the adapter", "description": "Provides the ability to see if a particular API path is supported by the adapter", "input": [ { "name": "apiPath", "type": "string", "info": "The API Path you want to check - make sure to not include base path and version", "description": "The API Path you want to check - make sure to not include base path and version", "schema": { "title": "apiPath", "type": "string" }, "required": true } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/iapFindAdapterPath" }, "task": true }, { "name": "iapTroubleshootAdapter", "summary": "Runs troubleshoot script for adapter", "description": "Runs troubleshoot script for adapter", "input": [ { "name": "props", "type": "object", "info": "Object containing configuration, healthcheck and auth properties {'connProps':{'host': 'api.service.com', 'base_path': '/', 'protocol': 'http', 'port': 443, 'version': 'v1'},'healthCheckEndpoint': '/healthcheck', 'auth': {'auth_method': 'no authentication', 'username': 'username', 'password': 'password'}}", "required": true, "schema": { "title": "props", "type": "object" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing the test results", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/iapTroubleshootAdapter" }, "task": true }, { "name": "iapRunAdapterHealthcheck", "summary": "Runs healthcheck script for adapter", "description": "Runs healthcheck script for adapter", "input": [], "output": { "name": "result", "type": "boolean", "description": "Whether healthcheck passed or failed", "schema": { "title": "result", "type": "boolean" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/iapRunAdapterHealthcheck" }, "task": true }, { "name": "iapRunAdapterConnectivity", "summary": "Runs connectivity check script for adapter", "description": "Runs connectivity check script for adapter", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing the test results", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/iapRunAdapterConnectivity" }, "task": true }, { "name": "iapRunAdapterBasicGet", "summary": "Runs basicGet script for adapter", "description": "Runs basicGet script for adapter", "input": [ { "name": "maxCalls", "required": false, "type": "number", "info": "How many GET endpoints to test (defaults to 5)", "schema": { "title": "maxCalls", "type": "number", "default": 5 } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing the test results", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/iapRunAdapterBasicGet" }, "task": true }, { "name": "iapMoveAdapterEntitiesToDB", "summary": "Moves entities from an adapter into the Itential Platform database", "description": "Moves entities from an adapter into the Itential Platform database", "input": [], "output": { "name": "res", "type": "object", "description": "A JSON Object containing status, code and the response from the mongo transaction", "schema": { "title": "res", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/iapMoveAdapterEntitiesToDB" }, "task": true }, { "name": "iapDeactivateTasks", "summary": "Deactivate the inputted tasks", "description": "Deactivate the inputted tasks", "input": [ { "name": "tasks", "type": "array", "description": "Tasks to deactivate", "schema": { "title": "tasks", "type": "array" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing success status", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/iapDeactivateTasks" }, "task": true }, { "name": "iapActivateTasks", "summary": "Activate the inputted tasks", "description": "activate the inputted tasks", "input": [ { "name": "tasks", "type": "array", "description": "Tasks to activate", "schema": { "title": "tasks", "type": "array" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing success status", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/iapActivateTasks" }, "task": true }, { "name": "iapPopulateEntityCache", "summary": "Populate the cache for the given entities", "description": "Populate the cache for the given entities", "input": [ { "name": "entityTypes", "type": "array", "info": "the entity type(s) to populate", "required": true, "schema": { "title": "entityTypes", "type": "array" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/iapPopulateEntityCache" }, "task": true }, { "name": "iapRetrieveEntitiesCache", "summary": "Retrieves data from cache for specified entity type", "description": "Retrieves data from cache for specified entity type", "input": [ { "name": "entityType", "type": "string", "info": "entity of which to retrieve", "required": true, "schema": { "title": "entityType", "type": "string" } }, { "name": "options", "type": "object", "info": "settings of which data to return and how to return it", "required": false, "schema": { "title": "options", "type": "object" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/iapRetrieveEntitiesCache" }, "task": true }, { "name": "getDevice", "summary": "Get the Appliance", "description": "Get the Appliance", "input": [ { "name": "deviceName", "type": "string", "info": "An Appliance Device Name", "required": true, "schema": { "title": "deviceName", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getDevice" }, "task": false }, { "name": "getDevicesFiltered", "summary": "Get Appliances that match the filter", "description": "Get Appliances that match the filter", "input": [ { "name": "options", "type": "object", "info": "options - e.g. { 'start': 1, 'limit': 20, 'filter': { 'name': 'abc123' } }", "required": true, "schema": { "title": "options", "type": "object" } } ], "output": { "name": "result", "type": "array", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "array" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getDevicesFiltered" }, "task": false }, { "name": "isAlive", "summary": "Checks the status for the provided Appliance", "description": "Checks the status for the provided Appliance", "input": [ { "name": "deviceName", "type": "string", "info": "An Appliance Device Name", "required": true, "schema": { "title": "deviceName", "type": "string" } } ], "output": { "name": "result", "type": "boolean", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "boolean" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/isAlive" }, "task": false }, { "name": "getConfig", "summary": "Gets a config for the provided Appliance", "description": "Gets a config for the provided Appliance", "input": [ { "name": "deviceName", "type": "string", "info": "An Appliance Device Name", "required": true, "schema": { "title": "deviceName", "type": "string" } }, { "name": "format", "type": "string", "info": "The format to be returned - this is ignored as we always return json", "required": false, "schema": { "title": "format", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getConfig" }, "task": false }, { "name": "iapGetDeviceCount", "summary": "Gets a device count from the system", "description": "Gets a device count from the system", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/iapGetDeviceCount" }, "task": false }, { "name": "iapExpandedGenericAdapterRequest", "summary": "Makes the requested generic call with additional options", "description": "Makes the requested generic call with additional options via metadata", "input": [ { "name": "metadata", "type": "object", "info": "metadata for the call (optional)", "description": "metadata for the call - allows for many enhancements (optional)", "schema": { "title": "metadata", "type": "object" }, "required": false }, { "name": "uriPath", "type": "string", "info": "the path of the api call - do not include the host, port, base path or version", "description": "the path of the api call", "schema": { "title": "uriPath", "type": "string" }, "required": false }, { "name": "restMethod", "type": "string", "info": "the rest method (GET, POST, PUT, PATCH, DELETE)", "description": "the rest method (GET, POST, PUT, PATCH, DELETE)", "schema": { "title": "restMethod", "type": "string" }, "required": false }, { "name": "pathVars", "type": "object", "info": "the parameters to be put within the url path (optional)", "description": "the parameters to be put within the url path (optional)", "schema": { "title": "pathVars", "type": "object" }, "required": false }, { "name": "queryData", "type": "object", "info": "the query parameters to be put on the url (optional)", "description": "the query parameters to be put on the url (optional)", "schema": { "title": "queryData", "type": "object" }, "required": false }, { "name": "requestBody", "type": "object", "info": "the payload to be sent with the request (optional)", "description": "the payload to be sent with the request (optional)", "schema": { "title": "requestBody", "type": "object" }, "required": false }, { "name": "addlHeaders", "type": "object", "info": "additional headers to be put on the call (optional)", "description": "additional headers to be put on the call (optional)", "schema": { "title": "addlHeaders", "type": "object" }, "required": false } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/iapExpandedGenericAdapterRequest" }, "task": true }, { "name": "genericAdapterRequest", "summary": "Makes the requested generic call", "description": "Makes the requested generic call", "input": [ { "name": "uriPath", "type": "string", "info": "the path of the api call - do not include the host, port, base path or version", "description": "the path of the api call", "schema": { "title": "uriPath", "type": "string" }, "required": true }, { "name": "restMethod", "type": "string", "info": "the rest method (GET, POST, PUT, PATCH, DELETE)", "description": "the rest method (GET, POST, PUT, PATCH, DELETE)", "schema": { "title": "restMethod", "type": "string" }, "required": true }, { "name": "queryData", "type": "object", "info": "the query parameters to be put on the url (optional)", "description": "the query parameters to be put on the url (optional)", "schema": { "title": "queryData", "type": "object" }, "required": false }, { "name": "requestBody", "type": "object", "info": "the payload to be sent with the request (optional)", "description": "the payload to be sent with the request (optional)", "schema": { "title": "requestBody", "type": "object" }, "required": false }, { "name": "addlHeaders", "type": "object", "info": "additional headers to be put on the call (optional)", "description": "additional headers to be put on the call (optional)", "schema": { "title": "addlHeaders", "type": "object" }, "required": false } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/genericAdapterRequest" }, "task": true }, { "name": "genericAdapterRequestNoBasePath", "summary": "Makes the requested generic call", "description": "Makes the requested generic call", "input": [ { "name": "uriPath", "type": "string", "info": "the path of the api call - do not include the host, port, base path or version", "description": "the path of the api call", "schema": { "title": "uriPath", "type": "string" }, "required": true }, { "name": "restMethod", "type": "string", "info": "the rest method (GET, POST, PUT, PATCH, DELETE)", "description": "the rest method (GET, POST, PUT, PATCH, DELETE)", "schema": { "title": "restMethod", "type": "string" }, "required": true }, { "name": "queryData", "type": "object", "info": "the query parameters to be put on the url (optional)", "description": "the query parameters to be put on the url (optional)", "schema": { "title": "queryData", "type": "object" }, "required": false }, { "name": "requestBody", "type": "object", "info": "the payload to be sent with the request (optional)", "description": "the payload to be sent with the request (optional)", "schema": { "title": "requestBody", "type": "object" }, "required": false }, { "name": "addlHeaders", "type": "object", "info": "additional headers to be put on the call (optional)", "description": "additional headers to be put on the call (optional)", "schema": { "title": "addlHeaders", "type": "object" }, "required": false } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/genericAdapterRequestNoBasePath" }, "task": true }, { "name": "iapRunAdapterLint", "summary": "Run the adapter lint script to return the results", "description": "Run the adapter lint script to return the results", "input": [], "output": { "name": "result", "type": "string", "description": "A string containing the run results", "schema": { "title": "result", "type": "string" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/iapRunAdapterLint" }, "task": true }, { "name": "iapRunAdapterTests", "summary": "Run the adapter test scripts (baseunit and unit) to return the results", "description": "Run the adapter test scripts (baseunit and unit) to return the results", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/iapRunAdapterTests" }, "task": true }, { "name": "iapGetAdapterInventory", "summary": "Provide inventory information abbout the adapter", "description": "Provide inventory information abbout the adapter", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/iapGetAdapterInventory" }, "task": true }, { "name": "getKvSecretConfig", "summary": "Retrieves the current configuration for the secrets backend at the given path", "description": "Retrieves the current configuration for the secrets backend at the given path", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "secretMount", "type": "string", "info": "the secret mount point (default secret)", "description": "the secret mount point (default secret)", "schema": { "title": "secretMount", "type": "string" }, "required": false } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/getKvSecretConfig" }, "task": true }, { "name": "postKvSecretConfig", "summary": "Configure backend level settings that are applied to every key in the key-value store.", "description": "Configure backend level settings that are applied to every key in the key-value store.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "secretMount", "type": "string", "info": "the secret mount point (default secret)", "description": "the secret mount point (default secret)", "schema": { "title": "secretMount", "type": "string" }, "required": false }, { "name": "body", "type": "object", "info": ": {\"cas_required\": \"boolean\", \"delete_version_after\": 123, \"max_versions\": 123}", "required": false, "schema": { "type": "object", "properties": { "cas_required": { "type": "boolean", "description": "If true, the backend will require the cas parameter to be set for each write" }, "delete_version_after": { "type": "integer", "description": "If set, the length of time before a version is deleted. A negative duration disables the use of delete_version_after on all keys. A zero duration clears the current setting. Accepts a Go duration format string." }, "max_versions": { "type": "integer", "description": "The number of versions to keep for each key. Defaults to 10" } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postKvSecretConfig" }, "task": true }, { "name": "getKvSecretDataPath", "summary": "Retrieves the secret at the specified location.", "description": "Retrieves the secret at the specified location.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "secretMount", "type": "string", "info": "the secret mount point (default secret)", "description": "the secret mount point (default secret)", "schema": { "title": "secretMount", "type": "string" }, "required": false }, { "name": "pathParam", "type": "string", "info": "Location of the secret.: string", "required": true, "schema": { "title": "pathParam", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getKvSecretDataPath" }, "task": true }, { "name": "postKvSecretDataPath", "summary": "Creates a new version of a secret at the specified location", "description": "Creates a new version of a secret at the specified location", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "secretMount", "type": "string", "info": "the secret mount point (default secret)", "description": "the secret mount point (default secret)", "schema": { "title": "secretMount", "type": "string" }, "required": false }, { "name": "pathParam", "type": "string", "info": "Location of the secret.: string", "required": true, "schema": { "title": "pathParam", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"data\": \"object\", \"options\": \"object\", \"version\": 123}", "required": false, "schema": { "type": "object", "properties": { "data": { "type": "object", "description": "The contents of the data map will be stored and returned on read." }, "options": { "type": "object", "description": "Options for writing a KV entry. Set the \"cas\" value to use a Check-And-Set operation. If not set the write will be allowed. If set to 0 a write will only be allowed if the key doesn’t exist. If the index is non-zero the write will only be allowed if the key’s current version matches the version specified in the cas parameter." }, "version": { "type": "integer", "description": "If provided during a read, the value at the version number will be returned" } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postKvSecretDataPath" }, "task": true }, { "name": "deleteKvSecretDataPath", "summary": "Issues a soft delete of the secret's latest version at the specified location.", "description": "Issues a soft delete of the secret's latest version at the specified location.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "secretMount", "type": "string", "info": "the secret mount point (default secret)", "description": "the secret mount point (default secret)", "schema": { "title": "secretMount", "type": "string" }, "required": false }, { "name": "pathParam", "type": "string", "info": "Location of the secret.: string", "required": true, "schema": { "title": "pathParam", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteKvSecretDataPath" }, "task": true }, { "name": "postKvSecretDeletePath", "summary": "Issues a soft delete of the specified versions of the secret", "description": "Issues a soft delete of the specified versions of the secret", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "secretMount", "type": "string", "info": "the secret mount point (default secret)", "description": "the secret mount point (default secret)", "schema": { "title": "secretMount", "type": "string" }, "required": false }, { "name": "pathParam", "type": "string", "info": "Location of the secret.: string", "required": true, "schema": { "title": "pathParam", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"versions\": \"array\"}", "required": false, "schema": { "type": "object", "properties": { "versions": { "type": "array", "description": "The versions to be archived. The versioned data will not be deleted, but it will no longer be returned in normal get requests.", "items": { "type": "integer" } } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postKvSecretDeletePath" }, "task": true }, { "name": "postKvSecretDestroyPath", "summary": "Permanently removes the specified version data for the provided key and version numbers from the secret store.", "description": "Permanently removes the specified version data for the provided key and version numbers from the secret store.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "secretMount", "type": "string", "info": "the secret mount point (default secret)", "description": "the secret mount point (default secret)", "schema": { "title": "secretMount", "type": "string" }, "required": false }, { "name": "pathParam", "type": "string", "info": "Location of the secret.: string", "required": true, "schema": { "title": "pathParam", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"versions\": \"array\"}", "required": false, "schema": { "type": "object", "properties": { "versions": { "type": "array", "description": "The versions to destroy. Their data will be permanently deleted.", "items": { "type": "integer" } } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postKvSecretDestroyPath" }, "task": true }, { "name": "getKvSecretMetadataPath", "summary": "Retrieves the metadata and versions for the secret at the specified path.", "description": "Retrieves the metadata and versions for the secret at the specified path.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "secretMount", "type": "string", "info": "the secret mount point (default secret)", "description": "the secret mount point (default secret)", "schema": { "title": "secretMount", "type": "string" }, "required": false }, { "name": "pathParam", "type": "string", "info": "Location of the secret.: string", "required": true, "schema": { "title": "pathParam", "type": "string" } }, { "name": "list", "type": "string", "info": "Return a list if `true`: string", "required": false, "schema": { "title": "list", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getKvSecretMetadataPath" }, "task": true }, { "name": "postKvSecretMetadataPath", "summary": "Creates or updates the metadata of a secret at the specified location.", "description": "Creates or updates the metadata of a secret at the specified location.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "secretMount", "type": "string", "info": "the secret mount point (default secret)", "description": "the secret mount point (default secret)", "schema": { "title": "secretMount", "type": "string" }, "required": false }, { "name": "pathParam", "type": "string", "info": "Location of the secret.: string", "required": true, "schema": { "title": "pathParam", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"cas_required\": \"boolean\", \"delete_version_after\": 123, \"max_versions\": 123}", "required": false, "schema": { "type": "object", "properties": { "cas_required": { "type": "boolean", "description": "If true the key will require the cas parameter to be set on all write requests. If false, the backend’s configuration will be used." }, "delete_version_after": { "type": "integer", "description": "The length of time before a version is deleted. If not set, the backend's configured delete_version_after is used. Cannot be greater than the backend's delete_version_after. A zero duration clears the current setting. A negative duration will cause an error." }, "max_versions": { "type": "integer", "description": "The number of versions to keep. If not set, the backend’s configured max version is used." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postKvSecretMetadataPath" }, "task": true }, { "name": "deleteKvSecretMetadataPath", "summary": "Permanently deletes the key metadata and all version data for the specified key.", "description": "Permanently deletes the key metadata and all version data for the specified key.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "secretMount", "type": "string", "info": "the secret mount point (default secret)", "description": "the secret mount point (default secret)", "schema": { "title": "secretMount", "type": "string" }, "required": false }, { "name": "pathParam", "type": "string", "info": "Location of the secret.: string", "required": true, "schema": { "title": "pathParam", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteKvSecretMetadataPath" }, "task": true }, { "name": "postKvSecretUndeletePath", "summary": "Undeletes the data for the provided version and path in the secret store.", "description": "Undeletes the data for the provided version and path in the secret store.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "secretMount", "type": "string", "info": "the secret mount point (default secret)", "description": "the secret mount point (default secret)", "schema": { "title": "secretMount", "type": "string" }, "required": false }, { "name": "pathParam", "type": "string", "info": "Location of the secret.: string", "required": true, "schema": { "title": "pathParam", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"versions\": \"array\"}", "required": false, "schema": { "type": "object", "properties": { "versions": { "type": "array", "description": "The versions to unarchive. The versions will be restored and their data will be returned on normal get requests.", "items": { "type": "integer" } } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postKvSecretUndeletePath" }, "task": true }, { "name": "getCubbyholeSecretPath", "summary": "Retrieves the secret at the specified location.", "description": "Retrieves the secret at the specified location.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "secretMount", "type": "string", "info": "the secret mount point (default secret)", "description": "the secret mount point (default secret)", "schema": { "title": "secretMount", "type": "string" }, "required": false }, { "name": "pathParam", "type": "string", "info": "Specifies the path of the secret.: string", "required": true, "schema": { "title": "pathParam", "type": "string" } }, { "name": "list", "type": "string", "info": "Return a list if `true`: string", "required": false, "schema": { "title": "list", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getCubbyholeSecretPath" }, "task": true }, { "name": "postCubbyholeSecretPath", "summary": "Store a secret at the specified location.", "description": "Store a secret at the specified location.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "secretMount", "type": "string", "info": "the secret mount point (default secret)", "description": "the secret mount point (default secret)", "schema": { "title": "secretMount", "type": "string" }, "required": false }, { "name": "pathParam", "type": "string", "info": "Specifies the path of the secret.: string", "required": true, "schema": { "title": "pathParam", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postCubbyholeSecretPath" }, "task": true }, { "name": "deleteCubbyholeSecretPath", "summary": "Deletes the secret at the specified location.", "description": "Deletes the secret at the specified location.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "secretMount", "type": "string", "info": "the secret mount point (default secret)", "description": "the secret mount point (default secret)", "schema": { "title": "secretMount", "type": "string" }, "required": false }, { "name": "pathParam", "type": "string", "info": "Specifies the path of the secret.: string", "required": true, "schema": { "title": "pathParam", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteCubbyholeSecretPath" }, "task": true }, { "name": "getPkiSecretCa", "summary": "Retrieves the CA certificate in raw DER-encoded form", "description": "Retrieves the CA certificate in raw DER-encoded form", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "secretMount", "type": "string", "info": "the secret mount point (default secret)", "description": "the secret mount point (default secret)", "schema": { "title": "secretMount", "type": "string" }, "required": false } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/getPkiSecretCa" }, "task": true }, { "name": "getPkiSecretCaPem", "summary": "Retrieves the CA certificate in raw PEM form", "description": "Retrieves the CA certificate in raw PEM form", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "secretMount", "type": "string", "info": "the secret mount point (default secret)", "description": "the secret mount point (default secret)", "schema": { "title": "secretMount", "type": "string" }, "required": false } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/getPkiSecretCaPem" }, "task": true }, { "name": "getPkiSecretCaChain", "summary": "Retrieves the CA certificate chain, including the CA in PEM format.", "description": "Retrieves the CA certificate chain, including the CA in PEM format.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "secretMount", "type": "string", "info": "the secret mount point (default secret)", "description": "the secret mount point (default secret)", "schema": { "title": "secretMount", "type": "string" }, "required": false } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/getPkiSecretCaChain" }, "task": true }, { "name": "getPkiSecretCertCaChain", "summary": "Retrieves the CA certificate chain, including the CA in PEM format.", "description": "Retrieves the CA certificate chain, including the CA in PEM format.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "secretMount", "type": "string", "info": "the secret mount point (default secret)", "description": "the secret mount point (default secret)", "schema": { "title": "secretMount", "type": "string" }, "required": false } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/getPkiSecretCertCaChain" }, "task": true }, { "name": "getPkiSecretCertCrl", "summary": "Retrieves one of a selection of certificates.", "description": "Retrieves one of a selection of certificates.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "secretMount", "type": "string", "info": "the secret mount point (default secret)", "description": "the secret mount point (default secret)", "schema": { "title": "secretMount", "type": "string" }, "required": false } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/getPkiSecretCertCrl" }, "task": true }, { "name": "getPkiSecretCertSerial", "summary": "Retrieves one of a selection of certificates.", "description": "Retrieves one of a selection of certificates.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "secretMount", "type": "string", "info": "the secret mount point (default secret)", "description": "the secret mount point (default secret)", "schema": { "title": "secretMount", "type": "string" }, "required": false }, { "name": "serial", "type": "string", "info": "Certificate serial number, in colon- or hyphen-separated octal: string", "required": true, "schema": { "title": "serial", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getPkiSecretCertSerial" }, "task": true }, { "name": "getPkiSecretCerts", "summary": "Returns the current certificates", "description": "Returns the current certificates", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "secretMount", "type": "string", "info": "the secret mount point (default secret)", "description": "the secret mount point (default secret)", "schema": { "title": "secretMount", "type": "string" }, "required": false }, { "name": "list", "type": "string", "info": "Return a list if `true`: string", "required": false, "schema": { "title": "list", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getPkiSecretCerts" }, "task": true }, { "name": "postPkiSecretConfigCa", "summary": "Set the CA information for the backend via a PEM file containing the CA certificate and its private key, concatenated.", "description": "Set the CA information for the backend via a PEM file containing the CA certificate and its private key, concatenated.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "secretMount", "type": "string", "info": "the secret mount point (default secret)", "description": "the secret mount point (default secret)", "schema": { "title": "secretMount", "type": "string" }, "required": false }, { "name": "body", "type": "object", "info": ": {\"pem_bundle\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "pem_bundle": { "type": "string", "description": "PEM-format, concatenated unencrypted secret key and certificate." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postPkiSecretConfigCa" }, "task": true }, { "name": "getPkiSecretConfigCrl", "summary": "Retrieves the duration for which the generated CRL should be marked valid.", "description": "Retrieves the duration for which the generated CRL should be marked valid.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "secretMount", "type": "string", "info": "the secret mount point (default secret)", "description": "the secret mount point (default secret)", "schema": { "title": "secretMount", "type": "string" }, "required": false } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/getPkiSecretConfigCrl" }, "task": true }, { "name": "postPkiSecretConfigCrl", "summary": "Sets the duration for which the generated CRL should be marked valid.", "description": "Sets the duration for which the generated CRL should be marked valid.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "secretMount", "type": "string", "info": "the secret mount point (default secret)", "description": "the secret mount point (default secret)", "schema": { "title": "secretMount", "type": "string" }, "required": false }, { "name": "body", "type": "object", "info": ": {\"disable\": \"boolean\", \"expiry\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "disable": { "type": "boolean", "description": "If set to true, disables generating the CRL entirely." }, "expiry": { "type": "string", "description": "The amount of time the generated CRL should be valid; defaults to 72 hours", "default": "72h" } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postPkiSecretConfigCrl" }, "task": true }, { "name": "getPkiSecretConfigUrls", "summary": "Fetches the URLs to be encoded in generated certificates.", "description": "Fetches the URLs to be encoded in generated certificates.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "secretMount", "type": "string", "info": "the secret mount point (default secret)", "description": "the secret mount point (default secret)", "schema": { "title": "secretMount", "type": "string" }, "required": false } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/getPkiSecretConfigUrls" }, "task": true }, { "name": "postPkiSecretConfigUrls", "summary": "Sets the issuing certificate endpoints, CRL distribution points, and OCSP server endpoints that will be encoded into issued certificates.", "description": "Sets the issuing certificate endpoints, CRL distribution points, and OCSP server endpoints that will be encoded into issued certificates.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "secretMount", "type": "string", "info": "the secret mount point (default secret)", "description": "the secret mount point (default secret)", "schema": { "title": "secretMount", "type": "string" }, "required": false }, { "name": "body", "type": "object", "info": ": {\"crl_distribution_points\": \"array\", \"issuing_certificates\": \"array\", \"ocsp_servers\": \"array\"}", "required": false, "schema": { "type": "object", "properties": { "crl_distribution_points": { "type": "array", "description": "Comma-separated list of URLs to be used for the CRL distribution points attribute", "items": { "type": "string" } }, "issuing_certificates": { "type": "array", "description": "Comma-separated list of URLs to be used for the issuing certificate attribute", "items": { "type": "string" } }, "ocsp_servers": { "type": "array", "description": "Comma-separated list of URLs to be used for the OCSP servers attribute", "items": { "type": "string" } } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postPkiSecretConfigUrls" }, "task": true }, { "name": "getPkiSecretCrl", "summary": "Retrieves the current CRL in raw DER-encoded form.", "description": "Retrieves the current CRL in raw DER-encoded form.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "secretMount", "type": "string", "info": "the secret mount point (default secret)", "description": "the secret mount point (default secret)", "schema": { "title": "secretMount", "type": "string" }, "required": false } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/getPkiSecretCrl" }, "task": true }, { "name": "getPkiSecretCrlPem", "summary": "Retrieves the current CRL in raw PEM form.", "description": "Retrieves the current CRL in raw PEM form.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "secretMount", "type": "string", "info": "the secret mount point (default secret)", "description": "the secret mount point (default secret)", "schema": { "title": "secretMount", "type": "string" }, "required": false } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/getPkiSecretCrlPem" }, "task": true }, { "name": "getPkiSecretCrlRotate", "summary": "Forces a rotation of the CRL.", "description": "Forces a rotation of the CRL.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "secretMount", "type": "string", "info": "the secret mount point (default secret)", "description": "the secret mount point (default secret)", "schema": { "title": "secretMount", "type": "string" }, "required": false } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/getPkiSecretCrlRotate" }, "task": true }, { "name": "postPkiSecretGenerateIntermediate", "summary": "Generates a new private key and a CSR for signing.", "description": "Generates a new private key and a CSR for signing.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "secretMount", "type": "string", "info": "the secret mount point (default secret)", "description": "the secret mount point (default secret)", "schema": { "title": "secretMount", "type": "string" }, "required": false }, { "name": "exported", "type": "string", "info": "Must be \"internal\" or \"exported\". If set to \"exported\", the generated private key will be returned. This is your *only* chance to retrieve the private key!: string", "required": true, "schema": { "title": "exported", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"add_basic_constraints\": \"boolean\", \"alt_names\": \"string\", \"common_name\": \"string\", \"country\": \"array\", \"exclude_cn_from_sans\": \"boolean\", \"format\": \"Must be one of [pem, der, pem_bundle]\", \"ip_sans\": \"array\", \"key_bits\": 123, \"key_type\": \"Must be one of [rsa, ec]\", \"locality\": \"array\", \"organization\": \"array\", \"other_sans\": \"array\", \"ou\": \"array\", \"postal_code\": \"array\", \"private_key_format\": \"Must be one of [, der, pem, pkcs8]\", \"province\": \"array\", \"serial_number\": \"string\", \"street_address\": \"array\", \"ttl\": 123, \"uri_sans\": \"array\"}", "required": false, "schema": { "type": "object", "properties": { "add_basic_constraints": { "type": "boolean", "description": "Whether to add a Basic Constraints extension with CA: true. Only needed as a workaround in some compatibility scenarios with Active Directory Certificate Services." }, "alt_names": { "type": "string", "description": "The requested Subject Alternative Names, if any, in a comma-delimited list. May contain both DNS names and email addresses.", "x-vault-displayAttrs": { "name": "DNS/Email Subject Alternative Names (SANs)" } }, "common_name": { "type": "string", "description": "The requested common name; if you want more than one, specify the alternative names in the alt_names map. If not specified when signing, the common name will be taken from the CSR; other names must still be specified in alt_names or ip_sans." }, "country": { "type": "array", "description": "If set, Country will be set to this value.", "items": { "type": "string" } }, "exclude_cn_from_sans": { "type": "boolean", "description": "If true, the Common Name will not be included in DNS or Email Subject Alternate Names. Defaults to false (CN is included).", "default": false, "x-vault-displayAttrs": { "name": "Exclude Common Name from Subject Alternative Names (SANs)" } }, "format": { "type": "string", "description": "Format for returned data. Can be \"pem\", \"der\", or \"pem_bundle\". If \"pem_bundle\" any private key and issuing cert will be appended to the certificate pem. Defaults to \"pem\".", "enum": [ "pem", "der", "pem_bundle" ], "default": "pem", "x-vault-displayAttrs": { "value": "pem" } }, "ip_sans": { "type": "array", "description": "The requested IP SANs, if any, in a comma-delimited list", "items": { "type": "string" }, "x-vault-displayAttrs": { "name": "IP Subject Alternative Names (SANs)" } }, "key_bits": { "type": "integer", "description": "The number of bits to use. You will almost certainly want to change this if you adjust the key_type.", "default": 2048, "x-vault-displayAttrs": { "value": 2048 } }, "key_type": { "type": "string", "description": "The type of key to use; defaults to RSA. \"rsa\" and \"ec\" are the only valid values.", "enum": [ "rsa", "ec" ], "default": "rsa", "x-vault-displayAttrs": { "value": "rsa" } }, "locality": { "type": "array", "description": "If set, Locality will be set to this value.", "items": { "type": "string" }, "x-vault-displayAttrs": { "name": "Locality/City" } }, "organization": { "type": "array", "description": "If set, O (Organization) will be set to this value.", "items": { "type": "string" } }, "other_sans": { "type": "array", "description": "Requested other SANs, in an array with the format ;UTF8: for each entry.", "items": { "type": "string" }, "x-vault-displayAttrs": { "name": "Other SANs" } }, "ou": { "type": "array", "description": "If set, OU (OrganizationalUnit) will be set to this value.", "items": { "type": "string" }, "x-vault-displayAttrs": { "name": "OU (Organizational Unit)" } }, "postal_code": { "type": "array", "description": "If set, Postal Code will be set to this value.", "items": { "type": "string" }, "x-vault-displayAttrs": { "name": "Postal Code" } }, "private_key_format": { "type": "string", "description": "Format for the returned private key. Generally the default will be controlled by the \"format\" parameter as either base64-encoded DER or PEM-encoded DER. However, this can be set to \"pkcs8\" to have the returned private key contain base64-encoded pkcs8 or PEM-encoded pkcs8 instead. Defaults to \"der\".", "enum": [ "", "der", "pem", "pkcs8" ], "default": "der", "x-vault-displayAttrs": { "value": "der" } }, "province": { "type": "array", "description": "If set, Province will be set to this value.", "items": { "type": "string" }, "x-vault-displayAttrs": { "name": "Province/State" } }, "serial_number": { "type": "string", "description": "The requested serial number, if any. If you want more than one, specify alternative names in the alt_names map using OID 2.5.4.5." }, "street_address": { "type": "array", "description": "If set, Street Address will be set to this value.", "items": { "type": "string" }, "x-vault-displayAttrs": { "name": "Street Address" } }, "ttl": { "type": "integer", "description": "The requested Time To Live for the certificate; sets the expiration date. If not specified the role default, backend default, or system default TTL is used, in that order. Cannot be larger than the mount max TTL. Note: this only has an effect when generating a CA cert or signing a CA cert, not when generating a CSR for an intermediate CA.", "x-vault-displayAttrs": { "name": "TTL" } }, "uri_sans": { "type": "array", "description": "The requested URI SANs, if any, in a comma-delimited list.", "items": { "type": "string" }, "x-vault-displayAttrs": { "name": "URI Subject Alternative Names (SANs)" } } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postPkiSecretGenerateIntermediate" }, "task": true }, { "name": "postPkiSecretSetSignedIntermediate", "summary": "Allows submitting the signed CA certificate corresponding to a private key generated via /pki/intermediate/generate.", "description": "Allows submitting the signed CA certificate corresponding to a private key generated via /pki/intermediate/generate.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "secretMount", "type": "string", "info": "the secret mount point (default secret)", "description": "the secret mount point (default secret)", "schema": { "title": "secretMount", "type": "string" }, "required": false }, { "name": "body", "type": "object", "info": ": {\"certificate\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "certificate": { "type": "string", "description": "PEM-format certificate. This must be a CA certificate with a public key matching the previously-generated key from the generation endpoint." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postPkiSecretSetSignedIntermediate" }, "task": true }, { "name": "postPkiSecretIssueCert", "summary": "Generates a new set of credentials (private key and certificate) based on the role named in the endpoint.", "description": "Generates a new set of credentials (private key and certificate) based on the role named in the endpoint.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "secretMount", "type": "string", "info": "the secret mount point (default secret)", "description": "the secret mount point (default secret)", "schema": { "title": "secretMount", "type": "string" }, "required": false }, { "name": "role", "type": "string", "info": "The desired role with configuration for this request: string", "required": true, "schema": { "title": "role", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"alt_names\": \"string\", \"common_name\": \"string\", \"exclude_cn_from_sans\": \"boolean\", \"format\": \"Must be one of [pem, der, pem_bundle]\", \"ip_sans\": \"array\", \"other_sans\": \"array\", \"private_key_format\": \"Must be one of [, der, pem, pkcs8]\", \"serial_number\": \"string\", \"ttl\": 123, \"uri_sans\": \"array\"}", "required": false, "schema": { "type": "object", "properties": { "alt_names": { "type": "string", "description": "The requested Subject Alternative Names, if any, in a comma-delimited list. If email protection is enabled for the role, this may contain email addresses.", "x-vault-displayAttrs": { "name": "DNS/Email Subject Alternative Names (SANs)" } }, "common_name": { "type": "string", "description": "The requested common name; if you want more than one, specify the alternative names in the alt_names map. If email protection is enabled in the role, this may be an email address." }, "exclude_cn_from_sans": { "type": "boolean", "description": "If true, the Common Name will not be included in DNS or Email Subject Alternate Names. Defaults to false (CN is included).", "default": false, "x-vault-displayAttrs": { "name": "Exclude Common Name from Subject Alternative Names (SANs)" } }, "format": { "type": "string", "description": "Format for returned data. Can be \"pem\", \"der\", or \"pem_bundle\". If \"pem_bundle\" any private key and issuing cert will be appended to the certificate pem. Defaults to \"pem\".", "enum": [ "pem", "der", "pem_bundle" ], "default": "pem", "x-vault-displayAttrs": { "value": "pem" } }, "ip_sans": { "type": "array", "description": "The requested IP SANs, if any, in a comma-delimited list", "items": { "type": "string" }, "x-vault-displayAttrs": { "name": "IP Subject Alternative Names (SANs)" } }, "other_sans": { "type": "array", "description": "Requested other SANs, in an array with the format ;UTF8: for each entry.", "items": { "type": "string" }, "x-vault-displayAttrs": { "name": "Other SANs" } }, "private_key_format": { "type": "string", "description": "Format for the returned private key. Generally the default will be controlled by the \"format\" parameter as either base64-encoded DER or PEM-encoded DER. However, this can be set to \"pkcs8\" to have the returned private key contain base64-encoded pkcs8 or PEM-encoded pkcs8 instead. Defaults to \"der\".", "enum": [ "", "der", "pem", "pkcs8" ], "default": "der", "x-vault-displayAttrs": { "value": "der" } }, "serial_number": { "type": "string", "description": "The requested serial number, if any. If you want more than one, specify alternative names in the alt_names map using OID 2.5.4.5." }, "ttl": { "type": "integer", "description": "The requested Time To Live for the certificate; sets the expiration date. If not specified the role default, backend default, or system default TTL is used, in that order. Cannot be larger than the role max TTL.", "x-vault-displayAttrs": { "name": "TTL" } }, "uri_sans": { "type": "array", "description": "The requested URI SANs, if any, in a comma-delimited list.", "items": { "type": "string" }, "x-vault-displayAttrs": { "name": "URI Subject Alternative Names (SANs)" } } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postPkiSecretIssueCert" }, "task": true }, { "name": "postPkiSecretRevokeCert", "summary": "Revoke a certificate by serial number.", "description": "Revoke a certificate by serial number.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "secretMount", "type": "string", "info": "the secret mount point (default secret)", "description": "the secret mount point (default secret)", "schema": { "title": "secretMount", "type": "string" }, "required": false }, { "name": "body", "type": "object", "info": ": {\"serial_number\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "serial_number": { "type": "string", "description": "Certificate serial number, in colon- or hyphen-separated octal" } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postPkiSecretRevokeCert" }, "task": true }, { "name": "listPkiSecretRoles", "summary": "List the existing roles in this backend", "description": "List the existing roles in this backend", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "secretMount", "type": "string", "info": "the secret mount point (default secret)", "description": "the secret mount point (default secret)", "schema": { "title": "secretMount", "type": "string" }, "required": false }, { "name": "list", "type": "string", "info": "Return a list if `true`: string", "required": false, "schema": { "title": "list", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/listPkiSecretRoles" }, "task": true }, { "name": "getPkiSecretRolesName", "summary": "Queries the role definition.", "description": "Queries the role definition.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "secretMount", "type": "string", "info": "the secret mount point (default secret)", "description": "the secret mount point (default secret)", "schema": { "title": "secretMount", "type": "string" }, "required": false }, { "name": "name", "type": "string", "info": "Name of the role: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getPkiSecretRolesName" }, "task": true }, { "name": "postPkiSecretRolesName", "summary": "Creates or updates the role definition.", "description": "Creates or updates the role definition.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "secretMount", "type": "string", "info": "the secret mount point (default secret)", "description": "the secret mount point (default secret)", "schema": { "title": "secretMount", "type": "string" }, "required": false }, { "name": "name", "type": "string", "info": "Name of the role: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"allow_any_name\": \"boolean\", \"allow_bare_domains\": \"boolean\", \"allow_glob_domains\": \"boolean\", \"allow_ip_sans\": \"boolean\", \"allow_localhost\": \"boolean\", \"allow_subdomains\": \"boolean\", \"allowed_domains\": \"array\", \"allowed_domains_template\": \"boolean\", \"allowed_other_sans\": \"array\", \"allowed_serial_numbers\": \"array\", \"allowed_uri_sans\": \"array\", \"backend\": \"string\", \"basic_constraints_valid_for_non_ca\": \"boolean\", \"client_flag\": \"boolean\", \"code_signing_flag\": \"boolean\", \"country\": \"array\", \"email_protection_flag\": \"boolean\", \"enforce_hostnames\": \"boolean\", \"ext_key_usage\": \"array\", \"ext_key_usage_oids\": \"array\", \"generate_lease\": \"boolean\", \"key_bits\": 123, \"key_type\": \"Must be one of [rsa, ec]\", \"key_usage\": \"array\", \"locality\": \"array\", \"max_ttl\": 123, \"no_store\": \"boolean\", \"not_before_duration\": 123, \"organization\": \"array\", \"ou\": \"array\", \"policy_identifiers\": \"array\", \"postal_code\": \"array\", \"province\": \"array\", \"require_cn\": \"boolean\", \"server_flag\": \"boolean\", \"street_address\": \"array\", \"ttl\": 123, \"use_csr_common_name\": \"boolean\", \"use_csr_sans\": \"boolean\"}", "required": false, "schema": { "type": "object", "properties": { "allow_any_name": { "type": "boolean", "description": "If set, clients can request certificates for any CN they like. See the documentation for more information." }, "allow_bare_domains": { "type": "boolean", "description": "If set, clients can request certificates for the base domains themselves, e.g. \"example.com\". This is a separate option as in some cases this can be considered a security threat." }, "allow_glob_domains": { "type": "boolean", "description": "If set, domains specified in \"allowed_domains\" can include glob patterns, e.g. \"ftp*.example.com\". See the documentation for more information." }, "allow_ip_sans": { "type": "boolean", "description": "If set, IP Subject Alternative Names are allowed. Any valid IP is accepted.", "default": true, "x-vault-displayAttrs": { "name": "Allow IP Subject Alternative Names", "value": true } }, "allow_localhost": { "type": "boolean", "description": "Whether to allow \"localhost\" as a valid common name in a request", "default": true, "x-vault-displayAttrs": { "value": true } }, "allow_subdomains": { "type": "boolean", "description": "If set, clients can request certificates for subdomains of the CNs allowed by the other role options, including wildcard subdomains. See the documentation for more information." }, "allowed_domains": { "type": "array", "description": "If set, clients can request certificates for subdomains directly beneath these domains, including the wildcard subdomains. See the documentation for more information. This parameter accepts a comma-separated string or list of domains.", "items": { "type": "string" } }, "allowed_domains_template": { "type": "boolean", "description": "If set, Allowed domains can be specified using identity template policies. Non-templated domains are also permitted.", "default": false }, "allowed_other_sans": { "type": "array", "description": "If set, an array of allowed other names to put in SANs. These values support globbing and must be in the format ;:. Currently only \"utf8\" is a valid type. All values, including globbing values, must use this syntax, with the exception being a single \"*\" which allows any OID and any value (but type must still be utf8).", "items": { "type": "string" }, "x-vault-displayAttrs": { "name": "Allowed Other Subject Alternative Names" } }, "allowed_serial_numbers": { "type": "array", "description": "If set, an array of allowed serial numbers to put in Subject. These values support globbing.", "items": { "type": "string" } }, "allowed_uri_sans": { "type": "array", "description": "If set, an array of allowed URIs to put in the URI Subject Alternative Names. Any valid URI is accepted, these values support globbing.", "items": { "type": "string" }, "x-vault-displayAttrs": { "name": "Allowed URI Subject Alternative Names" } }, "backend": { "type": "string", "description": "Backend Type" }, "basic_constraints_valid_for_non_ca": { "type": "boolean", "description": "Mark Basic Constraints valid when issuing non-CA certificates.", "x-vault-displayAttrs": { "name": "Basic Constraints Valid for Non-CA" } }, "client_flag": { "type": "boolean", "description": "If set, certificates are flagged for client auth use. Defaults to true.", "default": true, "x-vault-displayAttrs": { "value": true } }, "code_signing_flag": { "type": "boolean", "description": "If set, certificates are flagged for code signing use. Defaults to false." }, "country": { "type": "array", "description": "If set, Country will be set to this value in certificates issued by this role.", "items": { "type": "string" } }, "email_protection_flag": { "type": "boolean", "description": "If set, certificates are flagged for email protection use. Defaults to false." }, "enforce_hostnames": { "type": "boolean", "description": "If set, only valid host names are allowed for CN and SANs. Defaults to true.", "default": true, "x-vault-displayAttrs": { "value": true } }, "ext_key_usage": { "type": "array", "description": "A comma-separated string or list of extended key usages. Valid values can be found at https://golang.org/pkg/crypto/x509/#ExtKeyUsage -- simply drop the \"ExtKeyUsage\" part of the name. To remove all key usages from being set, set this value to an empty list.", "items": { "type": "string" }, "default": [], "x-vault-displayAttrs": { "name": "Extended Key Usage" } }, "ext_key_usage_oids": { "type": "array", "description": "A comma-separated string or list of extended key usage oids.", "items": { "type": "string" }, "x-vault-displayAttrs": { "name": "Extended Key Usage OIDs" } }, "generate_lease": { "type": "boolean", "description": "If set, certificates issued/signed against this role will have Vault leases attached to them. Defaults to \"false\". Certificates can be added to the CRL by \"vault revoke \" when certificates are associated with leases. It can also be done using the \"pki/revoke\" endpoint. However, when lease generation is disabled, invoking \"pki/revoke\" would be the only way to add the certificates to the CRL. When large number of certificates are generated with long lifetimes, it is recommended that lease generation be disabled, as large amount of leases adversely affect the startup time of Vault." }, "key_bits": { "type": "integer", "description": "The number of bits to use. You will almost certainly want to change this if you adjust the key_type.", "default": 2048 }, "key_type": { "type": "string", "description": "The type of key to use; defaults to RSA. \"rsa\" and \"ec\" are the only valid values.", "enum": [ "rsa", "ec" ], "default": "rsa" }, "key_usage": { "type": "array", "description": "A comma-separated string or list of key usages (not extended key usages). Valid values can be found at https://golang.org/pkg/crypto/x509/#KeyUsage -- simply drop the \"KeyUsage\" part of the name. To remove all key usages from being set, set this value to an empty list.", "items": { "type": "string" }, "default": [ "DigitalSignature", "KeyAgreement", "KeyEncipherment" ], "x-vault-displayAttrs": { "value": "DigitalSignature,KeyAgreement,KeyEncipherment" } }, "locality": { "type": "array", "description": "If set, Locality will be set to this value in certificates issued by this role.", "items": { "type": "string" }, "x-vault-displayAttrs": { "name": "Locality/City" } }, "max_ttl": { "type": "integer", "description": "The maximum allowed lease duration", "x-vault-displayAttrs": { "name": "Max TTL" } }, "no_store": { "type": "boolean", "description": "If set, certificates issued/signed against this role will not be stored in the storage backend. This can improve performance when issuing large numbers of certificates. However, certificates issued in this way cannot be enumerated or revoked, so this option is recommended only for certificates that are non-sensitive, or extremely short-lived. This option implies a value of \"false\" for \"generate_lease\"." }, "not_before_duration": { "type": "integer", "description": "The duration before now the cert needs to be created / signed.", "default": 30, "x-vault-displayAttrs": { "value": 30 } }, "organization": { "type": "array", "description": "If set, O (Organization) will be set to this value in certificates issued by this role.", "items": { "type": "string" } }, "ou": { "type": "array", "description": "If set, OU (OrganizationalUnit) will be set to this value in certificates issued by this role.", "items": { "type": "string" }, "x-vault-displayAttrs": { "name": "Organizational Unit" } }, "policy_identifiers": { "type": "array", "description": "A comma-separated string or list of policy oids.", "items": { "type": "string" } }, "postal_code": { "type": "array", "description": "If set, Postal Code will be set to this value in certificates issued by this role.", "items": { "type": "string" } }, "province": { "type": "array", "description": "If set, Province will be set to this value in certificates issued by this role.", "items": { "type": "string" }, "x-vault-displayAttrs": { "name": "Province/State" } }, "require_cn": { "type": "boolean", "description": "If set to false, makes the 'common_name' field optional while generating a certificate.", "default": true, "x-vault-displayAttrs": { "name": "Require Common Name" } }, "server_flag": { "type": "boolean", "description": "If set, certificates are flagged for server auth use. Defaults to true.", "default": true, "x-vault-displayAttrs": { "value": true } }, "street_address": { "type": "array", "description": "If set, Street Address will be set to this value in certificates issued by this role.", "items": { "type": "string" } }, "ttl": { "type": "integer", "description": "The lease duration if no specific lease duration is requested. The lease duration controls the expiration of certificates issued by this backend. Defaults to the value of max_ttl.", "x-vault-displayAttrs": { "name": "TTL" } }, "use_csr_common_name": { "type": "boolean", "description": "If set, when used with a signing profile, the common name in the CSR will be used. This does *not* include any requested Subject Alternative Names. Defaults to true.", "default": true, "x-vault-displayAttrs": { "name": "Use CSR Common Name", "value": true } }, "use_csr_sans": { "type": "boolean", "description": "If set, when used with a signing profile, the SANs in the CSR will be used. This does *not* include the Common Name (cn). Defaults to true.", "default": true, "x-vault-displayAttrs": { "name": "Use CSR Subject Alternative Names", "value": true } } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postPkiSecretRolesName" }, "task": true }, { "name": "deletePkiSecretRolesName", "summary": "Deletes the role definition.", "description": "Deletes the role definition.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "secretMount", "type": "string", "info": "the secret mount point (default secret)", "description": "the secret mount point (default secret)", "schema": { "title": "secretMount", "type": "string" }, "required": false }, { "name": "name", "type": "string", "info": "Name of the role: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deletePkiSecretRolesName" }, "task": true }, { "name": "deletePkiSecretRoot", "summary": "Deletes the root CA key to allow a new one to be generated.", "description": "Deletes the root CA key to allow a new one to be generated.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "secretMount", "type": "string", "info": "the secret mount point (default secret)", "description": "the secret mount point (default secret)", "schema": { "title": "secretMount", "type": "string" }, "required": false } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/deletePkiSecretRoot" }, "task": true }, { "name": "postPkiSecretGenerateRoot", "summary": "Generates a new self-signed CA certificate and private key.", "description": "Generates a new self-signed CA certificate and private key.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "secretMount", "type": "string", "info": "the secret mount point (default secret)", "description": "the secret mount point (default secret)", "schema": { "title": "secretMount", "type": "string" }, "required": false }, { "name": "exported", "type": "string", "info": "Must be \"internal\" or \"exported\". If set to \"exported\", the generated private key will be returned. This is your *only* chance to retrieve the private key!: string", "required": true, "schema": { "title": "exported", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"alt_names\": \"string\", \"common_name\": \"string\", \"country\": \"array\", \"exclude_cn_from_sans\": \"boolean\", \"format\": \"Must be one of [pem, der, pem_bundle]\", \"ip_sans\": \"array\", \"key_bits\": 123, \"key_type\": \"Must be one of [rsa, ec]\", \"locality\": \"array\", \"max_path_length\": 123, \"organization\": \"array\", \"other_sans\": \"array\", \"ou\": \"array\", \"permitted_dns_domains\": \"array\", \"postal_code\": \"array\", \"private_key_format\": \"Must be one of [, der, pem, pkcs8]\", \"province\": \"array\", \"serial_number\": \"string\", \"street_address\": \"array\", \"ttl\": 123, \"uri_sans\": \"array\"}", "required": false, "schema": { "type": "object", "properties": { "alt_names": { "type": "string", "description": "The requested Subject Alternative Names, if any, in a comma-delimited list. May contain both DNS names and email addresses.", "x-vault-displayAttrs": { "name": "DNS/Email Subject Alternative Names (SANs)" } }, "common_name": { "type": "string", "description": "The requested common name; if you want more than one, specify the alternative names in the alt_names map. If not specified when signing, the common name will be taken from the CSR; other names must still be specified in alt_names or ip_sans." }, "country": { "type": "array", "description": "If set, Country will be set to this value.", "items": { "type": "string" } }, "exclude_cn_from_sans": { "type": "boolean", "description": "If true, the Common Name will not be included in DNS or Email Subject Alternate Names. Defaults to false (CN is included).", "default": false, "x-vault-displayAttrs": { "name": "Exclude Common Name from Subject Alternative Names (SANs)" } }, "format": { "type": "string", "description": "Format for returned data. Can be \"pem\", \"der\", or \"pem_bundle\". If \"pem_bundle\" any private key and issuing cert will be appended to the certificate pem. Defaults to \"pem\".", "enum": [ "pem", "der", "pem_bundle" ], "default": "pem", "x-vault-displayAttrs": { "value": "pem" } }, "ip_sans": { "type": "array", "description": "The requested IP SANs, if any, in a comma-delimited list", "items": { "type": "string" }, "x-vault-displayAttrs": { "name": "IP Subject Alternative Names (SANs)" } }, "key_bits": { "type": "integer", "description": "The number of bits to use. You will almost certainly want to change this if you adjust the key_type.", "default": 2048, "x-vault-displayAttrs": { "value": 2048 } }, "key_type": { "type": "string", "description": "The type of key to use; defaults to RSA. \"rsa\" and \"ec\" are the only valid values.", "enum": [ "rsa", "ec" ], "default": "rsa", "x-vault-displayAttrs": { "value": "rsa" } }, "locality": { "type": "array", "description": "If set, Locality will be set to this value.", "items": { "type": "string" }, "x-vault-displayAttrs": { "name": "Locality/City" } }, "max_path_length": { "type": "integer", "description": "The maximum allowable path length", "default": -1 }, "organization": { "type": "array", "description": "If set, O (Organization) will be set to this value.", "items": { "type": "string" } }, "other_sans": { "type": "array", "description": "Requested other SANs, in an array with the format ;UTF8: for each entry.", "items": { "type": "string" }, "x-vault-displayAttrs": { "name": "Other SANs" } }, "ou": { "type": "array", "description": "If set, OU (OrganizationalUnit) will be set to this value.", "items": { "type": "string" }, "x-vault-displayAttrs": { "name": "OU (Organizational Unit)" } }, "permitted_dns_domains": { "type": "array", "description": "Domains for which this certificate is allowed to sign or issue child certificates. If set, all DNS names (subject and alt) on child certs must be exact matches or subsets of the given domains (see https://tools.ietf.org/html/rfc5280#section-4.2.1.10).", "items": { "type": "string" }, "x-vault-displayAttrs": { "name": "Permitted DNS Domains" } }, "postal_code": { "type": "array", "description": "If set, Postal Code will be set to this value.", "items": { "type": "string" }, "x-vault-displayAttrs": { "name": "Postal Code" } }, "private_key_format": { "type": "string", "description": "Format for the returned private key. Generally the default will be controlled by the \"format\" parameter as either base64-encoded DER or PEM-encoded DER. However, this can be set to \"pkcs8\" to have the returned private key contain base64-encoded pkcs8 or PEM-encoded pkcs8 instead. Defaults to \"der\".", "enum": [ "", "der", "pem", "pkcs8" ], "default": "der", "x-vault-displayAttrs": { "value": "der" } }, "province": { "type": "array", "description": "If set, Province will be set to this value.", "items": { "type": "string" }, "x-vault-displayAttrs": { "name": "Province/State" } }, "serial_number": { "type": "string", "description": "The requested serial number, if any. If you want more than one, specify alternative names in the alt_names map using OID 2.5.4.5." }, "street_address": { "type": "array", "description": "If set, Street Address will be set to this value.", "items": { "type": "string" }, "x-vault-displayAttrs": { "name": "Street Address" } }, "ttl": { "type": "integer", "description": "The requested Time To Live for the certificate; sets the expiration date. If not specified the role default, backend default, or system default TTL is used, in that order. Cannot be larger than the mount max TTL. Note: this only has an effect when generating a CA cert or signing a CA cert, not when generating a CSR for an intermediate CA.", "x-vault-displayAttrs": { "name": "TTL" } }, "uri_sans": { "type": "array", "description": "The requested URI SANs, if any, in a comma-delimited list.", "items": { "type": "string" }, "x-vault-displayAttrs": { "name": "URI Subject Alternative Names (SANs)" } } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postPkiSecretGenerateRoot" }, "task": true }, { "name": "postPkiSecretSignIntermediateRoot", "summary": "Issue an intermediate CA certificate based on the provided CSR.", "description": "Issue an intermediate CA certificate based on the provided CSR.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "secretMount", "type": "string", "info": "the secret mount point (default secret)", "description": "the secret mount point (default secret)", "schema": { "title": "secretMount", "type": "string" }, "required": false }, { "name": "body", "type": "object", "info": ": {\"alt_names\": \"string\", \"common_name\": \"string\", \"country\": \"array\", \"csr\": \"string\", \"exclude_cn_from_sans\": \"boolean\", \"format\": \"Must be one of [pem, der, pem_bundle]\", \"ip_sans\": \"array\", \"locality\": \"array\", \"max_path_length\": 123, \"organization\": \"array\", \"other_sans\": \"array\", \"ou\": \"array\", \"permitted_dns_domains\": \"array\", \"postal_code\": \"array\", \"private_key_format\": \"Must be one of [, der, pem, pkcs8]\", \"province\": \"array\", \"serial_number\": \"string\", \"street_address\": \"array\", \"ttl\": 123, \"uri_sans\": \"array\", \"use_csr_values\": \"boolean\"}", "required": false, "schema": { "type": "object", "properties": { "alt_names": { "type": "string", "description": "The requested Subject Alternative Names, if any, in a comma-delimited list. May contain both DNS names and email addresses.", "x-vault-displayAttrs": { "name": "DNS/Email Subject Alternative Names (SANs)" } }, "common_name": { "type": "string", "description": "The requested common name; if you want more than one, specify the alternative names in the alt_names map. If not specified when signing, the common name will be taken from the CSR; other names must still be specified in alt_names or ip_sans." }, "country": { "type": "array", "description": "If set, Country will be set to this value.", "items": { "type": "string" } }, "csr": { "type": "string", "description": "PEM-format CSR to be signed.", "default": "" }, "exclude_cn_from_sans": { "type": "boolean", "description": "If true, the Common Name will not be included in DNS or Email Subject Alternate Names. Defaults to false (CN is included).", "default": false, "x-vault-displayAttrs": { "name": "Exclude Common Name from Subject Alternative Names (SANs)" } }, "format": { "type": "string", "description": "Format for returned data. Can be \"pem\", \"der\", or \"pem_bundle\". If \"pem_bundle\" any private key and issuing cert will be appended to the certificate pem. Defaults to \"pem\".", "enum": [ "pem", "der", "pem_bundle" ], "default": "pem", "x-vault-displayAttrs": { "value": "pem" } }, "ip_sans": { "type": "array", "description": "The requested IP SANs, if any, in a comma-delimited list", "items": { "type": "string" }, "x-vault-displayAttrs": { "name": "IP Subject Alternative Names (SANs)" } }, "locality": { "type": "array", "description": "If set, Locality will be set to this value.", "items": { "type": "string" }, "x-vault-displayAttrs": { "name": "Locality/City" } }, "max_path_length": { "type": "integer", "description": "The maximum allowable path length", "default": -1 }, "organization": { "type": "array", "description": "If set, O (Organization) will be set to this value.", "items": { "type": "string" } }, "other_sans": { "type": "array", "description": "Requested other SANs, in an array with the format ;UTF8: for each entry.", "items": { "type": "string" }, "x-vault-displayAttrs": { "name": "Other SANs" } }, "ou": { "type": "array", "description": "If set, OU (OrganizationalUnit) will be set to this value.", "items": { "type": "string" }, "x-vault-displayAttrs": { "name": "OU (Organizational Unit)" } }, "permitted_dns_domains": { "type": "array", "description": "Domains for which this certificate is allowed to sign or issue child certificates. If set, all DNS names (subject and alt) on child certs must be exact matches or subsets of the given domains (see https://tools.ietf.org/html/rfc5280#section-4.2.1.10).", "items": { "type": "string" }, "x-vault-displayAttrs": { "name": "Permitted DNS Domains" } }, "postal_code": { "type": "array", "description": "If set, Postal Code will be set to this value.", "items": { "type": "string" }, "x-vault-displayAttrs": { "name": "Postal Code" } }, "private_key_format": { "type": "string", "description": "Format for the returned private key. Generally the default will be controlled by the \"format\" parameter as either base64-encoded DER or PEM-encoded DER. However, this can be set to \"pkcs8\" to have the returned private key contain base64-encoded pkcs8 or PEM-encoded pkcs8 instead. Defaults to \"der\".", "enum": [ "", "der", "pem", "pkcs8" ], "default": "der", "x-vault-displayAttrs": { "value": "der" } }, "province": { "type": "array", "description": "If set, Province will be set to this value.", "items": { "type": "string" }, "x-vault-displayAttrs": { "name": "Province/State" } }, "serial_number": { "type": "string", "description": "The requested serial number, if any. If you want more than one, specify alternative names in the alt_names map using OID 2.5.4.5." }, "street_address": { "type": "array", "description": "If set, Street Address will be set to this value.", "items": { "type": "string" }, "x-vault-displayAttrs": { "name": "Street Address" } }, "ttl": { "type": "integer", "description": "The requested Time To Live for the certificate; sets the expiration date. If not specified the role default, backend default, or system default TTL is used, in that order. Cannot be larger than the mount max TTL. Note: this only has an effect when generating a CA cert or signing a CA cert, not when generating a CSR for an intermediate CA.", "x-vault-displayAttrs": { "name": "TTL" } }, "uri_sans": { "type": "array", "description": "The requested URI SANs, if any, in a comma-delimited list.", "items": { "type": "string" }, "x-vault-displayAttrs": { "name": "URI Subject Alternative Names (SANs)" } }, "use_csr_values": { "type": "boolean", "description": "If true, then: 1) Subject information, including names and alternate names, will be preserved from the CSR rather than using values provided in the other parameters to this path; 2) Any key usages requested in the CSR will be added to the basic set of key usages used for CA certs signed by this path; for instance, the non-repudiation flag.", "default": false } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postPkiSecretSignIntermediateRoot" }, "task": true }, { "name": "postPkiSecretRootSignSelfIssued", "summary": "Signs another CA's self-issued certificate.", "description": "Signs another CA's self-issued certificate.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "secretMount", "type": "string", "info": "the secret mount point (default secret)", "description": "the secret mount point (default secret)", "schema": { "title": "secretMount", "type": "string" }, "required": false }, { "name": "body", "type": "object", "info": ": {\"certificate\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "certificate": { "type": "string", "description": "PEM-format self-issued certificate to be signed." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postPkiSecretRootSignSelfIssued" }, "task": true }, { "name": "postPkiSecretSignVerbatim", "summary": "Signs a new certificate based upon the provided CSR.", "description": "Signs a new certificate based upon the provided CSR.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "secretMount", "type": "string", "info": "the secret mount point (default secret)", "description": "the secret mount point (default secret)", "schema": { "title": "secretMount", "type": "string" }, "required": false }, { "name": "body", "type": "object", "info": ": {\"alt_names\": \"string\", \"common_name\": \"string\", \"csr\": \"string\", \"exclude_cn_from_sans\": \"boolean\", \"ext_key_usage\": \"array\", \"ext_key_usage_oids\": \"array\", \"format\": \"Must be one of [pem, der, pem_bundle]\", \"ip_sans\": \"array\", \"key_usage\": \"array\", \"other_sans\": \"array\", \"private_key_format\": \"Must be one of [, der, pem, pkcs8]\", \"role\": \"string\", \"serial_number\": \"string\", \"ttl\": 123, \"uri_sans\": \"array\"}", "required": false, "schema": { "type": "object", "properties": { "alt_names": { "type": "string", "description": "The requested Subject Alternative Names, if any, in a comma-delimited list. If email protection is enabled for the role, this may contain email addresses.", "x-vault-displayAttrs": { "name": "DNS/Email Subject Alternative Names (SANs)" } }, "common_name": { "type": "string", "description": "The requested common name; if you want more than one, specify the alternative names in the alt_names map. If email protection is enabled in the role, this may be an email address." }, "csr": { "type": "string", "description": "PEM-format CSR to be signed. Values will be taken verbatim from the CSR, except for basic constraints.", "default": "" }, "exclude_cn_from_sans": { "type": "boolean", "description": "If true, the Common Name will not be included in DNS or Email Subject Alternate Names. Defaults to false (CN is included).", "default": false, "x-vault-displayAttrs": { "name": "Exclude Common Name from Subject Alternative Names (SANs)" } }, "ext_key_usage": { "type": "array", "description": "A comma-separated string or list of extended key usages. Valid values can be found at https://golang.org/pkg/crypto/x509/#ExtKeyUsage -- simply drop the \"ExtKeyUsage\" part of the name. To remove all key usages from being set, set this value to an empty list.", "items": { "type": "string" }, "default": [] }, "ext_key_usage_oids": { "type": "array", "description": "A comma-separated string or list of extended key usage oids.", "items": { "type": "string" } }, "format": { "type": "string", "description": "Format for returned data. Can be \"pem\", \"der\", or \"pem_bundle\". If \"pem_bundle\" any private key and issuing cert will be appended to the certificate pem. Defaults to \"pem\".", "enum": [ "pem", "der", "pem_bundle" ], "default": "pem", "x-vault-displayAttrs": { "value": "pem" } }, "ip_sans": { "type": "array", "description": "The requested IP SANs, if any, in a comma-delimited list", "items": { "type": "string" }, "x-vault-displayAttrs": { "name": "IP Subject Alternative Names (SANs)" } }, "key_usage": { "type": "array", "description": "A comma-separated string or list of key usages (not extended key usages). Valid values can be found at https://golang.org/pkg/crypto/x509/#KeyUsage -- simply drop the \"KeyUsage\" part of the name. To remove all key usages from being set, set this value to an empty list.", "items": { "type": "string" }, "default": [ "DigitalSignature", "KeyAgreement", "KeyEncipherment" ] }, "other_sans": { "type": "array", "description": "Requested other SANs, in an array with the format ;UTF8: for each entry.", "items": { "type": "string" }, "x-vault-displayAttrs": { "name": "Other SANs" } }, "private_key_format": { "type": "string", "description": "Format for the returned private key. Generally the default will be controlled by the \"format\" parameter as either base64-encoded DER or PEM-encoded DER. However, this can be set to \"pkcs8\" to have the returned private key contain base64-encoded pkcs8 or PEM-encoded pkcs8 instead. Defaults to \"der\".", "enum": [ "", "der", "pem", "pkcs8" ], "default": "der", "x-vault-displayAttrs": { "value": "der" } }, "role": { "type": "string", "description": "The desired role with configuration for this request" }, "serial_number": { "type": "string", "description": "The requested serial number, if any. If you want more than one, specify alternative names in the alt_names map using OID 2.5.4.5." }, "ttl": { "type": "integer", "description": "The requested Time To Live for the certificate; sets the expiration date. If not specified the role default, backend default, or system default TTL is used, in that order. Cannot be larger than the role max TTL.", "x-vault-displayAttrs": { "name": "TTL" } }, "uri_sans": { "type": "array", "description": "The requested URI SANs, if any, in a comma-delimited list.", "items": { "type": "string" }, "x-vault-displayAttrs": { "name": "URI Subject Alternative Names (SANs)" } } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postPkiSecretSignVerbatim" }, "task": true }, { "name": "postPkiSecretSignVerbatimName", "summary": "Signs a new certificate based upon the provided CSR. Values are taken verbatim from the CSR.", "description": "Signs a new certificate based upon the provided CSR. Values are taken verbatim from the CSR.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "secretMount", "type": "string", "info": "the secret mount point (default secret)", "description": "the secret mount point (default secret)", "schema": { "title": "secretMount", "type": "string" }, "required": false }, { "name": "role", "type": "string", "info": "The desired role with configuration for this request: string", "required": true, "schema": { "title": "role", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"alt_names\": \"string\", \"common_name\": \"string\", \"csr\": \"string\", \"exclude_cn_from_sans\": \"boolean\", \"ext_key_usage\": \"array\", \"ext_key_usage_oids\": \"array\", \"format\": \"Must be one of [pem, der, pem_bundle]\", \"ip_sans\": \"array\", \"key_usage\": \"array\", \"other_sans\": \"array\", \"private_key_format\": \"Must be one of [, der, pem, pkcs8]\", \"serial_number\": \"string\", \"ttl\": 123, \"uri_sans\": \"array\"}", "required": false, "schema": { "type": "object", "properties": { "alt_names": { "type": "string", "description": "The requested Subject Alternative Names, if any, in a comma-delimited list. If email protection is enabled for the role, this may contain email addresses.", "x-vault-displayAttrs": { "name": "DNS/Email Subject Alternative Names (SANs)" } }, "common_name": { "type": "string", "description": "The requested common name; if you want more than one, specify the alternative names in the alt_names map. If email protection is enabled in the role, this may be an email address." }, "csr": { "type": "string", "description": "PEM-format CSR to be signed. Values will be taken verbatim from the CSR, except for basic constraints.", "default": "" }, "exclude_cn_from_sans": { "type": "boolean", "description": "If true, the Common Name will not be included in DNS or Email Subject Alternate Names. Defaults to false (CN is included).", "default": false, "x-vault-displayAttrs": { "name": "Exclude Common Name from Subject Alternative Names (SANs)" } }, "ext_key_usage": { "type": "array", "description": "A comma-separated string or list of extended key usages. Valid values can be found at https://golang.org/pkg/crypto/x509/#ExtKeyUsage -- simply drop the \"ExtKeyUsage\" part of the name. To remove all key usages from being set, set this value to an empty list.", "items": { "type": "string" }, "default": [] }, "ext_key_usage_oids": { "type": "array", "description": "A comma-separated string or list of extended key usage oids.", "items": { "type": "string" } }, "format": { "type": "string", "description": "Format for returned data. Can be \"pem\", \"der\", or \"pem_bundle\". If \"pem_bundle\" any private key and issuing cert will be appended to the certificate pem. Defaults to \"pem\".", "enum": [ "pem", "der", "pem_bundle" ], "default": "pem", "x-vault-displayAttrs": { "value": "pem" } }, "ip_sans": { "type": "array", "description": "The requested IP SANs, if any, in a comma-delimited list", "items": { "type": "string" }, "x-vault-displayAttrs": { "name": "IP Subject Alternative Names (SANs)" } }, "key_usage": { "type": "array", "description": "A comma-separated string or list of key usages (not extended key usages). Valid values can be found at https://golang.org/pkg/crypto/x509/#KeyUsage -- simply drop the \"KeyUsage\" part of the name. To remove all key usages from being set, set this value to an empty list.", "items": { "type": "string" }, "default": [ "DigitalSignature", "KeyAgreement", "KeyEncipherment" ] }, "other_sans": { "type": "array", "description": "Requested other SANs, in an array with the format ;UTF8: for each entry.", "items": { "type": "string" }, "x-vault-displayAttrs": { "name": "Other SANs" } }, "private_key_format": { "type": "string", "description": "Format for the returned private key. Generally the default will be controlled by the \"format\" parameter as either base64-encoded DER or PEM-encoded DER. However, this can be set to \"pkcs8\" to have the returned private key contain base64-encoded pkcs8 or PEM-encoded pkcs8 instead. Defaults to \"der\".", "enum": [ "", "der", "pem", "pkcs8" ], "default": "der", "x-vault-displayAttrs": { "value": "der" } }, "serial_number": { "type": "string", "description": "The requested serial number, if any. If you want more than one, specify alternative names in the alt_names map using OID 2.5.4.5." }, "ttl": { "type": "integer", "description": "The requested Time To Live for the certificate; sets the expiration date. If not specified the role default, backend default, or system default TTL is used, in that order. Cannot be larger than the role max TTL.", "x-vault-displayAttrs": { "name": "TTL" } }, "uri_sans": { "type": "array", "description": "The requested URI SANs, if any, in a comma-delimited list.", "items": { "type": "string" }, "x-vault-displayAttrs": { "name": "URI Subject Alternative Names (SANs)" } } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postPkiSecretSignVerbatimName" }, "task": true }, { "name": "postPkiSecretSignRole", "summary": "Sign certificates using a certain role with the provided details.", "description": "Sign certificates using a certain role with the provided details.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "secretMount", "type": "string", "info": "the secret mount point (default secret)", "description": "the secret mount point (default secret)", "schema": { "title": "secretMount", "type": "string" }, "required": false }, { "name": "role", "type": "string", "info": "The desired role with configuration for this request: string", "required": true, "schema": { "title": "role", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"alt_names\": \"string\", \"common_name\": \"string\", \"csr\": \"string\", \"exclude_cn_from_sans\": \"boolean\", \"format\": \"Must be one of [pem, der, pem_bundle]\", \"ip_sans\": \"array\", \"other_sans\": \"array\", \"private_key_format\": \"Must be one of [, der, pem, pkcs8]\", \"serial_number\": \"string\", \"ttl\": 123, \"uri_sans\": \"array\"}", "required": false, "schema": { "type": "object", "properties": { "alt_names": { "type": "string", "description": "The requested Subject Alternative Names, if any, in a comma-delimited list. If email protection is enabled for the role, this may contain email addresses.", "x-vault-displayAttrs": { "name": "DNS/Email Subject Alternative Names (SANs)" } }, "common_name": { "type": "string", "description": "The requested common name; if you want more than one, specify the alternative names in the alt_names map. If email protection is enabled in the role, this may be an email address." }, "csr": { "type": "string", "description": "PEM-format CSR to be signed.", "default": "" }, "exclude_cn_from_sans": { "type": "boolean", "description": "If true, the Common Name will not be included in DNS or Email Subject Alternate Names. Defaults to false (CN is included).", "default": false, "x-vault-displayAttrs": { "name": "Exclude Common Name from Subject Alternative Names (SANs)" } }, "format": { "type": "string", "description": "Format for returned data. Can be \"pem\", \"der\", or \"pem_bundle\". If \"pem_bundle\" any private key and issuing cert will be appended to the certificate pem. Defaults to \"pem\".", "enum": [ "pem", "der", "pem_bundle" ], "default": "pem", "x-vault-displayAttrs": { "value": "pem" } }, "ip_sans": { "type": "array", "description": "The requested IP SANs, if any, in a comma-delimited list", "items": { "type": "string" }, "x-vault-displayAttrs": { "name": "IP Subject Alternative Names (SANs)" } }, "other_sans": { "type": "array", "description": "Requested other SANs, in an array with the format ;UTF8: for each entry.", "items": { "type": "string" }, "x-vault-displayAttrs": { "name": "Other SANs" } }, "private_key_format": { "type": "string", "description": "Format for the returned private key. Generally the default will be controlled by the \"format\" parameter as either base64-encoded DER or PEM-encoded DER. However, this can be set to \"pkcs8\" to have the returned private key contain base64-encoded pkcs8 or PEM-encoded pkcs8 instead. Defaults to \"der\".", "enum": [ "", "der", "pem", "pkcs8" ], "default": "der", "x-vault-displayAttrs": { "value": "der" } }, "serial_number": { "type": "string", "description": "The requested serial number, if any. If you want more than one, specify alternative names in the alt_names map using OID 2.5.4.5." }, "ttl": { "type": "integer", "description": "The requested Time To Live for the certificate; sets the expiration date. If not specified the role default, backend default, or system default TTL is used, in that order. Cannot be larger than the role max TTL.", "x-vault-displayAttrs": { "name": "TTL" } }, "uri_sans": { "type": "array", "description": "The requested URI SANs, if any, in a comma-delimited list.", "items": { "type": "string" }, "x-vault-displayAttrs": { "name": "URI Subject Alternative Names (SANs)" } } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postPkiSecretSignRole" }, "task": true }, { "name": "postPkiSecretTidy", "summary": "Tidy up the backend by removing expired certificates, revocation information,\nor both.", "description": "Tidy up the backend by removing expired certificates, revocation information,\nor both.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "secretMount", "type": "string", "info": "the secret mount point (default secret)", "description": "the secret mount point (default secret)", "schema": { "title": "secretMount", "type": "string" }, "required": false }, { "name": "body", "type": "object", "info": ": {\"safety_buffer\": 123, \"tidy_cert_store\": \"boolean\", \"tidy_revocation_list\": \"boolean\", \"tidy_revoked_certs\": \"boolean\"}", "required": false, "schema": { "type": "object", "properties": { "safety_buffer": { "type": "integer", "description": "The amount of extra time that must have passed beyond certificate expiration before it is removed from the backend storage and/or revocation list. Defaults to 72 hours.", "default": 259200 }, "tidy_cert_store": { "type": "boolean", "description": "Set to true to enable tidying up the certificate store" }, "tidy_revocation_list": { "type": "boolean", "description": "Deprecated; synonym for 'tidy_revoked_certs" }, "tidy_revoked_certs": { "type": "boolean", "description": "Set to true to expire all revoked and expired certificates, removing them both from the CRL and from storage. The CRL will be rotated if this causes any values to be removed." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postPkiSecretTidy" }, "task": true }, { "name": "postAuthApproleLogin", "summary": "Issue a token based on the credentials supplied", "description": "Issue a token based on the credentials supplied", "input": [ { "name": "body", "type": "object", "info": ": {\"role_id\": \"string\", \"secret_id\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "role_id": { "type": "string", "description": "Unique identifier of the Role. Required to be supplied when the 'bind_secret_id' constraint is set." }, "secret_id": { "type": "string", "description": "SecretID belong to the App role", "default": "" } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postAuthApproleLogin" }, "task": true }, { "name": "getAuthApproleRole", "summary": "Lists all the roles registered with the backend.", "description": "Lists all the roles registered with the backend.", "input": [ { "name": "list", "type": "string", "info": "Return a list if `true`: string", "required": false, "schema": { "title": "list", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getAuthApproleRole" }, "task": true }, { "name": "getAuthApproleRoleRoleName", "summary": "Register an role with the backend.", "description": "Register an role with the backend.", "input": [ { "name": "roleName", "type": "string", "info": "Name of the role.: string", "required": true, "schema": { "title": "roleName", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getAuthApproleRoleRoleName" }, "task": true }, { "name": "postAuthApproleRoleRoleName", "summary": "Register an role with the backend.", "description": "Register an role with the backend.", "input": [ { "name": "roleName", "type": "string", "info": "Name of the role.: string", "required": true, "schema": { "title": "roleName", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"bind_secret_id\": \"boolean\", \"bound_cidr_list\": \"array\", \"local_secret_ids\": \"boolean\", \"period\": 123, \"policies\": \"array\", \"role_id\": \"string\", \"secret_id_bound_cidrs\": \"array\", \"secret_id_num_uses\": 123, \"secret_id_ttl\": 123, \"token_bound_cidrs\": \"array\", \"token_explicit_max_ttl\": 123, \"token_max_ttl\": 123, \"token_no_default_policy\": \"boolean\", \"token_num_uses\": 123, \"token_period\": 123, \"token_policies\": \"array\", \"token_ttl\": 123, \"token_type\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "bind_secret_id": { "type": "boolean", "description": "Impose secret_id to be presented when logging in using this role. Defaults to 'true'.", "default": true }, "bound_cidr_list": { "type": "array", "description": "Use \"secret_id_bound_cidrs\" instead.", "items": { "type": "string" }, "deprecated": true }, "local_secret_ids": { "type": "boolean", "description": "If set, the secret IDs generated using this role will be cluster local. This can only be set during role creation and once set, it can't be reset later." }, "period": { "type": "integer", "description": "Use \"token_period\" instead. If this and \"token_period\" are both specified, only \"token_period\" will be used.", "deprecated": true }, "policies": { "type": "array", "description": "Use \"token_policies\" instead. If this and \"token_policies\" are both specified, only \"token_policies\" will be used.", "items": { "type": "string" }, "deprecated": true }, "role_id": { "type": "string", "description": "Identifier of the role. Defaults to a UUID." }, "secret_id_bound_cidrs": { "type": "array", "description": "Comma separated string or list of CIDR blocks. If set, specifies the blocks of IP addresses which can perform the login operation.", "items": { "type": "string" } }, "secret_id_num_uses": { "type": "integer", "description": "Number of times a SecretID can access the role, after which the SecretID will expire. Defaults to 0 meaning that the the secret_id is of unlimited use." }, "secret_id_ttl": { "type": "integer", "description": "Duration in seconds after which the issued SecretID should expire. Defaults to 0, meaning no expiration." }, "token_bound_cidrs": { "type": "array", "description": "Comma separated string or JSON list of CIDR blocks. If set, specifies the blocks of IP addresses which are allowed to use the generated token.", "items": { "type": "string" }, "x-vault-displayAttrs": { "name": "Generated Token's Bound CIDRs", "group": "Tokens" } }, "token_explicit_max_ttl": { "type": "integer", "description": "If set, tokens created via this role carry an explicit maximum TTL. During renewal, the current maximum TTL values of the role and the mount are not checked for changes, and any updates to these values will have no effect on the token being renewed.", "x-vault-displayAttrs": { "name": "Generated Token's Explicit Maximum TTL", "group": "Tokens" } }, "token_max_ttl": { "type": "integer", "description": "The maximum lifetime of the generated token", "x-vault-displayAttrs": { "name": "Generated Token's Maximum TTL", "group": "Tokens" } }, "token_no_default_policy": { "type": "boolean", "description": "If true, the 'default' policy will not automatically be added to generated tokens", "x-vault-displayAttrs": { "name": "Do Not Attach 'default' Policy To Generated Tokens", "group": "Tokens" } }, "token_num_uses": { "type": "integer", "description": "The maximum number of times a token may be used, a value of zero means unlimited", "x-vault-displayAttrs": { "name": "Maximum Uses of Generated Tokens", "group": "Tokens" } }, "token_period": { "type": "integer", "description": "If set, tokens created via this role will have no max lifetime; instead, their renewal period will be fixed to this value. This takes an integer number of seconds, or a string duration (e.g. \"24h\").", "x-vault-displayAttrs": { "name": "Generated Token's Period", "group": "Tokens" } }, "token_policies": { "type": "array", "description": "Comma-separated list of policies", "items": { "type": "string" }, "x-vault-displayAttrs": { "name": "Generated Token's Policies", "group": "Tokens" } }, "token_ttl": { "type": "integer", "description": "The initial ttl of the token to generate", "x-vault-displayAttrs": { "name": "Generated Token's Initial TTL", "group": "Tokens" } }, "token_type": { "type": "string", "description": "The type of token to generate, service or batch", "default": "default-service", "x-vault-displayAttrs": { "name": "Generated Token's Type", "group": "Tokens" } } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postAuthApproleRoleRoleName" }, "task": true }, { "name": "deleteAuthApproleRoleRoleName", "summary": "Register an role with the backend.", "description": "Register an role with the backend.", "input": [ { "name": "roleName", "type": "string", "info": "Name of the role.: string", "required": true, "schema": { "title": "roleName", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteAuthApproleRoleRoleName" }, "task": true }, { "name": "getAuthApproleRoleRoleNameBindSecretId", "summary": "Impose secret_id to be presented during login using this role.", "description": "Impose secret_id to be presented during login using this role.", "input": [ { "name": "roleName", "type": "string", "info": "Name of the role.: string", "required": true, "schema": { "title": "roleName", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getAuthApproleRoleRoleNameBindSecretId" }, "task": true }, { "name": "postAuthApproleRoleRoleNameBindSecretId", "summary": "Impose secret_id to be presented during login using this role.", "description": "Impose secret_id to be presented during login using this role.", "input": [ { "name": "roleName", "type": "string", "info": "Name of the role.: string", "required": true, "schema": { "title": "roleName", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"bind_secret_id\": \"boolean\"}", "required": false, "schema": { "type": "object", "properties": { "bind_secret_id": { "type": "boolean", "description": "Impose secret_id to be presented when logging in using this role.", "default": true } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postAuthApproleRoleRoleNameBindSecretId" }, "task": true }, { "name": "deleteAuthApproleRoleRoleNameBindSecretId", "summary": "Impose secret_id to be presented during login using this role.", "description": "Impose secret_id to be presented during login using this role.", "input": [ { "name": "roleName", "type": "string", "info": "Name of the role.: string", "required": true, "schema": { "title": "roleName", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteAuthApproleRoleRoleNameBindSecretId" }, "task": true }, { "name": "getAuthApproleRoleRoleNameBoundCidrList", "summary": "Deprecated: Comma separated list of CIDR blocks, if set, specifies blocks of IP\naddresses which can", "description": "Deprecated: Comma separated list of CIDR blocks, if set, specifies blocks of IP\naddresses which can perform the login operation", "input": [ { "name": "roleName", "type": "string", "info": "Name of the role.: string", "required": true, "schema": { "title": "roleName", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getAuthApproleRoleRoleNameBoundCidrList" }, "task": true }, { "name": "postAuthApproleRoleRoleNameBoundCidrList", "summary": "Deprecated: Comma separated list of CIDR blocks, if set, specifies blocks of IP\naddresses which can", "description": "Deprecated: Comma separated list of CIDR blocks, if set, specifies blocks of IP\naddresses which can perform the login operation", "input": [ { "name": "roleName", "type": "string", "info": "Name of the role.: string", "required": true, "schema": { "title": "roleName", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"bound_cidr_list\": \"array\"}", "required": false, "schema": { "type": "object", "properties": { "bound_cidr_list": { "type": "array", "description": "Deprecated: Please use \"secret_id_bound_cidrs\" instead. Comma separated string or list of CIDR blocks. If set, specifies the blocks of IP addresses which can perform the login operation.", "items": { "type": "string" } } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postAuthApproleRoleRoleNameBoundCidrList" }, "task": true }, { "name": "deleteAuthApproleRoleRoleNameBoundCidrList", "summary": "Deprecated: Comma separated list of CIDR blocks, if set, specifies blocks of IP\naddresses which can", "description": "Deprecated: Comma separated list of CIDR blocks, if set, specifies blocks of IP\naddresses which can perform the login operation", "input": [ { "name": "roleName", "type": "string", "info": "Name of the role.: string", "required": true, "schema": { "title": "roleName", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteAuthApproleRoleRoleNameBoundCidrList" }, "task": true }, { "name": "postAuthApproleRoleRoleNameCustomSecretId", "summary": "Assign a SecretID of choice against the role.", "description": "Assign a SecretID of choice against the role.", "input": [ { "name": "roleName", "type": "string", "info": "Name of the role.: string", "required": true, "schema": { "title": "roleName", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"cidr_list\": \"array\", \"metadata\": \"string\", \"secret_id\": \"string\", \"token_bound_cidrs\": \"array\"}", "required": false, "schema": { "type": "object", "properties": { "cidr_list": { "type": "array", "description": "Comma separated string or list of CIDR blocks enforcing secret IDs to be used from specific set of IP addresses. If 'bound_cidr_list' is set on the role, then the list of CIDR blocks listed here should be a subset of the CIDR blocks listed on the role.", "items": { "type": "string" } }, "metadata": { "type": "string", "description": "Metadata to be tied to the SecretID. This should be a JSON formatted string containing metadata in key value pairs." }, "secret_id": { "type": "string", "description": "SecretID to be attached to the role." }, "token_bound_cidrs": { "type": "array", "description": "Comma separated string or list of CIDR blocks. If set, specifies the blocks of IP addresses which can use the returned token. Should be a subset of the token CIDR blocks listed on the role, if any.", "items": { "type": "string" } } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postAuthApproleRoleRoleNameCustomSecretId" }, "task": true }, { "name": "getAuthApproleRoleRoleNameLocalSecretIds", "summary": "Enables cluster local secret IDs", "description": "Enables cluster local secret IDs", "input": [ { "name": "roleName", "type": "string", "info": "Name of the role.: string", "required": true, "schema": { "title": "roleName", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getAuthApproleRoleRoleNameLocalSecretIds" }, "task": true }, { "name": "getAuthApproleRoleRoleNamePeriod", "summary": "Updates the value of 'period' on the role", "description": "Updates the value of 'period' on the role", "input": [ { "name": "roleName", "type": "string", "info": "Name of the role.: string", "required": true, "schema": { "title": "roleName", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getAuthApproleRoleRoleNamePeriod" }, "task": true }, { "name": "postAuthApproleRoleRoleNamePeriod", "summary": "Updates the value of 'period' on the role", "description": "Updates the value of 'period' on the role", "input": [ { "name": "roleName", "type": "string", "info": "Name of the role.: string", "required": true, "schema": { "title": "roleName", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"period\": 123, \"token_period\": 123}", "required": false, "schema": { "type": "object", "properties": { "period": { "type": "integer", "description": "Use \"token_period\" instead. If this and \"token_period\" are both specified, only \"token_period\" will be used.", "deprecated": true }, "token_period": { "type": "integer", "description": "If set, tokens created via this role will have no max lifetime; instead, their renewal period will be fixed to this value. This takes an integer number of seconds, or a string duration (e.g. \"24h\")." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postAuthApproleRoleRoleNamePeriod" }, "task": true }, { "name": "deleteAuthApproleRoleRoleNamePeriod", "summary": "Updates the value of 'period' on the role", "description": "Updates the value of 'period' on the role", "input": [ { "name": "roleName", "type": "string", "info": "Name of the role.: string", "required": true, "schema": { "title": "roleName", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteAuthApproleRoleRoleNamePeriod" }, "task": true }, { "name": "getAuthApproleRoleRoleNamePolicies", "summary": "Policies of the role.", "description": "Policies of the role.", "input": [ { "name": "roleName", "type": "string", "info": "Name of the role.: string", "required": true, "schema": { "title": "roleName", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getAuthApproleRoleRoleNamePolicies" }, "task": true }, { "name": "postAuthApproleRoleRoleNamePolicies", "summary": "Policies of the role.", "description": "Policies of the role.", "input": [ { "name": "roleName", "type": "string", "info": "Name of the role.: string", "required": true, "schema": { "title": "roleName", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"policies\": \"array\", \"token_policies\": \"array\"}", "required": false, "schema": { "type": "object", "properties": { "policies": { "type": "array", "description": "Use \"token_policies\" instead. If this and \"token_policies\" are both specified, only \"token_policies\" will be used.", "items": { "type": "string" }, "deprecated": true }, "token_policies": { "type": "array", "description": "Comma-separated list of policies", "items": { "type": "string" } } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postAuthApproleRoleRoleNamePolicies" }, "task": true }, { "name": "deleteAuthApproleRoleRoleNamePolicies", "summary": "Policies of the role.", "description": "Policies of the role.", "input": [ { "name": "roleName", "type": "string", "info": "Name of the role.: string", "required": true, "schema": { "title": "roleName", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteAuthApproleRoleRoleNamePolicies" }, "task": true }, { "name": "getAuthApproleRoleRoleNameRoleId", "summary": "Returns the 'role_id' of the role.", "description": "Returns the 'role_id' of the role.", "input": [ { "name": "roleName", "type": "string", "info": "Name of the role.: string", "required": true, "schema": { "title": "roleName", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getAuthApproleRoleRoleNameRoleId" }, "task": true }, { "name": "postAuthApproleRoleRoleNameRoleId", "summary": "Returns the 'role_id' of the role.", "description": "Returns the 'role_id' of the role.", "input": [ { "name": "roleName", "type": "string", "info": "Name of the role.: string", "required": true, "schema": { "title": "roleName", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"role_id\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "role_id": { "type": "string", "description": "Identifier of the role. Defaults to a UUID." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postAuthApproleRoleRoleNameRoleId" }, "task": true }, { "name": "getAuthApproleRoleRoleNameSecretId", "summary": "Generate a SecretID against this role.", "description": "Generate a SecretID against this role.", "input": [ { "name": "roleName", "type": "string", "info": "Name of the role.: string", "required": true, "schema": { "title": "roleName", "type": "string" } }, { "name": "list", "type": "string", "info": "Return a list if `true`: string", "required": false, "schema": { "title": "list", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getAuthApproleRoleRoleNameSecretId" }, "task": true }, { "name": "postAuthApproleRoleRoleNameSecretId", "summary": "Generate a SecretID against this role.", "description": "Generate a SecretID against this role.", "input": [ { "name": "roleName", "type": "string", "info": "Name of the role.: string", "required": true, "schema": { "title": "roleName", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"cidr_list\": \"array\", \"metadata\": \"string\", \"token_bound_cidrs\": \"array\"}", "required": false, "schema": { "type": "object", "properties": { "cidr_list": { "type": "array", "description": "Comma separated string or list of CIDR blocks enforcing secret IDs to be used from specific set of IP addresses. If 'bound_cidr_list' is set on the role, then the list of CIDR blocks listed here should be a subset of the CIDR blocks listed on the role.", "items": { "type": "string" } }, "metadata": { "type": "string", "description": "Metadata to be tied to the SecretID. This should be a JSON formatted string containing the metadata in key value pairs." }, "token_bound_cidrs": { "type": "array", "description": "Comma separated string or JSON list of CIDR blocks. If set, specifies the blocks of IP addresses which are allowed to use the generated token.", "items": { "type": "string" } } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postAuthApproleRoleRoleNameSecretId" }, "task": true }, { "name": "postAuthApproleRoleRoleNameSecretIdAccessorDestroy", "summary": "postAuthApproleRoleRole_nameSecretIdAccessorDestroy", "description": "postAuthApproleRoleRole_nameSecretIdAccessorDestroy", "input": [ { "name": "roleName", "type": "string", "info": "Name of the role.: string", "required": true, "schema": { "title": "roleName", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"secret_id_accessor\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "secret_id_accessor": { "type": "string", "description": "Accessor of the SecretID" } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postAuthApproleRoleRoleNameSecretIdAccessorDestroy" }, "task": true }, { "name": "deleteAuthApproleRoleRoleNameSecretIdAccessorDestroy", "summary": "deleteAuthApproleRoleRole_nameSecretIdAccessorDestroy", "description": "deleteAuthApproleRoleRole_nameSecretIdAccessorDestroy", "input": [ { "name": "roleName", "type": "string", "info": "Name of the role.: string", "required": true, "schema": { "title": "roleName", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteAuthApproleRoleRoleNameSecretIdAccessorDestroy" }, "task": true }, { "name": "postAuthApproleRoleRoleNameSecretIdAccessorLookup", "summary": "postAuthApproleRoleRole_nameSecretIdAccessorLookup", "description": "postAuthApproleRoleRole_nameSecretIdAccessorLookup", "input": [ { "name": "roleName", "type": "string", "info": "Name of the role.: string", "required": true, "schema": { "title": "roleName", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"secret_id_accessor\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "secret_id_accessor": { "type": "string", "description": "Accessor of the SecretID" } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postAuthApproleRoleRoleNameSecretIdAccessorLookup" }, "task": true }, { "name": "getAuthApproleRoleRoleNameSecretIdBoundCidrs", "summary": "Comma separated list of CIDR blocks, if set, specifies blocks of IP\naddresses which can perform the", "description": "Comma separated list of CIDR blocks, if set, specifies blocks of IP\naddresses which can perform the login operation", "input": [ { "name": "roleName", "type": "string", "info": "Name of the role.: string", "required": true, "schema": { "title": "roleName", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getAuthApproleRoleRoleNameSecretIdBoundCidrs" }, "task": true }, { "name": "postAuthApproleRoleRoleNameSecretIdBoundCidrs", "summary": "Comma separated list of CIDR blocks, if set, specifies blocks of IP\naddresses which can perform the", "description": "Comma separated list of CIDR blocks, if set, specifies blocks of IP\naddresses which can perform the login operation", "input": [ { "name": "roleName", "type": "string", "info": "Name of the role.: string", "required": true, "schema": { "title": "roleName", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"secret_id_bound_cidrs\": \"array\"}", "required": false, "schema": { "type": "object", "properties": { "secret_id_bound_cidrs": { "type": "array", "description": "Comma separated string or list of CIDR blocks. If set, specifies the blocks of IP addresses which can perform the login operation.", "items": { "type": "string" } } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postAuthApproleRoleRoleNameSecretIdBoundCidrs" }, "task": true }, { "name": "deleteAuthApproleRoleRoleNameSecretIdBoundCidrs", "summary": "Comma separated list of CIDR blocks, if set, specifies blocks of IP\naddresses which can perform the", "description": "Comma separated list of CIDR blocks, if set, specifies blocks of IP\naddresses which can perform the login operation", "input": [ { "name": "roleName", "type": "string", "info": "Name of the role.: string", "required": true, "schema": { "title": "roleName", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteAuthApproleRoleRoleNameSecretIdBoundCidrs" }, "task": true }, { "name": "getAuthApproleRoleRoleNameSecretIdNumUses", "summary": "Use limit of the SecretID generated against the role.", "description": "Use limit of the SecretID generated against the role.", "input": [ { "name": "roleName", "type": "string", "info": "Name of the role.: string", "required": true, "schema": { "title": "roleName", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getAuthApproleRoleRoleNameSecretIdNumUses" }, "task": true }, { "name": "postAuthApproleRoleRoleNameSecretIdNumUses", "summary": "Use limit of the SecretID generated against the role.", "description": "Use limit of the SecretID generated against the role.", "input": [ { "name": "roleName", "type": "string", "info": "Name of the role.: string", "required": true, "schema": { "title": "roleName", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"secret_id_num_uses\": 123}", "required": false, "schema": { "type": "object", "properties": { "secret_id_num_uses": { "type": "integer", "description": "Number of times a SecretID can access the role, after which the SecretID will expire." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postAuthApproleRoleRoleNameSecretIdNumUses" }, "task": true }, { "name": "deleteAuthApproleRoleRoleNameSecretIdNumUses", "summary": "Use limit of the SecretID generated against the role.", "description": "Use limit of the SecretID generated against the role.", "input": [ { "name": "roleName", "type": "string", "info": "Name of the role.: string", "required": true, "schema": { "title": "roleName", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteAuthApproleRoleRoleNameSecretIdNumUses" }, "task": true }, { "name": "getAuthApproleRoleRoleNameSecretIdTtl", "summary": "Duration in seconds, representing the lifetime of the SecretIDs\nthat are generated against the role", "description": "Duration in seconds, representing the lifetime of the SecretIDs\nthat are generated against the role using 'role/ /secret-id' or\n'role/ /custom-secret-id' endpoints.", "input": [ { "name": "roleName", "type": "string", "info": "Name of the role.: string", "required": true, "schema": { "title": "roleName", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getAuthApproleRoleRoleNameSecretIdTtl" }, "task": true }, { "name": "postAuthApproleRoleRoleNameSecretIdTtl", "summary": "Duration in seconds, representing the lifetime of the SecretIDs\nthat are generated against the role", "description": "Duration in seconds, representing the lifetime of the SecretIDs\nthat are generated against the role using 'role/ /secret-id' or\n'role/ /custom-secret-id' endpoints.", "input": [ { "name": "roleName", "type": "string", "info": "Name of the role.: string", "required": true, "schema": { "title": "roleName", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"secret_id_ttl\": 123}", "required": false, "schema": { "type": "object", "properties": { "secret_id_ttl": { "type": "integer", "description": "Duration in seconds after which the issued SecretID should expire. Defaults to 0, meaning no expiration." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postAuthApproleRoleRoleNameSecretIdTtl" }, "task": true }, { "name": "deleteAuthApproleRoleRoleNameSecretIdTtl", "summary": "Duration in seconds, representing the lifetime of the SecretIDs\nthat are generated against the role", "description": "Duration in seconds, representing the lifetime of the SecretIDs\nthat are generated against the role using 'role/ /secret-id' or\n'role/ /custom-secret-id' endpoints.", "input": [ { "name": "roleName", "type": "string", "info": "Name of the role.: string", "required": true, "schema": { "title": "roleName", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteAuthApproleRoleRoleNameSecretIdTtl" }, "task": true }, { "name": "postAuthApproleRoleRoleNameSecretIdDestroy", "summary": "Invalidate an issued secret_id", "description": "Invalidate an issued secret_id", "input": [ { "name": "roleName", "type": "string", "info": "Name of the role.: string", "required": true, "schema": { "title": "roleName", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"secret_id\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "secret_id": { "type": "string", "description": "SecretID attached to the role." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postAuthApproleRoleRoleNameSecretIdDestroy" }, "task": true }, { "name": "deleteAuthApproleRoleRoleNameSecretIdDestroy", "summary": "Invalidate an issued secret_id", "description": "Invalidate an issued secret_id", "input": [ { "name": "roleName", "type": "string", "info": "Name of the role.: string", "required": true, "schema": { "title": "roleName", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteAuthApproleRoleRoleNameSecretIdDestroy" }, "task": true }, { "name": "postAuthApproleRoleRoleNameSecretIdLookup", "summary": "Read the properties of an issued secret_id", "description": "Read the properties of an issued secret_id", "input": [ { "name": "roleName", "type": "string", "info": "Name of the role.: string", "required": true, "schema": { "title": "roleName", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"secret_id\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "secret_id": { "type": "string", "description": "SecretID attached to the role." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postAuthApproleRoleRoleNameSecretIdLookup" }, "task": true }, { "name": "getAuthApproleRoleRoleNameTokenBoundCidrs", "summary": "Comma separated string or list of CIDR blocks. If set, specifies the blocks of\nIP addresses which c", "description": "Comma separated string or list of CIDR blocks. If set, specifies the blocks of\nIP addresses which can use the returned token.", "input": [ { "name": "roleName", "type": "string", "info": "Name of the role.: string", "required": true, "schema": { "title": "roleName", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getAuthApproleRoleRoleNameTokenBoundCidrs" }, "task": true }, { "name": "postAuthApproleRoleRoleNameTokenBoundCidrs", "summary": "Comma separated string or list of CIDR blocks. If set, specifies the blocks of\nIP addresses which c", "description": "Comma separated string or list of CIDR blocks. If set, specifies the blocks of\nIP addresses which can use the returned token.", "input": [ { "name": "roleName", "type": "string", "info": "Name of the role.: string", "required": true, "schema": { "title": "roleName", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"token_bound_cidrs\": \"array\"}", "required": false, "schema": { "type": "object", "properties": { "token_bound_cidrs": { "type": "array", "description": "Comma separated string or JSON list of CIDR blocks. If set, specifies the blocks of IP addresses which are allowed to use the generated token.", "items": { "type": "string" } } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postAuthApproleRoleRoleNameTokenBoundCidrs" }, "task": true }, { "name": "deleteAuthApproleRoleRoleNameTokenBoundCidrs", "summary": "Comma separated string or list of CIDR blocks. If set, specifies the blocks of\nIP addresses which c", "description": "Comma separated string or list of CIDR blocks. If set, specifies the blocks of\nIP addresses which can use the returned token.", "input": [ { "name": "roleName", "type": "string", "info": "Name of the role.: string", "required": true, "schema": { "title": "roleName", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteAuthApproleRoleRoleNameTokenBoundCidrs" }, "task": true }, { "name": "getAuthApproleRoleRoleNameTokenMaxTtl", "summary": "Duration in seconds, the maximum lifetime of the tokens issued by using\nthe SecretIDs that were gen", "description": "Duration in seconds, the maximum lifetime of the tokens issued by using\nthe SecretIDs that were generated against this role, after which the\ntokens are not allowed to be renewed.", "input": [ { "name": "roleName", "type": "string", "info": "Name of the role.: string", "required": true, "schema": { "title": "roleName", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getAuthApproleRoleRoleNameTokenMaxTtl" }, "task": true }, { "name": "postAuthApproleRoleRoleNameTokenMaxTtl", "summary": "Duration in seconds, the maximum lifetime of the tokens issued by using\nthe SecretIDs that were gen", "description": "Duration in seconds, the maximum lifetime of the tokens issued by using\nthe SecretIDs that were generated against this role, after which the\ntokens are not allowed to be renewed.", "input": [ { "name": "roleName", "type": "string", "info": "Name of the role.: string", "required": true, "schema": { "title": "roleName", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"token_max_ttl\": 123}", "required": false, "schema": { "type": "object", "properties": { "token_max_ttl": { "type": "integer", "description": "The maximum lifetime of the generated token" } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postAuthApproleRoleRoleNameTokenMaxTtl" }, "task": true }, { "name": "deleteAuthApproleRoleRoleNameTokenMaxTtl", "summary": "Duration in seconds, the maximum lifetime of the tokens issued by using\nthe SecretIDs that were gen", "description": "Duration in seconds, the maximum lifetime of the tokens issued by using\nthe SecretIDs that were generated against this role, after which the\ntokens are not allowed to be renewed.", "input": [ { "name": "roleName", "type": "string", "info": "Name of the role.: string", "required": true, "schema": { "title": "roleName", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteAuthApproleRoleRoleNameTokenMaxTtl" }, "task": true }, { "name": "getAuthApproleRoleRoleNameTokenNumUses", "summary": "Number of times issued tokens can be used", "description": "Number of times issued tokens can be used", "input": [ { "name": "roleName", "type": "string", "info": "Name of the role.: string", "required": true, "schema": { "title": "roleName", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getAuthApproleRoleRoleNameTokenNumUses" }, "task": true }, { "name": "postAuthApproleRoleRoleNameTokenNumUses", "summary": "Number of times issued tokens can be used", "description": "Number of times issued tokens can be used", "input": [ { "name": "roleName", "type": "string", "info": "Name of the role.: string", "required": true, "schema": { "title": "roleName", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"token_num_uses\": 123}", "required": false, "schema": { "type": "object", "properties": { "token_num_uses": { "type": "integer", "description": "The maximum number of times a token may be used, a value of zero means unlimited" } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postAuthApproleRoleRoleNameTokenNumUses" }, "task": true }, { "name": "deleteAuthApproleRoleRoleNameTokenNumUses", "summary": "Number of times issued tokens can be used", "description": "Number of times issued tokens can be used", "input": [ { "name": "roleName", "type": "string", "info": "Name of the role.: string", "required": true, "schema": { "title": "roleName", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteAuthApproleRoleRoleNameTokenNumUses" }, "task": true }, { "name": "getAuthApproleRoleRoleNameTokenTtl", "summary": "Duration in seconds, the lifetime of the token issued by using the SecretID that\nis generated again", "description": "Duration in seconds, the lifetime of the token issued by using the SecretID that\nis generated against this role, before which the token needs to be renewed.", "input": [ { "name": "roleName", "type": "string", "info": "Name of the role.: string", "required": true, "schema": { "title": "roleName", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getAuthApproleRoleRoleNameTokenTtl" }, "task": true }, { "name": "postAuthApproleRoleRoleNameTokenTtl", "summary": "Duration in seconds, the lifetime of the token issued by using the SecretID that\nis generated again", "description": "Duration in seconds, the lifetime of the token issued by using the SecretID that\nis generated against this role, before which the token needs to be renewed.", "input": [ { "name": "roleName", "type": "string", "info": "Name of the role.: string", "required": true, "schema": { "title": "roleName", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"token_ttl\": 123}", "required": false, "schema": { "type": "object", "properties": { "token_ttl": { "type": "integer", "description": "The initial ttl of the token to generate" } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postAuthApproleRoleRoleNameTokenTtl" }, "task": true }, { "name": "deleteAuthApproleRoleRoleNameTokenTtl", "summary": "Duration in seconds, the lifetime of the token issued by using the SecretID that\nis generated again", "description": "Duration in seconds, the lifetime of the token issued by using the SecretID that\nis generated against this role, before which the token needs to be renewed.", "input": [ { "name": "roleName", "type": "string", "info": "Name of the role.: string", "required": true, "schema": { "title": "roleName", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteAuthApproleRoleRoleNameTokenTtl" }, "task": true }, { "name": "postAuthApproleTidySecretId", "summary": "Trigger the clean-up of expired SecretID entries.", "description": "Trigger the clean-up of expired SecretID entries.", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/postAuthApproleTidySecretId" }, "task": true }, { "name": "getAuthLdapConfig", "summary": "Configure the LDAP server to connect to, along with its options.", "description": "Configure the LDAP server to connect to, along with its options.", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/getAuthLdapConfig" }, "task": true }, { "name": "postAuthLdapConfig", "summary": "Configure the LDAP server to connect to, along with its options.", "description": "Configure the LDAP server to connect to, along with its options.", "input": [ { "name": "body", "type": "object", "info": ": {\"anonymous_group_search\": \"boolean\", \"binddn\": \"string\", \"bindpass\": \"string\", \"case_sensitive_names\": \"boolean\", \"certificate\": \"string\", \"client_tls_cert\": \"string\", \"client_tls_key\": \"string\", \"deny_null_bind\": \"boolean\", \"discoverdn\": \"boolean\", \"groupattr\": \"string\", \"groupdn\": \"string\", \"groupfilter\": \"string\", \"insecure_tls\": \"boolean\", \"request_timeout\": 123, \"starttls\": \"boolean\", \"tls_max_version\": \"Must be one of [tls10, tls11, tls12, tls13]\", \"tls_min_version\": \"Must be one of [tls10, tls11, tls12, tls13]\", \"token_bound_cidrs\": \"array\", \"token_explicit_max_ttl\": 123, \"token_max_ttl\": 123, \"token_no_default_policy\": \"boolean\", \"token_num_uses\": 123, \"token_period\": 123, \"token_policies\": \"array\", \"token_ttl\": 123, \"token_type\": \"string\", \"upndomain\": \"string\", \"url\": \"string\", \"use_pre111_group_cn_behavior\": \"boolean\", \"use_token_groups\": \"boolean\", \"userattr\": \"string\", \"userdn\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "anonymous_group_search": { "type": "boolean", "description": "Use anonymous binds when performing LDAP group searches (if true the initial credentials will still be used for the initial connection test).", "default": false, "x-vault-displayAttrs": { "name": "Anonymous group search" } }, "binddn": { "type": "string", "description": "LDAP DN for searching for the user DN (optional)", "x-vault-displayAttrs": { "name": "Name of Object to bind (binddn)" } }, "bindpass": { "type": "string", "description": "LDAP password for searching for the user DN (optional)", "x-vault-displayAttrs": { "sensitive": true } }, "case_sensitive_names": { "type": "boolean", "description": "If true, case sensitivity will be used when comparing usernames and groups for matching policies." }, "certificate": { "type": "string", "description": "CA certificate to use when verifying LDAP server certificate, must be x509 PEM encoded (optional)", "x-vault-displayAttrs": { "name": "CA certificate", "editType": "file" } }, "client_tls_cert": { "type": "string", "description": "Client certificate to provide to the LDAP server, must be x509 PEM encoded (optional)", "x-vault-displayAttrs": { "name": "Client certificate", "editType": "file" } }, "client_tls_key": { "type": "string", "description": "Client certificate key to provide to the LDAP server, must be x509 PEM encoded (optional)", "x-vault-displayAttrs": { "name": "Client key", "editType": "file" } }, "deny_null_bind": { "type": "boolean", "description": "Denies an unauthenticated LDAP bind request if the user's password is empty; defaults to true", "default": true }, "discoverdn": { "type": "boolean", "description": "Use anonymous bind to discover the bind DN of a user (optional)", "x-vault-displayAttrs": { "name": "Discover DN" } }, "groupattr": { "type": "string", "description": "LDAP attribute to follow on objects returned by in order to enumerate user group membership. Examples: \"cn\" or \"memberOf\", etc. Default: cn", "default": "cn", "x-vault-displayAttrs": { "name": "Group Attribute", "value": "cn" } }, "groupdn": { "type": "string", "description": "LDAP search base to use for group membership search (eg: ou=Groups,dc=example,dc=org)", "x-vault-displayAttrs": { "name": "Group DN" } }, "groupfilter": { "type": "string", "description": "Go template for querying group membership of user (optional) The template can access the following context variables: UserDN, Username Example: (&(objectClass=group)(member:1.2.840.113556.1.4.1941:={{.UserDN}})) Default: (|(memberUid={{.Username}})(member={{.UserDN}})(uniqueMember={{.UserDN}}))", "default": "(|(memberUid={{.Username}})(member={{.UserDN}})(uniqueMember={{.UserDN}}))", "x-vault-displayAttrs": { "name": "Group Filter" } }, "insecure_tls": { "type": "boolean", "description": "Skip LDAP server SSL Certificate verification - VERY insecure (optional)", "x-vault-displayAttrs": { "name": "Insecure TLS" } }, "request_timeout": { "type": "integer", "description": "Timeout, in seconds, for the connection when making requests against the server before returning back an error.", "default": "90s" }, "starttls": { "type": "boolean", "description": "Issue a StartTLS command after establishing unencrypted connection (optional)", "x-vault-displayAttrs": { "name": "Issue StartTLS" } }, "tls_max_version": { "type": "string", "description": "Maximum TLS version to use. Accepted values are 'tls10', 'tls11', 'tls12' or 'tls13'. Defaults to 'tls12'", "enum": [ "tls10", "tls11", "tls12", "tls13" ], "default": "tls12", "x-vault-displayAttrs": { "name": "Maximum TLS Version" } }, "tls_min_version": { "type": "string", "description": "Minimum TLS version to use. Accepted values are 'tls10', 'tls11', 'tls12' or 'tls13'. Defaults to 'tls12'", "enum": [ "tls10", "tls11", "tls12", "tls13" ], "default": "tls12", "x-vault-displayAttrs": { "name": "Minimum TLS Version" } }, "token_bound_cidrs": { "type": "array", "description": "Comma separated string or JSON list of CIDR blocks. If set, specifies the blocks of IP addresses which are allowed to use the generated token.", "items": { "type": "string" }, "x-vault-displayAttrs": { "name": "Generated Token's Bound CIDRs", "group": "Tokens" } }, "token_explicit_max_ttl": { "type": "integer", "description": "If set, tokens created via this role carry an explicit maximum TTL. During renewal, the current maximum TTL values of the role and the mount are not checked for changes, and any updates to these values will have no effect on the token being renewed.", "x-vault-displayAttrs": { "name": "Generated Token's Explicit Maximum TTL", "group": "Tokens" } }, "token_max_ttl": { "type": "integer", "description": "The maximum lifetime of the generated token", "x-vault-displayAttrs": { "name": "Generated Token's Maximum TTL", "group": "Tokens" } }, "token_no_default_policy": { "type": "boolean", "description": "If true, the 'default' policy will not automatically be added to generated tokens", "x-vault-displayAttrs": { "name": "Do Not Attach 'default' Policy To Generated Tokens", "group": "Tokens" } }, "token_num_uses": { "type": "integer", "description": "The maximum number of times a token may be used, a value of zero means unlimited", "x-vault-displayAttrs": { "name": "Maximum Uses of Generated Tokens", "group": "Tokens" } }, "token_period": { "type": "integer", "description": "If set, tokens created via this role will have no max lifetime; instead, their renewal period will be fixed to this value. This takes an integer number of seconds, or a string duration (e.g. \"24h\").", "x-vault-displayAttrs": { "name": "Generated Token's Period", "group": "Tokens" } }, "token_policies": { "type": "array", "description": "Comma-separated list of policies. This will apply to all tokens generated by this auth method, in addition to any configured for specific users/groups.", "items": { "type": "string" }, "x-vault-displayAttrs": { "name": "Generated Token's Policies", "group": "Tokens" } }, "token_ttl": { "type": "integer", "description": "The initial ttl of the token to generate", "x-vault-displayAttrs": { "name": "Generated Token's Initial TTL", "group": "Tokens" } }, "token_type": { "type": "string", "description": "The type of token to generate, service or batch", "default": "default-service", "x-vault-displayAttrs": { "name": "Generated Token's Type", "group": "Tokens" } }, "upndomain": { "type": "string", "description": "Enables userPrincipalDomain login with [username]@UPNDomain (optional)", "x-vault-displayAttrs": { "name": "User Principal (UPN) Domain" } }, "url": { "type": "string", "description": "LDAP URL to connect to (default: ldap://127.0.0.1). Multiple URLs can be specified by concatenating them with commas; they will be tried in-order.", "default": "ldap://127.0.0.1", "x-vault-displayAttrs": { "name": "URL" } }, "use_pre111_group_cn_behavior": { "type": "boolean", "description": "In Vault 1.1.1 a fix for handling group CN values of different cases unfortunately introduced a regression that could cause previously defined groups to not be found due to a change in the resulting name. If set true, the pre-1.1.1 behavior for matching group CNs will be used. This is only needed in some upgrade scenarios for backwards compatibility. It is enabled by default if the config is upgraded but disabled by default on new configurations." }, "use_token_groups": { "type": "boolean", "description": "If true, use the Active Directory tokenGroups constructed attribute of the user to find the group memberships. This will find all security groups including nested ones.", "default": false }, "userattr": { "type": "string", "description": "Attribute used for users (default: cn)", "default": "cn", "x-vault-displayAttrs": { "name": "User Attribute", "value": "cn" } }, "userdn": { "type": "string", "description": "LDAP domain to use for users (eg: ou=People,dc=example,dc=org)", "x-vault-displayAttrs": { "name": "User DN" } } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postAuthLdapConfig" }, "task": true }, { "name": "postAuthLdapDuoAccess", "summary": "Configure the access keys and host for Duo API connections.", "description": "Configure the access keys and host for Duo API connections.", "input": [ { "name": "body", "type": "object", "info": ": {\"host\": \"string\", \"ikey\": \"string\", \"skey\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "host": { "type": "string", "description": "Duo api host" }, "ikey": { "type": "string", "description": "Duo integration key" }, "skey": { "type": "string", "description": "Duo secret key" } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postAuthLdapDuoAccess" }, "task": true }, { "name": "getAuthLdapDuoConfig", "summary": "Configure Duo second factor behavior.", "description": "Configure Duo second factor behavior.", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/getAuthLdapDuoConfig" }, "task": true }, { "name": "postAuthLdapDuoConfig", "summary": "Configure Duo second factor behavior.", "description": "Configure Duo second factor behavior.", "input": [ { "name": "body", "type": "object", "info": ": {\"push_info\": \"string\", \"user_agent\": \"string\", \"username_format\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "push_info": { "type": "string", "description": "A string of URL-encoded key/value pairs that provides additional context about the authentication attempt in the Duo Mobile app" }, "user_agent": { "type": "string", "description": "User agent to connect to Duo (default \"\")" }, "username_format": { "type": "string", "description": "Format string given auth method username as argument to create Duo username (default '%s')" } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postAuthLdapDuoConfig" }, "task": true }, { "name": "getAuthLdapGroups", "summary": "Manage additional groups for users allowed to authenticate.", "description": "Manage additional groups for users allowed to authenticate.", "input": [ { "name": "list", "type": "string", "info": "Return a list if `true`: string", "required": false, "schema": { "title": "list", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getAuthLdapGroups" }, "task": true }, { "name": "getAuthLdapGroupsName", "summary": "Manage additional groups for users allowed to authenticate.", "description": "Manage additional groups for users allowed to authenticate.", "input": [ { "name": "name", "type": "string", "info": "Name of the LDAP group.: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getAuthLdapGroupsName" }, "task": true }, { "name": "postAuthLdapGroupsName", "summary": "Manage additional groups for users allowed to authenticate.", "description": "Manage additional groups for users allowed to authenticate.", "input": [ { "name": "name", "type": "string", "info": "Name of the LDAP group.: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"policies\": \"array\"}", "required": false, "schema": { "type": "object", "properties": { "policies": { "type": "array", "description": "Comma-separated list of policies associated to the group.", "items": { "type": "string" } } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postAuthLdapGroupsName" }, "task": true }, { "name": "deleteAuthLdapGroupsName", "summary": "Manage additional groups for users allowed to authenticate.", "description": "Manage additional groups for users allowed to authenticate.", "input": [ { "name": "name", "type": "string", "info": "Name of the LDAP group.: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteAuthLdapGroupsName" }, "task": true }, { "name": "postAuthLdapLoginUsername", "summary": "Log in with a username and password.", "description": "Log in with a username and password.", "input": [ { "name": "username", "type": "string", "info": "DN (distinguished name) to be used for login.: string", "required": true, "schema": { "title": "username", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"method\": \"string\", \"passcode\": \"string\", \"password\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "method": { "type": "string", "description": "Multi-factor auth method to use (optional)" }, "passcode": { "type": "string", "description": "One time passcode (optional)" }, "password": { "type": "string", "description": "Password for this user." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postAuthLdapLoginUsername" }, "task": true }, { "name": "getAuthLdapMfaConfig", "summary": "Configure multi factor backend.", "description": "Configure multi factor backend.", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/getAuthLdapMfaConfig" }, "task": true }, { "name": "postAuthLdapMfaConfig", "summary": "Configure multi factor backend.", "description": "Configure multi factor backend.", "input": [ { "name": "body", "type": "object", "info": ": {\"type\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "type": { "type": "string", "description": "Enables MFA with given backend (available: duo)" } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postAuthLdapMfaConfig" }, "task": true }, { "name": "getAuthLdapUsers", "summary": "Manage users allowed to authenticate.", "description": "Manage users allowed to authenticate.", "input": [ { "name": "list", "type": "string", "info": "Return a list if `true`: string", "required": false, "schema": { "title": "list", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getAuthLdapUsers" }, "task": true }, { "name": "getAuthLdapUsersName", "summary": "Manage users allowed to authenticate.", "description": "Manage users allowed to authenticate.", "input": [ { "name": "name", "type": "string", "info": "Name of the LDAP user.: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getAuthLdapUsersName" }, "task": true }, { "name": "postAuthLdapUsersName", "summary": "Manage users allowed to authenticate.", "description": "Manage users allowed to authenticate.", "input": [ { "name": "name", "type": "string", "info": "Name of the LDAP user.: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"groups\": \"array\", \"policies\": \"array\"}", "required": false, "schema": { "type": "object", "properties": { "groups": { "type": "array", "description": "Comma-separated list of additional groups associated with the user.", "items": { "type": "string" } }, "policies": { "type": "array", "description": "Comma-separated list of policies associated with the user.", "items": { "type": "string" } } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postAuthLdapUsersName" }, "task": true }, { "name": "deleteAuthLdapUsersName", "summary": "Manage users allowed to authenticate.", "description": "Manage users allowed to authenticate.", "input": [ { "name": "name", "type": "string", "info": "Name of the LDAP user.: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteAuthLdapUsersName" }, "task": true }, { "name": "getAuthRancherConfig", "summary": "Configures the JWT Public Key and Kubernetes API information.", "description": "Configures the JWT Public Key and Kubernetes API information.", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/getAuthRancherConfig" }, "task": true }, { "name": "postAuthRancherConfig", "summary": "Configures the JWT Public Key and Kubernetes API information.", "description": "Configures the JWT Public Key and Kubernetes API information.", "input": [ { "name": "body", "type": "object", "info": ": {\"disable_iss_validation\": \"boolean\", \"issuer\": \"string\", \"kubernetes_ca_cert\": \"string\", \"kubernetes_host\": \"string\", \"pem_keys\": \"array\", \"token_reviewer_jwt\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "disable_iss_validation": { "type": "boolean", "description": "Disable JWT issuer validation. Allows to skip ISS validation.", "default": false, "x-vault-displayAttrs": { "name": "Disable JWT Issuer Validation" } }, "issuer": { "type": "string", "description": "Optional JWT issuer. If no issuer is specified, then this plugin will use kubernetes.io/serviceaccount as the default issuer.", "x-vault-displayAttrs": { "name": "JWT Issuer" } }, "kubernetes_ca_cert": { "type": "string", "description": "PEM encoded CA cert for use by the TLS client used to talk with the API.", "x-vault-displayAttrs": { "name": "Kubernetes CA Certificate" } }, "kubernetes_host": { "type": "string", "description": "Host must be a host string, a host:port pair, or a URL to the base of the Kubernetes API server." }, "pem_keys": { "type": "array", "description": "Optional list of PEM-formated public keys or certificates used to verify the signatures of kubernetes service account JWTs. If a certificate is given, its public key will be extracted. Not every installation of Kuberentes exposes these keys.", "items": { "type": "string" }, "x-vault-displayAttrs": { "name": "Service account verification keys" } }, "token_reviewer_jwt": { "type": "string", "description": "A service account JWT used to access the TokenReview API to validate other JWTs during login. If not set the JWT used for login will be used to access the API.", "x-vault-displayAttrs": { "name": "Token Reviewer JWT" } } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postAuthRancherConfig" }, "task": true }, { "name": "postAuthRancherLogin", "summary": "Authenticates Kubernetes service accounts with Vault.", "description": "Authenticates Kubernetes service accounts with Vault.", "input": [ { "name": "body", "type": "object", "info": ": {\"jwt\": \"string\", \"role\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "jwt": { "type": "string", "description": "A signed JWT for authenticating a service account. This field is required." }, "role": { "type": "string", "description": "Name of the role against which the login is being attempted. This field is required" } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postAuthRancherLogin" }, "task": true }, { "name": "getAuthRancherRole", "summary": "Lists all the roles registered with the backend.", "description": "Lists all the roles registered with the backend.", "input": [ { "name": "list", "type": "string", "info": "Return a list if `true`: string", "required": false, "schema": { "title": "list", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getAuthRancherRole" }, "task": true }, { "name": "getAuthRancherRoleName", "summary": "Register an role with the backend.", "description": "Register an role with the backend.", "input": [ { "name": "name", "type": "string", "info": "Name of the role.: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getAuthRancherRoleName" }, "task": true }, { "name": "postAuthRancherRoleName", "summary": "Register an role with the backend.", "description": "Register an role with the backend.", "input": [ { "name": "name", "type": "string", "info": "Name of the role.: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"audience\": \"string\", \"bound_cidrs\": \"array\", \"bound_service_account_names\": \"array\", \"bound_service_account_namespaces\": \"array\", \"max_ttl\": 123, \"num_uses\": 123, \"period\": 123, \"policies\": \"array\", \"token_bound_cidrs\": \"array\", \"token_explicit_max_ttl\": 123, \"token_max_ttl\": 123, \"token_no_default_policy\": \"boolean\", \"token_num_uses\": 123, \"token_period\": 123, \"token_policies\": \"array\", \"token_ttl\": 123, \"token_type\": \"string\", \"ttl\": 123}", "required": false, "schema": { "type": "object", "properties": { "audience": { "type": "string", "description": "Optional Audience claim to verify in the jwt." }, "bound_cidrs": { "type": "array", "description": "Use \"token_bound_cidrs\" instead. If this and \"token_bound_cidrs\" are both specified, only \"token_bound_cidrs\" will be used.", "items": { "type": "string" }, "deprecated": true }, "bound_service_account_names": { "type": "array", "description": "List of service account names able to access this role. If set to \"*\" all names are allowed.", "items": { "type": "string" } }, "bound_service_account_namespaces": { "type": "array", "description": "List of namespaces allowed to access this role. If set to \"*\" all namespaces are allowed.", "items": { "type": "string" } }, "max_ttl": { "type": "integer", "description": "Use \"token_max_ttl\" instead. If this and \"token_max_ttl\" are both specified, only \"token_max_ttl\" will be used.", "deprecated": true }, "num_uses": { "type": "integer", "description": "Use \"token_num_uses\" instead. If this and \"token_num_uses\" are both specified, only \"token_num_uses\" will be used.", "deprecated": true }, "period": { "type": "integer", "description": "Use \"token_period\" instead. If this and \"token_period\" are both specified, only \"token_period\" will be used.", "deprecated": true }, "policies": { "type": "array", "description": "Use \"token_policies\" instead. If this and \"token_policies\" are both specified, only \"token_policies\" will be used.", "items": { "type": "string" }, "deprecated": true }, "token_bound_cidrs": { "type": "array", "description": "Comma separated string or JSON list of CIDR blocks. If set, specifies the blocks of IP addresses which are allowed to use the generated token.", "items": { "type": "string" }, "x-vault-displayAttrs": { "name": "Generated Token's Bound CIDRs", "group": "Tokens" } }, "token_explicit_max_ttl": { "type": "integer", "description": "If set, tokens created via this role carry an explicit maximum TTL. During renewal, the current maximum TTL values of the role and the mount are not checked for changes, and any updates to these values will have no effect on the token being renewed.", "x-vault-displayAttrs": { "name": "Generated Token's Explicit Maximum TTL", "group": "Tokens" } }, "token_max_ttl": { "type": "integer", "description": "The maximum lifetime of the generated token", "x-vault-displayAttrs": { "name": "Generated Token's Maximum TTL", "group": "Tokens" } }, "token_no_default_policy": { "type": "boolean", "description": "If true, the 'default' policy will not automatically be added to generated tokens", "x-vault-displayAttrs": { "name": "Do Not Attach 'default' Policy To Generated Tokens", "group": "Tokens" } }, "token_num_uses": { "type": "integer", "description": "The maximum number of times a token may be used, a value of zero means unlimited", "x-vault-displayAttrs": { "name": "Maximum Uses of Generated Tokens", "group": "Tokens" } }, "token_period": { "type": "integer", "description": "If set, tokens created via this role will have no max lifetime; instead, their renewal period will be fixed to this value. This takes an integer number of seconds, or a string duration (e.g. \"24h\").", "x-vault-displayAttrs": { "name": "Generated Token's Period", "group": "Tokens" } }, "token_policies": { "type": "array", "description": "Comma-separated list of policies", "items": { "type": "string" }, "x-vault-displayAttrs": { "name": "Generated Token's Policies", "group": "Tokens" } }, "token_ttl": { "type": "integer", "description": "The initial ttl of the token to generate", "x-vault-displayAttrs": { "name": "Generated Token's Initial TTL", "group": "Tokens" } }, "token_type": { "type": "string", "description": "The type of token to generate, service or batch", "default": "default-service", "x-vault-displayAttrs": { "name": "Generated Token's Type", "group": "Tokens" } }, "ttl": { "type": "integer", "description": "Use \"token_ttl\" instead. If this and \"token_ttl\" are both specified, only \"token_ttl\" will be used.", "deprecated": true } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postAuthRancherRoleName" }, "task": true }, { "name": "deleteAuthRancherRoleName", "summary": "Register an role with the backend.", "description": "Register an role with the backend.", "input": [ { "name": "name", "type": "string", "info": "Name of the role.: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteAuthRancherRoleName" }, "task": true }, { "name": "getAuthTokenAccessors", "summary": "List token accessors, which can then be\nbe used to iterate and discover their properties\nor revoke", "description": "List token accessors, which can then be\nbe used to iterate and discover their properties\nor revoke them. Because this can be used to\ncause a denial of service, this endpoint\nrequires 'sudo' capability in addition to\n'list'.", "input": [ { "name": "list", "type": "string", "info": "Return a list if `true`: string", "required": false, "schema": { "title": "list", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getAuthTokenAccessors" }, "task": true }, { "name": "postAuthTokenCreate", "summary": "The token create path is used to create new tokens.", "description": "The token create path is used to create new tokens.", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/postAuthTokenCreate" }, "task": true }, { "name": "postAuthTokenCreateWithNamespaceHeader", "summary": "The token create path is used to create new token with specified X-Vault-Namespace header.", "description": "The token create path is used to create new token with specified X-Vault-Namespace header.", "input": [ { "name": "namespace", "type": "string", "info": "X-Vault-Namespace header", "required": false, "schema": { "title": "namespace", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/postAuthTokenCreate" }, "task": true }, { "name": "postAuthTokenCreateOrphan", "summary": "The token create path is used to create new orphan tokens.", "description": "The token create path is used to create new orphan tokens.", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/postAuthTokenCreateOrphan" }, "task": true }, { "name": "postAuthTokenCreateRoleName", "summary": "This token create path is used to create new tokens adhering to the given role.", "description": "This token create path is used to create new tokens adhering to the given role.", "input": [ { "name": "roleName", "type": "string", "info": "Name of the role: string", "required": true, "schema": { "title": "roleName", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postAuthTokenCreateRoleName" }, "task": true }, { "name": "getAuthTokenLookup", "summary": "This endpoint will lookup a token and its properties.", "description": "This endpoint will lookup a token and its properties.", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/getAuthTokenLookup" }, "task": true }, { "name": "postAuthTokenLookup", "summary": "This endpoint will lookup a token and its properties.", "description": "This endpoint will lookup a token and its properties.", "input": [ { "name": "body", "type": "object", "info": ": {\"token\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "token": { "type": "string", "description": "Token to lookup (POST request body)" } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postAuthTokenLookup" }, "task": true }, { "name": "postAuthTokenLookupAccessor", "summary": "This endpoint will lookup a token associated with the given accessor and its properties. Response w", "description": "This endpoint will lookup a token associated with the given accessor and its properties. Response will not contain the token ID.", "input": [ { "name": "body", "type": "object", "info": ": {\"accessor\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "accessor": { "type": "string", "description": "Accessor of the token to look up (request body)" } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postAuthTokenLookupAccessor" }, "task": true }, { "name": "getAuthTokenLookupSelf", "summary": "This endpoint will lookup a token and its properties.", "description": "This endpoint will lookup a token and its properties.", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/getAuthTokenLookupSelf" }, "task": true }, { "name": "postAuthTokenLookupSelf", "summary": "This endpoint will lookup a token and its properties.", "description": "This endpoint will lookup a token and its properties.", "input": [ { "name": "body", "type": "object", "info": ": {\"token\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "token": { "type": "string", "description": "Token to look up (unused, does not need to be set)" } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postAuthTokenLookupSelf" }, "task": true }, { "name": "postAuthTokenRenew", "summary": "This endpoint will renew the given token and prevent expiration.", "description": "This endpoint will renew the given token and prevent expiration.", "input": [ { "name": "body", "type": "object", "info": ": {\"increment\": 123, \"token\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "increment": { "type": "integer", "description": "The desired increment in seconds to the token expiration", "default": 0 }, "token": { "type": "string", "description": "Token to renew (request body)" } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postAuthTokenRenew" }, "task": true }, { "name": "postAuthTokenRenewAccessor", "summary": "This endpoint will renew a token associated with the given accessor and its properties. Response wi", "description": "This endpoint will renew a token associated with the given accessor and its properties. Response will not contain the token ID.", "input": [ { "name": "body", "type": "object", "info": ": {\"accessor\": \"string\", \"increment\": 123}", "required": false, "schema": { "type": "object", "properties": { "accessor": { "type": "string", "description": "Accessor of the token to renew (request body)" }, "increment": { "type": "integer", "description": "The desired increment in seconds to the token expiration", "default": 0 } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postAuthTokenRenewAccessor" }, "task": true }, { "name": "postAuthTokenRenewSelf", "summary": "This endpoint will renew the token used to call it and prevent expiration.", "description": "This endpoint will renew the token used to call it and prevent expiration.", "input": [ { "name": "body", "type": "object", "info": ": {\"increment\": 123, \"token\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "increment": { "type": "integer", "description": "The desired increment in seconds to the token expiration", "default": 0 }, "token": { "type": "string", "description": "Token to renew (unused, does not need to be set)" } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postAuthTokenRenewSelf" }, "task": true }, { "name": "postAuthTokenRevoke", "summary": "This endpoint will delete the given token and all of its child tokens.", "description": "This endpoint will delete the given token and all of its child tokens.", "input": [ { "name": "body", "type": "object", "info": ": {\"token\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "token": { "type": "string", "description": "Token to revoke (request body)" } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postAuthTokenRevoke" }, "task": true }, { "name": "postAuthTokenRevokeAccessor", "summary": "This endpoint will delete the token associated with the accessor and all of its child tokens.", "description": "This endpoint will delete the token associated with the accessor and all of its child tokens.", "input": [ { "name": "body", "type": "object", "info": ": {\"accessor\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "accessor": { "type": "string", "description": "Accessor of the token (request body)" } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postAuthTokenRevokeAccessor" }, "task": true }, { "name": "postAuthTokenRevokeOrphan", "summary": "This endpoint will delete the token and orphan its child tokens.", "description": "This endpoint will delete the token and orphan its child tokens.", "input": [ { "name": "body", "type": "object", "info": ": {\"token\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "token": { "type": "string", "description": "Token to revoke (request body)" } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postAuthTokenRevokeOrphan" }, "task": true }, { "name": "postAuthTokenRevokeSelf", "summary": "This endpoint will delete the token used to call it and all of its child tokens.", "description": "This endpoint will delete the token used to call it and all of its child tokens.", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/postAuthTokenRevokeSelf" }, "task": true }, { "name": "getAuthTokenRoles", "summary": "This endpoint lists configured roles.", "description": "This endpoint lists configured roles.", "input": [ { "name": "list", "type": "string", "info": "Return a list if `true`: string", "required": false, "schema": { "title": "list", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getAuthTokenRoles" }, "task": true }, { "name": "getAuthTokenRolesRoleName", "summary": "getAuthTokenRolesRole_name", "description": "getAuthTokenRolesRole_name", "input": [ { "name": "roleName", "type": "string", "info": "Name of the role: string", "required": true, "schema": { "title": "roleName", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getAuthTokenRolesRoleName" }, "task": true }, { "name": "postAuthTokenRolesRoleName", "summary": "postAuthTokenRolesRole_name", "description": "postAuthTokenRolesRole_name", "input": [ { "name": "roleName", "type": "string", "info": "Name of the role: string", "required": true, "schema": { "title": "roleName", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"allowed_entity_aliases\": \"array\", \"allowed_policies\": \"array\", \"bound_cidrs\": \"array\", \"disallowed_policies\": \"array\", \"explicit_max_ttl\": 123, \"orphan\": \"boolean\", \"path_suffix\": \"string\", \"period\": 123, \"renewable\": \"boolean\", \"token_bound_cidrs\": \"array\", \"token_explicit_max_ttl\": 123, \"token_no_default_policy\": \"boolean\", \"token_num_uses\": 123, \"token_period\": 123, \"token_type\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "allowed_entity_aliases": { "type": "array", "description": "String or JSON list of allowed entity aliases. If set, specifies the entity aliases which are allowed to be used during token generation. This field supports globbing.", "items": { "type": "string" } }, "allowed_policies": { "type": "array", "description": "If set, tokens can be created with any subset of the policies in this list, rather than the normal semantics of tokens being a subset of the calling token's policies. The parameter is a comma-delimited string of policy names.", "items": { "type": "string" } }, "bound_cidrs": { "type": "array", "description": "Use 'token_bound_cidrs' instead.", "items": { "type": "string" }, "deprecated": true }, "disallowed_policies": { "type": "array", "description": "If set, successful token creation via this role will require that no policies in the given list are requested. The parameter is a comma-delimited string of policy names.", "items": { "type": "string" } }, "explicit_max_ttl": { "type": "integer", "description": "Use 'token_explicit_max_ttl' instead.", "deprecated": true }, "orphan": { "type": "boolean", "description": "If true, tokens created via this role will be orphan tokens (have no parent)" }, "path_suffix": { "type": "string", "description": "If set, tokens created via this role will contain the given suffix as a part of their path. This can be used to assist use of the 'revoke-prefix' endpoint later on. The given suffix must match the regular expression.\\w[\\w-.]+\\w" }, "period": { "type": "integer", "description": "Use 'token_period' instead.", "deprecated": true }, "renewable": { "type": "boolean", "description": "Tokens created via this role will be renewable or not according to this value. Defaults to \"true\".", "default": true }, "token_bound_cidrs": { "type": "array", "description": "Comma separated string or JSON list of CIDR blocks. If set, specifies the blocks of IP addresses which are allowed to use the generated token.", "items": { "type": "string" }, "x-vault-displayAttrs": { "name": "Generated Token's Bound CIDRs", "group": "Tokens" } }, "token_explicit_max_ttl": { "type": "integer", "description": "If set, tokens created via this role carry an explicit maximum TTL. During renewal, the current maximum TTL values of the role and the mount are not checked for changes, and any updates to these values will have no effect on the token being renewed.", "x-vault-displayAttrs": { "name": "Generated Token's Explicit Maximum TTL", "group": "Tokens" } }, "token_no_default_policy": { "type": "boolean", "description": "If true, the 'default' policy will not automatically be added to generated tokens", "x-vault-displayAttrs": { "name": "Do Not Attach 'default' Policy To Generated Tokens", "group": "Tokens" } }, "token_num_uses": { "type": "integer", "description": "The maximum number of times a token may be used, a value of zero means unlimited", "x-vault-displayAttrs": { "name": "Maximum Uses of Generated Tokens", "group": "Tokens" } }, "token_period": { "type": "integer", "description": "If set, tokens created via this role will have no max lifetime; instead, their renewal period will be fixed to this value. This takes an integer number of seconds, or a string duration (e.g. \"24h\").", "x-vault-displayAttrs": { "name": "Generated Token's Period", "group": "Tokens" } }, "token_type": { "type": "string", "description": "The type of token to generate, service or batch", "default": "default-service", "x-vault-displayAttrs": { "name": "Generated Token's Type", "group": "Tokens" } } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postAuthTokenRolesRoleName" }, "task": true }, { "name": "deleteAuthTokenRolesRoleName", "summary": "deleteAuthTokenRolesRole_name", "description": "deleteAuthTokenRolesRole_name", "input": [ { "name": "roleName", "type": "string", "info": "Name of the role: string", "required": true, "schema": { "title": "roleName", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteAuthTokenRolesRoleName" }, "task": true }, { "name": "postAuthTokenTidy", "summary": "This endpoint performs cleanup tasks that can be run if certain error\nconditions have occurred.", "description": "This endpoint performs cleanup tasks that can be run if certain error\nconditions have occurred.", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/postAuthTokenTidy" }, "task": true }, { "name": "postIdentityAlias", "summary": "Create a new alias.", "description": "Create a new alias.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "body", "type": "object", "info": ": {\"canonical_id\": \"string\", \"entity_id\": \"string\", \"id\": \"string\", \"mount_accessor\": \"string\", \"name\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "canonical_id": { "type": "string", "description": "Entity ID to which this alias belongs to" }, "entity_id": { "type": "string", "description": "Entity ID to which this alias belongs to. This field is deprecated in favor of 'canonical_id'." }, "id": { "type": "string", "description": "ID of the alias" }, "mount_accessor": { "type": "string", "description": "Mount accessor to which this alias belongs to" }, "name": { "type": "string", "description": "Name of the alias" } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postIdentityAlias" }, "task": true }, { "name": "getIdentityAliases", "summary": "List all the alias IDs.", "description": "List all the alias IDs.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "list", "type": "string", "info": "Return a list if `true`: string", "required": false, "schema": { "title": "list", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getIdentityAliases" }, "task": true }, { "name": "getIdentityAliasById", "summary": "Get Identity alias By ID.", "description": "Get Identity alias By ID.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "id", "type": "string", "info": "ID of the alias: string", "required": true, "schema": { "title": "id", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getIdentityAliasById" }, "task": true }, { "name": "updateIdentityAliasById", "summary": "Update Identity alias By ID", "description": "Update Identity alias By ID", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "id", "type": "string", "info": "ID of the alias: string", "required": true, "schema": { "title": "id", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"canonical_id\": \"string\", \"entity_id\": \"string\", \"mount_accessor\": \"string\", \"name\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "canonical_id": { "type": "string", "description": "Entity ID to which this alias should be tied to" }, "entity_id": { "type": "string", "description": "Entity ID to which this alias should be tied to. This field is deprecated in favor of 'canonical_id'." }, "mount_accessor": { "type": "string", "description": "Mount accessor to which this alias belongs to" }, "name": { "type": "string", "description": "Name of the alias" } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/updateIdentityAliasById" }, "task": true }, { "name": "deleteIdentityAliasById", "summary": "Delete Identity alias By ID.", "description": "Delete Identity alias By ID.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "id", "type": "string", "info": "ID of the alias: string", "required": true, "schema": { "title": "id", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteIdentityAliasById" }, "task": true }, { "name": "postIdentityEntity", "summary": "Create a new entity", "description": "Create a new entity", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "body", "type": "object", "info": ": {\"disabled\": \"boolean\", \"id\": \"string\", \"metadata\": \"object\", \"name\": \"string\", \"policies\": \"array\"}", "required": false, "schema": { "type": "object", "properties": { "disabled": { "type": "boolean", "description": "If set true, tokens tied to this identity will not be able to be used (but will not be revoked)." }, "id": { "type": "string", "description": "ID of the entity. If set, updates the corresponding existing entity." }, "metadata": { "type": "object", "description": "Metadata to be associated with the entity. In CLI, this parameter can be repeated multiple times, and it all gets merged together. For example: vault metadata=key1=value1 metadata=key2=value2" }, "name": { "type": "string", "description": "Name of the entity" }, "policies": { "type": "array", "description": "Policies to be tied to the entity.", "items": { "type": "string" } } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postIdentityEntity" }, "task": true }, { "name": "postIdentityEntityAlias", "summary": "Create a new entity alias.", "description": "Create a new entity alias.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "body", "type": "object", "info": ": {\"canonical_id\": \"string\", \"entity_id\": \"string\", \"id\": \"string\", \"mount_accessor\": \"string\", \"name\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "canonical_id": { "type": "string", "description": "Entity ID to which this alias belongs" }, "entity_id": { "type": "string", "description": "Entity ID to which this alias belongs. This field is deprecated, use canonical_id." }, "id": { "type": "string", "description": "ID of the entity alias. If set, updates the corresponding entity alias." }, "mount_accessor": { "type": "string", "description": "Mount accessor to which this alias belongs to; unused for a modify" }, "name": { "type": "string", "description": "Name of the alias; unused for a modify" } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postIdentityEntityAlias" }, "task": true }, { "name": "getIdentityEntityAliases", "summary": "List all the entity alias IDs.", "description": "List all the entity alias IDs.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "list", "type": "string", "info": "Return a list if `true`: string", "required": false, "schema": { "title": "list", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getIdentityEntityAliases" }, "task": true }, { "name": "getIdentityEntityAliasById", "summary": "Get Identity entity alias by ID.", "description": "Get Identity entity alias by ID.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "id", "type": "string", "info": "ID of the alias: string", "required": true, "schema": { "title": "id", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getIdentityEntityAliasById" }, "task": true }, { "name": "updateIdentityEntityAliasById", "summary": "Update Identity entity alias by ID.", "description": "Update Identity entity alias by ID.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "id", "type": "string", "info": "ID of the alias: string", "required": true, "schema": { "title": "id", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"canonical_id\": \"string\", \"entity_id\": \"string\", \"mount_accessor\": \"string\", \"name\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "canonical_id": { "type": "string", "description": "Entity ID to which this alias should be tied to" }, "entity_id": { "type": "string", "description": "Entity ID to which this alias belongs to. This field is deprecated, use canonical_id." }, "mount_accessor": { "type": "string", "description": "(Unused)" }, "name": { "type": "string", "description": "(Unused)" } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/updateIdentityEntityAliasById" }, "task": true }, { "name": "deleteIdentityEntityAliasById", "summary": "Delete Identity entity alias by ID.", "description": "Delete Identity entity alias by ID.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "id", "type": "string", "info": "ID of the alias: string", "required": true, "schema": { "title": "id", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteIdentityEntityAliasById" }, "task": true }, { "name": "postIdentityEntityBatchDelete", "summary": "Delete all of the entities provided", "description": "Delete all of the entities provided", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "body", "type": "object", "info": ": {\"entity_ids\": \"array\"}", "required": false, "schema": { "type": "object", "properties": { "entity_ids": { "type": "array", "description": "Entity IDs to delete", "items": { "type": "string" } } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postIdentityEntityBatchDelete" }, "task": true }, { "name": "getIdentityEntities", "summary": "List all the entity IDs", "description": "List all the entity IDs", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "list", "type": "string", "info": "Return a list if `true`: string", "required": false, "schema": { "title": "list", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getIdentityEntities" }, "task": true }, { "name": "getIdentityEntityById", "summary": "Get Identity entity using entity ID", "description": "Get Identity entity using entity ID", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "id", "type": "string", "info": "ID of the entity. If set, updates the corresponding existing entity.: string", "required": true, "schema": { "title": "id", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getIdentityEntityById" }, "task": true }, { "name": "updateIdentityEntityById", "summary": "Update Identity entity using entity ID", "description": "Update Identity entity using entity ID", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "id", "type": "string", "info": "ID of the entity. If set, updates the corresponding existing entity.: string", "required": true, "schema": { "title": "id", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"disabled\": \"boolean\", \"metadata\": \"object\", \"name\": \"string\", \"policies\": \"array\"}", "required": false, "schema": { "type": "object", "properties": { "disabled": { "type": "boolean", "description": "If set true, tokens tied to this identity will not be able to be used (but will not be revoked)." }, "metadata": { "type": "object", "description": "Metadata to be associated with the entity. In CLI, this parameter can be repeated multiple times, and it all gets merged together. For example: vault metadata=key1=value1 metadata=key2=value2" }, "name": { "type": "string", "description": "Name of the entity" }, "policies": { "type": "array", "description": "Policies to be tied to the entity.", "items": { "type": "string" } } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/updateIdentityEntityById" }, "task": true }, { "name": "deleteIdentityEntityById", "summary": "Delete Identity entity using entity ID", "description": "Delete Identity entity using entity ID", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "id", "type": "string", "info": "ID of the entity. If set, updates the corresponding existing entity.: string", "required": true, "schema": { "title": "id", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteIdentityEntityById" }, "task": true }, { "name": "postIdentityEntityMerge", "summary": "Merge two or more entities together", "description": "Merge two or more entities together", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "body", "type": "object", "info": ": {\"force\": \"boolean\", \"from_entity_ids\": \"array\", \"to_entity_id\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "force": { "type": "boolean", "description": "Setting this will follow the 'mine' strategy for merging MFA secrets. If there are secrets of the same type both in entities that are merged from and in entity into which all others are getting merged, secrets in the destination will be unaltered. If not set, this API will throw an error containing all the conflicts." }, "from_entity_ids": { "type": "array", "description": "Entity IDs which needs to get merged", "items": { "type": "string" } }, "to_entity_id": { "type": "string", "description": "Entity ID into which all the other entities need to get merged" } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postIdentityEntityMerge" }, "task": true }, { "name": "getIdentityEntityNames", "summary": "List all the entity names", "description": "List all the entity names", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "list", "type": "string", "info": "Return a list if `true`: string", "required": false, "schema": { "title": "list", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getIdentityEntityNames" }, "task": true }, { "name": "getIdentityEntityByName", "summary": "Get Identity entity using entity name", "description": "Get Identity entity using entity name", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "name", "type": "string", "info": "Name of the entity: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getIdentityEntityByName" }, "task": true }, { "name": "updateIdentityEntityByName", "summary": "Update Identity entity using entity name", "description": "Update Identity entity using entity name", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "name", "type": "string", "info": "Name of the entity: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"disabled\": \"boolean\", \"id\": \"string\", \"metadata\": \"object\", \"policies\": \"array\"}", "required": false, "schema": { "type": "object", "properties": { "disabled": { "type": "boolean", "description": "If set true, tokens tied to this identity will not be able to be used (but will not be revoked)." }, "id": { "type": "string", "description": "ID of the entity. If set, updates the corresponding existing entity." }, "metadata": { "type": "object", "description": "Metadata to be associated with the entity. In CLI, this parameter can be repeated multiple times, and it all gets merged together. For example: vault metadata=key1=value1 metadata=key2=value2" }, "policies": { "type": "array", "description": "Policies to be tied to the entity.", "items": { "type": "string" } } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/updateIdentityEntityByName" }, "task": true }, { "name": "deleteIdentityEntityByName", "summary": "Delete Identity entity using entity name", "description": "Delete Identity entity using entity name", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "name", "type": "string", "info": "Name of the entity: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteIdentityEntityByName" }, "task": true }, { "name": "postIdentityGroup", "summary": "Create a new group.", "description": "Create a new group.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "body", "type": "object", "info": ": {\"id\": \"string\", \"member_entity_ids\": \"array\", \"member_group_ids\": \"array\", \"metadata\": \"object\", \"name\": \"string\", \"policies\": \"array\", \"type\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "id": { "type": "string", "description": "ID of the group. If set, updates the corresponding existing group." }, "member_entity_ids": { "type": "array", "description": "Entity IDs to be assigned as group members.", "items": { "type": "string" } }, "member_group_ids": { "type": "array", "description": "Group IDs to be assigned as group members.", "items": { "type": "string" } }, "metadata": { "type": "object", "description": "Metadata to be associated with the group. In CLI, this parameter can be repeated multiple times, and it all gets merged together. For example: vault metadata=key1=value1 metadata=key2=value2" }, "name": { "type": "string", "description": "Name of the group." }, "policies": { "type": "array", "description": "Policies to be tied to the group.", "items": { "type": "string" } }, "type": { "type": "string", "description": "Type of the group, 'internal' or 'external'. Defaults to 'internal'" } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postIdentityGroup" }, "task": true }, { "name": "postIdentityGroupAlias", "summary": "Creates a new group alias, or updates an existing one.", "description": "Creates a new group alias, or updates an existing one.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "body", "type": "object", "info": ": {\"canonical_id\": \"string\", \"id\": \"string\", \"mount_accessor\": \"string\", \"name\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "canonical_id": { "type": "string", "description": "ID of the group to which this is an alias." }, "id": { "type": "string", "description": "ID of the group alias." }, "mount_accessor": { "type": "string", "description": "Mount accessor to which this alias belongs to." }, "name": { "type": "string", "description": "Alias of the group." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postIdentityGroupAlias" }, "task": true }, { "name": "getIdentityGroupAliasId", "summary": "List all the group alias IDs.", "description": "List all the group alias IDs.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "list", "type": "string", "info": "Return a list if `true`: string", "required": false, "schema": { "title": "list", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getIdentityGroupAliasId" }, "task": true }, { "name": "getIdentityGroupAliasById", "summary": "Get Identity Group Alias By Id", "description": "Get Identity Group Alias By Id", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "id", "type": "string", "info": "ID of the group alias.: string", "required": true, "schema": { "title": "id", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getIdentityGroupAliasById" }, "task": true }, { "name": "updateIdentityGroupAliasById", "summary": "Update Identity Group Alias By Id", "description": "Update Identity Group Alias By Id", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "id", "type": "string", "info": "ID of the group alias.: string", "required": true, "schema": { "title": "id", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"canonical_id\": \"string\", \"mount_accessor\": \"string\", \"name\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "canonical_id": { "type": "string", "description": "ID of the group to which this is an alias." }, "mount_accessor": { "type": "string", "description": "Mount accessor to which this alias belongs to." }, "name": { "type": "string", "description": "Alias of the group." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/updateIdentityGroupAliasById" }, "task": true }, { "name": "deleteIdentityGroupAliasById", "summary": "Delete Identity Group Alias By Id", "description": "Delete Identity Group Alias By Id", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "id", "type": "string", "info": "ID of the group alias.: string", "required": true, "schema": { "title": "id", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteIdentityGroupAliasById" }, "task": true }, { "name": "getIdentityGroups", "summary": "List all the group IDs.", "description": "List all the group IDs.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "list", "type": "string", "info": "Return a list if `true`: string", "required": false, "schema": { "title": "list", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getIdentityGroups" }, "task": true }, { "name": "getIdentityGroupById", "summary": "Get existing group using its ID.", "description": "Get existing group using its ID.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "id", "type": "string", "info": "ID of the group. If set, updates the corresponding existing group.: string", "required": true, "schema": { "title": "id", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getIdentityGroupById" }, "task": true }, { "name": "updateIdentityGroupById", "summary": "Update an existing group using its ID.", "description": "Update an existing group using its ID.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "id", "type": "string", "info": "ID of the group. If set, updates the corresponding existing group.: string", "required": true, "schema": { "title": "id", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"member_entity_ids\": \"array\", \"member_group_ids\": \"array\", \"metadata\": \"object\", \"name\": \"string\", \"policies\": \"array\", \"type\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "member_entity_ids": { "type": "array", "description": "Entity IDs to be assigned as group members.", "items": { "type": "string" } }, "member_group_ids": { "type": "array", "description": "Group IDs to be assigned as group members.", "items": { "type": "string" } }, "metadata": { "type": "object", "description": "Metadata to be associated with the group. In CLI, this parameter can be repeated multiple times, and it all gets merged together. For example: vault metadata=key1=value1 metadata=key2=value2" }, "name": { "type": "string", "description": "Name of the group." }, "policies": { "type": "array", "description": "Policies to be tied to the group.", "items": { "type": "string" } }, "type": { "type": "string", "description": "Type of the group, 'internal' or 'external'. Defaults to 'internal'" } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/updateIdentityGroupById" }, "task": true }, { "name": "deleteIdentityGroupById", "summary": "Delete an existing group using its ID.", "description": "Delete an existing group using its ID.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "id", "type": "string", "info": "ID of the group. If set, updates the corresponding existing group.: string", "required": true, "schema": { "title": "id", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteIdentityGroupById" }, "task": true }, { "name": "getIdentityGroupNames", "summary": "Get Identity Group Name", "description": "Get Identity Group Name", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "list", "type": "string", "info": "Return a list if `true`: string", "required": false, "schema": { "title": "list", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getIdentityGroupNames" }, "task": true }, { "name": "getIdentityGroupByName", "summary": "Get Identity Group By Name", "description": "Get Identity Group By Name", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "name", "type": "string", "info": "Name of the group.: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getIdentityGroupByName" }, "task": true }, { "name": "updateIdentityGroupByName", "summary": "Update Identity Group By Name", "description": "Update Identity Group By Name", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "name", "type": "string", "info": "Name of the group.: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"id\": \"string\", \"member_entity_ids\": \"array\", \"member_group_ids\": \"array\", \"metadata\": \"object\", \"policies\": \"array\", \"type\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "id": { "type": "string", "description": "ID of the group. If set, updates the corresponding existing group." }, "member_entity_ids": { "type": "array", "description": "Entity IDs to be assigned as group members.", "items": { "type": "string" } }, "member_group_ids": { "type": "array", "description": "Group IDs to be assigned as group members.", "items": { "type": "string" } }, "metadata": { "type": "object", "description": "Metadata to be associated with the group. In CLI, this parameter can be repeated multiple times, and it all gets merged together. For example: vault metadata=key1=value1 metadata=key2=value2" }, "policies": { "type": "array", "description": "Policies to be tied to the group.", "items": { "type": "string" } }, "type": { "type": "string", "description": "Type of the group, 'internal' or 'external'. Defaults to 'internal'" } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/updateIdentityGroupByName" }, "task": true }, { "name": "deleteIdentityGroupByName", "summary": "Delete Identity Group By Name", "description": "Delete Identity Group By Name", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "name", "type": "string", "info": "Name of the group.: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteIdentityGroupByName" }, "task": true }, { "name": "postIdentityLookupEntity", "summary": "Query entities based on various properties.", "description": "Query entities based on various properties.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "body", "type": "object", "info": ": {\"alias_id\": \"string\", \"alias_mount_accessor\": \"string\", \"alias_name\": \"string\", \"id\": \"string\", \"name\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "alias_id": { "type": "string", "description": "ID of the alias." }, "alias_mount_accessor": { "type": "string", "description": "Accessor of the mount to which the alias belongs to. This should be supplied in conjunction with 'alias_name'." }, "alias_name": { "type": "string", "description": "Name of the alias. This should be supplied in conjunction with 'alias_mount_accessor'." }, "id": { "type": "string", "description": "ID of the entity." }, "name": { "type": "string", "description": "Name of the entity." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postIdentityLookupEntity" }, "task": true }, { "name": "postIdentityLookupGroup", "summary": "Query groups based on various properties.", "description": "Query groups based on various properties.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "body", "type": "object", "info": ": {\"alias_id\": \"string\", \"alias_mount_accessor\": \"string\", \"alias_name\": \"string\", \"id\": \"string\", \"name\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "alias_id": { "type": "string", "description": "ID of the alias." }, "alias_mount_accessor": { "type": "string", "description": "Accessor of the mount to which the alias belongs to. This should be supplied in conjunction with 'alias_name'." }, "alias_name": { "type": "string", "description": "Name of the alias. This should be supplied in conjunction with 'alias_mount_accessor'." }, "id": { "type": "string", "description": "ID of the group." }, "name": { "type": "string", "description": "Name of the group." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postIdentityLookupGroup" }, "task": true }, { "name": "getIdentityOidcWellKnownKeys", "summary": "Retrieve public keys", "description": "Retrieve public keys", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/getIdentityOidcWellKnownKeys" }, "task": true }, { "name": "getIdentityOidcWellKnownOpenidConfiguration", "summary": "Query OIDC configurations", "description": "Query OIDC configurations", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/getIdentityOidcWellKnownOpenidConfiguration" }, "task": true }, { "name": "getIdentityOidcConfig", "summary": "OIDC configuration", "description": "OIDC configuration", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/getIdentityOidcConfig" }, "task": true }, { "name": "postIdentityOidcConfig", "summary": "OIDC configuration", "description": "OIDC configuration", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "body", "type": "object", "info": ": {\"issuer\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "issuer": { "type": "string", "description": "Issuer URL to be used in the iss claim of the token. If not set, Vault's app_addr will be used." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postIdentityOidcConfig" }, "task": true }, { "name": "postIdentityOidcIntrospect", "summary": "Verify the authenticity of an OIDC token", "description": "Verify the authenticity of an OIDC token", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "body", "type": "object", "info": ": {\"client_id\": \"string\", \"token\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "client_id": { "type": "string", "description": "Optional client_id to verify" }, "token": { "type": "string", "description": "Token to verify" } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postIdentityOidcIntrospect" }, "task": true }, { "name": "getIdentityOidcKeys", "summary": "List OIDC keys", "description": "List OIDC keys", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "list", "type": "string", "info": "Return a list if `true`: string", "required": false, "schema": { "title": "list", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getIdentityOidcKeys" }, "task": true }, { "name": "getIdentityOidcKeyByName", "summary": "CRUD operations for OIDC keys.", "description": "CRUD operations for OIDC keys.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "name", "type": "string", "info": "Name of the key: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getIdentityOidcKeyByName" }, "task": true }, { "name": "updateIdentityOidcKeyByName", "summary": "Update for OIDC keys.", "description": "Update for OIDC keys.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "name", "type": "string", "info": "Name of the key: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"algorithm\": \"string\", \"allowed_client_ids\": \"array\", \"rotation_period\": 123, \"verification_ttl\": 123}", "required": false, "schema": { "type": "object", "properties": { "algorithm": { "type": "string", "description": "Signing algorithm to use. This will default to RS256.", "default": "RS256" }, "allowed_client_ids": { "type": "array", "description": "Comma separated string or array of role client ids allowed to use this key for signing. If empty no roles are allowed. If \"*\" all roles are allowed.", "items": { "type": "string" } }, "rotation_period": { "type": "integer", "description": "How often to generate a new keypair.", "default": "24h" }, "verification_ttl": { "type": "integer", "description": "Controls how long the public portion of a key will be available for verification after being rotated.", "default": "24h" } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/updateIdentityOidcKeyByName" }, "task": true }, { "name": "deleteIdentityOidcKeyByName", "summary": "Delete for OIDC keys.", "description": "Delete for OIDC keys.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "name", "type": "string", "info": "Name of the key: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteIdentityOidcKeyByName" }, "task": true }, { "name": "postIdentityOidcKeyRotateByName", "summary": "Rotate a named OIDC key.", "description": "Rotate a named OIDC key.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "name", "type": "string", "info": "Name of the key: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"verification_ttl\": 123}", "required": false, "schema": { "type": "object", "properties": { "verification_ttl": { "type": "integer", "description": "Controls how long the public portion of a key will be available for verification after being rotated. Setting verification_ttl here will override the verification_ttl set on the key." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postIdentityOidcKeyRotateByName" }, "task": true }, { "name": "getIdentityOidcRoles", "summary": "List configured OIDC roles", "description": "List configured OIDC roles", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "list", "type": "string", "info": "Return a list if `true`: string", "required": false, "schema": { "title": "list", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getIdentityOidcRoles" }, "task": true }, { "name": "getIdentityOidcRoleByName", "summary": "Get OIDC Roles By Name", "description": "Get OIDC Roles By Name", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "name", "type": "string", "info": "Name of the role: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getIdentityOidcRoleByName" }, "task": true }, { "name": "updateIdentityOidcRoleByName", "summary": "Update OIDC Roles By Name", "description": "Update OIDC Roles By Name", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "name", "type": "string", "info": "Name of the role: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"client_id\": \"string\", \"key\": \"string\", \"template\": \"string\", \"ttl\": 123}", "required": false, "schema": { "type": "object", "properties": { "client_id": { "type": "string", "description": "Optional client_id" }, "key": { "type": "string", "description": "The OIDC key to use for generating tokens. The specified key must already exist." }, "template": { "type": "string", "description": "The template string to use for generating tokens. This may be in string-ified JSON or base64 format." }, "ttl": { "type": "integer", "description": "TTL of the tokens generated against the role.", "default": "24h" } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/updateIdentityOidcRoleByName" }, "task": true }, { "name": "deleteIdentityOidcRoleByName", "summary": "Delete OIDC Roles By Name", "description": "Delete OIDC Roles By Name", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "name", "type": "string", "info": "Name of the role: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteIdentityOidcRoleByName" }, "task": true }, { "name": "getIdentityOidcTokenByName", "summary": "Generate an OIDC token", "description": "Generate an OIDC token", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "name", "type": "string", "info": "Name of the role: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getIdentityOidcTokenByName" }, "task": true }, { "name": "postIdentityPersona", "summary": "Create a new alias.", "description": "Create a new alias.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "body", "type": "object", "info": ": {\"entity_id\": \"string\", \"id\": \"string\", \"metadata\": \"object\", \"mount_accessor\": \"string\", \"name\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "entity_id": { "type": "string", "description": "Entity ID to which this persona belongs to" }, "id": { "type": "string", "description": "ID of the persona" }, "metadata": { "type": "object", "description": "Metadata to be associated with the persona. In CLI, this parameter can be repeated multiple times, and it all gets merged together. For example: vault metadata=key1=value1 metadata=key2=value2" }, "mount_accessor": { "type": "string", "description": "Mount accessor to which this persona belongs to" }, "name": { "type": "string", "description": "Name of the persona" } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postIdentityPersona" }, "task": true }, { "name": "getIdentityPersonas", "summary": "List all the alias IDs.", "description": "List all the alias IDs.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "list", "type": "string", "info": "Return a list if `true`: string", "required": false, "schema": { "title": "list", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getIdentityPersonas" }, "task": true }, { "name": "getIdentityPersonaById", "summary": "Get Identity Persona By ID.", "description": "Get Identity Persona By ID.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "id", "type": "string", "info": "ID of the persona: string", "required": true, "schema": { "title": "id", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getIdentityPersonaById" }, "task": true }, { "name": "updateIdentityPersonaById", "summary": "Update Identity Persona By ID.", "description": "Update Identity Persona By ID.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "id", "type": "string", "info": "ID of the persona: string", "required": true, "schema": { "title": "id", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"entity_id\": \"string\", \"metadata\": \"object\", \"mount_accessor\": \"string\", \"name\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "entity_id": { "type": "string", "description": "Entity ID to which this persona should be tied to" }, "metadata": { "type": "object", "description": "Metadata to be associated with the persona. In CLI, this parameter can be repeated multiple times, and it all gets merged together. For example: vault metadata=key1=value1 metadata=key2=value2" }, "mount_accessor": { "type": "string", "description": "Mount accessor to which this persona belongs to" }, "name": { "type": "string", "description": "Name of the persona" } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/updateIdentityPersonaById" }, "task": true }, { "name": "deleteIdentityPersonaById", "summary": "Delete Identity Persona By ID.", "description": "Delete Identity Persona By ID.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault", "description": "the namespace within Vault", "schema": { "title": "namespace", "type": "string" }, "required": false }, { "name": "id", "type": "string", "info": "ID of the persona: string", "required": true, "schema": { "title": "id", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteIdentityPersonaById" }, "task": true }, { "name": "getSysAudit", "summary": "List the enabled audit devices.", "description": "List the enabled audit devices.", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/getSysAudit" }, "task": true }, { "name": "postSysAuditHashPath", "summary": "The hash of the given string via the given audit backend", "description": "The hash of the given string via the given audit backend", "input": [ { "name": "pathParam", "type": "string", "info": "The name of the backend. Cannot be delimited. Example: \"mysql\": string", "required": true, "schema": { "title": "pathParam", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"input\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "input": { "type": "string" } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysAuditHashPath" }, "task": true }, { "name": "postSysAuditPath", "summary": "Enable a new audit device at the supplied path.", "description": "Enable a new audit device at the supplied path.", "input": [ { "name": "pathParam", "type": "string", "info": "The name of the backend. Cannot be delimited. Example: \"mysql\": string", "required": true, "schema": { "title": "pathParam", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"description\": \"string\", \"local\": \"boolean\", \"options\": \"object\", \"type\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "description": { "type": "string", "description": "User-friendly description for this audit backend." }, "local": { "type": "boolean", "description": "Mark the mount as a local mount, which is not replicated and is unaffected by replication.", "default": false }, "options": { "type": "object", "description": "Configuration options for the audit backend." }, "type": { "type": "string", "description": "The type of the backend. Example: \"mysql\"" } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysAuditPath" }, "task": true }, { "name": "deleteSysAuditPath", "summary": "Disable the audit device at the given path.", "description": "Disable the audit device at the given path.", "input": [ { "name": "pathParam", "type": "string", "info": "The name of the backend. Cannot be delimited. Example: \"mysql\": string", "required": true, "schema": { "title": "pathParam", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteSysAuditPath" }, "task": true }, { "name": "getSysAuth", "summary": "List the currently enabled credential backends.", "description": "List the currently enabled credential backends.", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/getSysAuth" }, "task": true }, { "name": "postSysAuthPath", "summary": "Enables a new auth method.", "description": "After enabling, the auth method can be accessed and configured via the auth path specified as part of the URL. This auth path will be nested under the auth prefix.\n\nFor example, enable the \"foo\" auth method will make it accessible at /auth/foo.", "input": [ { "name": "pathParam", "type": "string", "info": "The path to mount to. Cannot be delimited. Example: \"user\": string", "required": true, "schema": { "title": "pathParam", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"config\": \"object\", \"description\": \"string\", \"external_entropy_access\": \"boolean\", \"local\": \"boolean\", \"options\": \"object\", \"plugin_name\": \"string\", \"seal_wrap\": \"boolean\", \"type\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "config": { "type": "object", "description": "Configuration for this mount, such as plugin_name." }, "description": { "type": "string", "description": "User-friendly description for this credential backend." }, "external_entropy_access": { "type": "boolean", "description": "Whether to give the mount access to Vault's external entropy.", "default": false }, "local": { "type": "boolean", "description": "Mark the mount as a local mount, which is not replicated and is unaffected by replication.", "default": false }, "options": { "type": "object", "description": "The options to pass into the backend. Should be a json object with string keys and values." }, "plugin_name": { "type": "string", "description": "Name of the auth plugin to use based from the name in the plugin catalog." }, "seal_wrap": { "type": "boolean", "description": "Whether to turn on seal wrapping for the mount.", "default": false }, "type": { "type": "string", "description": "The type of the backend. Example: \"userpass\"" } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysAuthPath" }, "task": true }, { "name": "deleteSysAuthPath", "summary": "Disable the auth method at the given auth path", "description": "Disable the auth method at the given auth path", "input": [ { "name": "pathParam", "type": "string", "info": "The path to mount to. Cannot be delimited. Example: \"user\": string", "required": true, "schema": { "title": "pathParam", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteSysAuthPath" }, "task": true }, { "name": "getSysAuthPathTune", "summary": "Reads the given auth path's configuration.", "description": "This endpoint requires sudo capability on the final path, but the same functionality can be achieved without sudo via `sys/mounts/auth/[auth-path]/tune`.", "input": [ { "name": "pathParam", "type": "string", "info": "Tune the configuration parameters for an auth path.: string", "required": true, "schema": { "title": "pathParam", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSysAuthPathTune" }, "task": true }, { "name": "postSysAuthPathTune", "summary": "Tune configuration parameters for a given auth path.", "description": "This endpoint requires sudo capability on the final path, but the same functionality can be achieved without sudo via `sys/mounts/auth/[auth-path]/tune`.", "input": [ { "name": "pathParam", "type": "string", "info": "Tune the configuration parameters for an auth path.: string", "required": true, "schema": { "title": "pathParam", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"allowed_response_headers\": \"array\", \"audit_non_hmac_request_keys\": \"array\", \"audit_non_hmac_response_keys\": \"array\", \"default_lease_ttl\": \"string\", \"description\": \"string\", \"listing_visibility\": \"string\", \"max_lease_ttl\": \"string\", \"options\": \"object\", \"passthrough_request_headers\": \"array\", \"token_type\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "allowed_response_headers": { "type": "array", "description": "A list of headers to whitelist and allow a plugin to set on responses.", "items": { "type": "string" } }, "audit_non_hmac_request_keys": { "type": "array", "description": "The list of keys in the request data object that will not be HMAC'ed by audit devices.", "items": { "type": "string" } }, "audit_non_hmac_response_keys": { "type": "array", "description": "The list of keys in the response data object that will not be HMAC'ed by audit devices.", "items": { "type": "string" } }, "default_lease_ttl": { "type": "string", "description": "The default lease TTL for this mount." }, "description": { "type": "string", "description": "User-friendly description for this credential backend." }, "listing_visibility": { "type": "string", "description": "Determines the visibility of the mount in the UI-specific listing endpoint. Accepted value are 'unauth' and ''." }, "max_lease_ttl": { "type": "string", "description": "The max lease TTL for this mount." }, "options": { "type": "object", "description": "The options to pass into the backend. Should be a json object with string keys and values." }, "passthrough_request_headers": { "type": "array", "description": "A list of headers to whitelist and pass from the request to the plugin.", "items": { "type": "string" } }, "token_type": { "type": "string", "description": "The type of token to issue (service or batch)." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysAuthPathTune" }, "task": true }, { "name": "postSysCapabilities", "summary": "Fetches the capabilities of the given token on the given path.", "description": "Fetches the capabilities of the given token on the given path.", "input": [ { "name": "body", "type": "object", "info": ": {\"path\": \"array\", \"paths\": \"array\", \"token\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "path": { "type": "array", "description": "Use 'paths' instead.", "items": { "type": "string" }, "deprecated": true }, "paths": { "type": "array", "description": "Paths on which capabilities are being queried.", "items": { "type": "string" } }, "token": { "type": "string", "description": "Token for which capabilities are being queried." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysCapabilities" }, "task": true }, { "name": "postSysCapabilitiesAccessor", "summary": "Fetches the capabilities of the token associated with the given token, on the given path.", "description": "Fetches the capabilities of the token associated with the given token, on the given path.", "input": [ { "name": "body", "type": "object", "info": ": {\"accessor\": \"string\", \"path\": \"array\", \"paths\": \"array\"}", "required": false, "schema": { "type": "object", "properties": { "accessor": { "type": "string", "description": "Accessor of the token for which capabilities are being queried." }, "path": { "type": "array", "description": "Use 'paths' instead.", "items": { "type": "string" }, "deprecated": true }, "paths": { "type": "array", "description": "Paths on which capabilities are being queried.", "items": { "type": "string" } } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysCapabilitiesAccessor" }, "task": true }, { "name": "postSysCapabilitiesSelf", "summary": "Fetches the capabilities of the given token on the given path.", "description": "Fetches the capabilities of the given token on the given path.", "input": [ { "name": "body", "type": "object", "info": ": {\"path\": \"array\", \"paths\": \"array\", \"token\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "path": { "type": "array", "description": "Use 'paths' instead.", "items": { "type": "string" }, "deprecated": true }, "paths": { "type": "array", "description": "Paths on which capabilities are being queried.", "items": { "type": "string" } }, "token": { "type": "string", "description": "Token for which capabilities are being queried." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysCapabilitiesSelf" }, "task": true }, { "name": "getSysConfigAuditingRequestHeaders", "summary": "List the request headers that are configured to be audited.", "description": "List the request headers that are configured to be audited.", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/getSysConfigAuditingRequestHeaders" }, "task": true }, { "name": "getSysConfigAuditingRequestHeadersHeader", "summary": "List the information for the given request header.", "description": "List the information for the given request header.", "input": [ { "name": "header", "type": "string", "info": ": string", "required": true, "schema": { "title": "header", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSysConfigAuditingRequestHeadersHeader" }, "task": true }, { "name": "postSysConfigAuditingRequestHeadersHeader", "summary": "Enable auditing of a header.", "description": "Enable auditing of a header.", "input": [ { "name": "header", "type": "string", "info": ": string", "required": true, "schema": { "title": "header", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"hmac\": \"boolean\"}", "required": false, "schema": { "type": "object", "properties": { "hmac": { "type": "boolean" } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysConfigAuditingRequestHeadersHeader" }, "task": true }, { "name": "deleteSysConfigAuditingRequestHeadersHeader", "summary": "Disable auditing of the given request header.", "description": "Disable auditing of the given request header.", "input": [ { "name": "header", "type": "string", "info": ": string", "required": true, "schema": { "title": "header", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteSysConfigAuditingRequestHeadersHeader" }, "task": true }, { "name": "getSysConfigControlGroup", "summary": "Configure control group global settings.", "description": "Configure control group global settings.", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/getSysConfigControlGroup" }, "task": true }, { "name": "postSysConfigControlGroup", "summary": "Configure control group global settings.", "description": "Configure control group global settings.", "input": [ { "name": "body", "type": "object", "info": ": {\"max_ttl\": 123}", "required": false, "schema": { "type": "object", "properties": { "max_ttl": { "type": "integer", "description": "The max TTL for a control group token." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysConfigControlGroup" }, "task": true }, { "name": "deleteSysConfigControlGroup", "summary": "Configure control group global settings.", "description": "Configure control group global settings.", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/deleteSysConfigControlGroup" }, "task": true }, { "name": "getSysConfigCors", "summary": "Return the current CORS settings.", "description": "Return the current CORS settings.", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/getSysConfigCors" }, "task": true }, { "name": "postSysConfigCors", "summary": "Configure the CORS settings.", "description": "Configure the CORS settings.", "input": [ { "name": "body", "type": "object", "info": ": {\"allowed_headers\": \"array\", \"allowed_origins\": \"array\", \"enable\": \"boolean\"}", "required": false, "schema": { "type": "object", "properties": { "allowed_headers": { "type": "array", "description": "A comma-separated string or array of strings indicating headers that are allowed on cross-origin requests.", "items": { "type": "string" } }, "allowed_origins": { "type": "array", "description": "A comma-separated string or array of strings indicating origins that may make cross-origin requests.", "items": { "type": "string" } }, "enable": { "type": "boolean", "description": "Enables or disables CORS headers on requests." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysConfigCors" }, "task": true }, { "name": "deleteSysConfigCors", "summary": "Remove any CORS settings.", "description": "Remove any CORS settings.", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/deleteSysConfigCors" }, "task": true }, { "name": "getSysConfigStateSanitized", "summary": "Return a sanitized version of the Vault server configuration.", "description": "The sanitized output strips configuration values in the storage, HA storage, and seals stanzas, which may contain sensitive values such as API tokens. It also removes any token or secret fields in other stanzas, such as the circonus_api_token from telemetry.", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/getSysConfigStateSanitized" }, "task": true }, { "name": "getSysConfigUiHeaders", "summary": "Return a list of configured UI headers.", "description": "Return a list of configured UI headers.", "input": [ { "name": "list", "type": "string", "info": "Return a list if `true`: string", "required": false, "schema": { "title": "list", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSysConfigUiHeaders" }, "task": true }, { "name": "getSysConfigUiHeadersHeader", "summary": "Return the given UI header's configuration", "description": "Return the given UI header's configuration", "input": [ { "name": "header", "type": "string", "info": "The name of the header.: string", "required": true, "schema": { "title": "header", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSysConfigUiHeadersHeader" }, "task": true }, { "name": "postSysConfigUiHeadersHeader", "summary": "Configure the values to be returned for the UI header.", "description": "Configure the values to be returned for the UI header.", "input": [ { "name": "header", "type": "string", "info": "The name of the header.: string", "required": true, "schema": { "title": "header", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"values\": \"array\"}", "required": false, "schema": { "type": "object", "properties": { "values": { "type": "array", "description": "The values to set the header.", "items": { "type": "string" } } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysConfigUiHeadersHeader" }, "task": true }, { "name": "deleteSysConfigUiHeadersHeader", "summary": "Remove a UI header.", "description": "Remove a UI header.", "input": [ { "name": "header", "type": "string", "info": "The name of the header.: string", "required": true, "schema": { "title": "header", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteSysConfigUiHeadersHeader" }, "task": true }, { "name": "postSysControlGroupAuthorize", "summary": "Authorize a control group request", "description": "Authorize a control group request", "input": [ { "name": "body", "type": "object", "info": ": {\"accessor\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "accessor": { "type": "string", "description": "The accessor of the request to authorize." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysControlGroupAuthorize" }, "task": true }, { "name": "postSysControlGroupRequest", "summary": "Check the status of a control group request", "description": "Check the status of a control group request", "input": [ { "name": "body", "type": "object", "info": ": {\"accessor\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "accessor": { "type": "string", "description": "The accessor of the request." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysControlGroupRequest" }, "task": true }, { "name": "getSysGenerateRoot", "summary": "Read the configuration and progress of the current root generation attempt.", "description": "Read the configuration and progress of the current root generation attempt.", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/getSysGenerateRoot" }, "task": true }, { "name": "postSysGenerateRoot", "summary": "Initializes a new root generation attempt.", "description": "Only a single root generation attempt can take place at a time. One (and only one) of otp or pgp_key are required.", "input": [ { "name": "body", "type": "object", "info": ": {\"pgp_key\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "pgp_key": { "type": "string", "description": "Specifies a base64-encoded PGP public key." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysGenerateRoot" }, "task": true }, { "name": "deleteSysGenerateRoot", "summary": "Cancels any in-progress root generation attempt.", "description": "Cancels any in-progress root generation attempt.", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/deleteSysGenerateRoot" }, "task": true }, { "name": "getSysGenerateRootAttempt", "summary": "Read the configuration and progress of the current root generation attempt.", "description": "Read the configuration and progress of the current root generation attempt.", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/getSysGenerateRootAttempt" }, "task": true }, { "name": "postSysGenerateRootAttempt", "summary": "Initializes a new root generation attempt.", "description": "Only a single root generation attempt can take place at a time. One (and only one) of otp or pgp_key are required.", "input": [ { "name": "body", "type": "object", "info": ": {\"pgp_key\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "pgp_key": { "type": "string", "description": "Specifies a base64-encoded PGP public key." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysGenerateRootAttempt" }, "task": true }, { "name": "deleteSysGenerateRootAttempt", "summary": "Cancels any in-progress root generation attempt.", "description": "Cancels any in-progress root generation attempt.", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/deleteSysGenerateRootAttempt" }, "task": true }, { "name": "postSysGenerateRootUpdate", "summary": "Enter a single master key share to progress the root generation attempt.", "description": "If the threshold number of master key shares is reached, Vault will complete the root generation and issue the new token. Otherwise, this API must be called multiple times until that threshold is met. The attempt nonce must be provided with each call.", "input": [ { "name": "body", "type": "object", "info": ": {\"key\": \"string\", \"nonce\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "key": { "type": "string", "description": "Specifies a single master key share." }, "nonce": { "type": "string", "description": "Specifies the nonce of the attempt." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysGenerateRootUpdate" }, "task": true }, { "name": "getSysHealth", "summary": "Returns the health status of Vault.", "description": "Returns the health status of Vault.", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/getSysHealth" }, "task": true }, { "name": "getSysHostInfo", "summary": "Information about the host instance that this Vault server is running on.", "description": "Information about the host instance that this Vault server is running on.\n\t\tThe information that gets collected includes host hardware information, and CPU,\n\t\tdisk, and memory utilization", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/getSysHostInfo" }, "task": true }, { "name": "getSysInit", "summary": "Returns the initialization status of Vault.", "description": "Returns the initialization status of Vault.", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/getSysInit" }, "task": true }, { "name": "postSysInit", "summary": "Initialize a new Vault.", "description": "The Vault must not have been previously initialized. The recovery options, as well as the stored shares option, are only available when using Vault HSM.", "input": [ { "name": "body", "type": "object", "info": ": {\"pgp_keys\": \"array\", \"recovery_pgp_keys\": \"array\", \"recovery_shares\": 123, \"recovery_threshold\": 123, \"root_token_pgp_key\": \"string\", \"secret_shares\": 123, \"secret_threshold\": 123, \"stored_shares\": 123}", "required": false, "schema": { "type": "object", "properties": { "pgp_keys": { "type": "array", "description": "Specifies an array of PGP public keys used to encrypt the output unseal keys. Ordering is preserved. The keys must be base64-encoded from their original binary representation. The size of this array must be the same as `secret_shares`.", "items": { "type": "string" } }, "recovery_pgp_keys": { "type": "array", "description": "Specifies an array of PGP public keys used to encrypt the output recovery keys. Ordering is preserved. The keys must be base64-encoded from their original binary representation. The size of this array must be the same as `recovery_shares`.", "items": { "type": "string" } }, "recovery_shares": { "type": "integer", "description": "Specifies the number of shares to split the recovery key into." }, "recovery_threshold": { "type": "integer", "description": "Specifies the number of shares required to reconstruct the recovery key. This must be less than or equal to `recovery_shares`." }, "root_token_pgp_key": { "type": "string", "description": "Specifies a PGP public key used to encrypt the initial root token. The key must be base64-encoded from its original binary representation." }, "secret_shares": { "type": "integer", "description": "Specifies the number of shares to split the master key into." }, "secret_threshold": { "type": "integer", "description": "Specifies the number of shares required to reconstruct the master key. This must be less than or equal secret_shares. If using Vault HSM with auto-unsealing, this value must be the same as `secret_shares`." }, "stored_shares": { "type": "integer", "description": "Specifies the number of shares that should be encrypted by the HSM and stored for auto-unsealing. Currently must be the same as `secret_shares`." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysInit" }, "task": true }, { "name": "getSysInternalSpecsOpenapi", "summary": "Generate an OpenAPI 3 document of all mounted paths.", "description": "Generate an OpenAPI 3 document of all mounted paths.", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/getSysInternalSpecsOpenapi" }, "task": true }, { "name": "getSysInternalUiMounts", "summary": "Lists all enabled and visible auth and secrets mounts.", "description": "Lists all enabled and visible auth and secrets mounts.", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/getSysInternalUiMounts" }, "task": true }, { "name": "getSysInternalUiMountsPath", "summary": "Return information about the given mount.", "description": "Return information about the given mount.", "input": [ { "name": "pathParam", "type": "string", "info": "The path of the mount.: string", "required": true, "schema": { "title": "pathParam", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSysInternalUiMountsPath" }, "task": true }, { "name": "getSysKeyStatus", "summary": "Provides information about the backend encryption key.", "description": "Provides information about the backend encryption key.", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/getSysKeyStatus" }, "task": true }, { "name": "getSysLeader", "summary": "Returns the high availability status and current leader instance of Vault.", "description": "Returns the high availability status and current leader instance of Vault.", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/getSysLeader" }, "task": true }, { "name": "postSysLeasesLookup", "summary": "Retrieve lease metadata.", "description": "Retrieve lease metadata.", "input": [ { "name": "body", "type": "object", "info": ": {\"lease_id\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "lease_id": { "type": "string", "description": "The lease identifier to renew. This is included with a lease." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysLeasesLookup" }, "task": true }, { "name": "getSysLeasesLookup", "summary": "Returns a list of lease ids.", "description": "Returns a list of lease ids.", "input": [ { "name": "list", "type": "string", "info": "Return a list if `true`: string", "required": false, "schema": { "title": "list", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSysLeasesLookup" }, "task": true }, { "name": "getSysLeasesLookupPrefix", "summary": "Returns a list of lease ids.", "description": "Returns a list of lease ids.", "input": [ { "name": "prefix", "type": "string", "info": "The path to list leases under. Example: \"aws/creds/deploy\": string", "required": true, "schema": { "title": "prefix", "type": "string" } }, { "name": "list", "type": "string", "info": "Return a list if `true`: string", "required": false, "schema": { "title": "list", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSysLeasesLookupPrefix" }, "task": true }, { "name": "postSysLeasesRenew", "summary": "Renews a lease, requesting to extend the lease.", "description": "Renews a lease, requesting to extend the lease.", "input": [ { "name": "body", "type": "object", "info": ": {\"increment\": 123, \"lease_id\": \"string\", \"url_lease_id\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "increment": { "type": "integer", "description": "The desired increment in seconds to the lease" }, "lease_id": { "type": "string", "description": "The lease identifier to renew. This is included with a lease." }, "url_lease_id": { "type": "string", "description": "The lease identifier to renew. This is included with a lease." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysLeasesRenew" }, "task": true }, { "name": "postSysLeasesRenewUrlLeaseId", "summary": "Renews a lease, requesting to extend the lease.", "description": "Renews a lease, requesting to extend the lease.", "input": [ { "name": "urlLeaseId", "type": "string", "info": "The lease identifier to renew. This is included with a lease.: string", "required": true, "schema": { "title": "urlLeaseId", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"increment\": 123, \"lease_id\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "increment": { "type": "integer", "description": "The desired increment in seconds to the lease" }, "lease_id": { "type": "string", "description": "The lease identifier to renew. This is included with a lease." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysLeasesRenewUrlLeaseId" }, "task": true }, { "name": "postSysLeasesRevoke", "summary": "Revokes a lease immediately.", "description": "Revokes a lease immediately.", "input": [ { "name": "body", "type": "object", "info": ": {\"lease_id\": \"string\", \"sync\": \"boolean\", \"url_lease_id\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "lease_id": { "type": "string", "description": "The lease identifier to renew. This is included with a lease." }, "sync": { "type": "boolean", "description": "Whether or not to perform the revocation synchronously", "default": true }, "url_lease_id": { "type": "string", "description": "The lease identifier to renew. This is included with a lease." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysLeasesRevoke" }, "task": true }, { "name": "postSysLeasesRevokeForcePrefix", "summary": "Revokes all secrets or tokens generated under a given prefix immediately", "description": "Unlike `/sys/leases/revoke-prefix`, this path ignores backend errors encountered during revocation. This is potentially very dangerous and should only be used in specific emergency situations where errors in the backend or the connected backend service prevent normal revocation.\n\nBy ignoring these errors, Vault abdicates responsibility for ensuring that the issued credentials or secrets are properly revoked and/or cleaned up. Access to this endpoint should be tightly controlled.", "input": [ { "name": "prefix", "type": "string", "info": "The path to revoke keys under. Example: \"prod/aws/ops\": string", "required": true, "schema": { "title": "prefix", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysLeasesRevokeForcePrefix" }, "task": true }, { "name": "postSysLeasesRevokePrefixPrefix", "summary": "Revokes all secrets (via a lease ID prefix) or tokens (via the tokens' path property) generated und", "description": "Revokes all secrets (via a lease ID prefix) or tokens (via the tokens' path property) generated under a given prefix immediately.", "input": [ { "name": "prefix", "type": "string", "info": "The path to revoke keys under. Example: \"prod/aws/ops\": string", "required": true, "schema": { "title": "prefix", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"sync\": \"boolean\"}", "required": false, "schema": { "type": "object", "properties": { "sync": { "type": "boolean", "description": "Whether or not to perform the revocation synchronously", "default": true } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysLeasesRevokePrefixPrefix" }, "task": true }, { "name": "postSysLeasesRevokeUrlLeaseId", "summary": "Revokes a lease immediately.", "description": "Revokes a lease immediately.", "input": [ { "name": "urlLeaseId", "type": "string", "info": "The lease identifier to renew. This is included with a lease.: string", "required": true, "schema": { "title": "urlLeaseId", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"lease_id\": \"string\", \"sync\": \"boolean\"}", "required": false, "schema": { "type": "object", "properties": { "lease_id": { "type": "string", "description": "The lease identifier to renew. This is included with a lease." }, "sync": { "type": "boolean", "description": "Whether or not to perform the revocation synchronously", "default": true } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysLeasesRevokeUrlLeaseId" }, "task": true }, { "name": "postSysLeasesTidy", "summary": "This endpoint performs cleanup tasks that can be run if certain error\nconditions have occurred.", "description": "This endpoint performs cleanup tasks that can be run if certain error\nconditions have occurred.", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/postSysLeasesTidy" }, "task": true }, { "name": "getSysLicense", "summary": "The path responds to the following HTTP methods.\n\n GET /\n Returns information on the inst", "description": "The path responds to the following HTTP methods.\n\n GET /\n Returns information on the installed license\n\n POST\n Sets the license for the server", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/getSysLicense" }, "task": true }, { "name": "postSysLicense", "summary": "The path responds to the following HTTP methods.\n\n GET /\n Returns information on the inst", "description": "The path responds to the following HTTP methods.\n\n GET /\n Returns information on the installed license\n\n POST\n Sets the license for the server", "input": [ { "name": "body", "type": "object", "info": ": {\"text\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "text": { "type": "string", "description": "The text of the license." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysLicense" }, "task": true }, { "name": "getSysMetrics", "summary": "Export the metrics aggregated for telemetry purpose.", "description": "Export the metrics aggregated for telemetry purpose.", "input": [ { "name": "format", "type": "string", "info": "Format to export metrics into. Currently accepts only \"prometheus\".: string", "required": false, "schema": { "title": "format", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSysMetrics" }, "task": true }, { "name": "getSysMfaMethod", "summary": "Lists all the available MFA methods by their name.", "description": "Lists all the available MFA methods by their name.", "input": [ { "name": "list", "type": "string", "info": "Return a list if `true`: string", "required": false, "schema": { "title": "list", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSysMfaMethod" }, "task": true }, { "name": "getSysMfaMethodDuoName", "summary": "Defines or updates a Duo MFA method.", "description": "Defines or updates a Duo MFA method.", "input": [ { "name": "name", "type": "string", "info": "Name of the MFA method.: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSysMfaMethodDuoName" }, "task": true }, { "name": "postSysMfaMethodDuoName", "summary": "Defines or updates a Duo MFA method.", "description": "Defines or updates a Duo MFA method.", "input": [ { "name": "name", "type": "string", "info": "Name of the MFA method.: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"api_hostname\": \"string\", \"integration_key\": \"string\", \"mount_accessor\": \"string\", \"push_info\": \"string\", \"secret_key\": \"string\", \"username_format\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "api_hostname": { "type": "string", "description": "API host name for Duo." }, "integration_key": { "type": "string", "description": "Integration key for Duo." }, "mount_accessor": { "type": "string", "description": "The mount to tie this method to for use in automatic mappings. The mapping will use the Name field of Aliases associated with this mount as the username in the mapping." }, "push_info": { "type": "string", "description": "Push information for Duo." }, "secret_key": { "type": "string", "description": "Secret key for Duo." }, "username_format": { "type": "string", "description": "A format string for mapping Identity names to MFA method names. Values to subtitute should be placed in {{}}. For example, \"{{alias.name}}@example.com\". Currently-supported mappings: alias.name: The name returned by the mount configured via the mount_accessor parameter If blank, the Alias's name field will be used as-is." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysMfaMethodDuoName" }, "task": true }, { "name": "deleteSysMfaMethodDuoName", "summary": "Defines or updates a Duo MFA method.", "description": "Defines or updates a Duo MFA method.", "input": [ { "name": "name", "type": "string", "info": "Name of the MFA method.: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteSysMfaMethodDuoName" }, "task": true }, { "name": "getSysMfaMethodOktaName", "summary": "Defines or updates an Okta MFA method.", "description": "Defines or updates an Okta MFA method.", "input": [ { "name": "name", "type": "string", "info": "Name of the MFA method.: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSysMfaMethodOktaName" }, "task": true }, { "name": "postSysMfaMethodOktaName", "summary": "Defines or updates an Okta MFA method.", "description": "Defines or updates an Okta MFA method.", "input": [ { "name": "name", "type": "string", "info": "Name of the MFA method.: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"api_token\": \"string\", \"base_url\": \"string\", \"mount_accessor\": \"string\", \"org_name\": \"string\", \"primary_email\": \"boolean\", \"production\": \"boolean\", \"username_format\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "api_token": { "type": "string", "description": "Okta API key." }, "base_url": { "type": "string", "description": "The base domain to use for the Okta API. When not specified in the configuration, \"okta.com\" is used." }, "mount_accessor": { "type": "string", "description": "The mount to tie this method to for use in automatic mappings. The mapping will use the Name field of Aliases associated with this mount as the username in the mapping." }, "org_name": { "type": "string", "description": "Name of the organization to be used in the Okta API." }, "primary_email": { "type": "boolean", "description": "If true, the username will only match the primary email for the account. Defaults to false." }, "production": { "type": "boolean", "description": "(DEPRECATED) Use base_url instead." }, "username_format": { "type": "string", "description": "A format string for mapping Identity names to MFA method names. Values to subtitute should be placed in {{}}. For example, \"{{alias.name}}@example.com\". Currently-supported mappings: alias.name: The name returned by the mount configured via the mount_accessor parameter If blank, the Alias's name field will be used as-is." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysMfaMethodOktaName" }, "task": true }, { "name": "deleteSysMfaMethodOktaName", "summary": "Defines or updates an Okta MFA method.", "description": "Defines or updates an Okta MFA method.", "input": [ { "name": "name", "type": "string", "info": "Name of the MFA method.: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteSysMfaMethodOktaName" }, "task": true }, { "name": "getSysMfaMethodPingidName", "summary": "Defines or updates a PingID MFA method.", "description": "Defines or updates a PingID MFA method.", "input": [ { "name": "name", "type": "string", "info": "Name of the MFA method.: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSysMfaMethodPingidName" }, "task": true }, { "name": "postSysMfaMethodPingidName", "summary": "Defines or updates a PingID MFA method.", "description": "Defines or updates a PingID MFA method.", "input": [ { "name": "name", "type": "string", "info": "Name of the MFA method.: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"mount_accessor\": \"string\", \"settings_file_base64\": \"string\", \"username_format\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "mount_accessor": { "type": "string", "description": "The mount to tie this method to for use in automatic mappings. The mapping will use the Name field of Aliases associated with this mount as the username in the mapping." }, "settings_file_base64": { "type": "string", "description": "The settings file provided by Ping, Base64-encoded. This must be a settings file suitable for third-party clients, not the PingID SDK or PingFederate." }, "username_format": { "type": "string", "description": "A format string for mapping Identity names to MFA method names. Values to subtitute should be placed in {{}}. For example, \"{{alias.name}}@example.com\". Currently-supported mappings: alias.name: The name returned by the mount configured via the mount_accessor parameter If blank, the Alias's name field will be used as-is." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysMfaMethodPingidName" }, "task": true }, { "name": "deleteSysMfaMethodPingidName", "summary": "Defines or updates a PingID MFA method.", "description": "Defines or updates a PingID MFA method.", "input": [ { "name": "name", "type": "string", "info": "Name of the MFA method.: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteSysMfaMethodPingidName" }, "task": true }, { "name": "getSysMfaMethodTotpName", "summary": "Defines or updates a TOTP MFA method.", "description": "Defines or updates a TOTP MFA method.", "input": [ { "name": "name", "type": "string", "info": "Name of the MFA method.: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSysMfaMethodTotpName" }, "task": true }, { "name": "postSysMfaMethodTotpName", "summary": "Defines or updates a TOTP MFA method.", "description": "Defines or updates a TOTP MFA method.", "input": [ { "name": "name", "type": "string", "info": "Name of the MFA method.: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"algorithm\": \"string\", \"digits\": 123, \"issuer\": \"string\", \"key_size\": 123, \"period\": 123, \"qr_size\": 123, \"skew\": 123}", "required": false, "schema": { "type": "object", "properties": { "algorithm": { "type": "string", "description": "The hashing algorithm used to generate the TOTP token. Options include SHA1, SHA256 and SHA512.", "default": "SHA1" }, "digits": { "type": "integer", "description": "The number of digits in the generated TOTP token. This value can either be 6 or 8.", "default": 6 }, "issuer": { "type": "string", "description": "The name of the key's issuing organization." }, "key_size": { "type": "integer", "description": "Determines the size in bytes of the generated key.", "default": 20 }, "period": { "type": "integer", "description": "The length of time used to generate a counter for the TOTP token calculation.", "default": 30 }, "qr_size": { "type": "integer", "description": "The pixel size of the generated square QR code.", "default": 200 }, "skew": { "type": "integer", "description": "The number of delay periods that are allowed when validating a TOTP token. This value can either be 0 or 1.", "default": 1 } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysMfaMethodTotpName" }, "task": true }, { "name": "deleteSysMfaMethodTotpName", "summary": "Defines or updates a TOTP MFA method.", "description": "Defines or updates a TOTP MFA method.", "input": [ { "name": "name", "type": "string", "info": "Name of the MFA method.: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteSysMfaMethodTotpName" }, "task": true }, { "name": "postSysMfaMethodTotpNameAdminDestroy", "summary": "Deletes the TOTP secret for the given method name on the given entity.", "description": "Deletes the TOTP secret for the given method name on the given entity.", "input": [ { "name": "name", "type": "string", "info": "Name of the MFA method.: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"entity_id\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "entity_id": { "type": "string", "description": "Identifier of the entity from which the MFA method secret needs to be removed." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysMfaMethodTotpNameAdminDestroy" }, "task": true }, { "name": "postSysMfaMethodTotpNameAdminGenerate", "summary": "Generates a TOTP secret for the given method name on the given entity.", "description": "Generates a TOTP secret for the given method name on the given entity.", "input": [ { "name": "name", "type": "string", "info": "Name of the MFA method.: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"entity_id\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "entity_id": { "type": "string", "description": "Entity ID on which the generated secret needs to get stored." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysMfaMethodTotpNameAdminGenerate" }, "task": true }, { "name": "getSysMfaMethodTotpNameGenerate", "summary": "Generates a TOTP secret for the given method name on the entity of the\n\t\tcalling token.", "description": "Generates a TOTP secret for the given method name on the entity of the\n\t\tcalling token.", "input": [ { "name": "name", "type": "string", "info": "Name of the MFA method.: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSysMfaMethodTotpNameGenerate" }, "task": true }, { "name": "getSysMonitor", "summary": "getSysMonitor", "description": "getSysMonitor", "input": [ { "name": "logLevel", "type": "string", "info": "Log level to view system logs at. Currently supported values are \"trace\", \"debug\", \"info\", \"warn\", \"error\".: string", "required": false, "schema": { "title": "logLevel", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSysMonitor" }, "task": true }, { "name": "getSysMounts", "summary": "List the currently mounted backends.", "description": "List the currently mounted backends.", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/getSysMounts" }, "task": true }, { "name": "postSysMountsPath", "summary": "Enable a new secrets engine at the given path.", "description": "Enable a new secrets engine at the given path.", "input": [ { "name": "pathParam", "type": "string", "info": "The path to mount to. Example: \"aws/east\": string", "required": true, "schema": { "title": "pathParam", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"config\": \"object\", \"description\": \"string\", \"external_entropy_access\": \"boolean\", \"local\": \"boolean\", \"options\": \"object\", \"plugin_name\": \"string\", \"seal_wrap\": \"boolean\", \"type\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "config": { "type": "object", "description": "Configuration for this mount, such as default_lease_ttl and max_lease_ttl." }, "description": { "type": "string", "description": "User-friendly description for this mount." }, "external_entropy_access": { "type": "boolean", "description": "Whether to give the mount access to Vault's external entropy.", "default": false }, "local": { "type": "boolean", "description": "Mark the mount as a local mount, which is not replicated and is unaffected by replication.", "default": false }, "options": { "type": "object", "description": "The options to pass into the backend. Should be a json object with string keys and values." }, "plugin_name": { "type": "string", "description": "Name of the plugin to mount based from the name registered in the plugin catalog." }, "seal_wrap": { "type": "boolean", "description": "Whether to turn on seal wrapping for the mount.", "default": false }, "type": { "type": "string", "description": "The type of the backend. Example: \"passthrough\"" } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysMountsPath" }, "task": true }, { "name": "deleteSysMountsPath", "summary": "Disable the mount point specified at the given path.", "description": "Disable the mount point specified at the given path.", "input": [ { "name": "pathParam", "type": "string", "info": "The path to mount to. Example: \"aws/east\": string", "required": true, "schema": { "title": "pathParam", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteSysMountsPath" }, "task": true }, { "name": "getSysMountsPathTune", "summary": "Tune backend configuration parameters for this mount.", "description": "Tune backend configuration parameters for this mount.", "input": [ { "name": "pathParam", "type": "string", "info": "The path to mount to. Example: \"aws/east\": string", "required": true, "schema": { "title": "pathParam", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSysMountsPathTune" }, "task": true }, { "name": "postSysMountsPathTune", "summary": "Tune backend configuration parameters for this mount.", "description": "Tune backend configuration parameters for this mount.", "input": [ { "name": "pathParam", "type": "string", "info": "The path to mount to. Example: \"aws/east\": string", "required": true, "schema": { "title": "pathParam", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"allowed_response_headers\": \"array\", \"audit_non_hmac_request_keys\": \"array\", \"audit_non_hmac_response_keys\": \"array\", \"default_lease_ttl\": \"string\", \"description\": \"string\", \"listing_visibility\": \"string\", \"max_lease_ttl\": \"string\", \"options\": \"object\", \"passthrough_request_headers\": \"array\", \"token_type\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "allowed_response_headers": { "type": "array", "description": "A list of headers to whitelist and allow a plugin to set on responses.", "items": { "type": "string" } }, "audit_non_hmac_request_keys": { "type": "array", "description": "The list of keys in the request data object that will not be HMAC'ed by audit devices.", "items": { "type": "string" } }, "audit_non_hmac_response_keys": { "type": "array", "description": "The list of keys in the response data object that will not be HMAC'ed by audit devices.", "items": { "type": "string" } }, "default_lease_ttl": { "type": "string", "description": "The default lease TTL for this mount." }, "description": { "type": "string", "description": "User-friendly description for this credential backend." }, "listing_visibility": { "type": "string", "description": "Determines the visibility of the mount in the UI-specific listing endpoint. Accepted value are 'unauth' and ''." }, "max_lease_ttl": { "type": "string", "description": "The max lease TTL for this mount." }, "options": { "type": "object", "description": "The options to pass into the backend. Should be a json object with string keys and values." }, "passthrough_request_headers": { "type": "array", "description": "A list of headers to whitelist and pass from the request to the plugin.", "items": { "type": "string" } }, "token_type": { "type": "string", "description": "The type of token to issue (service or batch)." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysMountsPathTune" }, "task": true }, { "name": "getSysNamespaces", "summary": "getSysNamespaces", "description": "getSysNamespaces", "input": [ { "name": "list", "type": "string", "info": "Return a list if `true`: string", "required": false, "schema": { "title": "list", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSysNamespaces" }, "task": true }, { "name": "getSysNamespacesPath", "summary": "getSysNamespacesPath", "description": "getSysNamespacesPath", "input": [ { "name": "pathParam", "type": "string", "info": "Path of the namespace.: string", "required": true, "schema": { "title": "pathParam", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSysNamespacesPath" }, "task": true }, { "name": "postSysNamespacesPath", "summary": "postSysNamespacesPath", "description": "postSysNamespacesPath", "input": [ { "name": "pathParam", "type": "string", "info": "Path of the namespace.: string", "required": true, "schema": { "title": "pathParam", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysNamespacesPath" }, "task": true }, { "name": "deleteSysNamespacesPath", "summary": "deleteSysNamespacesPath", "description": "deleteSysNamespacesPath", "input": [ { "name": "pathParam", "type": "string", "info": "Path of the namespace.: string", "required": true, "schema": { "title": "pathParam", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteSysNamespacesPath" }, "task": true }, { "name": "getSysPluginsCatalog", "summary": "Lists all the plugins known to Vault", "description": "Lists all the plugins known to Vault", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/getSysPluginsCatalog" }, "task": true }, { "name": "getSysPluginsCatalogName", "summary": "Return the configuration data for the plugin with the given name.", "description": "Return the configuration data for the plugin with the given name.", "input": [ { "name": "name", "type": "string", "info": "The name of the plugin: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSysPluginsCatalogName" }, "task": true }, { "name": "postSysPluginsCatalogName", "summary": "Register a new plugin, or updates an existing one with the supplied name.", "description": "Register a new plugin, or updates an existing one with the supplied name.", "input": [ { "name": "name", "type": "string", "info": "The name of the plugin: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"args\": \"array\", \"command\": \"string\", \"env\": \"array\", \"sha256\": \"string\", \"sha_256\": \"string\", \"type\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "args": { "type": "array", "description": "The args passed to plugin command.", "items": { "type": "string" } }, "command": { "type": "string", "description": "The command used to start the plugin. The executable defined in this command must exist in vault's plugin directory." }, "env": { "type": "array", "description": "The environment variables passed to plugin command. Each entry is of the form \"key=value\".", "items": { "type": "string" } }, "sha256": { "type": "string", "description": "The SHA256 sum of the executable used in the command field. This should be HEX encoded." }, "sha_256": { "type": "string", "description": "The SHA256 sum of the executable used in the command field. This should be HEX encoded." }, "type": { "type": "string", "description": "The type of the plugin, may be auth, secret, or database" } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysPluginsCatalogName" }, "task": true }, { "name": "deleteSysPluginsCatalogName", "summary": "Remove the plugin with the given name.", "description": "Remove the plugin with the given name.", "input": [ { "name": "name", "type": "string", "info": "The name of the plugin: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteSysPluginsCatalogName" }, "task": true }, { "name": "getSysPluginsCatalogType", "summary": "List the plugins in the catalog.", "description": "List the plugins in the catalog.", "input": [ { "name": "type", "type": "string", "info": "The type of the plugin, may be auth, secret, or database: string", "required": true, "schema": { "title": "type", "type": "string" } }, { "name": "list", "type": "string", "info": "Return a list if `true`: string", "required": false, "schema": { "title": "list", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSysPluginsCatalogType" }, "task": true }, { "name": "getSysPluginsCatalogTypeName", "summary": "Return the configuration data for the plugin with the given name.", "description": "Return the configuration data for the plugin with the given name.", "input": [ { "name": "name", "type": "string", "info": "The name of the plugin: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "type", "type": "string", "info": "The type of the plugin, may be auth, secret, or database: string", "required": true, "schema": { "title": "type", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSysPluginsCatalogTypeName" }, "task": true }, { "name": "postSysPluginsCatalogTypeName", "summary": "Register a new plugin, or updates an existing one with the supplied name.", "description": "Register a new plugin, or updates an existing one with the supplied name.", "input": [ { "name": "name", "type": "string", "info": "The name of the plugin: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "type", "type": "string", "info": "The type of the plugin, may be auth, secret, or database: string", "required": true, "schema": { "title": "type", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"args\": \"array\", \"command\": \"string\", \"env\": \"array\", \"sha256\": \"string\", \"sha_256\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "args": { "type": "array", "description": "The args passed to plugin command.", "items": { "type": "string" } }, "command": { "type": "string", "description": "The command used to start the plugin. The executable defined in this command must exist in vault's plugin directory." }, "env": { "type": "array", "description": "The environment variables passed to plugin command. Each entry is of the form \"key=value\".", "items": { "type": "string" } }, "sha256": { "type": "string", "description": "The SHA256 sum of the executable used in the command field. This should be HEX encoded." }, "sha_256": { "type": "string", "description": "The SHA256 sum of the executable used in the command field. This should be HEX encoded." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysPluginsCatalogTypeName" }, "task": true }, { "name": "deleteSysPluginsCatalogTypeName", "summary": "Remove the plugin with the given name.", "description": "Remove the plugin with the given name.", "input": [ { "name": "name", "type": "string", "info": "The name of the plugin: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "type", "type": "string", "info": "The type of the plugin, may be auth, secret, or database: string", "required": true, "schema": { "title": "type", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteSysPluginsCatalogTypeName" }, "task": true }, { "name": "postSysPluginsReloadBackend", "summary": "Reload mounted plugin backends.", "description": "Either the plugin name (`plugin`) or the desired plugin backend mounts (`mounts`) must be provided, but not both. In the case that the plugin name is provided, all mounted paths that use that plugin backend will be reloaded. If (`scope`) is provided and is (`global`), the plugin(s) are reloaded globally.", "input": [ { "name": "body", "type": "object", "info": ": {\"mounts\": \"array\", \"plugin\": \"string\", \"scope\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "mounts": { "type": "array", "description": "The mount paths of the plugin backends to reload.", "items": { "type": "string" } }, "plugin": { "type": "string", "description": "The name of the plugin to reload, as registered in the plugin catalog." }, "scope": { "type": "string" } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysPluginsReloadBackend" }, "task": true }, { "name": "getSysPluginsReloadBackendStatus", "summary": "Get the status of a cluster-scoped reload.", "description": "The reload_id returned by a cluster scoped reload must be provided.", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/getSysPluginsReloadBackendStatus" }, "task": true }, { "name": "getSysPoliciesAcl", "summary": "List the configured access control policies.", "description": "List the configured access control policies.", "input": [ { "name": "list", "type": "string", "info": "Return a list if `true`: string", "required": false, "schema": { "title": "list", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSysPoliciesAcl" }, "task": true }, { "name": "getSysPoliciesAclName", "summary": "Retrieve information about the named ACL policy.", "description": "Retrieve information about the named ACL policy.", "input": [ { "name": "name", "type": "string", "info": "The name of the policy. Example: \"ops\": string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSysPoliciesAclName" }, "task": true }, { "name": "postSysPoliciesAclName", "summary": "Add a new or update an existing ACL policy.", "description": "Add a new or update an existing ACL policy.", "input": [ { "name": "name", "type": "string", "info": "The name of the policy. Example: \"ops\": string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"policy\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "policy": { "type": "string", "description": "The rules of the policy." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysPoliciesAclName" }, "task": true }, { "name": "deleteSysPoliciesAclName", "summary": "Delete the ACL policy with the given name.", "description": "Delete the ACL policy with the given name.", "input": [ { "name": "name", "type": "string", "info": "The name of the policy. Example: \"ops\": string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteSysPoliciesAclName" }, "task": true }, { "name": "getSysPoliciesEgp", "summary": "List the configured access control policies.", "description": "List the configured access control policies.", "input": [ { "name": "list", "type": "string", "info": "Return a list if `true`: string", "required": false, "schema": { "title": "list", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSysPoliciesEgp" }, "task": true }, { "name": "getSysPoliciesEgpName", "summary": "Read, Modify, or Delete an access control policy.", "description": "Read, Modify, or Delete an access control policy.", "input": [ { "name": "name", "type": "string", "info": "The name of the policy. Example: \"ops\": string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSysPoliciesEgpName" }, "task": true }, { "name": "postSysPoliciesEgpName", "summary": "Read, Modify, or Delete an access control policy.", "description": "Read, Modify, or Delete an access control policy.", "input": [ { "name": "name", "type": "string", "info": "The name of the policy. Example: \"ops\": string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"enforcement_level\": \"string\", \"paths\": \"array\", \"policy\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "enforcement_level": { "type": "string", "description": "The enforcement level to apply to the policy." }, "paths": { "type": "array", "description": "The paths on which the policy should be applied.", "items": { "type": "string" } }, "policy": { "type": "string", "description": "The rules of the policy." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysPoliciesEgpName" }, "task": true }, { "name": "deleteSysPoliciesEgpName", "summary": "Read, Modify, or Delete an access control policy.", "description": "Read, Modify, or Delete an access control policy.", "input": [ { "name": "name", "type": "string", "info": "The name of the policy. Example: \"ops\": string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteSysPoliciesEgpName" }, "task": true }, { "name": "getSysPoliciesPasswordName", "summary": "Retrieve an existing password policy.", "description": "Retrieve an existing password policy.", "input": [ { "name": "name", "type": "string", "info": "The name of the password policy.: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSysPoliciesPasswordName" }, "task": true }, { "name": "postSysPoliciesPasswordName", "summary": "Add a new or update an existing password policy.", "description": "Add a new or update an existing password policy.", "input": [ { "name": "name", "type": "string", "info": "The name of the password policy.: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"policy\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "policy": { "type": "string", "description": "The password policy" } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysPoliciesPasswordName" }, "task": true }, { "name": "deleteSysPoliciesPasswordName", "summary": "Delete a password policy.", "description": "Delete a password policy.", "input": [ { "name": "name", "type": "string", "info": "The name of the password policy.: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteSysPoliciesPasswordName" }, "task": true }, { "name": "getSysPoliciesPasswordNameGenerate", "summary": "Generate a password from an existing password policy.", "description": "Generate a password from an existing password policy.", "input": [ { "name": "name", "type": "string", "info": "The name of the password policy.: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSysPoliciesPasswordNameGenerate" }, "task": true }, { "name": "getSysPoliciesRgp", "summary": "List the configured access control policies.", "description": "List the configured access control policies.", "input": [ { "name": "list", "type": "string", "info": "Return a list if `true`: string", "required": false, "schema": { "title": "list", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSysPoliciesRgp" }, "task": true }, { "name": "getSysPoliciesRgpName", "summary": "Read, Modify, or Delete an access control policy.", "description": "Read, Modify, or Delete an access control policy.", "input": [ { "name": "name", "type": "string", "info": "The name of the policy. Example: \"ops\": string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSysPoliciesRgpName" }, "task": true }, { "name": "postSysPoliciesRgpName", "summary": "Read, Modify, or Delete an access control policy.", "description": "Read, Modify, or Delete an access control policy.", "input": [ { "name": "name", "type": "string", "info": "The name of the policy. Example: \"ops\": string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"enforcement_level\": \"string\", \"policy\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "enforcement_level": { "type": "string", "description": "The enforcement level to apply to the policy." }, "policy": { "type": "string", "description": "The rules of the policy." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysPoliciesRgpName" }, "task": true }, { "name": "deleteSysPoliciesRgpName", "summary": "Read, Modify, or Delete an access control policy.", "description": "Read, Modify, or Delete an access control policy.", "input": [ { "name": "name", "type": "string", "info": "The name of the policy. Example: \"ops\": string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteSysPoliciesRgpName" }, "task": true }, { "name": "getSysPolicy", "summary": "List the configured access control policies.", "description": "List the configured access control policies.", "input": [ { "name": "list", "type": "string", "info": "Return a list if `true`: string", "required": false, "schema": { "title": "list", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSysPolicy" }, "task": true }, { "name": "getSysPolicyName", "summary": "Retrieve the policy body for the named policy.", "description": "Retrieve the policy body for the named policy.", "input": [ { "name": "name", "type": "string", "info": "The name of the policy. Example: \"ops\": string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSysPolicyName" }, "task": true }, { "name": "postSysPolicyName", "summary": "Add a new or update an existing policy.", "description": "Add a new or update an existing policy.", "input": [ { "name": "name", "type": "string", "info": "The name of the policy. Example: \"ops\": string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"policy\": \"string\", \"rules\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "policy": { "type": "string", "description": "The rules of the policy." }, "rules": { "type": "string", "description": "The rules of the policy.", "deprecated": true } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysPolicyName" }, "task": true }, { "name": "deleteSysPolicyName", "summary": "Delete the policy with the given name.", "description": "Delete the policy with the given name.", "input": [ { "name": "name", "type": "string", "info": "The name of the policy. Example: \"ops\": string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteSysPolicyName" }, "task": true }, { "name": "getSysPprof", "summary": "Returns an HTML page listing the available profiles.", "description": "Returns an HTML page listing the available\nprofiles. This should be mainly accessed via browsers or applications that can\nrender pages.", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/getSysPprof" }, "task": true }, { "name": "getSysPprofCmdline", "summary": "Returns the running program's command line.", "description": "Returns the running program's command line, with arguments separated by NUL bytes.", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/getSysPprofCmdline" }, "task": true }, { "name": "getSysPprofGoroutine", "summary": "Returns stack traces of all current goroutines.", "description": "Returns stack traces of all current goroutines.", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/getSysPprofGoroutine" }, "task": true }, { "name": "getSysPprofHeap", "summary": "Returns a sampling of memory allocations of live object.", "description": "Returns a sampling of memory allocations of live object.", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/getSysPprofHeap" }, "task": true }, { "name": "getSysPprofProfile", "summary": "Returns a pprof-formatted cpu profile payload.", "description": "Returns a pprof-formatted cpu profile payload. Profiling lasts for duration specified in seconds GET parameter, or for 30 seconds if not specified.", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/getSysPprofProfile" }, "task": true }, { "name": "getSysPprofSymbol", "summary": "Returns the program counters listed in the request.", "description": "Returns the program counters listed in the request.", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/getSysPprofSymbol" }, "task": true }, { "name": "getSysPprofTrace", "summary": "Returns the execution trace in binary form.", "description": "Returns the execution trace in binary form. Tracing lasts for duration specified in seconds GET parameter, or for 1 second if not specified.", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/getSysPprofTrace" }, "task": true }, { "name": "getSysQuotasConfig", "summary": "getSysQuotasConfig", "description": "getSysQuotasConfig", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/getSysQuotasConfig" }, "task": true }, { "name": "postSysQuotasConfig", "summary": "postSysQuotasConfig", "description": "postSysQuotasConfig", "input": [ { "name": "body", "type": "object", "info": ": {\"enable_rate_limit_audit_logging\": \"boolean\"}", "required": false, "schema": { "type": "object", "properties": { "enable_rate_limit_audit_logging": { "type": "boolean", "description": "If set, starts audit logging of requests that get rejected due to rate limit quota rule violations." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysQuotasConfig" }, "task": true }, { "name": "getSysQuotasLeaseCount", "summary": "getSysQuotasLeaseCount", "description": "getSysQuotasLeaseCount", "input": [ { "name": "list", "type": "string", "info": "Return a list if `true`: string", "required": false, "schema": { "title": "list", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSysQuotasLeaseCount" }, "task": true }, { "name": "getSysQuotasLeaseCountName", "summary": "getSysQuotasLeaseCountName", "description": "getSysQuotasLeaseCountName", "input": [ { "name": "name", "type": "string", "info": "Name of the quota rule.: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSysQuotasLeaseCountName" }, "task": true }, { "name": "postSysQuotasLeaseCountName", "summary": "postSysQuotasLeaseCountName", "description": "postSysQuotasLeaseCountName", "input": [ { "name": "name", "type": "string", "info": "Name of the quota rule.: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"max_leases\": 123, \"path\": \"string\", \"type\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "max_leases": { "type": "integer", "description": "Maximum number of leases allowed by the quota rule." }, "path": { "type": "string", "description": "Path including the applicable namespace prefix." }, "type": { "type": "string", "description": "Type of the quota rule." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysQuotasLeaseCountName" }, "task": true }, { "name": "deleteSysQuotasLeaseCountName", "summary": "deleteSysQuotasLeaseCountName", "description": "deleteSysQuotasLeaseCountName", "input": [ { "name": "name", "type": "string", "info": "Name of the quota rule.: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteSysQuotasLeaseCountName" }, "task": true }, { "name": "getSysQuotasRateLimit", "summary": "getSysQuotasRateLimit", "description": "getSysQuotasRateLimit", "input": [ { "name": "list", "type": "string", "info": "Return a list if `true`: string", "required": false, "schema": { "title": "list", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSysQuotasRateLimit" }, "task": true }, { "name": "getSysQuotasRateLimitName", "summary": "getSysQuotasRateLimitName", "description": "getSysQuotasRateLimitName", "input": [ { "name": "name", "type": "string", "info": "Name of the quota rule.: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSysQuotasRateLimitName" }, "task": true }, { "name": "postSysQuotasRateLimitName", "summary": "postSysQuotasRateLimitName", "description": "postSysQuotasRateLimitName", "input": [ { "name": "name", "type": "string", "info": "Name of the quota rule.: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"path\": \"string\", \"rate\": \"undefined\", \"type\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "path": { "type": "string", "description": "Path of the mount or namespace to apply the quota. A blank path configures a global quota. For example namespace1/ adds a quota to a full namespace, namespace1/auth/userpass adds a quota to userpass in namespace1." }, "rate": { "description": "The maximum number of requests at any given second to be allowed by the quota rule. The 'rate' must be positive." }, "type": { "type": "string", "description": "Type of the quota rule." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysQuotasRateLimitName" }, "task": true }, { "name": "deleteSysQuotasRateLimitName", "summary": "deleteSysQuotasRateLimitName", "description": "deleteSysQuotasRateLimitName", "input": [ { "name": "name", "type": "string", "info": "Name of the quota rule.: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteSysQuotasRateLimitName" }, "task": true }, { "name": "getSysRekeyBackup", "summary": "Return the backup copy of PGP-encrypted unseal keys.", "description": "Return the backup copy of PGP-encrypted unseal keys.", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/getSysRekeyBackup" }, "task": true }, { "name": "deleteSysRekeyBackup", "summary": "Delete the backup copy of PGP-encrypted unseal keys.", "description": "Delete the backup copy of PGP-encrypted unseal keys.", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/deleteSysRekeyBackup" }, "task": true }, { "name": "getSysRekeyInit", "summary": "Reads the configuration and progress of the current rekey attempt.", "description": "Reads the configuration and progress of the current rekey attempt.", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/getSysRekeyInit" }, "task": true }, { "name": "postSysRekeyInit", "summary": "Initializes a new rekey attempt.", "description": "Only a single rekey attempt can take place at a time, and changing the parameters of a rekey requires canceling and starting a new rekey, which will also provide a new nonce.", "input": [ { "name": "body", "type": "object", "info": ": {\"backup\": \"boolean\", \"pgp_keys\": \"array\", \"require_verification\": \"boolean\", \"secret_shares\": 123, \"secret_threshold\": 123}", "required": false, "schema": { "type": "object", "properties": { "backup": { "type": "boolean", "description": "Specifies if using PGP-encrypted keys, whether Vault should also store a plaintext backup of the PGP-encrypted keys." }, "pgp_keys": { "type": "array", "description": "Specifies an array of PGP public keys used to encrypt the output unseal keys. Ordering is preserved. The keys must be base64-encoded from their original binary representation. The size of this array must be the same as secret_shares.", "items": { "type": "string" } }, "require_verification": { "type": "boolean", "description": "Turns on verification functionality" }, "secret_shares": { "type": "integer", "description": "Specifies the number of shares to split the master key into." }, "secret_threshold": { "type": "integer", "description": "Specifies the number of shares required to reconstruct the master key. This must be less than or equal secret_shares. If using Vault HSM with auto-unsealing, this value must be the same as secret_shares." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysRekeyInit" }, "task": true }, { "name": "deleteSysRekeyInit", "summary": "Cancels any in-progress rekey.", "description": "This clears the rekey settings as well as any progress made. This must be called to change the parameters of the rekey. Note: verification is still a part of a rekey. If rekeying is canceled during the verification flow, the current unseal keys remain valid.", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/deleteSysRekeyInit" }, "task": true }, { "name": "getSysRekeyRecoveryKeyBackup", "summary": "Allows fetching or deleting the backup of the rotated unseal keys.", "description": "Allows fetching or deleting the backup of the rotated unseal keys.", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/getSysRekeyRecoveryKeyBackup" }, "task": true }, { "name": "deleteSysRekeyRecoveryKeyBackup", "summary": "Allows fetching or deleting the backup of the rotated unseal keys.", "description": "Allows fetching or deleting the backup of the rotated unseal keys.", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/deleteSysRekeyRecoveryKeyBackup" }, "task": true }, { "name": "postSysRekeyUpdate", "summary": "Enter a single master key share to progress the rekey of the Vault.", "description": "Enter a single master key share to progress the rekey of the Vault.", "input": [ { "name": "body", "type": "object", "info": ": {\"key\": \"string\", \"nonce\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "key": { "type": "string", "description": "Specifies a single master key share." }, "nonce": { "type": "string", "description": "Specifies the nonce of the rekey attempt." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysRekeyUpdate" }, "task": true }, { "name": "getSysRekeyVerify", "summary": "Read the configuration and progress of the current rekey verification attempt.", "description": "Read the configuration and progress of the current rekey verification attempt.", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/getSysRekeyVerify" }, "task": true }, { "name": "postSysRekeyVerify", "summary": "Enter a single new key share to progress the rekey verification operation.", "description": "Enter a single new key share to progress the rekey verification operation.", "input": [ { "name": "body", "type": "object", "info": ": {\"key\": \"string\", \"nonce\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "key": { "type": "string", "description": "Specifies a single master share key from the new set of shares." }, "nonce": { "type": "string", "description": "Specifies the nonce of the rekey verification operation." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysRekeyVerify" }, "task": true }, { "name": "deleteSysRekeyVerify", "summary": "Cancel any in-progress rekey verification operation.", "description": "This clears any progress made and resets the nonce. Unlike a `DELETE` against `sys/rekey/init`, this only resets the current verification operation, not the entire rekey atttempt.", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/deleteSysRekeyVerify" }, "task": true }, { "name": "postSysRemount", "summary": "Move the mount point of an already-mounted backend.", "description": "Move the mount point of an already-mounted backend.", "input": [ { "name": "body", "type": "object", "info": ": {\"from\": \"string\", \"to\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "from": { "type": "string", "description": "The previous mount point." }, "to": { "type": "string", "description": "The new mount point." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysRemount" }, "task": true }, { "name": "postSysRenew", "summary": "Renews a lease, requesting to extend the lease.", "description": "Renews a lease, requesting to extend the lease.", "input": [ { "name": "body", "type": "object", "info": ": {\"increment\": 123, \"lease_id\": \"string\", \"url_lease_id\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "increment": { "type": "integer", "description": "The desired increment in seconds to the lease" }, "lease_id": { "type": "string", "description": "The lease identifier to renew. This is included with a lease." }, "url_lease_id": { "type": "string", "description": "The lease identifier to renew. This is included with a lease." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysRenew" }, "task": true }, { "name": "postSysRenewUrlLeaseId", "summary": "Renews a lease, requesting to extend the lease.", "description": "Renews a lease, requesting to extend the lease.", "input": [ { "name": "urlLeaseId", "type": "string", "info": "The lease identifier to renew. This is included with a lease.: string", "required": true, "schema": { "title": "urlLeaseId", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"increment\": 123, \"lease_id\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "increment": { "type": "integer", "description": "The desired increment in seconds to the lease" }, "lease_id": { "type": "string", "description": "The lease identifier to renew. This is included with a lease." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysRenewUrlLeaseId" }, "task": true }, { "name": "postSysReplicationDrPrimaryDemote", "summary": "postSysReplicationDrPrimaryDemote", "description": "postSysReplicationDrPrimaryDemote", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/postSysReplicationDrPrimaryDemote" }, "task": true }, { "name": "postSysReplicationDrPrimaryDisable", "summary": "postSysReplicationDrPrimaryDisable", "description": "postSysReplicationDrPrimaryDisable", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/postSysReplicationDrPrimaryDisable" }, "task": true }, { "name": "postSysReplicationDrPrimaryEnable", "summary": "postSysReplicationDrPrimaryEnable", "description": "postSysReplicationDrPrimaryEnable", "input": [ { "name": "body", "type": "object", "info": ": {\"primary_cluster_addr\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "primary_cluster_addr": { "type": "string", "description": "The address the secondary cluster should connect to. Defaults to the primary's cluster address." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysReplicationDrPrimaryEnable" }, "task": true }, { "name": "postSysReplicationDrPrimaryRevokeSecondary", "summary": "postSysReplicationDrPrimaryRevokeSecondary", "description": "postSysReplicationDrPrimaryRevokeSecondary", "input": [ { "name": "body", "type": "object", "info": ": {\"id\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "id": { "type": "string", "description": "The secondary cluster ID to revoke" } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysReplicationDrPrimaryRevokeSecondary" }, "task": true }, { "name": "postSysReplicationDrPrimarySecondaryToken", "summary": "postSysReplicationDrPrimarySecondaryToken", "description": "postSysReplicationDrPrimarySecondaryToken", "input": [ { "name": "body", "type": "object", "info": ": {\"id\": \"string\", \"secondary_public_key\": \"string\", \"ttl\": 123}", "required": false, "schema": { "type": "object", "properties": { "id": { "type": "string", "description": "An opaque identifier that can be used to identify and revoke a secondary cluster's access later." }, "secondary_public_key": { "type": "string", "description": "A base64-encoded public key generated by the secondary cluster." }, "ttl": { "type": "integer", "description": "The TTL to use for the secondary activation token. Defaults to 30 minutes.", "default": "30m" } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysReplicationDrPrimarySecondaryToken" }, "task": true }, { "name": "postSysReplicationDrSecondaryDisable", "summary": "postSysReplicationDrSecondaryDisable", "description": "postSysReplicationDrSecondaryDisable", "input": [ { "name": "body", "type": "object", "info": ": {\"dr_operation_token\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "dr_operation_token": { "type": "string", "description": "DR operation token used to authorize this request." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysReplicationDrSecondaryDisable" }, "task": true }, { "name": "postSysReplicationDrSecondaryEnable", "summary": "postSysReplicationDrSecondaryEnable", "description": "postSysReplicationDrSecondaryEnable", "input": [ { "name": "body", "type": "object", "info": ": {\"ca_file\": \"string\", \"ca_path\": \"string\", \"client_cert_pem\": \"string\", \"client_key_pem\": \"string\", \"primary_api_addr\": \"string\", \"token\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "ca_file": { "type": "string", "description": "A path to a file containing a PEM-encoded CA certificate to verify the call against the primary's API address" }, "ca_path": { "type": "string", "description": "A path to a directory containing PEM-encoded CA certificates to verify the call against the primary's API address" }, "client_cert_pem": { "type": "string", "description": "The client certificate to use for authentication, in PEM format. Note: client authentication for this operation will always use TLS 1.2 or higher." }, "client_key_pem": { "type": "string", "description": "The client key to use for authentication, in PEM format." }, "primary_api_addr": { "type": "string", "description": "The API address of the primary. If not set, the value the primary supplies in the token will be used, which is the primary's redirect address." }, "token": { "type": "string", "description": "The token given by the primary to activate secondary status for this cluster." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysReplicationDrSecondaryEnable" }, "task": true }, { "name": "postSysReplicationDrSecondaryGeneratePublicKey", "summary": "postSysReplicationDrSecondaryGeneratePublicKey", "description": "postSysReplicationDrSecondaryGeneratePublicKey", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/postSysReplicationDrSecondaryGeneratePublicKey" }, "task": true }, { "name": "getSysReplicationDrSecondaryLicense", "summary": "The path responds to the following HTTP methods.\n\n GET /\n Returns information on the inst", "description": "The path responds to the following HTTP methods.\n\n GET /\n Returns information on the installed license\n\n POST\n Sets the license for the server", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/getSysReplicationDrSecondaryLicense" }, "task": true }, { "name": "postSysReplicationDrSecondaryLicense", "summary": "The path responds to the following HTTP methods.\n\n GET /\n Returns information on the inst", "description": "The path responds to the following HTTP methods.\n\n GET /\n Returns information on the installed license\n\n POST\n Sets the license for the server", "input": [ { "name": "body", "type": "object", "info": ": {\"dr_operation_token\": \"string\", \"text\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "dr_operation_token": { "type": "string", "description": "DR operation token used to authorize this request." }, "text": { "type": "string", "description": "The text of the license." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysReplicationDrSecondaryLicense" }, "task": true }, { "name": "postSysReplicationDrSecondaryOperationTokenDelete", "summary": "postSysReplicationDrSecondaryOperationTokenDelete", "description": "postSysReplicationDrSecondaryOperationTokenDelete", "input": [ { "name": "body", "type": "object", "info": ": {\"dr_operation_token\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "dr_operation_token": { "type": "string", "description": "DR operation token used to authorize this request." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysReplicationDrSecondaryOperationTokenDelete" }, "task": true }, { "name": "postSysReplicationDrSecondaryPromote", "summary": "postSysReplicationDrSecondaryPromote", "description": "postSysReplicationDrSecondaryPromote", "input": [ { "name": "body", "type": "object", "info": ": {\"dr_operation_token\": \"string\", \"force\": \"boolean\", \"primary_cluster_addr\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "dr_operation_token": { "type": "string", "description": "DR operation token used to authorize this request." }, "force": { "type": "boolean", "description": "Set to true if the cluster should be promoted despite replication being in an error state. This could mean some data was not replicated to the secondary" }, "primary_cluster_addr": { "type": "string", "description": "The address the secondary cluster should connect to. Defaults to the primary's cluster address." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysReplicationDrSecondaryPromote" }, "task": true }, { "name": "postSysReplicationDrSecondaryRecover", "summary": "postSysReplicationDrSecondaryRecover", "description": "postSysReplicationDrSecondaryRecover", "input": [ { "name": "body", "type": "object", "info": ": {\"dr_operation_token\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "dr_operation_token": { "type": "string", "description": "DR operation token used to authorize this request." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysReplicationDrSecondaryRecover" }, "task": true }, { "name": "postSysReplicationDrSecondaryReindex", "summary": "postSysReplicationDrSecondaryReindex", "description": "postSysReplicationDrSecondaryReindex", "input": [ { "name": "body", "type": "object", "info": ": {\"diff\": \"boolean\", \"dr_operation_token\": \"string\", \"force\": \"boolean\", \"skip_flush\": \"boolean\"}", "required": false, "schema": { "type": "object", "properties": { "diff": { "type": "boolean", "description": "Enables a slower re-indexing which will perform a key level check to diagnose issues. Defaults false." }, "dr_operation_token": { "type": "string", "description": "DR operation token used to authorize this request." }, "force": { "type": "boolean", "description": "Forces a complete re-indexing which only scans data available in the storage. Defaults false." }, "skip_flush": { "type": "boolean", "description": "Skips the tree flushing stage of the reindex process. This setting can be used to reduce the amount of time the tree is locked during a reindex process. If this node is killed before the full tree has been asynchronously flushed the reindex may not have applied fully and a new reindex may need to be done. Shutting down this node cleanly will cause the tree to be flushed prior to shutdown. Defaults false." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysReplicationDrSecondaryReindex" }, "task": true }, { "name": "postSysReplicationDrSecondaryUpdatePrimary", "summary": "postSysReplicationDrSecondaryUpdatePrimary", "description": "postSysReplicationDrSecondaryUpdatePrimary", "input": [ { "name": "body", "type": "object", "info": ": {\"ca_file\": \"string\", \"ca_path\": \"string\", \"client_cert_pem\": \"string\", \"client_key_pem\": \"string\", \"dr_operation_token\": \"string\", \"primary_api_addr\": \"string\", \"token\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "ca_file": { "type": "string", "description": "A path to a file containing a PEM-encoded CA certificate to verify the call against the primary's API address" }, "ca_path": { "type": "string", "description": "A path to a directory containing PEM-encoded CA certificates to verify the call against the primary's API address" }, "client_cert_pem": { "type": "string", "description": "The client certificate to use for authentication, in PEM format. Note: client authentication for this operation will always use TLS 1.2 or higher." }, "client_key_pem": { "type": "string", "description": "The client key to use for authentication, in PEM format." }, "dr_operation_token": { "type": "string", "description": "DR operation token used to authorize this request." }, "primary_api_addr": { "type": "string", "description": "The API address of the primary. If not set, the value the primary supplies in the token will be used, which is the primary's redirect address." }, "token": { "type": "string", "description": "The token given by the primary to activate secondary status for this cluster." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysReplicationDrSecondaryUpdatePrimary" }, "task": true }, { "name": "getSysReplicationDrStatus", "summary": "getSysReplicationDrStatus", "description": "getSysReplicationDrStatus", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/getSysReplicationDrStatus" }, "task": true }, { "name": "postSysReplicationPerformancePrimaryDemote", "summary": "postSysReplicationPerformancePrimaryDemote", "description": "postSysReplicationPerformancePrimaryDemote", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/postSysReplicationPerformancePrimaryDemote" }, "task": true }, { "name": "postSysReplicationPerformancePrimaryDisable", "summary": "postSysReplicationPerformancePrimaryDisable", "description": "postSysReplicationPerformancePrimaryDisable", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/postSysReplicationPerformancePrimaryDisable" }, "task": true }, { "name": "getSysReplicationPerformancePrimaryDynamicFilterId", "summary": "getSysReplicationPerformancePrimaryDynamicFilterId", "description": "getSysReplicationPerformancePrimaryDynamicFilterId", "input": [ { "name": "id", "type": "string", "info": "The opaque identifier used to identify the secondary.: string", "required": true, "schema": { "title": "id", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSysReplicationPerformancePrimaryDynamicFilterId" }, "task": true }, { "name": "postSysReplicationPerformancePrimaryEnable", "summary": "postSysReplicationPerformancePrimaryEnable", "description": "postSysReplicationPerformancePrimaryEnable", "input": [ { "name": "body", "type": "object", "info": ": {\"primary_cluster_addr\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "primary_cluster_addr": { "type": "string", "description": "The address the secondary cluster should connect to. Defaults to the primary's cluster address." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysReplicationPerformancePrimaryEnable" }, "task": true }, { "name": "getSysReplicationPerformancePrimaryMountFilterId", "summary": "getSysReplicationPerformancePrimaryMountFilterId", "description": "getSysReplicationPerformancePrimaryMountFilterId", "input": [ { "name": "id", "type": "string", "info": "The opaque identifier used to identify the secondary.: string", "required": true, "schema": { "title": "id", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSysReplicationPerformancePrimaryMountFilterId" }, "task": true }, { "name": "postSysReplicationPerformancePrimaryMountFilterId", "summary": "postSysReplicationPerformancePrimaryMountFilterId", "description": "postSysReplicationPerformancePrimaryMountFilterId", "input": [ { "name": "id", "type": "string", "info": "The opaque identifier used to identify the secondary.: string", "required": true, "schema": { "title": "id", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"mode\": \"string\", \"paths\": \"array\"}", "required": false, "schema": { "type": "object", "properties": { "mode": { "type": "string", "description": "The filter mode for the mount paths (whitelist or blacklist). Defaults to whitelist.", "default": "allow" }, "paths": { "type": "array", "description": "The paths to the mount to filter in replication.", "items": { "type": "string" } } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysReplicationPerformancePrimaryMountFilterId" }, "task": true }, { "name": "deleteSysReplicationPerformancePrimaryMountFilterId", "summary": "deleteSysReplicationPerformancePrimaryMountFilterId", "description": "deleteSysReplicationPerformancePrimaryMountFilterId", "input": [ { "name": "id", "type": "string", "info": "The opaque identifier used to identify the secondary.: string", "required": true, "schema": { "title": "id", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteSysReplicationPerformancePrimaryMountFilterId" }, "task": true }, { "name": "getSysReplicationPerformancePrimaryPathsFilterId", "summary": "getSysReplicationPerformancePrimaryPathsFilterId", "description": "getSysReplicationPerformancePrimaryPathsFilterId", "input": [ { "name": "id", "type": "string", "info": "The opaque identifier used to identify the secondary.: string", "required": true, "schema": { "title": "id", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSysReplicationPerformancePrimaryPathsFilterId" }, "task": true }, { "name": "postSysReplicationPerformancePrimaryPathsFilterId", "summary": "postSysReplicationPerformancePrimaryPathsFilterId", "description": "postSysReplicationPerformancePrimaryPathsFilterId", "input": [ { "name": "id", "type": "string", "info": "The opaque identifier used to identify the secondary.: string", "required": true, "schema": { "title": "id", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"mode\": \"string\", \"paths\": \"array\"}", "required": false, "schema": { "type": "object", "properties": { "mode": { "type": "string", "description": "The filter mode for the paths filter (allow or deny). Defaults to allow.", "default": "allow" }, "paths": { "type": "array", "description": "The paths to filter in replication. Must be a mount or a namespace.", "items": { "type": "string" } } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysReplicationPerformancePrimaryPathsFilterId" }, "task": true }, { "name": "deleteSysReplicationPerformancePrimaryPathsFilterId", "summary": "deleteSysReplicationPerformancePrimaryPathsFilterId", "description": "deleteSysReplicationPerformancePrimaryPathsFilterId", "input": [ { "name": "id", "type": "string", "info": "The opaque identifier used to identify the secondary.: string", "required": true, "schema": { "title": "id", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteSysReplicationPerformancePrimaryPathsFilterId" }, "task": true }, { "name": "postSysReplicationPerformancePrimaryRevokeSecondary", "summary": "postSysReplicationPerformancePrimaryRevokeSecondary", "description": "postSysReplicationPerformancePrimaryRevokeSecondary", "input": [ { "name": "body", "type": "object", "info": ": {\"id\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "id": { "type": "string", "description": "The secondary cluster ID to revoke" } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysReplicationPerformancePrimaryRevokeSecondary" }, "task": true }, { "name": "postSysReplicationPerformancePrimarySecondaryToken", "summary": "postSysReplicationPerformancePrimarySecondaryToken", "description": "postSysReplicationPerformancePrimarySecondaryToken", "input": [ { "name": "body", "type": "object", "info": ": {\"id\": \"string\", \"secondary_public_key\": \"string\", \"ttl\": 123}", "required": false, "schema": { "type": "object", "properties": { "id": { "type": "string", "description": "An opaque identifier that can be used to identify and revoke a secondary cluster's access later." }, "secondary_public_key": { "type": "string", "description": "A base64-encoded public key generated by the secondary cluster." }, "ttl": { "type": "integer", "description": "The TTL to use for the secondary activation token. Defaults to 30 minutes.", "default": "30m" } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysReplicationPerformancePrimarySecondaryToken" }, "task": true }, { "name": "postSysReplicationPerformanceSecondaryDisable", "summary": "postSysReplicationPerformanceSecondaryDisable", "description": "postSysReplicationPerformanceSecondaryDisable", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/postSysReplicationPerformanceSecondaryDisable" }, "task": true }, { "name": "getSysReplicationPerformanceSecondaryDynamicFilterId", "summary": "getSysReplicationPerformanceSecondaryDynamicFilterId", "description": "getSysReplicationPerformanceSecondaryDynamicFilterId", "input": [ { "name": "id", "type": "string", "info": "The opaque identifier used to identify the secondary.: string", "required": true, "schema": { "title": "id", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSysReplicationPerformanceSecondaryDynamicFilterId" }, "task": true }, { "name": "postSysReplicationPerformanceSecondaryEnable", "summary": "postSysReplicationPerformanceSecondaryEnable", "description": "postSysReplicationPerformanceSecondaryEnable", "input": [ { "name": "body", "type": "object", "info": ": {\"ca_file\": \"string\", \"ca_path\": \"string\", \"client_cert_pem\": \"string\", \"client_key_pem\": \"string\", \"primary_api_addr\": \"string\", \"token\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "ca_file": { "type": "string", "description": "A path to a file containing a PEM-encoded CA certificate to verify the call against the primary's API address" }, "ca_path": { "type": "string", "description": "A path to a directory containing PEM-encoded CA certificates to verify the call against the primary's API address" }, "client_cert_pem": { "type": "string", "description": "The client certificate to use for authentication, in PEM format. Note: client authentication for this operation will always use TLS 1.2 or higher." }, "client_key_pem": { "type": "string", "description": "The client key to use for authentication, in PEM format." }, "primary_api_addr": { "type": "string", "description": "The API address of the primary. If not set, the value the primary supplies in the token will be used, which is the primary's redirect address." }, "token": { "type": "string", "description": "The token given by the primary to activate secondary status for this cluster." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysReplicationPerformanceSecondaryEnable" }, "task": true }, { "name": "postSysReplicationPerformanceSecondaryGeneratePublicKey", "summary": "postSysReplicationPerformanceSecondaryGeneratePublicKey", "description": "postSysReplicationPerformanceSecondaryGeneratePublicKey", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/postSysReplicationPerformanceSecondaryGeneratePublicKey" }, "task": true }, { "name": "postSysReplicationPerformanceSecondaryPromote", "summary": "postSysReplicationPerformanceSecondaryPromote", "description": "postSysReplicationPerformanceSecondaryPromote", "input": [ { "name": "body", "type": "object", "info": ": {\"force\": \"boolean\", \"primary_cluster_addr\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "force": { "type": "boolean", "description": "Set to true if the cluster should be promoted despite replication being in an error state. This could mean some data was not replicated to the secondary" }, "primary_cluster_addr": { "type": "string", "description": "The address the secondary cluster should connect to. Defaults to the primary's cluster address." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysReplicationPerformanceSecondaryPromote" }, "task": true }, { "name": "postSysReplicationPerformanceSecondaryUpdatePrimary", "summary": "postSysReplicationPerformanceSecondaryUpdatePrimary", "description": "postSysReplicationPerformanceSecondaryUpdatePrimary", "input": [ { "name": "body", "type": "object", "info": ": {\"ca_file\": \"string\", \"ca_path\": \"string\", \"client_cert_pem\": \"string\", \"client_key_pem\": \"string\", \"primary_api_addr\": \"string\", \"token\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "ca_file": { "type": "string", "description": "A path to a file containing a PEM-encoded CA certificate to verify the call against the primary's API address" }, "ca_path": { "type": "string", "description": "A path to a directory containing PEM-encoded CA certificates to verify the call against the primary's API address" }, "client_cert_pem": { "type": "string", "description": "The client certificate to use for authentication, in PEM format. Note: client authentication for this operation will always use TLS 1.2 or higher." }, "client_key_pem": { "type": "string", "description": "The client key to use for authentication, in PEM format." }, "primary_api_addr": { "type": "string", "description": "The API address of the primary. If not set, the value the primary supplies in the token will be used, which is the primary's redirect address." }, "token": { "type": "string", "description": "The token given by the primary to activate secondary status for this cluster." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysReplicationPerformanceSecondaryUpdatePrimary" }, "task": true }, { "name": "getSysReplicationPerformanceStatus", "summary": "getSysReplicationPerformanceStatus", "description": "getSysReplicationPerformanceStatus", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/getSysReplicationPerformanceStatus" }, "task": true }, { "name": "postSysReplicationPrimaryDemote", "summary": "postSysReplicationPrimaryDemote", "description": "postSysReplicationPrimaryDemote", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/postSysReplicationPrimaryDemote" }, "task": true }, { "name": "postSysReplicationPrimaryDisable", "summary": "postSysReplicationPrimaryDisable", "description": "postSysReplicationPrimaryDisable", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/postSysReplicationPrimaryDisable" }, "task": true }, { "name": "postSysReplicationPrimaryEnable", "summary": "postSysReplicationPrimaryEnable", "description": "postSysReplicationPrimaryEnable", "input": [ { "name": "body", "type": "object", "info": ": {\"primary_cluster_addr\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "primary_cluster_addr": { "type": "string", "description": "The address the secondary cluster should connect to. Defaults to the primary's cluster address." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysReplicationPrimaryEnable" }, "task": true }, { "name": "postSysReplicationPrimaryRevokeSecondary", "summary": "postSysReplicationPrimaryRevokeSecondary", "description": "postSysReplicationPrimaryRevokeSecondary", "input": [ { "name": "body", "type": "object", "info": ": {\"id\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "id": { "type": "string", "description": "The secondary cluster ID to revoke" } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysReplicationPrimaryRevokeSecondary" }, "task": true }, { "name": "postSysReplicationPrimarySecondaryToken", "summary": "postSysReplicationPrimarySecondaryToken", "description": "postSysReplicationPrimarySecondaryToken", "input": [ { "name": "body", "type": "object", "info": ": {\"id\": \"string\", \"secondary_public_key\": \"string\", \"ttl\": 123}", "required": false, "schema": { "type": "object", "properties": { "id": { "type": "string", "description": "An opaque identifier that can be used to identify and revoke a secondary cluster's access later." }, "secondary_public_key": { "type": "string", "description": "A base64-encoded public key generated by the secondary cluster." }, "ttl": { "type": "integer", "description": "The TTL to use for the secondary activation token. Defaults to 30 minutes.", "default": "30m" } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysReplicationPrimarySecondaryToken" }, "task": true }, { "name": "postSysReplicationRecover", "summary": "postSysReplicationRecover", "description": "postSysReplicationRecover", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/postSysReplicationRecover" }, "task": true }, { "name": "postSysReplicationReindex", "summary": "postSysReplicationReindex", "description": "postSysReplicationReindex", "input": [ { "name": "body", "type": "object", "info": ": {\"diff\": \"boolean\", \"force\": \"boolean\", \"skip_flush\": \"boolean\"}", "required": false, "schema": { "type": "object", "properties": { "diff": { "type": "boolean", "description": "Enables a slower re-indexing which will perform a key level check to diagnose issues. Defaults false." }, "force": { "type": "boolean", "description": "Forces a complete re-indexing which only scans data available in the storage. Defaults false." }, "skip_flush": { "type": "boolean", "description": "Skips the tree flushing stage of the reindex process. This setting can be used to reduce the amount of time the tree is locked during a reindex process. If this node is killed before the full tree has been asynchronously flushed the reindex may not have applied fully and a new reindex may need to be done. Shutting down this node cleanly will cause the tree to be flushed prior to shutdown. Defaults false." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysReplicationReindex" }, "task": true }, { "name": "postSysReplicationSecondaryDisable", "summary": "postSysReplicationSecondaryDisable", "description": "postSysReplicationSecondaryDisable", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/postSysReplicationSecondaryDisable" }, "task": true }, { "name": "postSysReplicationSecondaryEnable", "summary": "postSysReplicationSecondaryEnable", "description": "postSysReplicationSecondaryEnable", "input": [ { "name": "body", "type": "object", "info": ": {\"ca_file\": \"string\", \"ca_path\": \"string\", \"client_cert_pem\": \"string\", \"client_key_pem\": \"string\", \"primary_api_addr\": \"string\", \"token\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "ca_file": { "type": "string", "description": "A path to a file containing a PEM-encoded CA certificate to verify the call against the primary's API address" }, "ca_path": { "type": "string", "description": "A path to a directory containing PEM-encoded CA certificates to verify the call against the primary's API address" }, "client_cert_pem": { "type": "string", "description": "The client certificate to use for authentication, in PEM format. Note: client authentication for this operation will always use TLS 1.2 or higher." }, "client_key_pem": { "type": "string", "description": "The client key to use for authentication, in PEM format." }, "primary_api_addr": { "type": "string", "description": "The API address of the primary. If not set, the value the primary supplies in the token will be used, which is the primary's redirect address." }, "token": { "type": "string", "description": "The token given by the primary to activate secondary status for this cluster." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysReplicationSecondaryEnable" }, "task": true }, { "name": "postSysReplicationSecondaryPromote", "summary": "postSysReplicationSecondaryPromote", "description": "postSysReplicationSecondaryPromote", "input": [ { "name": "body", "type": "object", "info": ": {\"force\": \"boolean\", \"primary_cluster_addr\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "force": { "type": "boolean", "description": "Set to true if the cluster should be promoted despite replication being in an error state. This could mean some data was not replicated to the secondary" }, "primary_cluster_addr": { "type": "string", "description": "The address the secondary cluster should connect to. Defaults to the primary's cluster address." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysReplicationSecondaryPromote" }, "task": true }, { "name": "postSysReplicationSecondaryUpdatePrimary", "summary": "postSysReplicationSecondaryUpdatePrimary", "description": "postSysReplicationSecondaryUpdatePrimary", "input": [ { "name": "body", "type": "object", "info": ": {\"ca_file\": \"string\", \"ca_path\": \"string\", \"client_cert_pem\": \"string\", \"client_key_pem\": \"string\", \"primary_api_addr\": \"string\", \"token\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "ca_file": { "type": "string", "description": "A path to a file containing a PEM-encoded CA certificate to verify the call against the primary's API address" }, "ca_path": { "type": "string", "description": "A path to a directory containing PEM-encoded CA certificates to verify the call against the primary's API address" }, "client_cert_pem": { "type": "string", "description": "The client certificate to use for authentication, in PEM format. Note: client authentication for this operation will always use TLS 1.2 or higher." }, "client_key_pem": { "type": "string", "description": "The client key to use for authentication, in PEM format." }, "primary_api_addr": { "type": "string", "description": "The API address of the primary. If not set, the value the primary supplies in the token will be used, which is the primary's redirect address." }, "token": { "type": "string", "description": "The token given by the primary to activate secondary status for this cluster." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysReplicationSecondaryUpdatePrimary" }, "task": true }, { "name": "getSysReplicationStatus", "summary": "getSysReplicationStatus", "description": "getSysReplicationStatus", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/getSysReplicationStatus" }, "task": true }, { "name": "postSysRevoke", "summary": "Revokes a lease immediately.", "description": "Revokes a lease immediately.", "input": [ { "name": "body", "type": "object", "info": ": {\"lease_id\": \"string\", \"sync\": \"boolean\", \"url_lease_id\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "lease_id": { "type": "string", "description": "The lease identifier to renew. This is included with a lease." }, "sync": { "type": "boolean", "description": "Whether or not to perform the revocation synchronously", "default": true }, "url_lease_id": { "type": "string", "description": "The lease identifier to renew. This is included with a lease." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysRevoke" }, "task": true }, { "name": "postSysRevokeForcePrefix", "summary": "Revokes all secrets or tokens generated under a given prefix immediately", "description": "Unlike `/sys/leases/revoke-prefix`, this path ignores backend errors encountered during revocation. This is potentially very dangerous and should only be used in specific emergency situations where errors in the backend or the connected backend service prevent normal revocation.\n\nBy ignoring these errors, Vault abdicates responsibility for ensuring that the issued credentials or secrets are properly revoked and/or cleaned up. Access to this endpoint should be tightly controlled.", "input": [ { "name": "prefix", "type": "string", "info": "The path to revoke keys under. Example: \"prod/aws/ops\": string", "required": true, "schema": { "title": "prefix", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysRevokeForcePrefix" }, "task": true }, { "name": "postSysRevokePrefixPrefix", "summary": "Revokes all secrets (via a lease ID prefix) or tokens (via the tokens' path property) generated und", "description": "Revokes all secrets (via a lease ID prefix) or tokens (via the tokens' path property) generated under a given prefix immediately.", "input": [ { "name": "prefix", "type": "string", "info": "The path to revoke keys under. Example: \"prod/aws/ops\": string", "required": true, "schema": { "title": "prefix", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"sync\": \"boolean\"}", "required": false, "schema": { "type": "object", "properties": { "sync": { "type": "boolean", "description": "Whether or not to perform the revocation synchronously", "default": true } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysRevokePrefixPrefix" }, "task": true }, { "name": "postSysRevokeUrlLeaseId", "summary": "Revokes a lease immediately.", "description": "Revokes a lease immediately.", "input": [ { "name": "urlLeaseId", "type": "string", "info": "The lease identifier to renew. This is included with a lease.: string", "required": true, "schema": { "title": "urlLeaseId", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"lease_id\": \"string\", \"sync\": \"boolean\"}", "required": false, "schema": { "type": "object", "properties": { "lease_id": { "type": "string", "description": "The lease identifier to renew. This is included with a lease." }, "sync": { "type": "boolean", "description": "Whether or not to perform the revocation synchronously", "default": true } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysRevokeUrlLeaseId" }, "task": true }, { "name": "postSysRotate", "summary": "Rotates the backend encryption key used to persist data.", "description": "Rotates the backend encryption key used to persist data.", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/postSysRotate" }, "task": true }, { "name": "postSysSeal", "summary": "Seal the Vault.", "description": "Seal the Vault.", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/postSysSeal" }, "task": true }, { "name": "getSysSealStatus", "summary": "Check the seal status of a Vault.", "description": "Check the seal status of a Vault.", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/getSysSealStatus" }, "task": true }, { "name": "getSysSealwrapRewrap", "summary": "Retrieve the state of any ongoing seal rewrap process", "description": "Retrieve the state of any ongoing seal rewrap process", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/getSysSealwrapRewrap" }, "task": true }, { "name": "postSysSealwrapRewrap", "summary": "Start a seal rewrap process", "description": "Start a seal rewrap process", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/postSysSealwrapRewrap" }, "task": true }, { "name": "postSysStepDown", "summary": "Cause the node to give up active status.", "description": "This endpoint forces the node to give up active status. If the node does not have active status, this endpoint does nothing. Note that the node will sleep for ten seconds before attempting to grab the active lock again, but if no standby nodes grab the active lock in the interim, the same node may become the active node again.", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/postSysStepDown" }, "task": true }, { "name": "postSysStorageRaftBootstrapAnswer", "summary": "Accepts an answer from the peer to be joined to the fact cluster.", "description": "Accepts an answer from the peer to be joined to the fact cluster.", "input": [ { "name": "body", "type": "object", "info": ": {\"answer\": \"string\", \"cluster_addr\": \"string\", \"non_voter\": \"boolean\", \"server_id\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "answer": { "type": "string" }, "cluster_addr": { "type": "string" }, "non_voter": { "type": "boolean" }, "server_id": { "type": "string" } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysStorageRaftBootstrapAnswer" }, "task": true }, { "name": "postSysStorageRaftBootstrapChallenge", "summary": "Creates a challenge for the new peer to be joined to the raft cluster.", "description": "Creates a challenge for the new peer to be joined to the raft cluster.", "input": [ { "name": "body", "type": "object", "info": ": {\"server_id\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "server_id": { "type": "string" } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysStorageRaftBootstrapChallenge" }, "task": true }, { "name": "getSysStorageRaftConfiguration", "summary": "Returns the configuration of the raft cluster.", "description": "Returns the configuration of the raft cluster.", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/getSysStorageRaftConfiguration" }, "task": true }, { "name": "postSysStorageRaftRemovePeer", "summary": "Remove a peer from the raft cluster.", "description": "Remove a peer from the raft cluster.", "input": [ { "name": "body", "type": "object", "info": ": {\"server_id\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "server_id": { "type": "string" } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysStorageRaftRemovePeer" }, "task": true }, { "name": "getSysStorageRaftSnapshot", "summary": "Returns a snapshot of the current state of vault.", "description": "Returns a snapshot of the current state of vault.", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/getSysStorageRaftSnapshot" }, "task": true }, { "name": "postSysStorageRaftSnapshot", "summary": "Installs the provided snapshot, returning the cluster to the state defined in it.", "description": "Installs the provided snapshot, returning the cluster to the state defined in it.", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/postSysStorageRaftSnapshot" }, "task": true }, { "name": "postSysStorageRaftSnapshotForce", "summary": "Installs the provided snapshot, returning the cluster to the state defined in it. This bypasses che", "description": "Installs the provided snapshot, returning the cluster to the state defined in it. This bypasses checks ensuring the current Autounseal or Shamir keys are consistent with the snapshot data.", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/postSysStorageRaftSnapshotForce" }, "task": true }, { "name": "postSysToolsHash", "summary": "Generate a hash sum for input data", "description": "Generate a hash sum for input data", "input": [ { "name": "body", "type": "object", "info": ": {\"algorithm\": \"string\", \"format\": \"string\", \"input\": \"string\", \"urlalgorithm\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "algorithm": { "type": "string", "description": "Algorithm to use (POST body parameter). Valid values are: * sha2-224 * sha2-256 * sha2-384 * sha2-512 Defaults to \"sha2-256\".", "default": "sha2-256" }, "format": { "type": "string", "description": "Encoding format to use. Can be \"hex\" or \"base64\". Defaults to \"hex\".", "default": "hex" }, "input": { "type": "string", "description": "The base64-encoded input data" }, "urlalgorithm": { "type": "string", "description": "Algorithm to use (POST URL parameter)" } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysToolsHash" }, "task": true }, { "name": "postSysToolsHashUrlalgorithm", "summary": "Generate a hash sum for input data", "description": "Generate a hash sum for input data", "input": [ { "name": "urlalgorithm", "type": "string", "info": "Algorithm to use (POST URL parameter): string", "required": true, "schema": { "title": "urlalgorithm", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"algorithm\": \"string\", \"format\": \"string\", \"input\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "algorithm": { "type": "string", "description": "Algorithm to use (POST body parameter). Valid values are: * sha2-224 * sha2-256 * sha2-384 * sha2-512 Defaults to \"sha2-256\".", "default": "sha2-256" }, "format": { "type": "string", "description": "Encoding format to use. Can be \"hex\" or \"base64\". Defaults to \"hex\".", "default": "hex" }, "input": { "type": "string", "description": "The base64-encoded input data" } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysToolsHashUrlalgorithm" }, "task": true }, { "name": "postSysToolsRandom", "summary": "Generate random bytes", "description": "Generate random bytes", "input": [ { "name": "body", "type": "object", "info": ": {\"bytes\": 123, \"format\": \"string\", \"urlbytes\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "bytes": { "type": "integer", "description": "The number of bytes to generate (POST body parameter). Defaults to 32 (256 bits).", "default": 32 }, "format": { "type": "string", "description": "Encoding format to use. Can be \"hex\" or \"base64\". Defaults to \"base64\".", "default": "base64" }, "urlbytes": { "type": "string", "description": "The number of bytes to generate (POST URL parameter)" } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysToolsRandom" }, "task": true }, { "name": "postSysToolsRandomUrlbytes", "summary": "Generate random bytes", "description": "Generate random bytes", "input": [ { "name": "urlbytes", "type": "string", "info": "The number of bytes to generate (POST URL parameter): string", "required": true, "schema": { "title": "urlbytes", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"bytes\": 123, \"format\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "bytes": { "type": "integer", "description": "The number of bytes to generate (POST body parameter). Defaults to 32 (256 bits).", "default": 32 }, "format": { "type": "string", "description": "Encoding format to use. Can be \"hex\" or \"base64\". Defaults to \"base64\".", "default": "base64" } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysToolsRandomUrlbytes" }, "task": true }, { "name": "postSysUnseal", "summary": "Unseal the Vault.", "description": "Unseal the Vault.", "input": [ { "name": "body", "type": "object", "info": ": {\"key\": \"string\", \"reset\": \"boolean\"}", "required": false, "schema": { "type": "object", "properties": { "key": { "type": "string", "description": "Specifies a single master key share. This is required unless reset is true." }, "reset": { "type": "boolean", "description": "Specifies if previously-provided unseal keys are discarded and the unseal process is reset." } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysUnseal" }, "task": true }, { "name": "getSysWrappingLookup", "summary": "Look up wrapping properties for the requester's token.", "description": "Look up wrapping properties for the requester's token.", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/getSysWrappingLookup" }, "task": true }, { "name": "postSysWrappingLookup", "summary": "Look up wrapping properties for the given token.", "description": "Look up wrapping properties for the given token.", "input": [ { "name": "body", "type": "object", "info": ": {\"token\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "token": { "type": "string" } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysWrappingLookup" }, "task": true }, { "name": "postSysWrappingRewrap", "summary": "Rotates a response-wrapped token.", "description": "Rotates a response-wrapped token.", "input": [ { "name": "body", "type": "object", "info": ": {\"token\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "token": { "type": "string" } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysWrappingRewrap" }, "task": true }, { "name": "postSysWrappingUnwrap", "summary": "Unwraps a response-wrapped token.", "description": "Unwraps a response-wrapped token.", "input": [ { "name": "body", "type": "object", "info": ": {\"token\": \"string\"}", "required": false, "schema": { "type": "object", "properties": { "token": { "type": "string" } } } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysWrappingUnwrap" }, "task": true }, { "name": "postSysWrappingWrap", "summary": "Response-wraps an arbitrary JSON object.", "description": "Response-wraps an arbitrary JSON object.", "input": [], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "GET", "path": "/postSysWrappingWrap" }, "task": true }, { "name": "getAdConfig", "summary": "getAdConfig", "description": "Configure the AD to connect to, along with password options.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "admount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "admount", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getAdConfig" }, "task": true }, { "name": "createAdConfig", "summary": "createAdConfig", "description": "Configure the AD server to connect to, along with password options.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "admount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "admount", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"anonymous_group_search\": \"boolean\", \"binddn\": \"string\", \"bindpass\": \"string\", \"case_sensitive_names\": \"boolean\", \"certificate\": \"string\", \"client_tls_cert\": \"string\", \"client_tls_key\": \"string\", \"deny_null_bind\": \"boolean\", \"discoverdn\": \"boolean\", \"formatter\": \"string\", \"groupattr\": \"string\", \"groupdn\": \"string\", \"groupfilter\": \"string\", \"insecure_tls\": \"boolean\", \"last_rotation_tolerance\": 123, \"length\": 123, \"max_ttl\": 123, \"password_policy\": \"string\", \"request_timeout\": 123, \"starttls\": \"boolean\", \"tls_max_version\": \"Must be one of [tls10, tls11, tls12, tls13]\", \"tls_min_version\": \"Must be one of [tls10, tls11, tls12, tls13]\", \"ttl\": 123, \"upndomain\": \"string\", \"url\": \"string\", \"use_pre111_group_cn_behavior\": \"boolean\", \"use_token_groups\": \"boolean\", \"userattr\": \"string\", \"userdn\": \"string\"}", "required": false, "schema": { "title": "AdConfigRequest", "type": "object", "properties": { "anonymous_group_search": { "type": "boolean", "description": "Use anonymous binds when performing LDAP group searches (if true the initial credentials will still be used for the initial connection test).", "default": false }, "binddn": { "type": "string", "description": "LDAP DN for searching for the user DN (optional)" }, "bindpass": { "type": "string", "description": "LDAP password for searching for the user DN (optional)" }, "case_sensitive_names": { "type": "boolean", "description": "If true, case sensitivity will be used when comparing usernames and groups for matching policies." }, "certificate": { "type": "string", "description": "CA certificate to use when verifying LDAP server certificate, must be x509 PEM encoded (optional)" }, "client_tls_cert": { "type": "string", "description": "Client certificate to provide to the LDAP server, must be x509 PEM encoded (optional)" }, "client_tls_key": { "type": "string", "description": "Client certificate key to provide to the LDAP server, must be x509 PEM encoded (optional)" }, "deny_null_bind": { "type": "boolean", "description": "Denies an unauthenticated LDAP bind request if the user's password is empty; defaults to true", "default": true }, "discoverdn": { "type": "boolean", "description": "Use anonymous bind to discover the bind DN of a user (optional)" }, "formatter": { "type": "string", "description": "Text to insert the password into, ex. \"customPrefix{{PASSWORD}}customSuffix\".", "x-deprecated": true }, "groupattr": { "type": "string", "description": "LDAP attribute to follow on objects returned by in order to enumerate user group membership. Examples: \"cn\" or \"memberOf\", etc. Default: cn", "default": "cn" }, "groupdn": { "type": "string", "description": "LDAP search base to use for group membership search (eg: ou=Groups,dc=example,dc=org)" }, "groupfilter": { "type": "string", "description": "Go template for querying group membership of user (optional) The template can access the following context variables: UserDN, Username Example: (&(objectClass=group)(member:1.2.840.113556.1.4.1941:={{.UserDN}})) Default: (|(memberUid={{.Username}})(member={{.UserDN}})(uniqueMember={{.UserDN}}))", "default": "(|(memberUid={{.Username}})(member={{.UserDN}})(uniqueMember={{.UserDN}}))" }, "insecure_tls": { "type": "boolean", "description": "Skip LDAP server SSL Certificate verification - VERY insecure (optional)" }, "last_rotation_tolerance": { "type": "integer", "description": "The number of seconds after a Vault rotation where, if Active Directory shows a later rotation, it should be considered out-of-band.", "default": 5 }, "length": { "type": "integer", "description": "The desired length of passwords that Vault generates.", "default": 64, "x-deprecated": true }, "max_ttl": { "type": "integer", "description": "In seconds, the maximum password time-to-live." }, "password_policy": { "type": "string", "description": "Name of the password policy to use to generate passwords." }, "request_timeout": { "type": "integer", "description": "Timeout, in seconds, for the connection when making requests against the server before returning back an error." }, "starttls": { "type": "boolean", "description": "Issue a StartTLS command after establishing unencrypted connection (optional)" }, "tls_max_version": { "title": "TlsMaxVersion", "enum": [ "tls10", "tls11", "tls12", "tls13" ], "type": "string", "description": "Maximum TLS version to use. Accepted values are 'tls10', 'tls11', 'tls12' or 'tls13'. Defaults to 'tls12'" }, "tls_min_version": { "title": "TlsMinVersion", "enum": [ "tls10", "tls11", "tls12", "tls13" ], "type": "string", "description": "Minimum TLS version to use. Accepted values are 'tls10', 'tls11', 'tls12' or 'tls13'. Defaults to 'tls12'" }, "ttl": { "type": "integer", "description": "In seconds, the default password time-to-live." }, "upndomain": { "type": "string", "description": "Enables userPrincipalDomain login with [username]@UPNDomain (optional)" }, "url": { "type": "string", "description": "LDAP URL to connect to (default: ldap://127.0.0.1). Multiple URLs can be specified by concatenating them with commas; they will be tried in-order.", "default": "ldap://127.0.0.1" }, "use_pre111_group_cn_behavior": { "type": "boolean", "description": "In Vault 1.1.1 a fix for handling group CN values of different cases unfortunately introduced a regression that could cause previously defined groups to not be found due to a change in the resulting name. If set true, the pre-1.1.1 behavior for matching group CNs will be used. This is only needed in some upgrade scenarios for backwards compatibility. It is enabled by default if the config is upgraded but disabled by default on new configurations." }, "use_token_groups": { "type": "boolean", "description": "If true, use the Active Directory tokenGroups constructed attribute of the user to find the group memberships. This will find all security groups including nested ones.", "default": false }, "userattr": { "type": "string", "description": "Attribute used for users (default: cn)", "default": "cn" }, "userdn": { "type": "string", "description": "LDAP domain to use for users (eg: ou=People,dc=example,dc=org)" } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/createAdConfig" }, "task": true }, { "name": "deleteAdConfig", "summary": "deleteAdEngineConfig", "description": "Configure the AD server to connect to, along with password options.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "admount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "admount", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteAdConfig" }, "task": true }, { "name": "getAdCredsName", "summary": "getAdCredsName", "description": "Retrieve a role's creds by role name.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "admount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "admount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the role: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getAdCredsName" }, "task": true }, { "name": "getAdLibrary", "summary": "getAdLibrary", "description": "List the name of each set of service accounts currently stored.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "admount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "admount", "type": "string" } }, { "name": "list", "type": "string", "info": "Return a list if `true`: string", "required": false, "schema": { "title": "list", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getAdLibrary" }, "task": true }, { "name": "createAdLibraryManageNameCheckIn", "summary": "createAdLibraryManageNameCheckIn", "description": "Check service accounts in to the library.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "admount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "admount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the set.: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"service_account_names\": \"array\"}", "required": false, "schema": { "title": "AdLibraryManageCheckInRequest", "type": "object", "properties": { "service_account_names": { "type": "array", "items": { "type": "string" }, "description": "The username/logon name for the service accounts to check in." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/createAdLibraryManageNameCheckIn" }, "task": true }, { "name": "getAdLibraryName", "summary": "getAdLibraryName", "description": "Read a library set.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "admount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "admount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the set.: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getAdLibraryName" }, "task": true }, { "name": "updateAdLibraryName", "summary": "updateAdLibraryName", "description": "Update a library set.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "admount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "admount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the set.: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"disable_check_in_enforcement\": \"boolean\", \"max_ttl\": 123, \"service_account_names\": \"array\", \"ttl\": 123}", "required": false, "schema": { "title": "AdLibraryRequest", "type": "object", "properties": { "disable_check_in_enforcement": { "type": "boolean", "description": "Disable the default behavior of requiring that check-ins are performed by the entity that checked them out.", "default": false }, "max_ttl": { "type": "integer", "description": "In seconds, the max amount of time a check-out's renewals should last. Defaults to 24 hours.", "default": 86400 }, "service_account_names": { "type": "array", "items": { "type": "string" }, "description": "The username/logon name for the service accounts with which this set will be associated." }, "ttl": { "type": "integer", "description": "In seconds, the amount of time a check-out should last. Defaults to 24 hours.", "default": 86400 } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/updateAdLibraryName" }, "task": true }, { "name": "deleteAdLibraryName", "summary": "deleteAdLibraryName", "description": "Delete a library set.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "admount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "admount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the set.: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteAdLibraryName" }, "task": true }, { "name": "createAdLibraryNameCheckIn", "summary": "createAdLibraryNameCheckIn", "description": "Check service accounts in to the library.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "admount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "admount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the set.: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"service_account_names\": \"array\"}", "required": false, "schema": { "title": "AdLibraryCheckInRequest", "type": "object", "properties": { "service_account_names": { "type": "array", "items": { "type": "string" }, "description": "The username/logon name for the service accounts to check in." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/createAdLibraryNameCheckIn" }, "task": true }, { "name": "createAdLibraryNameCheckOut", "summary": "createAdLibraryNameCheckOut", "description": "Check a service account out from the library.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "admount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "admount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the set: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"ttl\": 123}", "required": false, "schema": { "title": "AdLibraryCheckOutRequest", "type": "object", "properties": { "ttl": { "type": "integer", "description": "The length of time before the check-out will expire, in seconds." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/createAdLibraryNameCheckOut" }, "task": true }, { "name": "getAdLibraryNameStatus", "summary": "getAdLibraryNameStatus", "description": "Check the status of the service accounts in a library set.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "admount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "admount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the set.: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getAdLibraryNameStatus" }, "task": true }, { "name": "getAdRotateRoot", "summary": "getAdRotateRoot", "description": "Request to rotate the root credentials.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "admount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "admount", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getAdRotateRoot" }, "task": true }, { "name": "createAdRotateRoot", "summary": "createAdRotateRoot", "description": "Request to rotate the root credentials.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "admount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "admount", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/createAdRotateRoot" }, "task": true }, { "name": "getAlicloudRole", "summary": "getAlicloudRole", "description": "List the existing roles in this backend.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "alicloudmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "alicloudmount", "type": "string" } }, { "name": "list", "type": "string", "info": "Return a list if `true`: string", "required": false, "schema": { "title": "list", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getAlicloudRole" }, "task": true }, { "name": "getAlicloudRoleName", "summary": "getAlicloudRoleName", "description": "Read, write and reference policies and roles that API keys or STS credentials can be made for.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "alicloudmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "alicloudmount", "type": "string" } }, { "name": "name", "type": "string", "info": "The name of the role.: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getAlicloudRoleName" }, "task": true }, { "name": "postAlicloudRoleName", "summary": "postAlicloudRoleName", "description": "Read, write and reference policies and roles that API keys or STS credentials can be made for.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "alicloudmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "alicloudmount", "type": "string" } }, { "name": "name", "type": "string", "info": "The name of the role.: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"inline_policies\": \"string\", \"max_ttl\": 123, \"remote_policies\": \"array\", \"role_arn\": \"string\", \"ttl\": 123}", "required": false, "schema": { "title": "AlicloudRoleRequest", "type": "object", "properties": { "inline_policies": { "type": "string", "description": "JSON of policies to be dynamically applied to users of this role." }, "max_ttl": { "type": "integer", "description": "The maximum allowed lifetime of tokens issued using this role." }, "remote_policies": { "type": "array", "items": { "type": "string" }, "description": "The name and type of each remote policy to be applied. Example: \"name:AliyunRDSReadOnlyAccess,type:System\"." }, "role_arn": { "type": "string", "description": "ARN of the role to be assumed. If provided, inline_policies and remote_policies should be blank. At creation time, this role must have configured trusted actors, and the access key and secret that will be used to assume the role (in /config) must qualify as a trusted actor." }, "ttl": { "type": "integer", "description": "Duration in seconds after which the issued token should expire. Defaults to 0, in which case the value will fallback to the system/mount defaults." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postAlicloudRoleName" }, "task": true }, { "name": "deleteAlicloudRoleName", "summary": "deleteAlicloudRoleName", "description": "Read, write and reference policies and roles that API keys or STS credentials can be made for.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "alicloudmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "alicloudmount", "type": "string" } }, { "name": "name", "type": "string", "info": "The name of the role.: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteAlicloudRoleName" }, "task": true }, { "name": "getAwsConfigLease", "summary": "getAwsConfigLease", "description": "Configure the default lease information for generated credentials.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "awsmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "awsmount", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getAwsConfigLease" }, "task": true }, { "name": "postAwsConfigLease", "summary": "postAwsConfigLease", "description": "Configure the default lease information for generated credentials.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "awsmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "awsmount", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"lease\": \"string\", \"lease_max\": \"string\"}", "required": false, "schema": { "title": "AwsConfigLeaseRequest", "type": "object", "properties": { "lease": { "type": "string", "description": "Default lease for roles." }, "lease_max": { "type": "string", "description": "Maximum time a credential is valid for." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postAwsConfigLease" }, "task": true }, { "name": "getAwsConfigRoot", "summary": "getAwsConfigRoot", "description": "Configure the root credentials that are used to manage IAM.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "awsmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "awsmount", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getAwsConfigRoot" }, "task": true }, { "name": "postAwsConfigRoot", "summary": "postAwsConfigRoot", "description": "Configure the root credentials that are used to manage IAM.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "awsmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "awsmount", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"access_key\": \"string\", \"iam_endpoint\": \"string\", \"max_retries\": 123, \"region\": \"string\", \"secret_key\": \"string\", \"sts_endpoint\": \"string\"}", "required": false, "schema": { "title": "AwsConfigRootRequest", "type": "object", "properties": { "access_key": { "type": "string", "description": "Access key with permission to create new keys." }, "iam_endpoint": { "type": "string", "description": "Endpoint to custom IAM server URL" }, "max_retries": { "type": "integer", "description": "Maximum number of retries for recoverable exceptions of AWS APIs", "default": -1 }, "region": { "type": "string", "description": "Region for API calls." }, "secret_key": { "type": "string", "description": "Secret key with permission to create new keys." }, "sts_endpoint": { "type": "string", "description": "Endpoint to custom STS server URL" } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postAwsConfigRoot" }, "task": true }, { "name": "postAwsConfigRotateRoot", "summary": "postAwsConfigRotateRoot", "description": "Request to rotate the AWS credentials used by Vault", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "awsmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "awsmount", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postAwsConfigRotateRoot" }, "task": true }, { "name": "getAwsCreds", "summary": "getAwsCreds", "description": "Generate AWS credentials from a specific Vault role.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "awsmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "awsmount", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getAwsCreds" }, "task": true }, { "name": "postAwsCreds", "summary": "postAwsCreds", "description": "Generate AWS credentials from a specific Vault role.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "awsmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "awsmount", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"name\": \"string\", \"role_arn\": \"string\", \"role_session_name\": \"string\", \"ttl\": 123}", "required": false, "schema": { "title": "AwsCredsRequest", "type": "object", "properties": { "name": { "type": "string", "description": "Name of the role" }, "role_arn": { "type": "string", "description": "ARN of role to assume when credential_type is assumed_role" }, "role_session_name": { "type": "string", "description": "Session name to use when assuming role. Max chars: 64" }, "ttl": { "type": "integer", "description": "Lifetime of the returned credentials in seconds", "default": 3600 } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postAwsCreds" }, "task": true }, { "name": "getAwsStsName", "summary": "getAwsStsName", "description": "Generate AWS credentials from a specific Vault role.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "awsmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "awsmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the role: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getAwsStsName" }, "task": true }, { "name": "postAwsStsName", "summary": "postAwsStsName", "description": "Generate AWS credentials from a specific Vault role.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "awsmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "awsmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the role: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"role_arn\": \"string\", \"role_session_name\": \"string\", \"ttl\": 123}", "required": false, "schema": { "title": "AwsStsRequest", "type": "object", "properties": { "role_arn": { "type": "string", "description": "ARN of role to assume when credential_type is assumed_role" }, "role_session_name": { "type": "string", "description": "Session name to use when assuming role. Max chars: 64" }, "ttl": { "type": "integer", "description": "Lifetime of the returned credentials in seconds", "default": 3600 } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postAwsStsName" }, "task": true }, { "name": "getAzureCredsRole", "summary": "getAzureCredsRole", "description": "Request Service Principal credentials for a given Vault role.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "azuremount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "azuremount", "type": "string" } }, { "name": "role", "type": "string", "info": "Name of the Vault role: string", "required": true, "schema": { "title": "role", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getAzureCredsRole" }, "task": true }, { "name": "getConsulConfigAccess", "summary": "getConsulConfigAccess", "description": "getConsulConfigAccess", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "consulmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "consulmount", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getConsulConfigAccess" }, "task": true }, { "name": "postConsulConfigAccess", "summary": "postConsulConfigAccess", "description": "postConsulConfigAccess", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "consulmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "consulmount", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"address\": \"string\", \"ca_cert\": \"string\", \"client_cert\": \"string\", \"client_key\": \"string\", \"scheme\": \"string\", \"token\": \"string\"}", "required": false, "schema": { "title": "ConsulConfigAccessRequest", "type": "object", "properties": { "address": { "type": "string", "description": "Consul server address" }, "ca_cert": { "type": "string", "description": "CA certificate to use when verifying Consul server certificate, must be x509 PEM encoded." }, "client_cert": { "type": "string", "description": "Client certificate used for Consul's TLS communication, must be x509 PEM encoded and if this is set you need to also set client_key." }, "client_key": { "type": "string", "description": "Client key used for Consul's TLS communication, must be x509 PEM encoded and if this is set you need to also set client_cert." }, "scheme": { "type": "string", "description": "URI scheme for the Consul address", "default": "http" }, "token": { "type": "string", "description": "Token for API calls" } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postConsulConfigAccess" }, "task": true }, { "name": "getConsulCredsRole", "summary": "getConsulCredsRole", "description": "getConsulCredsRole", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "consulmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "consulmount", "type": "string" } }, { "name": "role", "type": "string", "info": "Name of the role: string", "required": true, "schema": { "title": "role", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getConsulCredsRole" }, "task": true }, { "name": "getCubbyholePath", "summary": "getCubbyholePath", "description": "Retrieve the secret at the specified location.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "cubbyholemount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "cubbyholemount", "type": "string" } }, { "name": "enginepath", "type": "string", "info": "Specifies the path of the secret.: string", "required": true, "schema": { "title": "enginepath", "type": "string" } }, { "name": "list", "type": "string", "info": "Return a list if `true`: string", "required": false, "schema": { "title": "list", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getCubbyholePath" }, "task": true }, { "name": "postCubbyholePath", "summary": "postCubbyholePath", "description": "Store a secret at the specified location.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "cubbyholemount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "cubbyholemount", "type": "string" } }, { "name": "enginepath", "type": "string", "info": "Specifies the path of the secret.: string", "required": true, "schema": { "title": "enginepath", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postCubbyholePath" }, "task": true }, { "name": "deleteCubbyholePath", "summary": "deleteCubbyholePath", "description": "Deletes the secret at the specified location.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "cubbyholemount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "cubbyholemount", "type": "string" } }, { "name": "enginepath", "type": "string", "info": "Specifies the path of the secret.: string", "required": true, "schema": { "title": "enginepath", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteCubbyholePath" }, "task": true }, { "name": "getDatabaseConfigName", "summary": "getDatabaseConfigName", "description": "Configure connection details to a database plugin.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "databasemount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "databasemount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of this database connection: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getDatabaseConfigName" }, "task": true }, { "name": "postDatabaseConfigName", "summary": "postDatabaseConfigName", "description": "Configure connection details to a database plugin.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "databasemount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "databasemount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of this database connection: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"allowed_roles\": \"array\", \"password_policy\": \"string\", \"plugin_name\": \"string\", \"root_rotation_statements\": \"array\", \"verify_connection\": \"boolean\"}", "required": false, "schema": { "title": "DatabaseConfigRequest", "type": "object", "properties": { "allowed_roles": { "type": "array", "items": { "type": "string" }, "description": "Comma separated string or array of the role names allowed to get creds from this database connection. If empty no roles are allowed. If \"*\" all roles are allowed." }, "password_policy": { "type": "string", "description": "Password policy to use when generating passwords." }, "plugin_name": { "type": "string", "description": "The name of a builtin or previously registered plugin known to vault. This endpoint will create an instance of that plugin type." }, "root_rotation_statements": { "type": "array", "items": { "type": "string" }, "description": "Specifies the database statements to be executed to rotate the root user's credentials. See the plugin's API page for more information on support and formatting for this parameter." }, "verify_connection": { "type": "boolean", "description": "If true, the connection details are verified by actually connecting to the database. Defaults to true.", "default": true } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postDatabaseConfigName" }, "task": true }, { "name": "deleteDatabaseConfigName", "summary": "deleteDatabaseConfigName", "description": "Configure connection details to a database plugin.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "databasemount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "databasemount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of this database connection: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteDatabaseConfigName" }, "task": true }, { "name": "postDatabaseResetName", "summary": "postDatabaseResetName", "description": "Resets a database plugin.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "databasemount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "databasemount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of this database connection: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postDatabaseResetName" }, "task": true }, { "name": "postDatabaseRotateRoleName", "summary": "postDatabaseRotateRoleName", "description": "Request database credentials for a certain role.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "databasemount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "databasemount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the static role: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postDatabaseRotateRoleName" }, "task": true }, { "name": "postDatabaseRotateRootName", "summary": "postDatabaseRotateRootName", "description": "Request database credentials for a certain role.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "databasemount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "databasemount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of this database connection: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postDatabaseRotateRootName" }, "task": true }, { "name": "getDatabaseStaticCredsName", "summary": "getDatabaseStaticCredsName", "description": "Request database credentials for a certain static role. These credentials are\nrotated periodically.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "databasemount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "databasemount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the static role.: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getDatabaseStaticCredsName" }, "task": true }, { "name": "getDatabaseStaticRoles", "summary": "getDatabaseStaticRoles", "description": "Manage the static roles that can be created with this backend.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "databasemount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "databasemount", "type": "string" } }, { "name": "list", "type": "string", "info": "Return a list if `true`: string", "required": false, "schema": { "title": "list", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getDatabaseStaticRoles" }, "task": true }, { "name": "getDatabaseStaticRolesName", "summary": "getDatabaseStaticRolesName", "description": "Manage the static roles that can be created with this backend.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "databasemount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "databasemount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the role.: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getDatabaseStaticRolesName" }, "task": true }, { "name": "postDatabaseStaticRolesName", "summary": "postDatabaseStaticRolesName", "description": "Manage the static roles that can be created with this backend.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "databasemount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "databasemount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the role.: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"db_name\": \"string\", \"rotation_period\": 123, \"rotation_statements\": \"array\", \"username\": \"string\"}", "required": false, "schema": { "title": "DatabaseStaticRolesRequest", "type": "object", "properties": { "db_name": { "type": "string", "description": "Name of the database this role acts on." }, "rotation_period": { "type": "integer", "description": "Period for automatic credential rotation of the given username. Not valid unless used with \"username\"." }, "rotation_statements": { "type": "array", "items": { "type": "string" }, "description": "Specifies the database statements to be executed to rotate the accounts credentials. Not every plugin type will support this functionality. See the plugin's API page for more information on support and formatting for this parameter." }, "username": { "type": "string", "description": "Name of the static user account for Vault to manage. Requires \"rotation_period\" to be specified" } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postDatabaseStaticRolesName" }, "task": true }, { "name": "deleteDatabaseStaticRolesName", "summary": "deleteDatabaseStaticRolesName", "description": "Manage the static roles that can be created with this backend.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "databasemount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "databasemount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the role.: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteDatabaseStaticRolesName" }, "task": true }, { "name": "postGcpConfigRotateRoot", "summary": "postGcpConfigRotateRoot", "description": "Request to rotate the GCP credentials used by Vault", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "gcpmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "gcpmount", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postGcpConfigRotateRoot" }, "task": true }, { "name": "getGcpKeyRoleset", "summary": "getGcpKeyRoleset", "description": "Generate an service account private key under a specific role set.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "gcpmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "gcpmount", "type": "string" } }, { "name": "roleset", "type": "string", "info": "Required. Name of the role set.: string", "required": true, "schema": { "title": "roleset", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getGcpKeyRoleset" }, "task": true }, { "name": "postGcpKeyRoleset", "summary": "postGcpKeyRoleset", "description": "Generate an service account private key under a specific role set.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "gcpmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "gcpmount", "type": "string" } }, { "name": "roleset", "type": "string", "info": "Required. Name of the role set.: string", "required": true, "schema": { "title": "roleset", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"key_algorithm\": \"string\", \"key_type\": \"string\", \"ttl\": 123}", "required": false, "schema": { "title": "GcpKeyRequest", "type": "object", "properties": { "key_algorithm": { "type": "string", "description": "Private key algorithm for service account key - defaults to KEY_ALG_RSA_2048\"", "default": "KEY_ALG_RSA_2048" }, "key_type": { "type": "string", "description": "Private key type for service account key - defaults to TYPE_GOOGLE_CREDENTIALS_FILE\"", "default": "TYPE_GOOGLE_CREDENTIALS_FILE" }, "ttl": { "type": "integer", "description": "Lifetime of the service account key" } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postGcpKeyRoleset" }, "task": true }, { "name": "getGcpRolesetName", "summary": "getGcpRolesetName", "description": "Read/write sets of IAM roles to be given to generated credentials for specified GCP resources.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "gcpmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "gcpmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Required. Name of the role.: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getGcpRolesetName" }, "task": true }, { "name": "postGcpRolesetName", "summary": "postGcpRolesetName", "description": "Read/write sets of IAM roles to be given to generated credentials for specified GCP resources.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "gcpmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "gcpmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Required. Name of the role.: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"bindings\": \"string\", \"project\": \"string\", \"secret_type\": \"string\", \"token_scopes\": \"array\"}", "required": false, "schema": { "title": "GcpRolesetRequest", "type": "object", "properties": { "bindings": { "type": "string", "description": "Bindings configuration string." }, "project": { "type": "string", "description": "Name of the GCP project that this roleset's service account will belong to." }, "secret_type": { "type": "string", "description": "Type of secret generated for this role set. Defaults to 'access_token'", "default": "access_token" }, "token_scopes": { "type": "array", "items": { "type": "string" }, "description": "List of OAuth scopes to assign to credentials generated under this role set" } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postGcpRolesetName" }, "task": true }, { "name": "deleteGcpRolesetName", "summary": "deleteGcpRolesetName", "description": "Read/write sets of IAM roles to be given to generated credentials for specified GCP resources.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "gcpmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "gcpmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Required. Name of the role.: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteGcpRolesetName" }, "task": true }, { "name": "postGcpRolesetNameRotate", "summary": "postGcpRolesetNameRotate", "description": "Rotates or recreates the service account bound to a roleset.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "gcpmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "gcpmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the role.: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postGcpRolesetNameRotate" }, "task": true }, { "name": "postGcpRolesetNameRotateKey", "summary": "postGcpRolesetNameRotateKey", "description": "Rotate the service account key used to generate access tokens for a roleset.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "gcpmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "gcpmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the role.: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postGcpRolesetNameRotateKey" }, "task": true }, { "name": "getGcpRolesets", "summary": "getGcpRolesets", "description": "List existing rolesets.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "gcpmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "gcpmount", "type": "string" } }, { "name": "list", "type": "string", "info": "Return a list if `true`: string", "required": false, "schema": { "title": "list", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getGcpRolesets" }, "task": true }, { "name": "getGcpTokenRoleset", "summary": "getGcpTokenRoleset", "description": "Generate an OAuth2 access token under a specific role set.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "gcpmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "gcpmount", "type": "string" } }, { "name": "roleset", "type": "string", "info": "Required. Name of the role set.: string", "required": true, "schema": { "title": "roleset", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getGcpTokenRoleset" }, "task": true }, { "name": "postGcpTokenRoleset", "summary": "postGcpTokenRoleset", "description": "Generate an OAuth2 access token under a specific role set.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "gcpmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "gcpmount", "type": "string" } }, { "name": "roleset", "type": "string", "info": "Required. Name of the role set.: string", "required": true, "schema": { "title": "roleset", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postGcpTokenRoleset" }, "task": true }, { "name": "postGcpkmsDecryptKey", "summary": "postGcpkmsDecryptKey", "description": "Decrypt a ciphertext value using a named key", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "gcpkmsmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "gcpkmsmount", "type": "string" } }, { "name": "key", "type": "string", "info": "Name of the key in Vault to use for decryption. This key must already exist in Vault and must map back to a Google Cloud KMS key.: string", "required": true, "schema": { "title": "key", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"additional_authenticated_data\": \"string\", \"ciphertext\": \"string\", \"key_version\": 123}", "required": false, "schema": { "title": "GcpkmsDecryptRequest", "type": "object", "properties": { "additional_authenticated_data": { "type": "string", "description": "Optional data that was specified during encryption of this payload." }, "ciphertext": { "type": "string", "description": "Ciphertext to decrypt as previously returned from an encrypt operation. This must be base64-encoded ciphertext as previously returned from an encrypt operation." }, "key_version": { "type": "integer", "description": "Integer version of the crypto key version to use for decryption. This is required for asymmetric keys. For symmetric keys, Cloud KMS will choose the correct version automatically." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postGcpkmsDecryptKey" }, "task": true }, { "name": "postGcpkmsEncryptKey", "summary": "postGcpkmsEncryptKey", "description": "Encrypt a plaintext value using a named key", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "gcpkmsmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "gcpkmsmount", "type": "string" } }, { "name": "key", "type": "string", "info": "Name of the key in Vault to use for encryption. This key must already exist in Vault and must map back to a Google Cloud KMS key.: string", "required": true, "schema": { "title": "key", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"additional_authenticated_data\": \"string\", \"key_version\": 123, \"plaintext\": \"string\"}", "required": false, "schema": { "title": "GcpkmsEncryptRequest", "type": "object", "properties": { "additional_authenticated_data": { "type": "string", "description": "Optional base64-encoded data that, if specified, must also be provided to decrypt this payload." }, "key_version": { "type": "integer", "description": "Integer version of the crypto key version to use for encryption. If unspecified, this defaults to the latest active crypto key version." }, "plaintext": { "type": "string", "description": "Plaintext value to be encrypted. This can be a string or binary, but the size is limited. See the Google Cloud KMS documentation for information on size limitations by key types." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postGcpkmsEncryptKey" }, "task": true }, { "name": "getGcpkmsKeys", "summary": "getGcpkmsKeys", "description": "List named keys", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "gcpkmsmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "gcpkmsmount", "type": "string" } }, { "name": "list", "type": "string", "info": "Return a list if `true`: string", "required": false, "schema": { "title": "list", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getGcpkmsKeys" }, "task": true }, { "name": "getGcpkmsKeysConfigKey", "summary": "getGcpkmsKeysConfigKey", "description": "Configure the key in Vault", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "gcpkmsmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "gcpkmsmount", "type": "string" } }, { "name": "key", "type": "string", "info": "Name of the key in Vault.: string", "required": true, "schema": { "title": "key", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getGcpkmsKeysConfigKey" }, "task": true }, { "name": "postGcpkmsKeysConfigKey", "summary": "postGcpkmsKeysConfigKey", "description": "Configure the key in Vault", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "gcpkmsmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "gcpkmsmount", "type": "string" } }, { "name": "key", "type": "string", "info": "Name of the key in Vault.: string", "required": true, "schema": { "title": "key", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"max_version\": 123, \"min_version\": 123}", "required": false, "schema": { "title": "GcpkmsKeysConfigRequest", "type": "object", "properties": { "max_version": { "type": "integer", "description": "Maximum allowed crypto key version. If set to a positive value, key versions greater than the given value are not permitted to be used. If set to 0 or a negative value, there is no maximum key version." }, "min_version": { "type": "integer", "description": "Minimum allowed crypto key version. If set to a positive value, key versions less than the given value are not permitted to be used. If set to 0 or a negative value, there is no minimum key version. This value only affects encryption/re-encryption, not decryption. To restrict old values from being decrypted, increase this value and then perform a trim operation." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postGcpkmsKeysConfigKey" }, "task": true }, { "name": "postGcpkmsKeysDeregisterKey", "summary": "postGcpkmsKeysDeregisterKey", "description": "Deregister an existing key in Vault", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "gcpkmsmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "gcpkmsmount", "type": "string" } }, { "name": "key", "type": "string", "info": "Name of the key to deregister in Vault. If the key exists in Google Cloud KMS, it will be left untouched.: string", "required": true, "schema": { "title": "key", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postGcpkmsKeysDeregisterKey" }, "task": true }, { "name": "deleteGcpkmsKeysDeregisterKey", "summary": "deleteGcpkmsKeysDeregisterKey", "description": "Deregister an existing key in Vault", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "gcpkmsmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "gcpkmsmount", "type": "string" } }, { "name": "key", "type": "string", "info": "Name of the key to deregister in Vault. If the key exists in Google Cloud KMS, it will be left untouched.: string", "required": true, "schema": { "title": "key", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteGcpkmsKeysDeregisterKey" }, "task": true }, { "name": "postGcpkmsKeysRegisterKey", "summary": "postGcpkmsKeysRegisterKey", "description": "Register an existing crypto key in Google Cloud KMS", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "gcpkmsmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "gcpkmsmount", "type": "string" } }, { "name": "key", "type": "string", "info": "Name of the key to register in Vault. This will be the named used to refer to the underlying crypto key when encrypting or decrypting data.: string", "required": true, "schema": { "title": "key", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"crypto_key\": \"string\", \"verify\": \"boolean\"}", "required": false, "schema": { "title": "GcpkmsKeysRegisterRequest", "type": "object", "properties": { "crypto_key": { "type": "string", "description": "Full resource ID of the crypto key including the project, location, key ring, and crypto key like \"projects/%s/locations/%s/keyRings/%s/cryptoKeys/%s\". This crypto key must already exist in Google Cloud KMS unless verify is set to \"false\"." }, "verify": { "type": "boolean", "description": "Verify that the given Google Cloud KMS crypto key exists and is accessible before creating the storage entry in Vault. Set this to \"false\" if the key will not exist at creation time.", "default": true } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postGcpkmsKeysRegisterKey" }, "task": true }, { "name": "postGcpkmsKeysRotateKey", "summary": "postGcpkmsKeysRotateKey", "description": "Rotate a crypto key to a new primary version", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "gcpkmsmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "gcpkmsmount", "type": "string" } }, { "name": "key", "type": "string", "info": "Name of the key to rotate. This key must already be registered with Vault and point to a valid Google Cloud KMS crypto key.: string", "required": true, "schema": { "title": "key", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postGcpkmsKeysRotateKey" }, "task": true }, { "name": "postGcpkmsKeysTrimKey", "summary": "postGcpkmsKeysTrimKey", "description": "Delete old crypto key versions from Google Cloud KMS", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "gcpkmsmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "gcpkmsmount", "type": "string" } }, { "name": "key", "type": "string", "info": "Name of the key in Vault.: string", "required": true, "schema": { "title": "key", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postGcpkmsKeysTrimKey" }, "task": true }, { "name": "deleteGcpkmsKeysTrimKey", "summary": "deleteGcpkmsKeysTrimKey", "description": "Delete old crypto key versions from Google Cloud KMS", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "gcpkmsmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "gcpkmsmount", "type": "string" } }, { "name": "key", "type": "string", "info": "Name of the key in Vault.: string", "required": true, "schema": { "title": "key", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteGcpkmsKeysTrimKey" }, "task": true }, { "name": "getGcpkmsKeysKey", "summary": "getGcpkmsKeysKey", "description": "Interact with crypto keys in Vault and Google Cloud KMS", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "gcpkmsmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "gcpkmsmount", "type": "string" } }, { "name": "key", "type": "string", "info": "Name of the key in Vault.: string", "required": true, "schema": { "title": "key", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getGcpkmsKeysKey" }, "task": true }, { "name": "postGcpkmsKeysKey", "summary": "postGcpkmsKeysKey", "description": "Interact with crypto keys in Vault and Google Cloud KMS", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "gcpkmsmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "gcpkmsmount", "type": "string" } }, { "name": "key", "type": "string", "info": "Name of the key in Vault.: string", "required": true, "schema": { "title": "key", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"algorithm\": \"string\", \"crypto_key\": \"string\", \"key_ring\": \"string\", \"labels\": \"object\", \"protection_level\": \"string\", \"purpose\": \"string\", \"rotation_period\": 123}", "required": false, "schema": { "title": "GcpkmsKeysRequest", "type": "object", "properties": { "algorithm": { "type": "string", "description": "Algorithm to use for encryption, decryption, or signing. The value depends on the key purpose. The value cannot be changed after creation. For a key purpose of \"encrypt_decrypt\", the valid values are: - symmetric_encryption (default) For a key purpose of \"asymmetric_sign\", valid values are: - rsa_sign_pss_2048_sha256 - rsa_sign_pss_3072_sha256 - rsa_sign_pss_4096_sha256 - rsa_sign_pkcs1_2048_sha256 - rsa_sign_pkcs1_3072_sha256 - rsa_sign_pkcs1_4096_sha256 - ec_sign_p256_sha256 - ec_sign_p384_sha384 For a key purpose of \"asymmetric_decrypt\", valid values are: - rsa_decrypt_oaep_2048_sha256 - rsa_decrypt_oaep_3072_sha256 - rsa_decrypt_oaep_4096_sha256" }, "crypto_key": { "type": "string", "description": "Name of the crypto key to use. If the given crypto key does not exist, Vault will try to create it. This defaults to the name of the key given to Vault as the parameter if unspecified." }, "key_ring": { "type": "string", "description": "Full Google Cloud resource ID of the key ring with the project and location (e.g. projects/my-project/locations/global/keyRings/my-keyring). If the given key ring does not exist, Vault will try to create it during a create operation." }, "labels": { "type": "object", "description": "Arbitrary key=value label to apply to the crypto key. To specify multiple labels, specify this argument multiple times (e.g. labels=\"a=b\" labels=\"c=d\")." }, "protection_level": { "type": "string", "description": "Level of protection to use for the key management. Valid values are \"software\" and \"hsm\". The default value is \"software\". The value cannot be changed after creation." }, "purpose": { "type": "string", "description": "Purpose of the key. Valid options are \"asymmetric_decrypt\", \"asymmetric_sign\", and \"encrypt_decrypt\". The default value is \"encrypt_decrypt\". The value cannot be changed after creation." }, "rotation_period": { "type": "integer", "description": "Amount of time between crypto key version rotations. This is specified as a time duration value like 72h (72 hours). The smallest possible value is 24h. This value only applies to keys with a purpose of \"encrypt_decrypt\"." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postGcpkmsKeysKey" }, "task": true }, { "name": "deleteGcpkmsKeysKey", "summary": "deleteGcpkmsKeysKey", "description": "Interact with crypto keys in Vault and Google Cloud KMS", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "gcpkmsmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "gcpkmsmount", "type": "string" } }, { "name": "key", "type": "string", "info": "Name of the key in Vault.: string", "required": true, "schema": { "title": "key", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteGcpkmsKeysKey" }, "task": true }, { "name": "getGcpkmsPubkeyKey", "summary": "getGcpkmsPubkeyKey", "description": "Retrieve the public key associated with the named key", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "gcpkmsmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "gcpkmsmount", "type": "string" } }, { "name": "key", "type": "string", "info": "Name of the key for which to get the public key. This key must already exist in Vault and Google Cloud KMS.: string", "required": true, "schema": { "title": "key", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getGcpkmsPubkeyKey" }, "task": true }, { "name": "postGcpkmsReencryptKey", "summary": "postGcpkmsReencryptKey", "description": "Re-encrypt existing ciphertext data to a new version", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "gcpkmsmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "gcpkmsmount", "type": "string" } }, { "name": "key", "type": "string", "info": "Name of the key to use for encryption. This key must already exist in Vault and Google Cloud KMS.: string", "required": true, "schema": { "title": "key", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"additional_authenticated_data\": \"string\", \"ciphertext\": \"string\", \"key_version\": 123}", "required": false, "schema": { "title": "GcpkmsReencryptRequest", "type": "object", "properties": { "additional_authenticated_data": { "type": "string", "description": "Optional data that, if specified, must also be provided during decryption." }, "ciphertext": { "type": "string", "description": "Ciphertext to be re-encrypted to the latest key version. This must be ciphertext that Vault previously generated for this named key." }, "key_version": { "type": "integer", "description": "Integer version of the crypto key version to use for the new encryption. If unspecified, this defaults to the latest active crypto key version." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postGcpkmsReencryptKey" }, "task": true }, { "name": "postGcpkmsSignKey", "summary": "postGcpkmsSignKey", "description": "Signs a message or digest using a named key", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "gcpkmsmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "gcpkmsmount", "type": "string" } }, { "name": "key", "type": "string", "info": "Name of the key in Vault to use for signing. This key must already exist in Vault and must map back to a Google Cloud KMS key.: string", "required": true, "schema": { "title": "key", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"digest\": \"string\", \"key_version\": 123}", "required": false, "schema": { "title": "GcpkmsSignRequest", "type": "object", "properties": { "digest": { "type": "string", "description": "Digest to sign. This digest must use the same SHA algorithm as the underlying Cloud KMS key. The digest must be the base64-encoded binary value. This field is required." }, "key_version": { "type": "integer", "description": "Integer version of the crypto key version to use for signing. This field is required." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postGcpkmsSignKey" }, "task": true }, { "name": "postGcpkmsVerifyKey", "summary": "postGcpkmsVerifyKey", "description": "Verify a signature using a named key", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "gcpkmsmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "gcpkmsmount", "type": "string" } }, { "name": "key", "type": "string", "info": "Name of the key in Vault to use for verification. This key must already exist in Vault and must map back to a Google Cloud KMS key.: string", "required": true, "schema": { "title": "key", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"digest\": \"string\", \"key_version\": 123, \"signature\": \"string\"}", "required": false, "schema": { "title": "GcpkmsVerifyRequest", "type": "object", "properties": { "digest": { "type": "string", "description": "Digest to verify. This digest must use the same SHA algorithm as the underlying Cloud KMS key. The digest must be the base64-encoded binary value. This field is required." }, "key_version": { "type": "integer", "description": "Integer version of the crypto key version to use for verification. This field is required." }, "signature": { "type": "string", "description": "Base64-encoded signature to use for verification. This field is required." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postGcpkmsVerifyKey" }, "task": true }, { "name": "getKvDataPath", "summary": "getKvDataPath", "description": "Write, Read, and Delete data in the Key-Value Store.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "kvmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "kvmount", "type": "string" } }, { "name": "enginepath", "type": "string", "info": "Location of the secret.: string", "required": true, "schema": { "title": "enginepath", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getKvDataPath" }, "task": true }, { "name": "postKvDataPath", "summary": "postKvDataPath", "description": "Write, Read, and Delete data in the Key-Value Store.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "kvmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "kvmount", "type": "string" } }, { "name": "enginepath", "type": "string", "info": "Location of the secret.: string", "required": true, "schema": { "title": "enginepath", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"data\": \"object\", \"options\": \"object\", \"version\": 123}", "required": false, "schema": { "title": "KvDataRequest", "type": "object", "properties": { "data": { "type": "object", "description": "The contents of the data map will be stored and returned on read." }, "options": { "type": "object", "description": "Options for writing a KV entry. Set the \"cas\" value to use a Check-And-Set operation. If not set the write will be allowed. If set to 0 a write will only be allowed if the key doesn’t exist. If the index is non-zero the write will only be allowed if the key’s current version matches the version specified in the cas parameter." }, "version": { "type": "integer", "description": "If provided during a read, the value at the version number will be returned" } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postKvDataPath" }, "task": true }, { "name": "deleteKvDataPath", "summary": "deleteKvDataPath", "description": "Write, Read, and Delete data in the Key-Value Store.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "kvmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "kvmount", "type": "string" } }, { "name": "enginepath", "type": "string", "info": "Location of the secret.: string", "required": true, "schema": { "title": "enginepath", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteKvDataPath" }, "task": true }, { "name": "postKvDeletePath", "summary": "postKvDeletePath", "description": "Marks one or more versions as deleted in the KV store.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "kvmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "kvmount", "type": "string" } }, { "name": "enginepath", "type": "string", "info": "Location of the secret.: string", "required": true, "schema": { "title": "enginepath", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"versions\": \"array\"}", "required": false, "schema": { "title": "KvDeleteRequest", "type": "object", "properties": { "versions": { "type": "array", "items": { "type": "integer" }, "description": "The versions to be archived. The versioned data will not be deleted, but it will no longer be returned in normal get requests." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postKvDeletePath" }, "task": true }, { "name": "postKvDestroyPath", "summary": "postKvDestroyPath", "description": "Permanently removes one or more versions in the KV store", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "kvmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "kvmount", "type": "string" } }, { "name": "enginepath", "type": "string", "info": "Location of the secret.: string", "required": true, "schema": { "title": "enginepath", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"versions\": \"array\"}", "required": false, "schema": { "title": "KvDestroyRequest", "type": "object", "properties": { "versions": { "type": "array", "items": { "type": "integer" }, "description": "The versions to destroy. Their data will be permanently deleted." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postKvDestroyPath" }, "task": true }, { "name": "getKvMetadataPath", "summary": "getKvMetadataPath", "description": "Configures settings for the KV store", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "kvmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "kvmount", "type": "string" } }, { "name": "enginepath", "type": "string", "info": "Location of the secret.: string", "required": true, "schema": { "title": "enginepath", "type": "string" } }, { "name": "list", "type": "string", "info": "Return a list if `true`: string", "required": false, "schema": { "title": "list", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getKvMetadataPath" }, "task": true }, { "name": "postKvMetadataPath", "summary": "postKvMetadataPath", "description": "Configures settings for the KV store", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "kvmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "kvmount", "type": "string" } }, { "name": "enginepath", "type": "string", "info": "Location of the secret.: string", "required": true, "schema": { "title": "enginepath", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"cas_required\": \"boolean\", \"delete_version_after\": 123, \"max_versions\": 123}", "required": false, "schema": { "title": "KvMetadataRequest", "type": "object", "properties": { "cas_required": { "type": "boolean", "description": "If true the key will require the cas parameter to be set on all write requests. If false, the backend’s configuration will be used." }, "delete_version_after": { "type": "integer", "description": "The length of time before a version is deleted. If not set, the backend's configured delete_version_after is used. Cannot be greater than the backend's delete_version_after. A zero duration clears the current setting. A negative duration will cause an error." }, "max_versions": { "type": "integer", "description": "The number of versions to keep. If not set, the backend’s configured max version is used." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postKvMetadataPath" }, "task": true }, { "name": "deleteKvMetadataPath", "summary": "deleteKvMetadataPath", "description": "Configures settings for the KV store", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "kvmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "kvmount", "type": "string" } }, { "name": "enginepath", "type": "string", "info": "Location of the secret.: string", "required": true, "schema": { "title": "enginepath", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteKvMetadataPath" }, "task": true }, { "name": "postKvUndeletePath", "summary": "postKvUndeletePath", "description": "Undeletes one or more versions from the KV store.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "kvmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "kvmount", "type": "string" } }, { "name": "enginepath", "type": "string", "info": "Location of the secret.: string", "required": true, "schema": { "title": "enginepath", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"versions\": \"array\"}", "required": false, "schema": { "title": "KvUndeleteRequest", "type": "object", "properties": { "versions": { "type": "array", "items": { "type": "integer" }, "description": "The versions to unarchive. The versions will be restored and their data will be returned on normal get requests." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postKvUndeletePath" }, "task": true }, { "name": "getNomadConfigAccess", "summary": "getNomadConfigAccess", "description": "getNomadConfigAccess", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "nomadmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "nomadmount", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getNomadConfigAccess" }, "task": true }, { "name": "postNomadConfigAccess", "summary": "postNomadConfigAccess", "description": "postNomadConfigAccess", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "nomadmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "nomadmount", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"address\": \"string\", \"ca_cert\": \"string\", \"client_cert\": \"string\", \"client_key\": \"string\", \"max_token_name_length\": 123, \"token\": \"string\"}", "required": false, "schema": { "title": "NomadConfigAccessRequest", "type": "object", "properties": { "address": { "type": "string", "description": "Nomad server address" }, "ca_cert": { "type": "string", "description": "CA certificate to use when verifying Nomad server certificate, must be x509 PEM encoded." }, "client_cert": { "type": "string", "description": "Client certificate used for Nomad's TLS communication, must be x509 PEM encoded and if this is set you need to also set client_key." }, "client_key": { "type": "string", "description": "Client key used for Nomad's TLS communication, must be x509 PEM encoded and if this is set you need to also set client_cert." }, "max_token_name_length": { "type": "integer", "description": "Max length for name of generated Nomad tokens" }, "token": { "type": "string", "description": "Token for API calls" } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postNomadConfigAccess" }, "task": true }, { "name": "deleteNomadConfigAccess", "summary": "deleteNomadConfigAccess", "description": "deleteNomadConfigAccess", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "nomadmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "nomadmount", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteNomadConfigAccess" }, "task": true }, { "name": "getNomadConfigLease", "summary": "getNomadConfigLease", "description": "Configure the lease parameters for generated tokens", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "nomadmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "nomadmount", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getNomadConfigLease" }, "task": true }, { "name": "postNomadConfigLease", "summary": "postNomadConfigLease", "description": "Configure the lease parameters for generated tokens", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "nomadmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "nomadmount", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"max_ttl\": 123, \"ttl\": 123}", "required": false, "schema": { "title": "NomadConfigLeaseRequest", "type": "object", "properties": { "max_ttl": { "type": "integer", "description": "Duration after which the issued token should not be allowed to be renewed" }, "ttl": { "type": "integer", "description": "Duration before which the issued token needs renewal" } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postNomadConfigLease" }, "task": true }, { "name": "deleteNomadConfigLease", "summary": "deleteNomadConfigLease", "description": "Configure the lease parameters for generated tokens", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "nomadmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "nomadmount", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteNomadConfigLease" }, "task": true }, { "name": "getNomadRole", "summary": "getNomadRole", "description": "getNomadRole", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "nomadmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "nomadmount", "type": "string" } }, { "name": "list", "type": "string", "info": "Return a list if `true`: string", "required": false, "schema": { "title": "list", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getNomadRole" }, "task": true }, { "name": "getNomadRoleName", "summary": "getNomadRoleName", "description": "getNomadRoleName", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "nomadmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "nomadmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the role: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getNomadRoleName" }, "task": true }, { "name": "postNomadRoleName", "summary": "postNomadRoleName", "description": "postNomadRoleName", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "nomadmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "nomadmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the role: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"global\": \"boolean\", \"policies\": \"array\", \"type\": \"string\"}", "required": false, "schema": { "title": "NomadRoleRequest", "type": "object", "properties": { "global": { "type": "boolean", "description": "Boolean value describing if the token should be global or not. Defaults to false." }, "policies": { "type": "array", "items": { "type": "string" }, "description": "Comma-separated string or list of policies as previously created in Nomad. Required for 'client' token." }, "type": { "type": "string", "description": "Which type of token to create: 'client' or 'management'. If a 'management' token, the \"policies\" parameter is not required. Defaults to 'client'.", "default": "client" } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postNomadRoleName" }, "task": true }, { "name": "deleteNomadRoleName", "summary": "deleteNomadRoleName", "description": "deleteNomadRoleName", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "nomadmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "nomadmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the role: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteNomadRoleName" }, "task": true }, { "name": "getPkiCa", "summary": "getPkiCa", "description": "Fetch a CA, CRL, CA Chain, or non-revoked certificate.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "pkimount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "pkimount", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getPkiCa" }, "task": true }, { "name": "getPkiCaPem", "summary": "getPkiCaPem", "description": "Fetch a CA, CRL, CA Chain, or non-revoked certificate.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "pkimount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "pkimount", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getPkiCaPem" }, "task": true }, { "name": "getPkiCaChain", "summary": "getPkiCa_chain", "description": "Fetch a CA, CRL, CA Chain, or non-revoked certificate.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "pkimount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "pkimount", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getPkiCaChain" }, "task": true }, { "name": "getPkiCertCaChain", "summary": "getPkiCertCa_chain", "description": "Fetch a CA, CRL, CA Chain, or non-revoked certificate.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "pkimount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "pkimount", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getPkiCertCaChain" }, "task": true }, { "name": "getPkiCertCrl", "summary": "getPkiCertCrl", "description": "Fetch a CA, CRL, CA Chain, or non-revoked certificate.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "pkimount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "pkimount", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getPkiCertCrl" }, "task": true }, { "name": "getPkiCertSerial", "summary": "getPkiCertSerial", "description": "Fetch a CA, CRL, CA Chain, or non-revoked certificate.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "pkimount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "pkimount", "type": "string" } }, { "name": "serial", "type": "string", "info": "Certificate serial number, in colon- or hyphen-separated octal: string", "required": true, "schema": { "title": "serial", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getPkiCertSerial" }, "task": true }, { "name": "getPkiCerts", "summary": "getPkiCerts", "description": "Fetch a CA, CRL, CA Chain, or non-revoked certificate.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "pkimount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "pkimount", "type": "string" } }, { "name": "list", "type": "string", "info": "Return a list if `true`: string", "required": false, "schema": { "title": "list", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getPkiCerts" }, "task": true }, { "name": "postPkiConfigCa", "summary": "postPkiConfigCa", "description": "Set the CA certificate and private key used for generated credentials.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "pkimount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "pkimount", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"pem_bundle\": \"string\"}", "required": false, "schema": { "title": "PkiConfigCaRequest", "type": "object", "properties": { "pem_bundle": { "type": "string", "description": "PEM-format, concatenated unencrypted secret key and certificate." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postPkiConfigCa" }, "task": true }, { "name": "getPkiConfigCrl", "summary": "getPkiConfigCrl", "description": "Configure the CRL expiration.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "pkimount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "pkimount", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getPkiConfigCrl" }, "task": true }, { "name": "postPkiConfigCrl", "summary": "postPkiConfigCrl", "description": "Configure the CRL expiration.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "pkimount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "pkimount", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"disable\": \"boolean\", \"expiry\": \"string\"}", "required": false, "schema": { "title": "PkiConfigCrlRequest", "type": "object", "properties": { "disable": { "type": "boolean", "description": "If set to true, disables generating the CRL entirely." }, "expiry": { "type": "string", "description": "The amount of time the generated CRL should be valid; defaults to 72 hours", "default": "72h" } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postPkiConfigCrl" }, "task": true }, { "name": "getPkiConfigUrls", "summary": "getPkiConfigUrls", "description": "Set the URLs for the issuing CA, CRL distribution points, and OCSP servers.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "pkimount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "pkimount", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getPkiConfigUrls" }, "task": true }, { "name": "postPkiConfigUrls", "summary": "postPkiConfigUrls", "description": "Set the URLs for the issuing CA, CRL distribution points, and OCSP servers.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "pkimount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "pkimount", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"crl_distribution_points\": \"array\", \"issuing_certificates\": \"array\", \"ocsp_servers\": \"array\"}", "required": false, "schema": { "title": "PkiConfigUrlsRequest", "type": "object", "properties": { "crl_distribution_points": { "type": "array", "items": { "type": "string" }, "description": "Comma-separated list of URLs to be used for the CRL distribution points attribute" }, "issuing_certificates": { "type": "array", "items": { "type": "string" }, "description": "Comma-separated list of URLs to be used for the issuing certificate attribute" }, "ocsp_servers": { "type": "array", "items": { "type": "string" }, "description": "Comma-separated list of URLs to be used for the OCSP servers attribute" } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postPkiConfigUrls" }, "task": true }, { "name": "getPkiCrl", "summary": "getPkiCrl", "description": "Fetch a CA, CRL, CA Chain, or non-revoked certificate.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "pkimount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "pkimount", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getPkiCrl" }, "task": true }, { "name": "getPkiCrlPem", "summary": "getPkiCrlPem", "description": "Fetch a CA, CRL, CA Chain, or non-revoked certificate.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "pkimount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "pkimount", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getPkiCrlPem" }, "task": true }, { "name": "getPkiCrlRotate", "summary": "getPkiCrlRotate", "description": "Force a rebuild of the CRL.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "pkimount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "pkimount", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getPkiCrlRotate" }, "task": true }, { "name": "postPkiIntermediateGenerateExported", "summary": "postPkiIntermediateGenerateExported", "description": "Generate a new CSR and private key used for signing.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "pkimount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "pkimount", "type": "string" } }, { "name": "exported", "type": "string", "info": "Must be \"internal\" or \"exported\". If set to \"exported\", the generated private key will be returned. This is your *only* chance to retrieve the private key!: string", "required": true, "schema": { "title": "exported", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"add_basic_constraints\": \"boolean\", \"alt_names\": \"string\", \"common_name\": \"string\", \"country\": \"array\", \"exclude_cn_from_sans\": \"boolean\", \"format\": \"Must be one of [pem, der, pem_bundle]\", \"ip_sans\": \"array\", \"key_bits\": 123, \"key_type\": \"Must be one of [rsa, ec]\", \"locality\": \"array\", \"organization\": \"array\", \"other_sans\": \"array\", \"ou\": \"array\", \"postal_code\": \"array\", \"private_key_format\": \"Must be one of [der, pem, pkcs8]\", \"province\": \"array\", \"serial_number\": \"string\", \"street_address\": \"array\", \"ttl\": 123, \"uri_sans\": \"array\"}", "required": false, "schema": { "title": "PkiIntermediateGenerateRequest", "type": "object", "properties": { "add_basic_constraints": { "type": "boolean", "description": "Whether to add a Basic Constraints extension with CA: true. Only needed as a workaround in some compatibility scenarios with Active Directory Certificate Services." }, "alt_names": { "type": "string", "description": "The requested Subject Alternative Names, if any, in a comma-delimited list. May contain both DNS names and email addresses." }, "common_name": { "type": "string", "description": "The requested common name; if you want more than one, specify the alternative names in the alt_names map. If not specified when signing, the common name will be taken from the CSR; other names must still be specified in alt_names or ip_sans." }, "country": { "type": "array", "items": { "type": "string" }, "description": "If set, Country will be set to this value." }, "exclude_cn_from_sans": { "type": "boolean", "description": "If true, the Common Name will not be included in DNS or Email Subject Alternate Names. Defaults to false (CN is included).", "default": false }, "format": { "title": "Format", "enum": [ "pem", "der", "pem_bundle" ], "type": "string", "description": "Format for returned data. Can be \"pem\", \"der\", or \"pem_bundle\". If \"pem_bundle\" any private key and issuing cert will be appended to the certificate pem. Defaults to \"pem\"." }, "ip_sans": { "type": "array", "items": { "type": "string" }, "description": "The requested IP SANs, if any, in a comma-delimited list" }, "key_bits": { "type": "integer", "description": "The number of bits to use. You will almost certainly want to change this if you adjust the key_type.", "default": 2048 }, "key_type": { "title": "KeyType", "enum": [ "rsa", "ec" ], "type": "string", "description": "The type of key to use; defaults to RSA. \"rsa\" and \"ec\" are the only valid values." }, "locality": { "type": "array", "items": { "type": "string" }, "description": "If set, Locality will be set to this value." }, "organization": { "type": "array", "items": { "type": "string" }, "description": "If set, O (Organization) will be set to this value." }, "other_sans": { "type": "array", "items": { "type": "string" }, "description": "Requested other SANs, in an array with the format ;UTF8: for each entry." }, "ou": { "type": "array", "items": { "type": "string" }, "description": "If set, OU (OrganizationalUnit) will be set to this value." }, "postal_code": { "type": "array", "items": { "type": "string" }, "description": "If set, Postal Code will be set to this value." }, "private_key_format": { "title": "PrivateKeyFormat", "enum": [ "der", "pem", "pkcs8" ], "type": "string", "description": "Format for the returned private key. Generally the default will be controlled by the \"format\" parameter as either base64-encoded DER or PEM-encoded DER. However, this can be set to \"pkcs8\" to have the returned private key contain base64-encoded pkcs8 or PEM-encoded pkcs8 instead. Defaults to \"der\"." }, "province": { "type": "array", "items": { "type": "string" }, "description": "If set, Province will be set to this value." }, "serial_number": { "type": "string", "description": "The requested serial number, if any. If you want more than one, specify alternative names in the alt_names map using OID 2.5.4.5." }, "street_address": { "type": "array", "items": { "type": "string" }, "description": "If set, Street Address will be set to this value." }, "ttl": { "type": "integer", "description": "The requested Time To Live for the certificate; sets the expiration date. If not specified the role default, backend default, or system default TTL is used, in that order. Cannot be larger than the mount max TTL. Note: this only has an effect when generating a CA cert or signing a CA cert, not when generating a CSR for an intermediate CA." }, "uri_sans": { "type": "array", "items": { "type": "string" }, "description": "The requested URI SANs, if any, in a comma-delimited list." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postPkiIntermediateGenerateExported" }, "task": true }, { "name": "postPkiIntermediateSetSigned", "summary": "postPkiIntermediateSetSigned", "description": "Provide the signed intermediate CA cert.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "pkimount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "pkimount", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"certificate\": \"string\"}", "required": false, "schema": { "title": "PkiIntermediateSetSignedRequest", "type": "object", "properties": { "certificate": { "type": "string", "description": "PEM-format certificate. This must be a CA certificate with a public key matching the previously-generated key from the generation endpoint." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postPkiIntermediateSetSigned" }, "task": true }, { "name": "postPkiIssueRole", "summary": "postPkiIssueRole", "description": "Request a certificate using a certain role with the provided details.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "pkimount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "pkimount", "type": "string" } }, { "name": "role", "type": "string", "info": "The desired role with configuration for this request: string", "required": true, "schema": { "title": "role", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"alt_names\": \"string\", \"common_name\": \"string\", \"exclude_cn_from_sans\": \"boolean\", \"format\": \"Must be one of [pem, der, pem_bundle]\", \"ip_sans\": \"array\", \"other_sans\": \"array\", \"private_key_format\": \"Must be one of [der, pem, pkcs8]\", \"serial_number\": \"string\", \"ttl\": 123, \"uri_sans\": \"array\"}", "required": false, "schema": { "title": "PkiIssueRequest", "type": "object", "properties": { "alt_names": { "type": "string", "description": "The requested Subject Alternative Names, if any, in a comma-delimited list. If email protection is enabled for the role, this may contain email addresses." }, "common_name": { "type": "string", "description": "The requested common name; if you want more than one, specify the alternative names in the alt_names map. If email protection is enabled in the role, this may be an email address." }, "exclude_cn_from_sans": { "type": "boolean", "description": "If true, the Common Name will not be included in DNS or Email Subject Alternate Names. Defaults to false (CN is included).", "default": false }, "format": { "title": "Format", "enum": [ "pem", "der", "pem_bundle" ], "type": "string", "description": "Format for returned data. Can be \"pem\", \"der\", or \"pem_bundle\". If \"pem_bundle\" any private key and issuing cert will be appended to the certificate pem. Defaults to \"pem\"." }, "ip_sans": { "type": "array", "items": { "type": "string" }, "description": "The requested IP SANs, if any, in a comma-delimited list" }, "other_sans": { "type": "array", "items": { "type": "string" }, "description": "Requested other SANs, in an array with the format ;UTF8: for each entry." }, "private_key_format": { "title": "PrivateKeyFormat", "enum": [ "der", "pem", "pkcs8" ], "type": "string", "description": "Format for the returned private key. Generally the default will be controlled by the \"format\" parameter as either base64-encoded DER or PEM-encoded DER. However, this can be set to \"pkcs8\" to have the returned private key contain base64-encoded pkcs8 or PEM-encoded pkcs8 instead. Defaults to \"der\"." }, "serial_number": { "type": "string", "description": "The requested serial number, if any. If you want more than one, specify alternative names in the alt_names map using OID 2.5.4.5." }, "ttl": { "type": "integer", "description": "The requested Time To Live for the certificate; sets the expiration date. If not specified the role default, backend default, or system default TTL is used, in that order. Cannot be larger than the role max TTL." }, "uri_sans": { "type": "array", "items": { "type": "string" }, "description": "The requested URI SANs, if any, in a comma-delimited list." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postPkiIssueRole" }, "task": true }, { "name": "postPkiRevoke", "summary": "postPkiRevoke", "description": "Revoke a certificate by serial number.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "pkimount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "pkimount", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"serial_number\": \"string\"}", "required": false, "schema": { "title": "PkiRevokeRequest", "type": "object", "properties": { "serial_number": { "type": "string", "description": "Certificate serial number, in colon- or hyphen-separated octal" } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postPkiRevoke" }, "task": true }, { "name": "deletePkiRoot", "summary": "deletePkiRoot", "description": "Deletes the root CA key to allow a new one to be generated.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "pkimount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "pkimount", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deletePkiRoot" }, "task": true }, { "name": "postPkiRootGenerateExported", "summary": "postPkiRootGenerateExported", "description": "Generate a new CA certificate and private key used for signing.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "pkimount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "pkimount", "type": "string" } }, { "name": "exported", "type": "string", "info": "Must be \"internal\" or \"exported\". If set to \"exported\", the generated private key will be returned. This is your *only* chance to retrieve the private key!: string", "required": true, "schema": { "title": "exported", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"alt_names\": \"string\", \"common_name\": \"string\", \"country\": \"array\", \"exclude_cn_from_sans\": \"boolean\", \"format\": \"Must be one of [pem, der, pem_bundle]\", \"ip_sans\": \"array\", \"key_bits\": 123, \"key_type\": \"Must be one of [rsa, ec]\", \"locality\": \"array\", \"max_path_length\": 123, \"organization\": \"array\", \"other_sans\": \"array\", \"ou\": \"array\", \"permitted_dns_domains\": \"array\", \"postal_code\": \"array\", \"private_key_format\": \"Must be one of [der, pem, pkcs8]\", \"province\": \"array\", \"serial_number\": \"string\", \"street_address\": \"array\", \"ttl\": 123, \"uri_sans\": \"array\"}", "required": false, "schema": { "title": "PkiRootGenerateRequest", "type": "object", "properties": { "alt_names": { "type": "string", "description": "The requested Subject Alternative Names, if any, in a comma-delimited list. May contain both DNS names and email addresses." }, "common_name": { "type": "string", "description": "The requested common name; if you want more than one, specify the alternative names in the alt_names map. If not specified when signing, the common name will be taken from the CSR; other names must still be specified in alt_names or ip_sans." }, "country": { "type": "array", "items": { "type": "string" }, "description": "If set, Country will be set to this value." }, "exclude_cn_from_sans": { "type": "boolean", "description": "If true, the Common Name will not be included in DNS or Email Subject Alternate Names. Defaults to false (CN is included).", "default": false }, "format": { "title": "Format", "enum": [ "pem", "der", "pem_bundle" ], "type": "string", "description": "Format for returned data. Can be \"pem\", \"der\", or \"pem_bundle\". If \"pem_bundle\" any private key and issuing cert will be appended to the certificate pem. Defaults to \"pem\"." }, "ip_sans": { "type": "array", "items": { "type": "string" }, "description": "The requested IP SANs, if any, in a comma-delimited list" }, "key_bits": { "type": "integer", "description": "The number of bits to use. You will almost certainly want to change this if you adjust the key_type.", "default": 2048 }, "key_type": { "title": "KeyType", "enum": [ "rsa", "ec" ], "type": "string", "description": "The type of key to use; defaults to RSA. \"rsa\" and \"ec\" are the only valid values." }, "locality": { "type": "array", "items": { "type": "string" }, "description": "If set, Locality will be set to this value." }, "max_path_length": { "type": "integer", "description": "The maximum allowable path length", "default": -1 }, "organization": { "type": "array", "items": { "type": "string" }, "description": "If set, O (Organization) will be set to this value." }, "other_sans": { "type": "array", "items": { "type": "string" }, "description": "Requested other SANs, in an array with the format ;UTF8: for each entry." }, "ou": { "type": "array", "items": { "type": "string" }, "description": "If set, OU (OrganizationalUnit) will be set to this value." }, "permitted_dns_domains": { "type": "array", "items": { "type": "string" }, "description": "Domains for which this certificate is allowed to sign or issue child certificates. If set, all DNS names (subject and alt) on child certs must be exact matches or subsets of the given domains (see https://tools.ietf.org/html/rfc5280#section-4.2.1.10)." }, "postal_code": { "type": "array", "items": { "type": "string" }, "description": "If set, Postal Code will be set to this value." }, "private_key_format": { "title": "PrivateKeyFormat", "enum": [ "der", "pem", "pkcs8" ], "type": "string", "description": "Format for the returned private key. Generally the default will be controlled by the \"format\" parameter as either base64-encoded DER or PEM-encoded DER. However, this can be set to \"pkcs8\" to have the returned private key contain base64-encoded pkcs8 or PEM-encoded pkcs8 instead. Defaults to \"der\"." }, "province": { "type": "array", "items": { "type": "string" }, "description": "If set, Province will be set to this value." }, "serial_number": { "type": "string", "description": "The requested serial number, if any. If you want more than one, specify alternative names in the alt_names map using OID 2.5.4.5." }, "street_address": { "type": "array", "items": { "type": "string" }, "description": "If set, Street Address will be set to this value." }, "ttl": { "type": "integer", "description": "The requested Time To Live for the certificate; sets the expiration date. If not specified the role default, backend default, or system default TTL is used, in that order. Cannot be larger than the mount max TTL. Note: this only has an effect when generating a CA cert or signing a CA cert, not when generating a CSR for an intermediate CA." }, "uri_sans": { "type": "array", "items": { "type": "string" }, "description": "The requested URI SANs, if any, in a comma-delimited list." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postPkiRootGenerateExported" }, "task": true }, { "name": "postPkiRootSignIntermediate", "summary": "postPkiRootSignIntermediate", "description": "Issue an intermediate CA certificate based on the provided CSR.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "pkimount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "pkimount", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"alt_names\": \"string\", \"common_name\": \"string\", \"country\": \"array\", \"csr\": \"string\", \"exclude_cn_from_sans\": \"boolean\", \"format\": \"Must be one of [pem, der, pem_bundle]\", \"ip_sans\": \"array\", \"locality\": \"array\", \"max_path_length\": 123, \"organization\": \"array\", \"other_sans\": \"array\", \"ou\": \"array\", \"permitted_dns_domains\": \"array\", \"postal_code\": \"array\", \"private_key_format\": \"Must be one of [der, pem, pkcs8]\", \"province\": \"array\", \"serial_number\": \"string\", \"street_address\": \"array\", \"ttl\": 123, \"uri_sans\": \"array\", \"use_csr_values\": \"boolean\"}", "required": false, "schema": { "title": "PkiRootSignIntermediateRequest", "type": "object", "properties": { "alt_names": { "type": "string", "description": "The requested Subject Alternative Names, if any, in a comma-delimited list. May contain both DNS names and email addresses." }, "common_name": { "type": "string", "description": "The requested common name; if you want more than one, specify the alternative names in the alt_names map. If not specified when signing, the common name will be taken from the CSR; other names must still be specified in alt_names or ip_sans." }, "country": { "type": "array", "items": { "type": "string" }, "description": "If set, Country will be set to this value." }, "csr": { "type": "string", "description": "PEM-format CSR to be signed." }, "exclude_cn_from_sans": { "type": "boolean", "description": "If true, the Common Name will not be included in DNS or Email Subject Alternate Names. Defaults to false (CN is included).", "default": false }, "format": { "title": "Format", "enum": [ "pem", "der", "pem_bundle" ], "type": "string", "description": "Format for returned data. Can be \"pem\", \"der\", or \"pem_bundle\". If \"pem_bundle\" any private key and issuing cert will be appended to the certificate pem. Defaults to \"pem\"." }, "ip_sans": { "type": "array", "items": { "type": "string" }, "description": "The requested IP SANs, if any, in a comma-delimited list" }, "locality": { "type": "array", "items": { "type": "string" }, "description": "If set, Locality will be set to this value." }, "max_path_length": { "type": "integer", "description": "The maximum allowable path length", "default": -1 }, "organization": { "type": "array", "items": { "type": "string" }, "description": "If set, O (Organization) will be set to this value." }, "other_sans": { "type": "array", "items": { "type": "string" }, "description": "Requested other SANs, in an array with the format ;UTF8: for each entry." }, "ou": { "type": "array", "items": { "type": "string" }, "description": "If set, OU (OrganizationalUnit) will be set to this value." }, "permitted_dns_domains": { "type": "array", "items": { "type": "string" }, "description": "Domains for which this certificate is allowed to sign or issue child certificates. If set, all DNS names (subject and alt) on child certs must be exact matches or subsets of the given domains (see https://tools.ietf.org/html/rfc5280#section-4.2.1.10)." }, "postal_code": { "type": "array", "items": { "type": "string" }, "description": "If set, Postal Code will be set to this value." }, "private_key_format": { "title": "PrivateKeyFormat", "enum": [ "der", "pem", "pkcs8" ], "type": "string", "description": "Format for the returned private key. Generally the default will be controlled by the \"format\" parameter as either base64-encoded DER or PEM-encoded DER. However, this can be set to \"pkcs8\" to have the returned private key contain base64-encoded pkcs8 or PEM-encoded pkcs8 instead. Defaults to \"der\"." }, "province": { "type": "array", "items": { "type": "string" }, "description": "If set, Province will be set to this value." }, "serial_number": { "type": "string", "description": "The requested serial number, if any. If you want more than one, specify alternative names in the alt_names map using OID 2.5.4.5." }, "street_address": { "type": "array", "items": { "type": "string" }, "description": "If set, Street Address will be set to this value." }, "ttl": { "type": "integer", "description": "The requested Time To Live for the certificate; sets the expiration date. If not specified the role default, backend default, or system default TTL is used, in that order. Cannot be larger than the mount max TTL. Note: this only has an effect when generating a CA cert or signing a CA cert, not when generating a CSR for an intermediate CA." }, "uri_sans": { "type": "array", "items": { "type": "string" }, "description": "The requested URI SANs, if any, in a comma-delimited list." }, "use_csr_values": { "type": "boolean", "description": "If true, then: 1) Subject information, including names and alternate names, will be preserved from the CSR rather than using values provided in the other parameters to this path; 2) Any key usages requested in the CSR will be added to the basic set of key usages used for CA certs signed by this path; for instance, the non-repudiation flag.", "default": false } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postPkiRootSignIntermediate" }, "task": true }, { "name": "postPkiRootSignSelfIssued", "summary": "postPkiRootSignSelfIssued", "description": "Signs another CA's self-issued certificate.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "pkimount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "pkimount", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"certificate\": \"string\"}", "required": false, "schema": { "title": "PkiRootSignSelfIssuedRequest", "type": "object", "properties": { "certificate": { "type": "string", "description": "PEM-format self-issued certificate to be signed." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postPkiRootSignSelfIssued" }, "task": true }, { "name": "postPkiSignVerbatim", "summary": "postPkiSignVerbatim", "description": "Request certificates using a certain role with the provided details.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "pkimount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "pkimount", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"alt_names\": \"string\", \"common_name\": \"string\", \"csr\": \"string\", \"exclude_cn_from_sans\": \"boolean\", \"ext_key_usage\": \"array\", \"ext_key_usage_oids\": \"array\", \"format\": \"Must be one of [pem, der, pem_bundle]\", \"ip_sans\": \"array\", \"key_usage\": \"array\", \"other_sans\": \"array\", \"private_key_format\": \"Must be one of [der, pem, pkcs8]\", \"role\": \"string\", \"serial_number\": \"string\", \"ttl\": 123, \"uri_sans\": \"array\"}", "required": false, "schema": { "title": "PkiSignVerbatimRequest", "type": "object", "properties": { "alt_names": { "type": "string", "description": "The requested Subject Alternative Names, if any, in a comma-delimited list. If email protection is enabled for the role, this may contain email addresses." }, "common_name": { "type": "string", "description": "The requested common name; if you want more than one, specify the alternative names in the alt_names map. If email protection is enabled in the role, this may be an email address." }, "csr": { "type": "string", "description": "PEM-format CSR to be signed. Values will be taken verbatim from the CSR, except for basic constraints." }, "exclude_cn_from_sans": { "type": "boolean", "description": "If true, the Common Name will not be included in DNS or Email Subject Alternate Names. Defaults to false (CN is included).", "default": false }, "ext_key_usage": { "type": "array", "items": { "type": "string" }, "description": "A comma-separated string or list of extended key usages. Valid values can be found at https://golang.org/pkg/crypto/x509/#ExtKeyUsage -- simply drop the \"ExtKeyUsage\" part of the name. To remove all key usages from being set, set this value to an empty list.", "default": [] }, "ext_key_usage_oids": { "type": "array", "items": { "type": "string" }, "description": "A comma-separated string or list of extended key usage oids." }, "format": { "title": "Format", "enum": [ "pem", "der", "pem_bundle" ], "type": "string", "description": "Format for returned data. Can be \"pem\", \"der\", or \"pem_bundle\". If \"pem_bundle\" any private key and issuing cert will be appended to the certificate pem. Defaults to \"pem\"." }, "ip_sans": { "type": "array", "items": { "type": "string" }, "description": "The requested IP SANs, if any, in a comma-delimited list" }, "key_usage": { "type": "array", "items": { "type": "string" }, "description": "A comma-separated string or list of key usages (not extended key usages). Valid values can be found at https://golang.org/pkg/crypto/x509/#KeyUsage -- simply drop the \"KeyUsage\" part of the name. To remove all key usages from being set, set this value to an empty list.", "default": [ "DigitalSignature", "KeyAgreement", "KeyEncipherment" ] }, "other_sans": { "type": "array", "items": { "type": "string" }, "description": "Requested other SANs, in an array with the format ;UTF8: for each entry." }, "private_key_format": { "title": "PrivateKeyFormat", "enum": [ "der", "pem", "pkcs8" ], "type": "string", "description": "Format for the returned private key. Generally the default will be controlled by the \"format\" parameter as either base64-encoded DER or PEM-encoded DER. However, this can be set to \"pkcs8\" to have the returned private key contain base64-encoded pkcs8 or PEM-encoded pkcs8 instead. Defaults to \"der\"." }, "role": { "type": "string", "description": "The desired role with configuration for this request" }, "serial_number": { "type": "string", "description": "The requested serial number, if any. If you want more than one, specify alternative names in the alt_names map using OID 2.5.4.5." }, "ttl": { "type": "integer", "description": "The requested Time To Live for the certificate; sets the expiration date. If not specified the role default, backend default, or system default TTL is used, in that order. Cannot be larger than the role max TTL." }, "uri_sans": { "type": "array", "items": { "type": "string" }, "description": "The requested URI SANs, if any, in a comma-delimited list." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postPkiSignVerbatim" }, "task": true }, { "name": "postPkiSignVerbatimRole", "summary": "postPkiSignVerbatimRole", "description": "Request certificates using a certain role with the provided details.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "pkimount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "pkimount", "type": "string" } }, { "name": "role", "type": "string", "info": "The desired role with configuration for this request: string", "required": true, "schema": { "title": "role", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"alt_names\": \"string\", \"common_name\": \"string\", \"csr\": \"string\", \"exclude_cn_from_sans\": \"boolean\", \"ext_key_usage\": \"array\", \"ext_key_usage_oids\": \"array\", \"format\": \"Must be one of [pem, der, pem_bundle]\", \"ip_sans\": \"array\", \"key_usage\": \"array\", \"other_sans\": \"array\", \"private_key_format\": \"Must be one of [der, pem, pkcs8]\", \"serial_number\": \"string\", \"ttl\": 123, \"uri_sans\": \"array\"}", "required": false, "schema": { "title": "PkiSignVerbatimRequest1", "type": "object", "properties": { "alt_names": { "type": "string", "description": "The requested Subject Alternative Names, if any, in a comma-delimited list. If email protection is enabled for the role, this may contain email addresses." }, "common_name": { "type": "string", "description": "The requested common name; if you want more than one, specify the alternative names in the alt_names map. If email protection is enabled in the role, this may be an email address." }, "csr": { "type": "string", "description": "PEM-format CSR to be signed. Values will be taken verbatim from the CSR, except for basic constraints." }, "exclude_cn_from_sans": { "type": "boolean", "description": "If true, the Common Name will not be included in DNS or Email Subject Alternate Names. Defaults to false (CN is included).", "default": false }, "ext_key_usage": { "type": "array", "items": { "type": "string" }, "description": "A comma-separated string or list of extended key usages. Valid values can be found at https://golang.org/pkg/crypto/x509/#ExtKeyUsage -- simply drop the \"ExtKeyUsage\" part of the name. To remove all key usages from being set, set this value to an empty list.", "default": [] }, "ext_key_usage_oids": { "type": "array", "items": { "type": "string" }, "description": "A comma-separated string or list of extended key usage oids." }, "format": { "title": "Format", "enum": [ "pem", "der", "pem_bundle" ], "type": "string", "description": "Format for returned data. Can be \"pem\", \"der\", or \"pem_bundle\". If \"pem_bundle\" any private key and issuing cert will be appended to the certificate pem. Defaults to \"pem\"." }, "ip_sans": { "type": "array", "items": { "type": "string" }, "description": "The requested IP SANs, if any, in a comma-delimited list" }, "key_usage": { "type": "array", "items": { "type": "string" }, "description": "A comma-separated string or list of key usages (not extended key usages). Valid values can be found at https://golang.org/pkg/crypto/x509/#KeyUsage -- simply drop the \"KeyUsage\" part of the name. To remove all key usages from being set, set this value to an empty list.", "default": [ "DigitalSignature", "KeyAgreement", "KeyEncipherment" ] }, "other_sans": { "type": "array", "items": { "type": "string" }, "description": "Requested other SANs, in an array with the format ;UTF8: for each entry." }, "private_key_format": { "title": "PrivateKeyFormat", "enum": [ "der", "pem", "pkcs8" ], "type": "string", "description": "Format for the returned private key. Generally the default will be controlled by the \"format\" parameter as either base64-encoded DER or PEM-encoded DER. However, this can be set to \"pkcs8\" to have the returned private key contain base64-encoded pkcs8 or PEM-encoded pkcs8 instead. Defaults to \"der\"." }, "serial_number": { "type": "string", "description": "The requested serial number, if any. If you want more than one, specify alternative names in the alt_names map using OID 2.5.4.5." }, "ttl": { "type": "integer", "description": "The requested Time To Live for the certificate; sets the expiration date. If not specified the role default, backend default, or system default TTL is used, in that order. Cannot be larger than the role max TTL." }, "uri_sans": { "type": "array", "items": { "type": "string" }, "description": "The requested URI SANs, if any, in a comma-delimited list." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postPkiSignVerbatimRole" }, "task": true }, { "name": "postPkiSignRole", "summary": "postPkiSignRole", "description": "Request certificates using a certain role with the provided details.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "pkimount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "pkimount", "type": "string" } }, { "name": "role", "type": "string", "info": "The desired role with configuration for this request: string", "required": true, "schema": { "title": "role", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"alt_names\": \"string\", \"common_name\": \"string\", \"csr\": \"string\", \"exclude_cn_from_sans\": \"boolean\", \"format\": \"Must be one of [pem, der, pem_bundle]\", \"ip_sans\": \"array\", \"other_sans\": \"array\", \"private_key_format\": \"Must be one of [der, pem, pkcs8]\", \"serial_number\": \"string\", \"ttl\": 123, \"uri_sans\": \"array\"}", "required": false, "schema": { "title": "PkiSignRequest", "type": "object", "properties": { "alt_names": { "type": "string", "description": "The requested Subject Alternative Names, if any, in a comma-delimited list. If email protection is enabled for the role, this may contain email addresses." }, "common_name": { "type": "string", "description": "The requested common name; if you want more than one, specify the alternative names in the alt_names map. If email protection is enabled in the role, this may be an email address." }, "csr": { "type": "string", "description": "PEM-format CSR to be signed." }, "exclude_cn_from_sans": { "type": "boolean", "description": "If true, the Common Name will not be included in DNS or Email Subject Alternate Names. Defaults to false (CN is included).", "default": false }, "format": { "title": "Format", "enum": [ "pem", "der", "pem_bundle" ], "type": "string", "description": "Format for returned data. Can be \"pem\", \"der\", or \"pem_bundle\". If \"pem_bundle\" any private key and issuing cert will be appended to the certificate pem. Defaults to \"pem\"." }, "ip_sans": { "type": "array", "items": { "type": "string" }, "description": "The requested IP SANs, if any, in a comma-delimited list" }, "other_sans": { "type": "array", "items": { "type": "string" }, "description": "Requested other SANs, in an array with the format ;UTF8: for each entry." }, "private_key_format": { "title": "PrivateKeyFormat", "enum": [ "der", "pem", "pkcs8" ], "type": "string", "description": "Format for the returned private key. Generally the default will be controlled by the \"format\" parameter as either base64-encoded DER or PEM-encoded DER. However, this can be set to \"pkcs8\" to have the returned private key contain base64-encoded pkcs8 or PEM-encoded pkcs8 instead. Defaults to \"der\"." }, "serial_number": { "type": "string", "description": "The requested serial number, if any. If you want more than one, specify alternative names in the alt_names map using OID 2.5.4.5." }, "ttl": { "type": "integer", "description": "The requested Time To Live for the certificate; sets the expiration date. If not specified the role default, backend default, or system default TTL is used, in that order. Cannot be larger than the role max TTL." }, "uri_sans": { "type": "array", "items": { "type": "string" }, "description": "The requested URI SANs, if any, in a comma-delimited list." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postPkiSignRole" }, "task": true }, { "name": "postPkiTidy", "summary": "postPkiTidy", "description": "Tidy up the backend by removing expired certificates, revocation information,\nor both.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "pkimount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "pkimount", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"safety_buffer\": 123, \"tidy_cert_store\": \"boolean\", \"tidy_revocation_list\": \"boolean\", \"tidy_revoked_certs\": \"boolean\"}", "required": false, "schema": { "title": "PkiTidyRequest", "type": "object", "properties": { "safety_buffer": { "type": "integer", "description": "The amount of extra time that must have passed beyond certificate expiration before it is removed from the backend storage and/or revocation list. Defaults to 72 hours.", "default": 259200 }, "tidy_cert_store": { "type": "boolean", "description": "Set to true to enable tidying up the certificate store" }, "tidy_revocation_list": { "type": "boolean", "description": "Deprecated; synonym for 'tidy_revoked_certs" }, "tidy_revoked_certs": { "type": "boolean", "description": "Set to true to expire all revoked and expired certificates, removing them both from the CRL and from storage. The CRL will be rotated if this causes any values to be removed." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postPkiTidy" }, "task": true }, { "name": "postRabbitmqConfigConnection", "summary": "postRabbitmqConfigConnection", "description": "Configure the connection URI, username, and password to talk to RabbitMQ management HTTP API.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "rabbitmqmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "rabbitmqmount", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"connection_uri\": \"string\", \"password\": \"string\", \"password_policy\": \"string\", \"username\": \"string\", \"verify_connection\": \"boolean\"}", "required": false, "schema": { "title": "RabbitmqConfigConnectionRequest", "type": "object", "properties": { "connection_uri": { "type": "string", "description": "RabbitMQ Management URI" }, "password": { "type": "string", "description": "Password of the provided RabbitMQ management user" }, "password_policy": { "type": "string", "description": "Name of the password policy to use to generate passwords for dynamic credentials." }, "username": { "type": "string", "description": "Username of a RabbitMQ management administrator" }, "verify_connection": { "type": "boolean", "description": "If set, connection_uri is verified by actually connecting to the RabbitMQ management API", "default": true } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postRabbitmqConfigConnection" }, "task": true }, { "name": "getRabbitmqConfigLease", "summary": "getRabbitmqConfigLease", "description": "Configure the lease parameters for generated credentials", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "rabbitmqmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "rabbitmqmount", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getRabbitmqConfigLease" }, "task": true }, { "name": "postRabbitmqConfigLease", "summary": "postRabbitmqConfigLease", "description": "Configure the lease parameters for generated credentials", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "rabbitmqmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "rabbitmqmount", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"max_ttl\": 123, \"ttl\": 123}", "required": false, "schema": { "title": "RabbitmqConfigLeaseRequest", "type": "object", "properties": { "max_ttl": { "type": "integer", "description": "Duration after which the issued credentials should not be allowed to be renewed", "default": 0 }, "ttl": { "type": "integer", "description": "Duration before which the issued credentials needs renewal", "default": 0 } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postRabbitmqConfigLease" }, "task": true }, { "name": "getSecretEngineConfig", "summary": "getSecretEngineConfig", "description": "Configure the Secret Engine to connect to, along with password options.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSecretEngineConfig" }, "task": true }, { "name": "postSecretEngineConfig", "summary": "postSecretEngineConfig", "description": "Configure the Secret Engine server to connect to, along with password options.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"anonymous_group_search\": \"boolean\", \"binddn\": \"string\", \"bindpass\": \"string\", \"case_sensitive_names\": \"boolean\", \"certificate\": \"string\", \"client_tls_cert\": \"string\", \"client_tls_key\": \"string\", \"deny_null_bind\": \"boolean\", \"discoverdn\": \"boolean\", \"formatter\": \"string\", \"groupattr\": \"string\", \"groupdn\": \"string\", \"groupfilter\": \"string\", \"insecure_tls\": \"boolean\", \"last_rotation_tolerance\": 123, \"length\": 123, \"max_ttl\": 123, \"password_policy\": \"string\", \"request_timeout\": 123, \"starttls\": \"boolean\", \"tls_max_version\": \"Must be one of [tls10, tls11, tls12, tls13]\", \"tls_min_version\": \"Must be one of [tls10, tls11, tls12, tls13]\", \"ttl\": 123, \"upndomain\": \"string\", \"url\": \"string\", \"use_pre111_group_cn_behavior\": \"boolean\", \"use_token_groups\": \"boolean\", \"userattr\": \"string\", \"userdn\": \"string\"}", "required": false, "schema": { "title": "AdConfigRequest", "type": "object", "properties": { "anonymous_group_search": { "type": "boolean", "description": "Use anonymous binds when performing LDAP group searches (if true the initial credentials will still be used for the initial connection test).", "default": false }, "binddn": { "type": "string", "description": "LDAP DN for searching for the user DN (optional)" }, "bindpass": { "type": "string", "description": "LDAP password for searching for the user DN (optional)" }, "case_sensitive_names": { "type": "boolean", "description": "If true, case sensitivity will be used when comparing usernames and groups for matching policies." }, "certificate": { "type": "string", "description": "CA certificate to use when verifying LDAP server certificate, must be x509 PEM encoded (optional)" }, "client_tls_cert": { "type": "string", "description": "Client certificate to provide to the LDAP server, must be x509 PEM encoded (optional)" }, "client_tls_key": { "type": "string", "description": "Client certificate key to provide to the LDAP server, must be x509 PEM encoded (optional)" }, "deny_null_bind": { "type": "boolean", "description": "Denies an unauthenticated LDAP bind request if the user's password is empty; defaults to true", "default": true }, "discoverdn": { "type": "boolean", "description": "Use anonymous bind to discover the bind DN of a user (optional)" }, "formatter": { "type": "string", "description": "Text to insert the password into, ex. \"customPrefix{{PASSWORD}}customSuffix\".", "x-deprecated": true }, "groupattr": { "type": "string", "description": "LDAP attribute to follow on objects returned by in order to enumerate user group membership. Examples: \"cn\" or \"memberOf\", etc. Default: cn", "default": "cn" }, "groupdn": { "type": "string", "description": "LDAP search base to use for group membership search (eg: ou=Groups,dc=example,dc=org)" }, "groupfilter": { "type": "string", "description": "Go template for querying group membership of user (optional) The template can access the following context variables: UserDN, Username Example: (&(objectClass=group)(member:1.2.840.113556.1.4.1941:={{.UserDN}})) Default: (|(memberUid={{.Username}})(member={{.UserDN}})(uniqueMember={{.UserDN}}))", "default": "(|(memberUid={{.Username}})(member={{.UserDN}})(uniqueMember={{.UserDN}}))" }, "insecure_tls": { "type": "boolean", "description": "Skip LDAP server SSL Certificate verification - VERY insecure (optional)" }, "last_rotation_tolerance": { "type": "integer", "description": "The number of seconds after a Vault rotation where, if Active Directory shows a later rotation, it should be considered out-of-band.", "default": 5 }, "length": { "type": "integer", "description": "The desired length of passwords that Vault generates.", "default": 64, "x-deprecated": true }, "max_ttl": { "type": "integer", "description": "In seconds, the maximum password time-to-live." }, "password_policy": { "type": "string", "description": "Name of the password policy to use to generate passwords." }, "request_timeout": { "type": "integer", "description": "Timeout, in seconds, for the connection when making requests against the server before returning back an error." }, "starttls": { "type": "boolean", "description": "Issue a StartTLS command after establishing unencrypted connection (optional)" }, "tls_max_version": { "title": "TlsMaxVersion", "enum": [ "tls10", "tls11", "tls12", "tls13" ], "type": "string", "description": "Maximum TLS version to use. Accepted values are 'tls10', 'tls11', 'tls12' or 'tls13'. Defaults to 'tls12'" }, "tls_min_version": { "title": "TlsMinVersion", "enum": [ "tls10", "tls11", "tls12", "tls13" ], "type": "string", "description": "Minimum TLS version to use. Accepted values are 'tls10', 'tls11', 'tls12' or 'tls13'. Defaults to 'tls12'" }, "ttl": { "type": "integer", "description": "In seconds, the default password time-to-live." }, "upndomain": { "type": "string", "description": "Enables userPrincipalDomain login with [username]@UPNDomain (optional)" }, "url": { "type": "string", "description": "LDAP URL to connect to (default: ldap://127.0.0.1). Multiple URLs can be specified by concatenating them with commas; they will be tried in-order.", "default": "ldap://127.0.0.1" }, "use_pre111_group_cn_behavior": { "type": "boolean", "description": "In Vault 1.1.1 a fix for handling group CN values of different cases unfortunately introduced a regression that could cause previously defined groups to not be found due to a change in the resulting name. If set true, the pre-1.1.1 behavior for matching group CNs will be used. This is only needed in some upgrade scenarios for backwards compatibility. It is enabled by default if the config is upgraded but disabled by default on new configurations." }, "use_token_groups": { "type": "boolean", "description": "If true, use the Active Directory tokenGroups constructed attribute of the user to find the group memberships. This will find all security groups including nested ones.", "default": false }, "userattr": { "type": "string", "description": "Attribute used for users (default: cn)", "default": "cn" }, "userdn": { "type": "string", "description": "LDAP domain to use for users (eg: ou=People,dc=example,dc=org)" } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSecretEngineConfig" }, "task": true }, { "name": "deleteSecretEngineConfig", "summary": "deleteSecretEngineConfig", "description": "Configure the Secret Engine server to connect to, along with password options.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteSecretEngineConfig" }, "task": true }, { "name": "getSecretEngineCredsName", "summary": "getSecretEngineCredsName", "description": "Retrieve a role's creds by role name.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the role: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSecretEngineCredsName" }, "task": true }, { "name": "getSecretEngineLibrary", "summary": "getSecretEngineLibrary", "description": "List the name of each set of service accounts currently stored.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "list", "type": "string", "info": "Return a list if `true`: string", "required": false, "schema": { "title": "list", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSecretEngineLibrary" }, "task": true }, { "name": "postSecretEngineLibraryManageNameCheckIn", "summary": "postSecretEngineLibraryManageNameCheckIn", "description": "Check service accounts in to the library.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the set.: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"service_account_names\": \"array\"}", "required": false, "schema": { "title": "AdLibraryManageCheckInRequest", "type": "object", "properties": { "service_account_names": { "type": "array", "items": { "type": "string" }, "description": "The username/logon name for the service accounts to check in." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSecretEngineLibraryManageNameCheckIn" }, "task": true }, { "name": "getSecretEngineLibraryName", "summary": "getSecretEngineLibraryName", "description": "Read a library set.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the set.: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSecretEngineLibraryName" }, "task": true }, { "name": "updateSecretEngineLibraryName", "summary": "updateSecretEngineLibraryName", "description": "Update a library set.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the set.: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"disable_check_in_enforcement\": \"boolean\", \"max_ttl\": 123, \"service_account_names\": \"array\", \"ttl\": 123}", "required": false, "schema": { "title": "AdLibraryRequest", "type": "object", "properties": { "disable_check_in_enforcement": { "type": "boolean", "description": "Disable the default behavior of requiring that check-ins are performed by the entity that checked them out.", "default": false }, "max_ttl": { "type": "integer", "description": "In seconds, the max amount of time a check-out's renewals should last. Defaults to 24 hours.", "default": 86400 }, "service_account_names": { "type": "array", "items": { "type": "string" }, "description": "The username/logon name for the service accounts with which this set will be associated." }, "ttl": { "type": "integer", "description": "In seconds, the amount of time a check-out should last. Defaults to 24 hours.", "default": 86400 } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/updateSecretEngineLibraryName" }, "task": true }, { "name": "deleteSecretEngineLibraryName", "summary": "deleteSecretEngineLibraryName", "description": "Delete a library set.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the set.: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteSecretEngineLibraryName" }, "task": true }, { "name": "postSecretEngineLibraryNameCheckIn", "summary": "postSecretEngineLibraryNameCheckIn", "description": "Check service accounts in to the library.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the set.: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"service_account_names\": \"array\"}", "required": false, "schema": { "title": "AdLibraryCheckInRequest", "type": "object", "properties": { "service_account_names": { "type": "array", "items": { "type": "string" }, "description": "The username/logon name for the service accounts to check in." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSecretEngineLibraryNameCheckIn" }, "task": true }, { "name": "postSecretEngineLibraryNameCheckOut", "summary": "postSecretEngineLibraryNameCheckOut", "description": "Check a service account out from the library.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the set: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"ttl\": 123}", "required": false, "schema": { "title": "AdLibraryCheckOutRequest", "type": "object", "properties": { "ttl": { "type": "integer", "description": "The length of time before the check-out will expire, in seconds." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSecretEngineLibraryNameCheckOut" }, "task": true }, { "name": "getSecretEngineLibraryNameStatus", "summary": "getSecretEngineLibraryNameStatus", "description": "Check the status of the service accounts in a library set.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the set.: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSecretEngineLibraryNameStatus" }, "task": true }, { "name": "getSecretEngineRotateRoot", "summary": "getSecretEngineRotateRoot", "description": "Request to rotate the root credentials.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSecretEngineRotateRoot" }, "task": true }, { "name": "postSecretEngineRotateRoot", "summary": "postSecretEngineRotateRoot", "description": "Request to rotate the root credentials.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSecretEngineRotateRoot" }, "task": true }, { "name": "getSecretEngineRole", "summary": "getSecretEngineRole", "description": "List the existing roles in this backend.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "list", "type": "string", "info": "Return a list if `true`: string", "required": false, "schema": { "title": "list", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSecretEngineRole" }, "task": true }, { "name": "getSecretEngineRoleName", "summary": "getSecretEngineRoleName", "description": "Read, write and reference policies and roles that API keys or STS credentials can be made for.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "name", "type": "string", "info": "The name of the role.: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSecretEngineRoleName" }, "task": true }, { "name": "postSecretEngineRoleName", "summary": "postSecretEngineRoleName", "description": "Read, write and reference policies and roles that API keys or STS credentials can be made for.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "name", "type": "string", "info": "The name of the role.: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"inline_policies\": \"string\", \"max_ttl\": 123, \"remote_policies\": \"array\", \"role_arn\": \"string\", \"ttl\": 123}", "required": false, "schema": { "title": "AlicloudRoleRequest", "type": "object", "properties": { "inline_policies": { "type": "string", "description": "JSON of policies to be dynamically applied to users of this role." }, "max_ttl": { "type": "integer", "description": "The maximum allowed lifetime of tokens issued using this role." }, "remote_policies": { "type": "array", "items": { "type": "string" }, "description": "The name and type of each remote policy to be applied. Example: \"name:AliyunRDSReadOnlyAccess,type:System\"." }, "role_arn": { "type": "string", "description": "ARN of the role to be assumed. If provided, inline_policies and remote_policies should be blank. At creation time, this role must have configured trusted actors, and the access key and secret that will be used to assume the role (in /config) must qualify as a trusted actor." }, "ttl": { "type": "integer", "description": "Duration in seconds after which the issued token should expire. Defaults to 0, in which case the value will fallback to the system/mount defaults." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSecretEngineRoleName" }, "task": true }, { "name": "deleteSecretEngineRoleName", "summary": "deleteSecretEngineRoleName", "description": "Read, write and reference policies and roles that API keys or STS credentials can be made for.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "name", "type": "string", "info": "The name of the role.: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteSecretEngineRoleName" }, "task": true }, { "name": "getSecretEngineConfigLease", "summary": "getSecretEngineConfigLease", "description": "Configure the default lease information for generated credentials.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSecretEngineConfigLease" }, "task": true }, { "name": "postSecretEngineConfigLease", "summary": "postSecretEngineConfigLease", "description": "Configure the default lease information for generated credentials.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"lease\": \"string\", \"lease_max\": \"string\"}", "required": false, "schema": { "title": "AwsConfigLeaseRequest", "type": "object", "properties": { "lease": { "type": "string", "description": "Default lease for roles." }, "lease_max": { "type": "string", "description": "Maximum time a credential is valid for." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSecretEngineConfigLease" }, "task": true }, { "name": "getSecretEngineConfigRoot", "summary": "getSecretEngineConfigRoot", "description": "Configure the root credentials that are used to manage Config.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSecretEngineConfigRoot" }, "task": true }, { "name": "postSecretEngineConfigRoot", "summary": "postSecretEngineConfigRoot", "description": "Configure the root credentials that are used to manage Config.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"access_key\": \"string\", \"iam_endpoint\": \"string\", \"max_retries\": 123, \"region\": \"string\", \"secret_key\": \"string\", \"sts_endpoint\": \"string\"}", "required": false, "schema": { "title": "AwsConfigRootRequest", "type": "object", "properties": { "access_key": { "type": "string", "description": "Access key with permission to create new keys." }, "iam_endpoint": { "type": "string", "description": "Endpoint to custom IAM server URL" }, "max_retries": { "type": "integer", "description": "Maximum number of retries for recoverable exceptions of AWS APIs", "default": -1 }, "region": { "type": "string", "description": "Region for API calls." }, "secret_key": { "type": "string", "description": "Secret key with permission to create new keys." }, "sts_endpoint": { "type": "string", "description": "Endpoint to custom STS server URL" } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSecretEngineConfigRoot" }, "task": true }, { "name": "postSecretEngineConfigRotateRoot", "summary": "postSecretEngineConfigRotateRoot", "description": "Request to rotate the Secret Engine credentials used by Vault", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSecretEngineConfigRotateRoot" }, "task": true }, { "name": "getSecretEngineCreds", "summary": "getSecretEngineCreds", "description": "Generate Secret Engine credentials from a specific Vault role.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSecretEngineCreds" }, "task": true }, { "name": "postSecretEngineCreds", "summary": "postSecretEngineCreds", "description": "Generate Secret Engine credentials from a specific Vault role.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"name\": \"string\", \"role_arn\": \"string\", \"role_session_name\": \"string\", \"ttl\": 123}", "required": false, "schema": { "title": "AwsCredsRequest", "type": "object", "properties": { "name": { "type": "string", "description": "Name of the role" }, "role_arn": { "type": "string", "description": "ARN of role to assume when credential_type is assumed_role" }, "role_session_name": { "type": "string", "description": "Session name to use when assuming role. Max chars: 64" }, "ttl": { "type": "integer", "description": "Lifetime of the returned credentials in seconds", "default": 3600 } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSecretEngineCreds" }, "task": true }, { "name": "getSecretEngineStsName", "summary": "getSecretEngineStsName", "description": "Generate Secret Engine credentials from a specific Vault role.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the role: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSecretEngineStsName" }, "task": true }, { "name": "postSecretEngineStsName", "summary": "postSecretEngineStsName", "description": "Generate Secret Engine credentials from a specific Vault role.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the role: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"role_arn\": \"string\", \"role_session_name\": \"string\", \"ttl\": 123}", "required": false, "schema": { "title": "AwsStsRequest", "type": "object", "properties": { "role_arn": { "type": "string", "description": "ARN of role to assume when credential_type is assumed_role" }, "role_session_name": { "type": "string", "description": "Session name to use when assuming role. Max chars: 64" }, "ttl": { "type": "integer", "description": "Lifetime of the returned credentials in seconds", "default": 3600 } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSecretEngineStsName" }, "task": true }, { "name": "getSecretEngineCredsRole", "summary": "getSecretEngineCredsRole", "description": "Request Service Principal credentials for a given Vault role.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "role", "type": "string", "info": "Name of the Vault role: string", "required": true, "schema": { "title": "role", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSecretEngineCredsRole" }, "task": true }, { "name": "getSecretEngineConfigAccess", "summary": "getSecretEngineConfigAccess", "description": "getSecretEngineConfigAccess", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSecretEngineConfigAccess" }, "task": true }, { "name": "postSecretEngineConfigAccess", "summary": "postSecretEngineConfigAccess", "description": "postSecretEngineConfigAccess", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"address\": \"string\", \"ca_cert\": \"string\", \"client_cert\": \"string\", \"client_key\": \"string\", \"scheme\": \"string\", \"token\": \"string\"}", "required": false, "schema": { "title": "ConsulConfigAccessRequest", "type": "object", "properties": { "address": { "type": "string", "description": "Consul server address" }, "ca_cert": { "type": "string", "description": "CA certificate to use when verifying Consul server certificate, must be x509 PEM encoded." }, "client_cert": { "type": "string", "description": "Client certificate used for Consul's TLS communication, must be x509 PEM encoded and if this is set you need to also set client_key." }, "client_key": { "type": "string", "description": "Client key used for Consul's TLS communication, must be x509 PEM encoded and if this is set you need to also set client_cert." }, "scheme": { "type": "string", "description": "URI scheme for the Consul address", "default": "http" }, "token": { "type": "string", "description": "Token for API calls" } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSecretEngineConfigAccess" }, "task": true }, { "name": "getSecretEnginePath", "summary": "getSecretEnginePath", "description": "Retrieve the secret at the specified location.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "secretpath", "type": "string", "info": "Specifies the path of the secret.: string", "required": true, "schema": { "title": "secretpath", "type": "string" } }, { "name": "list", "type": "string", "info": "Return a list if `true`: string", "required": false, "schema": { "title": "list", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSecretEnginePath" }, "task": true }, { "name": "postSecretEnginePath", "summary": "postSecretEnginePath", "description": "Store a secret at the specified location.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "secretpath", "type": "string", "info": "Specifies the path of the secret.: string", "required": true, "schema": { "title": "secretpath", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSecretEnginePath" }, "task": true }, { "name": "deleteSecretEnginePath", "summary": "deleteSecretEnginePath", "description": "Deletes the secret at the specified location.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "secretpath", "type": "string", "info": "Specifies the path of the secret.: string", "required": true, "schema": { "title": "secretpath", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteSecretEnginePath" }, "task": true }, { "name": "getSecretEngineConfigName", "summary": "getSecretEngineConfigName", "description": "Configure connection details to a Secret Engine plugin.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of this database connection: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSecretEngineConfigName" }, "task": true }, { "name": "postSecretEngineConfigName", "summary": "postSecretEngineConfigName", "description": "Configure connection details to a Secret Engine plugin.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of this database connection: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"allowed_roles\": \"array\", \"password_policy\": \"string\", \"plugin_name\": \"string\", \"root_rotation_statements\": \"array\", \"verify_connection\": \"boolean\"}", "required": false, "schema": { "title": "DatabaseConfigRequest", "type": "object", "properties": { "allowed_roles": { "type": "array", "items": { "type": "string" }, "description": "Comma separated string or array of the role names allowed to get creds from this database connection. If empty no roles are allowed. If \"*\" all roles are allowed." }, "password_policy": { "type": "string", "description": "Password policy to use when generating passwords." }, "plugin_name": { "type": "string", "description": "The name of a builtin or previously registered plugin known to vault. This endpoint will create an instance of that plugin type." }, "root_rotation_statements": { "type": "array", "items": { "type": "string" }, "description": "Specifies the database statements to be executed to rotate the root user's credentials. See the plugin's API page for more information on support and formatting for this parameter." }, "verify_connection": { "type": "boolean", "description": "If true, the connection details are verified by actually connecting to the database. Defaults to true.", "default": true } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSecretEngineConfigName" }, "task": true }, { "name": "deleteSecretEngineConfigName", "summary": "deleteSecretEngineConfigName", "description": "Configure connection details to a Secret Engine plugin.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of this database connection: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteSecretEngineConfigName" }, "task": true }, { "name": "postSecretEngineResetName", "summary": "postSecretEngineResetName", "description": "Resets a Secret Engine plugin.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of this database connection: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSecretEngineResetName" }, "task": true }, { "name": "postSecretEngineRotateRoleName", "summary": "postSecretEngineRotateRoleName", "description": "Request Secret Engine credentials for a certain role.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the static role: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSecretEngineRotateRoleName" }, "task": true }, { "name": "postSecretEngineRotateRootName", "summary": "postSecretEngineRotateRootName", "description": "Request Secret Engine credentials for a certain role.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of this database connection: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSecretEngineRotateRootName" }, "task": true }, { "name": "getSecretEngineStaticCredsName", "summary": "getSecretEngineStaticCredsName", "description": "Request Secret Engine credentials for a certain static role. These credentials are\nrotated periodically.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the static role.: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSecretEngineStaticCredsName" }, "task": true }, { "name": "getSecretEngineStaticRoles", "summary": "getSecretEngineStaticRoles", "description": "Manage the static roles that can be created with this backend.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "list", "type": "string", "info": "Return a list if `true`: string", "required": false, "schema": { "title": "list", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSecretEngineStaticRoles" }, "task": true }, { "name": "getSecretEngineStaticRolesName", "summary": "getSecretEngineStaticRolesName", "description": "Manage the static roles that can be created with this backend.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the role.: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSecretEngineStaticRolesName" }, "task": true }, { "name": "postSecretEngineStaticRolesName", "summary": "postSecretEngineStaticRolesName", "description": "Manage the static roles that can be created with this backend.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the role.: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"db_name\": \"string\", \"rotation_period\": 123, \"rotation_statements\": \"array\", \"username\": \"string\"}", "required": false, "schema": { "title": "DatabaseStaticRolesRequest", "type": "object", "properties": { "db_name": { "type": "string", "description": "Name of the database this role acts on." }, "rotation_period": { "type": "integer", "description": "Period for automatic credential rotation of the given username. Not valid unless used with \"username\"." }, "rotation_statements": { "type": "array", "items": { "type": "string" }, "description": "Specifies the database statements to be executed to rotate the accounts credentials. Not every plugin type will support this functionality. See the plugin's API page for more information on support and formatting for this parameter." }, "username": { "type": "string", "description": "Name of the static user account for Vault to manage. Requires \"rotation_period\" to be specified" } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSecretEngineStaticRolesName" }, "task": true }, { "name": "deleteSecretEngineStaticRolesName", "summary": "deleteSecretEngineStaticRolesName", "description": "Manage the static roles that can be created with this backend.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the role.: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteSecretEngineStaticRolesName" }, "task": true }, { "name": "getSecretEngineKeyRoleset", "summary": "getSecretEngineKeyRoleset", "description": "Generate an service account private key under a specific role set.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "roleset", "type": "string", "info": "Required. Name of the role set.: string", "required": true, "schema": { "title": "roleset", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSecretEngineKeyRoleset" }, "task": true }, { "name": "postSecretEngineKeyRoleset", "summary": "postSecretEngineKeyRoleset", "description": "Generate an service account private key under a specific role set.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "roleset", "type": "string", "info": "Required. Name of the role set.: string", "required": true, "schema": { "title": "roleset", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"key_algorithm\": \"string\", \"key_type\": \"string\", \"ttl\": 123}", "required": false, "schema": { "title": "GcpKeyRequest", "type": "object", "properties": { "key_algorithm": { "type": "string", "description": "Private key algorithm for service account key - defaults to KEY_ALG_RSA_2048\"", "default": "KEY_ALG_RSA_2048" }, "key_type": { "type": "string", "description": "Private key type for service account key - defaults to TYPE_GOOGLE_CREDENTIALS_FILE\"", "default": "TYPE_GOOGLE_CREDENTIALS_FILE" }, "ttl": { "type": "integer", "description": "Lifetime of the service account key" } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSecretEngineKeyRoleset" }, "task": true }, { "name": "getSecretEngineRolesetName", "summary": "getSecretEngineRolesetName", "description": "Read/write sets of IAM roles to be given to generated credentials for specified Secret Engine resources.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Required. Name of the role.: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSecretEngineRolesetName" }, "task": true }, { "name": "postSecretEngineRolesetName", "summary": "postSecretEngineRolesetName", "description": "Read/write sets of IAM roles to be given to generated credentials for specified SecretEngine resources.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Required. Name of the role.: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"bindings\": \"string\", \"project\": \"string\", \"secret_type\": \"string\", \"token_scopes\": \"array\"}", "required": false, "schema": { "title": "GcpRolesetRequest", "type": "object", "properties": { "bindings": { "type": "string", "description": "Bindings configuration string." }, "project": { "type": "string", "description": "Name of the GCP project that this roleset's service account will belong to." }, "secret_type": { "type": "string", "description": "Type of secret generated for this role set. Defaults to 'access_token'", "default": "access_token" }, "token_scopes": { "type": "array", "items": { "type": "string" }, "description": "List of OAuth scopes to assign to credentials generated under this role set" } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSecretEngineRolesetName" }, "task": true }, { "name": "deleteSecretEngineRolesetName", "summary": "deleteSecretEngineRolesetName", "description": "Read/write sets of IAM roles to be given to generated credentials for specified Secret Engine resources.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Required. Name of the role.: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteSecretEngineRolesetName" }, "task": true }, { "name": "postSecretEngineRolesetNameRotate", "summary": "postSecretEngineRolesetNameRotate", "description": "Rotates or recreates the service account bound to a roleset.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the role.: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSecretEngineRolesetNameRotate" }, "task": true }, { "name": "postSecretEngineRolesetNameRotateKey", "summary": "postSecretEngineRolesetNameRotateKey", "description": "Rotate the service account key used to generate access tokens for a roleset.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the role.: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSecretEngineRolesetNameRotateKey" }, "task": true }, { "name": "getSecretEngineRolesets", "summary": "getSecretEngineRolesets", "description": "List existing rolesets.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "list", "type": "string", "info": "Return a list if `true`: string", "required": false, "schema": { "title": "list", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSecretEngineRolesets" }, "task": true }, { "name": "getSecretEngineTokenRoleset", "summary": "getSecretEngineTokenRoleset", "description": "Generate an OAuth2 access token under a specific role set.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "roleset", "type": "string", "info": "Required. Name of the role set.: string", "required": true, "schema": { "title": "roleset", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSecretEngineTokenRoleset" }, "task": true }, { "name": "postSecretEngineTokenRoleset", "summary": "postSecretEngineTokenRoleset", "description": "Generate an OAuth2 access token under a specific role set.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "roleset", "type": "string", "info": "Required. Name of the role set.: string", "required": true, "schema": { "title": "roleset", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSecretEngineTokenRoleset" }, "task": true }, { "name": "postSecretEngineDecryptKey", "summary": "postSecretEngineDecryptKey", "description": "Decrypt a ciphertext value using a named key", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "key", "type": "string", "info": "Name of the key in Vault to use for decryption. This key must already exist in Vault and must map back to a Google Cloud KMS key.: string", "required": true, "schema": { "title": "key", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"additional_authenticated_data\": \"string\", \"ciphertext\": \"string\", \"key_version\": 123}", "required": false, "schema": { "title": "GcpkmsDecryptRequest", "type": "object", "properties": { "additional_authenticated_data": { "type": "string", "description": "Optional data that was specified during encryption of this payload." }, "ciphertext": { "type": "string", "description": "Ciphertext to decrypt as previously returned from an encrypt operation. This must be base64-encoded ciphertext as previously returned from an encrypt operation." }, "key_version": { "type": "integer", "description": "Integer version of the crypto key version to use for decryption. This is required for asymmetric keys. For symmetric keys, Cloud KMS will choose the correct version automatically." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSecretEngineDecryptKey" }, "task": true }, { "name": "postSecretEngineEncryptKey", "summary": "postSecretEngineEncryptKey", "description": "Encrypt a plaintext value using a named key", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "key", "type": "string", "info": "Name of the key in Vault to use for encryption. This key must already exist in Vault and must map back to a Google Cloud KMS key.: string", "required": true, "schema": { "title": "key", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"additional_authenticated_data\": \"string\", \"key_version\": 123, \"plaintext\": \"string\"}", "required": false, "schema": { "title": "GcpkmsEncryptRequest", "type": "object", "properties": { "additional_authenticated_data": { "type": "string", "description": "Optional base64-encoded data that, if specified, must also be provided to decrypt this payload." }, "key_version": { "type": "integer", "description": "Integer version of the crypto key version to use for encryption. If unspecified, this defaults to the latest active crypto key version." }, "plaintext": { "type": "string", "description": "Plaintext value to be encrypted. This can be a string or binary, but the size is limited. See the Google Cloud KMS documentation for information on size limitations by key types." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSecretEngineEncryptKey" }, "task": true }, { "name": "getSecretEngineKeys", "summary": "getSecretEngineKeys", "description": "List named keys", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "list", "type": "string", "info": "Return a list if `true`: string", "required": false, "schema": { "title": "list", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSecretEngineKeys" }, "task": true }, { "name": "getSecretEngineKeysConfigKey", "summary": "getSecretEngineKeysConfigKey", "description": "Configure the key in Vault", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "key", "type": "string", "info": "Name of the key in Vault.: string", "required": true, "schema": { "title": "key", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSecretEngineKeysConfigKey" }, "task": true }, { "name": "postSecretEngineKeysConfigKey", "summary": "postSecretEngineKeysConfigKey", "description": "Configure the key in Vault", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "key", "type": "string", "info": "Name of the key in Vault.: string", "required": true, "schema": { "title": "key", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"max_version\": 123, \"min_version\": 123}", "required": false, "schema": { "title": "GcpkmsKeysConfigRequest", "type": "object", "properties": { "max_version": { "type": "integer", "description": "Maximum allowed crypto key version. If set to a positive value, key versions greater than the given value are not permitted to be used. If set to 0 or a negative value, there is no maximum key version." }, "min_version": { "type": "integer", "description": "Minimum allowed crypto key version. If set to a positive value, key versions less than the given value are not permitted to be used. If set to 0 or a negative value, there is no minimum key version. This value only affects encryption/re-encryption, not decryption. To restrict old values from being decrypted, increase this value and then perform a trim operation." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSecretEngineKeysConfigKey" }, "task": true }, { "name": "postSecretEngineKeysDeregisterKey", "summary": "postSecretEngineKeysDeregisterKey", "description": "Deregister an existing key in Vault", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "key", "type": "string", "info": "Name of the key to deregister in Vault. If the key exists in Google Cloud KMS, it will be left untouched.: string", "required": true, "schema": { "title": "key", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSecretEngineKeysDeregisterKey" }, "task": true }, { "name": "deleteSecretEngineKeysDeregisterKey", "summary": "deleteSecretEngineKeysDeregisterKey", "description": "Deregister an existing key in Vault", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "key", "type": "string", "info": "Name of the key to deregister in Vault. If the key exists in Google Cloud KMS, it will be left untouched.: string", "required": true, "schema": { "title": "key", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteSecretEngineKeysDeregisterKey" }, "task": true }, { "name": "postSecretEngineKeysRegisterKey", "summary": "postSecretEngineKeysRegisterKey", "description": "Register an existing crypto key in Secret Engine", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "key", "type": "string", "info": "Name of the key to register in Vault. This will be the named used to refer to the underlying crypto key when encrypting or decrypting data.: string", "required": true, "schema": { "title": "key", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"crypto_key\": \"string\", \"verify\": \"boolean\"}", "required": false, "schema": { "title": "GcpkmsKeysRegisterRequest", "type": "object", "properties": { "crypto_key": { "type": "string", "description": "Full resource ID of the crypto key including the project, location, key ring, and crypto key like \"projects/%s/locations/%s/keyRings/%s/cryptoKeys/%s\". This crypto key must already exist in Google Cloud KMS unless verify is set to \"false\"." }, "verify": { "type": "boolean", "description": "Verify that the given Google Cloud KMS crypto key exists and is accessible before creating the storage entry in Vault. Set this to \"false\" if the key will not exist at creation time.", "default": true } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSecretEngineKeysRegisterKey" }, "task": true }, { "name": "postSecretEngineKeysRotateKey", "summary": "postSecretEngineKeysRotateKey", "description": "Rotate a crypto key to a new primary version", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "key", "type": "string", "info": "Name of the key to rotate. This key must already be registered with Vault and point to a valid Google Cloud KMS crypto key.: string", "required": true, "schema": { "title": "key", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSecretEngineKeysRotateKey" }, "task": true }, { "name": "postSecretEngineKeysTrimKey", "summary": "postSecretEngineKeysTrimKey", "description": "Delete old crypto key versions from SecretEngine", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "key", "type": "string", "info": "Name of the key in Vault.: string", "required": true, "schema": { "title": "key", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSecretEngineKeysTrimKey" }, "task": true }, { "name": "deleteSecretEngineKeysTrimKey", "summary": "deleteSecretEngineKeysTrimKey", "description": "Delete old crypto key versions from Secret Engine", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "key", "type": "string", "info": "Name of the key in Vault.: string", "required": true, "schema": { "title": "key", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteSecretEngineKeysTrimKey" }, "task": true }, { "name": "getSecretEngineKeysKey", "summary": "getSecretEngineKeysKey", "description": "Interact with crypto keys in Vault and Secret Engine", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "key", "type": "string", "info": "Name of the key in Vault.: string", "required": true, "schema": { "title": "key", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSecretEngineKeysKey" }, "task": true }, { "name": "postSecretEngineKeysKey", "summary": "postSecretEngineKeysKey", "description": "Interact with crypto keys in Vault and Secret Engine", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "key", "type": "string", "info": "Name of the key in Vault.: string", "required": true, "schema": { "title": "key", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"algorithm\": \"string\", \"crypto_key\": \"string\", \"key_ring\": \"string\", \"labels\": \"object\", \"protection_level\": \"string\", \"purpose\": \"string\", \"rotation_period\": 123}", "required": false, "schema": { "title": "GcpkmsKeysRequest", "type": "object", "properties": { "algorithm": { "type": "string", "description": "Algorithm to use for encryption, decryption, or signing. The value depends on the key purpose. The value cannot be changed after creation. For a key purpose of \"encrypt_decrypt\", the valid values are: - symmetric_encryption (default) For a key purpose of \"asymmetric_sign\", valid values are: - rsa_sign_pss_2048_sha256 - rsa_sign_pss_3072_sha256 - rsa_sign_pss_4096_sha256 - rsa_sign_pkcs1_2048_sha256 - rsa_sign_pkcs1_3072_sha256 - rsa_sign_pkcs1_4096_sha256 - ec_sign_p256_sha256 - ec_sign_p384_sha384 For a key purpose of \"asymmetric_decrypt\", valid values are: - rsa_decrypt_oaep_2048_sha256 - rsa_decrypt_oaep_3072_sha256 - rsa_decrypt_oaep_4096_sha256" }, "crypto_key": { "type": "string", "description": "Name of the crypto key to use. If the given crypto key does not exist, Vault will try to create it. This defaults to the name of the key given to Vault as the parameter if unspecified." }, "key_ring": { "type": "string", "description": "Full Google Cloud resource ID of the key ring with the project and location (e.g. projects/my-project/locations/global/keyRings/my-keyring). If the given key ring does not exist, Vault will try to create it during a create operation." }, "labels": { "type": "object", "description": "Arbitrary key=value label to apply to the crypto key. To specify multiple labels, specify this argument multiple times (e.g. labels=\"a=b\" labels=\"c=d\")." }, "protection_level": { "type": "string", "description": "Level of protection to use for the key management. Valid values are \"software\" and \"hsm\". The default value is \"software\". The value cannot be changed after creation." }, "purpose": { "type": "string", "description": "Purpose of the key. Valid options are \"asymmetric_decrypt\", \"asymmetric_sign\", and \"encrypt_decrypt\". The default value is \"encrypt_decrypt\". The value cannot be changed after creation." }, "rotation_period": { "type": "integer", "description": "Amount of time between crypto key version rotations. This is specified as a time duration value like 72h (72 hours). The smallest possible value is 24h. This value only applies to keys with a purpose of \"encrypt_decrypt\"." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSecretEngineKeysKey" }, "task": true }, { "name": "deleteSecretEngineKeysKey", "summary": "deleteSecretEngineKeysKey", "description": "Interact with crypto keys in Vault and Secret Engine", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "key", "type": "string", "info": "Name of the key in Vault.: string", "required": true, "schema": { "title": "key", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteSecretEngineKeysKey" }, "task": true }, { "name": "getSecretEnginePubkeyKey", "summary": "getSecretEnginePubkeyKey", "description": "Retrieve the public key associated with the named key", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "key", "type": "string", "info": "Name of the key for which to get the public key. This key must already exist in Vault and Google Cloud KMS.: string", "required": true, "schema": { "title": "key", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSecretEnginePubkeyKey" }, "task": true }, { "name": "postSecretEngineReencryptKey", "summary": "postSecretEngineReencryptKey", "description": "Re-encrypt existing ciphertext data to a new version", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "key", "type": "string", "info": "Name of the key to use for encryption. This key must already exist in Vault and Google Cloud KMS.: string", "required": true, "schema": { "title": "key", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"additional_authenticated_data\": \"string\", \"ciphertext\": \"string\", \"key_version\": 123}", "required": false, "schema": { "title": "GcpkmsReencryptRequest", "type": "object", "properties": { "additional_authenticated_data": { "type": "string", "description": "Optional data that, if specified, must also be provided during decryption." }, "ciphertext": { "type": "string", "description": "Ciphertext to be re-encrypted to the latest key version. This must be ciphertext that Vault previously generated for this named key." }, "key_version": { "type": "integer", "description": "Integer version of the crypto key version to use for the new encryption. If unspecified, this defaults to the latest active crypto key version." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSecretEngineReencryptKey" }, "task": true }, { "name": "postSecretEngineSignKey", "summary": "postSecretEngineSignKey", "description": "Signs a message or digest using a named key", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "key", "type": "string", "info": "Name of the key in Vault to use for signing. This key must already exist in Vault and must map back to a Google Cloud KMS key.: string", "required": true, "schema": { "title": "key", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"digest\": \"string\", \"key_version\": 123}", "required": false, "schema": { "title": "GcpkmsSignRequest", "type": "object", "properties": { "digest": { "type": "string", "description": "Digest to sign. This digest must use the same SHA algorithm as the underlying Cloud KMS key. The digest must be the base64-encoded binary value. This field is required." }, "key_version": { "type": "integer", "description": "Integer version of the crypto key version to use for signing. This field is required." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSecretEngineSignKey" }, "task": true }, { "name": "postSecretEngineVerifyKey", "summary": "postSecretEngineVerifyKey", "description": "Verify a signature using a named key", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "key", "type": "string", "info": "Name of the key in Vault to use for verification. This key must already exist in Vault and must map back to a Google Cloud KMS key.: string", "required": true, "schema": { "title": "key", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"digest\": \"string\", \"key_version\": 123, \"signature\": \"string\"}", "required": false, "schema": { "title": "GcpkmsVerifyRequest", "type": "object", "properties": { "digest": { "type": "string", "description": "Digest to verify. This digest must use the same SHA algorithm as the underlying Cloud KMS key. The digest must be the base64-encoded binary value. This field is required." }, "key_version": { "type": "integer", "description": "Integer version of the crypto key version to use for verification. This field is required." }, "signature": { "type": "string", "description": "Base64-encoded signature to use for verification. This field is required." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSecretEngineVerifyKey" }, "task": true }, { "name": "getSecretEngineDataPath", "summary": "getSecretEngineDataPath", "description": "Write, Read, and Delete data in the Secret Engine.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "enginepath", "type": "string", "info": "Location of the secret.: string", "required": true, "schema": { "title": "enginepath", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSecretEngineDataPath" }, "task": true }, { "name": "postSecretEngineDataPath", "summary": "postSecretEngineDataPath", "description": "Write, Read, and Delete data in the Secret Engine.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "enginepath", "type": "string", "info": "Location of the secret.: string", "required": true, "schema": { "title": "enginepath", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"data\": \"object\", \"options\": \"object\", \"version\": 123}", "required": false, "schema": { "title": "KvDataRequest", "type": "object", "properties": { "data": { "type": "object", "description": "The contents of the data map will be stored and returned on read." }, "options": { "type": "object", "description": "Options for writing a KV entry. Set the \"cas\" value to use a Check-And-Set operation. If not set the write will be allowed. If set to 0 a write will only be allowed if the key doesn’t exist. If the index is non-zero the write will only be allowed if the key’s current version matches the version specified in the cas parameter." }, "version": { "type": "integer", "description": "If provided during a read, the value at the version number will be returned" } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSecretEngineDataPath" }, "task": true }, { "name": "deleteSecretEngineDataPath", "summary": "deleteSecretEngineDataPath", "description": "Write, Read, and Delete data in the Secret Engine.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "enginepath", "type": "string", "info": "Location of the secret.: string", "required": true, "schema": { "title": "enginepath", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteSecretEngineDataPath" }, "task": true }, { "name": "postSecretEngineDeletePath", "summary": "postSecretEngineDeletePath", "description": "Marks one or more versions as deleted in the Secret Engine.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "enginepath", "type": "string", "info": "Location of the secret.: string", "required": true, "schema": { "title": "enginepath", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"versions\": \"array\"}", "required": false, "schema": { "title": "KvDeleteRequest", "type": "object", "properties": { "versions": { "type": "array", "items": { "type": "integer" }, "description": "The versions to be archived. The versioned data will not be deleted, but it will no longer be returned in normal get requests." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSecretEngineDeletePath" }, "task": true }, { "name": "postSecretEngineDestroyPath", "summary": "postSecretEngineDestroyPath", "description": "Permanently removes one or more versions in the Secret Engine", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "enginepath", "type": "string", "info": "Location of the secret.: string", "required": true, "schema": { "title": "enginepath", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"versions\": \"array\"}", "required": false, "schema": { "title": "KvDestroyRequest", "type": "object", "properties": { "versions": { "type": "array", "items": { "type": "integer" }, "description": "The versions to destroy. Their data will be permanently deleted." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSecretEngineDestroyPath" }, "task": true }, { "name": "getSecretEngineMetadataPath", "summary": "getSecretEngineMetadataPath", "description": "Configures settings for the Secret Engine", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "enginepath", "type": "string", "info": "Location of the secret.: string", "required": true, "schema": { "title": "enginepath", "type": "string" } }, { "name": "list", "type": "string", "info": "Return a list if `true`: string", "required": false, "schema": { "title": "list", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSecretEngineMetadataPath" }, "task": true }, { "name": "postSecretEngineMetadataPath", "summary": "postSecretEngineMetadataPath", "description": "Configures settings for the Secret Engine", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "enginepath", "type": "string", "info": "Location of the secret.: string", "required": true, "schema": { "title": "enginepath", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"cas_required\": \"boolean\", \"delete_version_after\": 123, \"max_versions\": 123}", "required": false, "schema": { "title": "KvMetadataRequest", "type": "object", "properties": { "cas_required": { "type": "boolean", "description": "If true the key will require the cas parameter to be set on all write requests. If false, the backend’s configuration will be used." }, "delete_version_after": { "type": "integer", "description": "The length of time before a version is deleted. If not set, the backend's configured delete_version_after is used. Cannot be greater than the backend's delete_version_after. A zero duration clears the current setting. A negative duration will cause an error." }, "max_versions": { "type": "integer", "description": "The number of versions to keep. If not set, the backend’s configured max version is used." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSecretEngineMetadataPath" }, "task": true }, { "name": "deleteSecretEngineMetadataPath", "summary": "deleteSecretEngineMetadataPath", "description": "Configures settings for the Secret Engine", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "enginepath", "type": "string", "info": "Location of the secret.: string", "required": true, "schema": { "title": "enginepath", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteSecretEngineMetadataPath" }, "task": true }, { "name": "postSecretEngineUndeletePath", "summary": "postSecretEngineUndeletePath", "description": "Undeletes one or more versions from the SecretEngine.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "enginepath", "type": "string", "info": "Location of the secret.: string", "required": true, "schema": { "title": "enginepath", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"versions\": \"array\"}", "required": false, "schema": { "title": "KvUndeleteRequest", "type": "object", "properties": { "versions": { "type": "array", "items": { "type": "integer" }, "description": "The versions to unarchive. The versions will be restored and their data will be returned on normal get requests." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSecretEngineUndeletePath" }, "task": true }, { "name": "postSecretEngineConfigConnection", "summary": "postSecretEngineConfigConnection", "description": "Configure the connection URI, username, and password to talk to Secret Engine management HTTP API.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"connection_uri\": \"string\", \"password\": \"string\", \"password_policy\": \"string\", \"username\": \"string\", \"verify_connection\": \"boolean\"}", "required": false, "schema": { "title": "RabbitmqConfigConnectionRequest", "type": "object", "properties": { "connection_uri": { "type": "string", "description": "RabbitMQ Management URI" }, "password": { "type": "string", "description": "Password of the provided RabbitMQ management user" }, "password_policy": { "type": "string", "description": "Name of the password policy to use to generate passwords for dynamic credentials." }, "username": { "type": "string", "description": "Username of a RabbitMQ management administrator" }, "verify_connection": { "type": "boolean", "description": "If set, connection_uri is verified by actually connecting to the RabbitMQ management API", "default": true } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSecretEngineConfigConnection" }, "task": true }, { "name": "getSecretEngineConfigZeroaddress", "summary": "getSecretEngineConfigZeroaddress", "description": "Assign zero address as default CIDR block for select roles.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSecretEngineConfigZeroaddress" }, "task": true }, { "name": "postSecretEngineConfigZeroaddress", "summary": "postSecretEngineConfigZeroaddress", "description": "Assign zero address as default CIDR block for select roles.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"roles\": \"array\"}", "required": false, "schema": { "title": "SshConfigZeroaddressRequest", "type": "object", "properties": { "roles": { "type": "array", "items": { "type": "string" }, "description": "[Required] Comma separated list of role names which allows credentials to be requested for any IP address. CIDR blocks previously registered under these roles will be ignored." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSecretEngineConfigZeroaddress" }, "task": true }, { "name": "deleteSecretEngineConfigZeroaddress", "summary": "deleteSecretEngineConfigZeroaddress", "description": "Assign zero address as default CIDR block for select roles.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteSecretEngineConfigZeroaddress" }, "task": true }, { "name": "postSecretEngineKeysKeyName", "summary": "postSecretEngineKeysKey_name", "description": "Register a shared private key with Vault.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "keyName", "type": "string", "info": "[Required] Name of the key: string", "required": true, "schema": { "title": "keyName", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"key\": \"string\"}", "required": false, "schema": { "title": "SshKeysRequest", "type": "object", "properties": { "key": { "type": "string", "description": "[Required] SSH private key with super user privileges in host" } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSecretEngineKeysKeyName" }, "task": true }, { "name": "deleteSecretEngineKeysKeyName", "summary": "deleteSecretEngineKeysKey_name", "description": "Register a shared private key with Vault.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "keyName", "type": "string", "info": "[Required] Name of the key: string", "required": true, "schema": { "title": "keyName", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteSecretEngineKeysKeyName" }, "task": true }, { "name": "postSecretEngineLookup", "summary": "postSecretEngineLookup", "description": "List all the roles associated with the given IP address.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"ip\": \"string\"}", "required": false, "schema": { "title": "SshLookupRequest", "type": "object", "properties": { "ip": { "type": "string", "description": "[Required] IP address of remote host" } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSecretEngineLookup" }, "task": true }, { "name": "getSecretEnginePublicKey", "summary": "getSecretEnginePublic_key", "description": "Retrieve the public key.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSecretEnginePublicKey" }, "task": true }, { "name": "postSecretEngineVerify", "summary": "postSecretEngineVerify", "description": "Validate the OTP provided by Vault Secret Engine Agent.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"otp\": \"string\"}", "required": false, "schema": { "title": "SshVerifyRequest", "type": "object", "properties": { "otp": { "type": "string", "description": "[Required] One-Time-Key that needs to be validated" } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSecretEngineVerify" }, "task": true }, { "name": "getCertCa", "summary": "getCertCa", "description": "Fetch a CA, CRL, CA Chain, or non-revoked certificate.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getCertCa" }, "task": true }, { "name": "getCertCaPem", "summary": "getCertCaPem", "description": "Fetch a CA, CRL, CA Chain, or non-revoked certificate.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getCertCaPem" }, "task": true }, { "name": "getCertCaChain", "summary": "getCertCa_chain", "description": "Fetch a CA, CRL, CA Chain, or non-revoked certificate.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getCertCaChain" }, "task": true }, { "name": "getCertCertCaChain", "summary": "getCertCertCa_chain", "description": "Fetch a CA, CRL, CA Chain, or non-revoked certificate.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getCertCertCaChain" }, "task": true }, { "name": "getCertCertCrl", "summary": "getCertCertCrl", "description": "Fetch a CA, CRL, CA Chain, or non-revoked certificate.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getCertCertCrl" }, "task": true }, { "name": "getCertSerial", "summary": "getCertSerial", "description": "Fetch a CA, CRL, CA Chain, or non-revoked certificate.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "serial", "type": "string", "info": "Certificate serial number, in colon- or hyphen-separated octal: string", "required": true, "schema": { "title": "serial", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getCertSerial" }, "task": true }, { "name": "getCertCerts", "summary": "getCertCerts", "description": "Fetch a CA, CRL, CA Chain, or non-revoked certificate.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "list", "type": "string", "info": "Return a list if `true`: string", "required": false, "schema": { "title": "list", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getCertCerts" }, "task": true }, { "name": "postCertConfigCa", "summary": "postCertConfigCa", "description": "Set the CA certificate and private key used for generated credentials.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"pem_bundle\": \"string\"}", "required": false, "schema": { "title": "CertConfigCaRequest", "type": "object", "properties": { "pem_bundle": { "type": "string", "description": "PEM-format, concatenated unencrypted secret key and certificate." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postCertConfigCa" }, "task": true }, { "name": "getCertConfigCrl", "summary": "getCertConfigCrl", "description": "Configure the CRL expiration.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getCertConfigCrl" }, "task": true }, { "name": "postCertConfigCrl", "summary": "postCertConfigCrl", "description": "Configure the CRL expiration.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"disable\": \"boolean\", \"expiry\": \"string\"}", "required": false, "schema": { "title": "CertConfigCrlRequest", "type": "object", "properties": { "disable": { "type": "boolean", "description": "If set to true, disables generating the CRL entirely." }, "expiry": { "type": "string", "description": "The amount of time the generated CRL should be valid; defaults to 72 hours", "default": "72h" } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postCertConfigCrl" }, "task": true }, { "name": "getCertConfigUrls", "summary": "getCertConfigUrls", "description": "Set the URLs for the issuing CA, CRL distribution points, and OCSP servers.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getCertConfigUrls" }, "task": true }, { "name": "postCertConfigUrls", "summary": "postCertConfigUrls", "description": "Set the URLs for the issuing CA, CRL distribution points, and OCSP servers.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"crl_distribution_points\": \"array\", \"issuing_certificates\": \"array\", \"ocsp_servers\": \"array\"}", "required": false, "schema": { "title": "CertConfigUrlsRequest", "type": "object", "properties": { "crl_distribution_points": { "type": "array", "items": { "type": "string" }, "description": "Comma-separated list of URLs to be used for the CRL distribution points attribute" }, "issuing_certificates": { "type": "array", "items": { "type": "string" }, "description": "Comma-separated list of URLs to be used for the issuing certificate attribute" }, "ocsp_servers": { "type": "array", "items": { "type": "string" }, "description": "Comma-separated list of URLs to be used for the OCSP servers attribute" } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postCertConfigUrls" }, "task": true }, { "name": "getCertCrl", "summary": "getCertCrl", "description": "Fetch a CA, CRL, CA Chain, or non-revoked certificate.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getCertCrl" }, "task": true }, { "name": "getCertCrlPem", "summary": "getCertCrlPem", "description": "Fetch a CA, CRL, CA Chain, or non-revoked certificate.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getCertCrlPem" }, "task": true }, { "name": "getCertCrlRotate", "summary": "getCertCrlRotate", "description": "Force a rebuild of the CRL.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getCertCrlRotate" }, "task": true }, { "name": "getCertImportQueue", "summary": "getCertImportQueue", "description": "Fetch a CA, CRL, CA Chain, or non-revoked certificate.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "list", "type": "string", "info": "Return a list if `true`: string", "required": false, "schema": { "title": "list", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getCertImportQueue" }, "task": true }, { "name": "getCertImportQueueRole", "summary": "getCertImportQueueRole", "description": "Fetch a CA, CRL, CA Chain, or non-revoked certificate.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "role", "type": "string", "info": "The desired role with configuration for this request: string", "required": true, "schema": { "title": "role", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getCertImportQueueRole" }, "task": true }, { "name": "postCertIntermediateGenerateExported", "summary": "postCertIntermediateGenerateExported", "description": "Generate a new CSR and private key used for signing.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "exported", "type": "string", "info": "Must be \"internal\" or \"exported\". If set to \"exported\", the generated private key will be returned. This is your *only* chance to retrieve the private key!: string", "required": true, "schema": { "title": "exported", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"add_basic_constraints\": \"boolean\", \"alt_names\": \"string\", \"common_name\": \"string\", \"country\": \"array\", \"exclude_cn_from_sans\": \"boolean\", \"format\": \"string\", \"ip_sans\": \"array\", \"key_bits\": 123, \"key_type\": \"string\", \"locality\": \"array\", \"organization\": \"array\", \"other_sans\": \"array\", \"ou\": \"array\", \"postal_code\": \"array\", \"private_key_format\": \"string\", \"province\": \"array\", \"serial_number\": \"string\", \"street_address\": \"array\", \"ttl\": 123, \"uri_sans\": \"array\"}", "required": false, "schema": { "title": "CertIntermediateGenerateRequest", "type": "object", "properties": { "add_basic_constraints": { "type": "boolean", "description": "Whether to add a Basic Constraints extension with CA: true. Only needed as a workaround in some compatibility scenarios with Active Directory Certificate Services." }, "alt_names": { "type": "string", "description": "The requested Subject Alternative Names, if any, in a comma-delimited list. May contain both DNS names and email addresses." }, "common_name": { "type": "string", "description": "The requested common name; if you want more than one, specify the alternative names in the alt_names map. If not specified when signing, the common name will be taken from the CSR; other names must still be specified in alt_names or ip_sans." }, "country": { "type": "array", "items": { "type": "string" }, "description": "If set, Country will be set to this value." }, "exclude_cn_from_sans": { "type": "boolean", "description": "If true, the Common Name will not be included in DNS or Email Subject Alternate Names. Defaults to false (CN is included).", "default": false }, "format": { "type": "string", "description": "Format for returned data. Can be \"pem\", \"der\", or \"pem_bundle\". If \"pem_bundle\" any private key and issuing cert will be appended to the certificate pem. Defaults to \"pem\".", "default": "pem" }, "ip_sans": { "type": "array", "items": { "type": "string" }, "description": "The requested IP SANs, if any, in a comma-delimited list" }, "key_bits": { "type": "integer", "description": "The number of bits to use. You will almost certainly want to change this if you adjust the key_type.", "default": 2048 }, "key_type": { "type": "string", "description": "The type of key to use; defaults to RSA. \"rsa\" and \"ec\" are the only valid values.", "default": "rsa" }, "locality": { "type": "array", "items": { "type": "string" }, "description": "If set, Locality will be set to this value." }, "organization": { "type": "array", "items": { "type": "string" }, "description": "If set, O (Organization) will be set to this value." }, "other_sans": { "type": "array", "items": { "type": "string" }, "description": "Requested other SANs, in an array with the format ;UTF8: for each entry." }, "ou": { "type": "array", "items": { "type": "string" }, "description": "If set, OU (OrganizationalUnit) will be set to this value." }, "postal_code": { "type": "array", "items": { "type": "string" }, "description": "If set, Postal Code will be set to this value." }, "private_key_format": { "type": "string", "description": "Format for the returned private key. Generally the default will be controlled by the \"format\" parameter as either base64-encoded DER or PEM-encoded DER. However, this can be set to \"pkcs8\" to have the returned private key contain base64-encoded pkcs8 or PEM-encoded pkcs8 instead. Defaults to \"der\".", "default": "der" }, "province": { "type": "array", "items": { "type": "string" }, "description": "If set, Province will be set to this value." }, "serial_number": { "type": "string", "description": "The requested serial number, if any. If you want more than one, specify alternative names in the alt_names map using OID 2.5.4.5." }, "street_address": { "type": "array", "items": { "type": "string" }, "description": "If set, Street Address will be set to this value." }, "ttl": { "type": "integer", "description": "The requested Time To Live for the certificate; sets the expiration date. If not specified the role default, backend default, or system default TTL is used, in that order. Cannot be larger than the mount max TTL. Note: this only has an effect when generating a CA cert or signing a CA cert, not when generating a CSR for an intermediate CA." }, "uri_sans": { "type": "array", "items": { "type": "string" }, "description": "The requested URI SANs, if any, in a comma-delimited list." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postCertIntermediateGenerateExported" }, "task": true }, { "name": "postCertIntermediateSetSigned", "summary": "postCertIntermediateSetSigned", "description": "Provide the signed intermediate CA cert.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"certificate\": \"string\"}", "required": false, "schema": { "title": "CertIntermediateSetSignedRequest", "type": "object", "properties": { "certificate": { "type": "string", "description": "PEM-format certificate. This must be a CA certificate with a public key matching the previously-generated key from the generation endpoint." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postCertIntermediateSetSigned" }, "task": true }, { "name": "postCertIssueRole", "summary": "postCertIssueRole", "description": "Request a certificate using a certain role with the provided details.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "role", "type": "string", "info": "The desired role with configuration for this request: string", "required": true, "schema": { "title": "role", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"alt_names\": \"string\", \"common_name\": \"string\", \"exclude_cn_from_sans\": \"boolean\", \"format\": \"string\", \"ip_sans\": \"array\", \"other_sans\": \"array\", \"private_key_format\": \"string\", \"serial_number\": \"string\", \"ttl\": 123, \"uri_sans\": \"array\"}", "required": false, "schema": { "title": "CertIssueRequest", "type": "object", "properties": { "alt_names": { "type": "string", "description": "The requested Subject Alternative Names, if any, in a comma-delimited list. If email protection is enabled for the role, this may contain email addresses." }, "common_name": { "type": "string", "description": "The requested common name; if you want more than one, specify the alternative names in the alt_names map. If email protection is enabled in the role, this may be an email address." }, "exclude_cn_from_sans": { "type": "boolean", "description": "If true, the Common Name will not be included in DNS or Email Subject Alternate Names. Defaults to false (CN is included).", "default": false }, "format": { "type": "string", "description": "Format for returned data. Can be \"pem\", \"der\", or \"pem_bundle\". If \"pem_bundle\" any private key and issuing cert will be appended to the certificate pem. Defaults to \"pem\".", "default": "pem" }, "ip_sans": { "type": "array", "items": { "type": "string" }, "description": "The requested IP SANs, if any, in a comma-delimited list" }, "other_sans": { "type": "array", "items": { "type": "string" }, "description": "Requested other SANs, in an array with the format ;UTF8: for each entry." }, "private_key_format": { "type": "string", "description": "Format for the returned private key. Generally the default will be controlled by the \"format\" parameter as either base64-encoded DER or PEM-encoded DER. However, this can be set to \"pkcs8\" to have the returned private key contain base64-encoded pkcs8 or PEM-encoded pkcs8 instead. Defaults to \"der\".", "default": "der" }, "serial_number": { "type": "string", "description": "The requested serial number, if any. If you want more than one, specify alternative names in the alt_names map using OID 2.5.4.5." }, "ttl": { "type": "integer", "description": "The requested Time To Live for the certificate; sets the expiration date. If not specified the role default, backend default, or system default TTL is used, in that order. Cannot be larger than the role max TTL." }, "uri_sans": { "type": "array", "items": { "type": "string" }, "description": "The requested URI SANs, if any, in a comma-delimited list." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postCertIssueRole" }, "task": true }, { "name": "postCertRevoke", "summary": "postCertRevoke", "description": "Revoke a certificate by serial number.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"serial_number\": \"string\"}", "required": false, "schema": { "title": "CertRevokeRequest", "type": "object", "properties": { "serial_number": { "type": "string", "description": "Certificate serial number, in colon- or hyphen-separated octal" } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postCertRevoke" }, "task": true }, { "name": "getSecretEngineRoles", "summary": "getSecretEngineRoles", "description": "List the existing roles in this backend", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "list", "type": "string", "info": "Return a list if `true`: string", "required": false, "schema": { "title": "list", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSecretEngineRoles" }, "task": true }, { "name": "getSecretEngineRolesName", "summary": "getSecretEngineRolesName", "description": "Manage the roles that can be created with this backend.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the role: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSecretEngineRolesName" }, "task": true }, { "name": "postSecretEngineRolesName", "summary": "postSecretEngineRolesName", "description": "Manage the roles that can be created with this backend.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the role: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"allow_any_name\": \"boolean\", \"allow_bare_domains\": \"boolean\", \"allow_glob_domains\": \"boolean\", \"allow_ip_sans\": \"boolean\", \"allow_localhost\": \"boolean\", \"allow_subdomains\": \"boolean\", \"allowed_domains\": \"array\", \"allowed_other_sans\": \"array\", \"allowed_serial_numbers\": \"array\", \"allowed_uri_sans\": \"array\", \"basic_constraints_valid_for_non_ca\": \"boolean\", \"client_flag\": \"boolean\", \"code_signing_flag\": \"boolean\", \"country\": \"array\", \"email_protection_flag\": \"boolean\", \"enforce_hostnames\": \"boolean\", \"ext_key_usage\": \"array\", \"ext_key_usage_oids\": \"array\", \"generate_lease\": \"boolean\", \"key_bits\": 123, \"key_type\": \"string\", \"key_usage\": \"array\", \"locality\": \"array\", \"max_ttl\": 123, \"no_store\": \"boolean\", \"not_before_duration\": 123, \"organization\": \"array\", \"ou\": \"array\", \"policy_identifiers\": \"array\", \"postal_code\": \"array\", \"province\": \"array\", \"require_cn\": \"boolean\", \"server_flag\": \"boolean\", \"street_address\": \"array\", \"ttl\": 123, \"use_csr_common_name\": \"boolean\", \"use_csr_sans\": \"boolean\"}", "required": false, "schema": { "title": "CertRolesRequest", "type": "object", "properties": { "allow_any_name": { "type": "boolean", "description": "If set, clients can request certificates for any CN they like. See the documentation for more information." }, "allow_bare_domains": { "type": "boolean", "description": "If set, clients can request certificates for the base domains themselves, e.g. \"example.com\". This is a separate option as in some cases this can be considered a security threat." }, "allow_glob_domains": { "type": "boolean", "description": "If set, domains specified in \"allowed_domains\" can include glob patterns, e.g. \"ftp*.example.com\". See the documentation for more information." }, "allow_ip_sans": { "type": "boolean", "description": "If set, IP Subject Alternative Names are allowed. Any valid IP is accepted.", "default": true }, "allow_localhost": { "type": "boolean", "description": "Whether to allow \"localhost\" as a valid common name in a request", "default": true }, "allow_subdomains": { "type": "boolean", "description": "If set, clients can request certificates for subdomains of the CNs allowed by the other role options, including wildcard subdomains. See the documentation for more information." }, "allowed_domains": { "type": "array", "items": { "type": "string" }, "description": "If set, clients can request certificates for subdomains directly beneath these domains, including the wildcard subdomains. See the documentation for more information. This parameter accepts a comma-separated string or list of domains." }, "allowed_other_sans": { "type": "array", "items": { "type": "string" }, "description": "If set, an array of allowed other names to put in SANs. These values support globbing and must be in the format ;:. Currently only \"utf8\" is a valid type. All values, including globbing values, must use this syntax, with the exception being a single \"*\" which allows any OID and any value (but type must still be utf8)." }, "allowed_serial_numbers": { "type": "array", "items": { "type": "string" }, "description": "If set, an array of allowed serial numbers to put in Subject. These values support globbing." }, "allowed_uri_sans": { "type": "array", "items": { "type": "string" }, "description": "If set, an array of allowed URIs to put in the URI Subject Alternative Names. Any valid URI is accepted, these values support globbing." }, "basic_constraints_valid_for_non_ca": { "type": "boolean", "description": "Mark Basic Constraints valid when issuing non-CA certificates." }, "client_flag": { "type": "boolean", "description": "If set, certificates are flagged for client auth use. Defaults to true.", "default": true }, "code_signing_flag": { "type": "boolean", "description": "If set, certificates are flagged for code signing use. Defaults to false." }, "country": { "type": "array", "items": { "type": "string" }, "description": "If set, Country will be set to this value in certificates issued by this role." }, "email_protection_flag": { "type": "boolean", "description": "If set, certificates are flagged for email protection use. Defaults to false." }, "enforce_hostnames": { "type": "boolean", "description": "If set, only valid host names are allowed for CN and SANs. Defaults to true.", "default": true }, "ext_key_usage": { "type": "array", "items": { "type": "string" }, "description": "A comma-separated string or list of extended key usages. Valid values can be found at https://golang.org/pkg/crypto/x509/#ExtKeyUsage -- simply drop the \"ExtKeyUsage\" part of the name. To remove all key usages from being set, set this value to an empty list.", "default": [] }, "ext_key_usage_oids": { "type": "array", "items": { "type": "string" }, "description": "A comma-separated string or list of extended key usage oids." }, "generate_lease": { "type": "boolean", "description": "If set, certificates issued/signed against this role will have Vault leases attached to them. Defaults to \"false\". Certificates can be added to the CRL by \"vault revoke \" when certificates are associated with leases. It can also be done using the \"pki/revoke\" endpoint. However, when lease generation is disabled, invoking \"pki/revoke\" would be the only way to add the certificates to the CRL. When large number of certificates are generated with long lifetimes, it is recommended that lease generation be disabled, as large amount of leases adversely affect the startup time of Vault." }, "key_bits": { "type": "integer", "description": "The number of bits to use. You will almost certainly want to change this if you adjust the key_type.", "default": 2048 }, "key_type": { "type": "string", "description": "The type of key to use; defaults to RSA. \"rsa\" and \"ec\" are the only valid values.", "default": "rsa" }, "key_usage": { "type": "array", "items": { "type": "string" }, "description": "A comma-separated string or list of key usages (not extended key usages). Valid values can be found at https://golang.org/pkg/crypto/x509/#KeyUsage -- simply drop the \"KeyUsage\" part of the name. To remove all key usages from being set, set this value to an empty list.", "default": [ "DigitalSignature", "KeyAgreement", "KeyEncipherment" ] }, "locality": { "type": "array", "items": { "type": "string" }, "description": "If set, Locality will be set to this value in certificates issued by this role." }, "max_ttl": { "type": "integer", "description": "The maximum allowed lease duration" }, "no_store": { "type": "boolean", "description": "If set, certificates issued/signed against this role will not be stored in the storage backend. This can improve performance when issuing large numbers of certificates. However, certificates issued in this way cannot be enumerated or revoked, so this option is recommended only for certificates that are non-sensitive, or extremely short-lived. This option implies a value of \"false\" for \"generate_lease\"." }, "not_before_duration": { "type": "integer", "description": "The duration before now the cert needs to be created / signed.", "default": 30 }, "organization": { "type": "array", "items": { "type": "string" }, "description": "If set, O (Organization) will be set to this value in certificates issued by this role." }, "ou": { "type": "array", "items": { "type": "string" }, "description": "If set, OU (OrganizationalUnit) will be set to this value in certificates issued by this role." }, "policy_identifiers": { "type": "array", "items": { "type": "string" }, "description": "A comma-separated string or list of policy oids." }, "postal_code": { "type": "array", "items": { "type": "string" }, "description": "If set, Postal Code will be set to this value in certificates issued by this role." }, "province": { "type": "array", "items": { "type": "string" }, "description": "If set, Province will be set to this value in certificates issued by this role." }, "require_cn": { "type": "boolean", "description": "If set to false, makes the 'common_name' field optional while generating a certificate.", "default": true }, "server_flag": { "type": "boolean", "description": "If set, certificates are flagged for server auth use. Defaults to true.", "default": true }, "street_address": { "type": "array", "items": { "type": "string" }, "description": "If set, Street Address will be set to this value in certificates issued by this role." }, "ttl": { "type": "integer", "description": "The lease duration if no specific lease duration is requested. The lease duration controls the expiration of certificates issued by this backend. Defaults to the value of max_ttl." }, "use_csr_common_name": { "type": "boolean", "description": "If set, when used with a signing profile, the common name in the CSR will be used. This does *not* include any requested Subject Alternative Names. Defaults to true.", "default": true }, "use_csr_sans": { "type": "boolean", "description": "If set, when used with a signing profile, the SANs in the CSR will be used. This does *not* include the Common Name (cn). Defaults to true.", "default": true } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSecretEngineRolesName" }, "task": true }, { "name": "deleteSecretEngineRolesName", "summary": "deleteSecretEngineRolesName", "description": "Manage the roles that can be created with this backend.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the role: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteSecretEngineRolesName" }, "task": true }, { "name": "deleteCertRoot", "summary": "deleteCertRoot", "description": "Deletes the root CA key to allow a new one to be generated.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteCertRoot" }, "task": true }, { "name": "postCertRootGenerateExported", "summary": "postCertRootGenerateExported", "description": "Generate a new CA certificate and private key used for signing.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "exported", "type": "string", "info": "Must be \"internal\" or \"exported\". If set to \"exported\", the generated private key will be returned. This is your *only* chance to retrieve the private key!: string", "required": true, "schema": { "title": "exported", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"alt_names\": \"string\", \"common_name\": \"string\", \"country\": \"array\", \"exclude_cn_from_sans\": \"boolean\", \"format\": \"string\", \"ip_sans\": \"array\", \"key_bits\": 123, \"key_type\": \"string\", \"locality\": \"array\", \"max_path_length\": 123, \"organization\": \"array\", \"other_sans\": \"array\", \"ou\": \"array\", \"permitted_dns_domains\": \"array\", \"postal_code\": \"array\", \"private_key_format\": \"string\", \"province\": \"array\", \"serial_number\": \"string\", \"street_address\": \"array\", \"ttl\": 123, \"uri_sans\": \"array\"}", "required": false, "schema": { "title": "CertRootGenerateRequest", "type": "object", "properties": { "alt_names": { "type": "string", "description": "The requested Subject Alternative Names, if any, in a comma-delimited list. May contain both DNS names and email addresses." }, "common_name": { "type": "string", "description": "The requested common name; if you want more than one, specify the alternative names in the alt_names map. If not specified when signing, the common name will be taken from the CSR; other names must still be specified in alt_names or ip_sans." }, "country": { "type": "array", "items": { "type": "string" }, "description": "If set, Country will be set to this value." }, "exclude_cn_from_sans": { "type": "boolean", "description": "If true, the Common Name will not be included in DNS or Email Subject Alternate Names. Defaults to false (CN is included).", "default": false }, "format": { "type": "string", "description": "Format for returned data. Can be \"pem\", \"der\", or \"pem_bundle\". If \"pem_bundle\" any private key and issuing cert will be appended to the certificate pem. Defaults to \"pem\".", "default": "pem" }, "ip_sans": { "type": "array", "items": { "type": "string" }, "description": "The requested IP SANs, if any, in a comma-delimited list" }, "key_bits": { "type": "integer", "description": "The number of bits to use. You will almost certainly want to change this if you adjust the key_type.", "default": 2048 }, "key_type": { "type": "string", "description": "The type of key to use; defaults to RSA. \"rsa\" and \"ec\" are the only valid values.", "default": "rsa" }, "locality": { "type": "array", "items": { "type": "string" }, "description": "If set, Locality will be set to this value." }, "max_path_length": { "type": "integer", "description": "The maximum allowable path length", "default": -1 }, "organization": { "type": "array", "items": { "type": "string" }, "description": "If set, O (Organization) will be set to this value." }, "other_sans": { "type": "array", "items": { "type": "string" }, "description": "Requested other SANs, in an array with the format ;UTF8: for each entry." }, "ou": { "type": "array", "items": { "type": "string" }, "description": "If set, OU (OrganizationalUnit) will be set to this value." }, "permitted_dns_domains": { "type": "array", "items": { "type": "string" }, "description": "Domains for which this certificate is allowed to sign or issue child certificates. If set, all DNS names (subject and alt) on child certs must be exact matches or subsets of the given domains (see https://tools.ietf.org/html/rfc5280#section-4.2.1.10)." }, "postal_code": { "type": "array", "items": { "type": "string" }, "description": "If set, Postal Code will be set to this value." }, "private_key_format": { "type": "string", "description": "Format for the returned private key. Generally the default will be controlled by the \"format\" parameter as either base64-encoded DER or PEM-encoded DER. However, this can be set to \"pkcs8\" to have the returned private key contain base64-encoded pkcs8 or PEM-encoded pkcs8 instead. Defaults to \"der\".", "default": "der" }, "province": { "type": "array", "items": { "type": "string" }, "description": "If set, Province will be set to this value." }, "serial_number": { "type": "string", "description": "The requested serial number, if any. If you want more than one, specify alternative names in the alt_names map using OID 2.5.4.5." }, "street_address": { "type": "array", "items": { "type": "string" }, "description": "If set, Street Address will be set to this value." }, "ttl": { "type": "integer", "description": "The requested Time To Live for the certificate; sets the expiration date. If not specified the role default, backend default, or system default TTL is used, in that order. Cannot be larger than the mount max TTL. Note: this only has an effect when generating a CA cert or signing a CA cert, not when generating a CSR for an intermediate CA." }, "uri_sans": { "type": "array", "items": { "type": "string" }, "description": "The requested URI SANs, if any, in a comma-delimited list." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postCertRootGenerateExported" }, "task": true }, { "name": "postCertRootSignIntermediate", "summary": "postCertRootSignIntermediate", "description": "Issue an intermediate CA certificate based on the provided CSR.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"alt_names\": \"string\", \"common_name\": \"string\", \"country\": \"array\", \"csr\": \"string\", \"exclude_cn_from_sans\": \"boolean\", \"format\": \"string\", \"ip_sans\": \"array\", \"locality\": \"array\", \"max_path_length\": 123, \"organization\": \"array\", \"other_sans\": \"array\", \"ou\": \"array\", \"permitted_dns_domains\": \"array\", \"postal_code\": \"array\", \"private_key_format\": \"string\", \"province\": \"array\", \"serial_number\": \"string\", \"street_address\": \"array\", \"ttl\": 123, \"uri_sans\": \"array\", \"use_csr_values\": \"boolean\"}", "required": false, "schema": { "title": "CertRootSignIntermediateRequest", "type": "object", "properties": { "alt_names": { "type": "string", "description": "The requested Subject Alternative Names, if any, in a comma-delimited list. May contain both DNS names and email addresses." }, "common_name": { "type": "string", "description": "The requested common name; if you want more than one, specify the alternative names in the alt_names map. If not specified when signing, the common name will be taken from the CSR; other names must still be specified in alt_names or ip_sans." }, "country": { "type": "array", "items": { "type": "string" }, "description": "If set, Country will be set to this value." }, "csr": { "type": "string", "description": "PEM-format CSR to be signed." }, "exclude_cn_from_sans": { "type": "boolean", "description": "If true, the Common Name will not be included in DNS or Email Subject Alternate Names. Defaults to false (CN is included).", "default": false }, "format": { "type": "string", "description": "Format for returned data. Can be \"pem\", \"der\", or \"pem_bundle\". If \"pem_bundle\" any private key and issuing cert will be appended to the certificate pem. Defaults to \"pem\".", "default": "pem" }, "ip_sans": { "type": "array", "items": { "type": "string" }, "description": "The requested IP SANs, if any, in a comma-delimited list" }, "locality": { "type": "array", "items": { "type": "string" }, "description": "If set, Locality will be set to this value." }, "max_path_length": { "type": "integer", "description": "The maximum allowable path length", "default": -1 }, "organization": { "type": "array", "items": { "type": "string" }, "description": "If set, O (Organization) will be set to this value." }, "other_sans": { "type": "array", "items": { "type": "string" }, "description": "Requested other SANs, in an array with the format ;UTF8: for each entry." }, "ou": { "type": "array", "items": { "type": "string" }, "description": "If set, OU (OrganizationalUnit) will be set to this value." }, "permitted_dns_domains": { "type": "array", "items": { "type": "string" }, "description": "Domains for which this certificate is allowed to sign or issue child certificates. If set, all DNS names (subject and alt) on child certs must be exact matches or subsets of the given domains (see https://tools.ietf.org/html/rfc5280#section-4.2.1.10)." }, "postal_code": { "type": "array", "items": { "type": "string" }, "description": "If set, Postal Code will be set to this value." }, "private_key_format": { "type": "string", "description": "Format for the returned private key. Generally the default will be controlled by the \"format\" parameter as either base64-encoded DER or PEM-encoded DER. However, this can be set to \"pkcs8\" to have the returned private key contain base64-encoded pkcs8 or PEM-encoded pkcs8 instead. Defaults to \"der\".", "default": "der" }, "province": { "type": "array", "items": { "type": "string" }, "description": "If set, Province will be set to this value." }, "serial_number": { "type": "string", "description": "The requested serial number, if any. If you want more than one, specify alternative names in the alt_names map using OID 2.5.4.5." }, "street_address": { "type": "array", "items": { "type": "string" }, "description": "If set, Street Address will be set to this value." }, "ttl": { "type": "integer", "description": "The requested Time To Live for the certificate; sets the expiration date. If not specified the role default, backend default, or system default TTL is used, in that order. Cannot be larger than the mount max TTL. Note: this only has an effect when generating a CA cert or signing a CA cert, not when generating a CSR for an intermediate CA." }, "uri_sans": { "type": "array", "items": { "type": "string" }, "description": "The requested URI SANs, if any, in a comma-delimited list." }, "use_csr_values": { "type": "boolean", "description": "If true, then: 1) Subject information, including names and alternate names, will be preserved from the CSR rather than using values provided in the other parameters to this path; 2) Any key usages requested in the CSR will be added to the basic set of key usages used for CA certs signed by this path; for instance, the non-repudiation flag.", "default": false } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postCertRootSignIntermediate" }, "task": true }, { "name": "postCertRootSignSelfIssued", "summary": "postCertRootSignSelfIssued", "description": "Signs another CA's self-issued certificate.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"certificate\": \"string\"}", "required": false, "schema": { "title": "CertRootSignSelfIssuedRequest", "type": "object", "properties": { "certificate": { "type": "string", "description": "PEM-format self-issued certificate to be signed." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postCertRootSignSelfIssued" }, "task": true }, { "name": "getCertShowVenafiRolePolicyMap", "summary": "getCertShowVenafiRolePolicyMap", "description": "Fetch a CA, CRL, CA Chain, or non-revoked certificate.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getCertShowVenafiRolePolicyMap" }, "task": true }, { "name": "postCertSignVerbatim", "summary": "postCertSignVerbatim", "description": "Request certificates using a certain role with the provided details.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"alt_names\": \"string\", \"common_name\": \"string\", \"csr\": \"string\", \"exclude_cn_from_sans\": \"boolean\", \"ext_key_usage\": \"array\", \"ext_key_usage_oids\": \"array\", \"format\": \"string\", \"ip_sans\": \"array\", \"key_usage\": \"array\", \"other_sans\": \"array\", \"private_key_format\": \"string\", \"role\": \"string\", \"serial_number\": \"string\", \"ttl\": 123, \"uri_sans\": \"array\"}", "required": false, "schema": { "title": "CertSignVerbatimRequest", "type": "object", "properties": { "alt_names": { "type": "string", "description": "The requested Subject Alternative Names, if any, in a comma-delimited list. If email protection is enabled for the role, this may contain email addresses." }, "common_name": { "type": "string", "description": "The requested common name; if you want more than one, specify the alternative names in the alt_names map. If email protection is enabled in the role, this may be an email address." }, "csr": { "type": "string", "description": "PEM-format CSR to be signed. Values will be taken verbatim from the CSR, except for basic constraints." }, "exclude_cn_from_sans": { "type": "boolean", "description": "If true, the Common Name will not be included in DNS or Email Subject Alternate Names. Defaults to false (CN is included).", "default": false }, "ext_key_usage": { "type": "array", "items": { "type": "string" }, "description": "A comma-separated string or list of extended key usages. Valid values can be found at https://golang.org/pkg/crypto/x509/#ExtKeyUsage -- simply drop the \"ExtKeyUsage\" part of the name. To remove all key usages from being set, set this value to an empty list.", "default": [] }, "ext_key_usage_oids": { "type": "array", "items": { "type": "string" }, "description": "A comma-separated string or list of extended key usage oids." }, "format": { "type": "string", "description": "Format for returned data. Can be \"pem\", \"der\", or \"pem_bundle\". If \"pem_bundle\" any private key and issuing cert will be appended to the certificate pem. Defaults to \"pem\".", "default": "pem" }, "ip_sans": { "type": "array", "items": { "type": "string" }, "description": "The requested IP SANs, if any, in a comma-delimited list" }, "key_usage": { "type": "array", "items": { "type": "string" }, "description": "A comma-separated string or list of key usages (not extended key usages). Valid values can be found at https://golang.org/pkg/crypto/x509/#KeyUsage -- simply drop the \"KeyUsage\" part of the name. To remove all key usages from being set, set this value to an empty list.", "default": [ "DigitalSignature", "KeyAgreement", "KeyEncipherment" ] }, "other_sans": { "type": "array", "items": { "type": "string" }, "description": "Requested other SANs, in an array with the format ;UTF8: for each entry." }, "private_key_format": { "type": "string", "description": "Format for the returned private key. Generally the default will be controlled by the \"format\" parameter as either base64-encoded DER or PEM-encoded DER. However, this can be set to \"pkcs8\" to have the returned private key contain base64-encoded pkcs8 or PEM-encoded pkcs8 instead. Defaults to \"der\".", "default": "der" }, "role": { "type": "string", "description": "The desired role with configuration for this request" }, "serial_number": { "type": "string", "description": "The requested serial number, if any. If you want more than one, specify alternative names in the alt_names map using OID 2.5.4.5." }, "ttl": { "type": "integer", "description": "The requested Time To Live for the certificate; sets the expiration date. If not specified the role default, backend default, or system default TTL is used, in that order. Cannot be larger than the role max TTL." }, "uri_sans": { "type": "array", "items": { "type": "string" }, "description": "The requested URI SANs, if any, in a comma-delimited list." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postCertSignVerbatim" }, "task": true }, { "name": "postCertSignVerbatimRole", "summary": "postCertSignVerbatimRole", "description": "Request certificates using a certain role with the provided details.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "role", "type": "string", "info": "The desired role with configuration for this request: string", "required": true, "schema": { "title": "role", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"alt_names\": \"string\", \"common_name\": \"string\", \"csr\": \"string\", \"exclude_cn_from_sans\": \"boolean\", \"ext_key_usage\": \"array\", \"ext_key_usage_oids\": \"array\", \"format\": \"string\", \"ip_sans\": \"array\", \"key_usage\": \"array\", \"other_sans\": \"array\", \"private_key_format\": \"string\", \"serial_number\": \"string\", \"ttl\": 123, \"uri_sans\": \"array\"}", "required": false, "schema": { "title": "CertSignVerbatimRequest1", "type": "object", "properties": { "alt_names": { "type": "string", "description": "The requested Subject Alternative Names, if any, in a comma-delimited list. If email protection is enabled for the role, this may contain email addresses." }, "common_name": { "type": "string", "description": "The requested common name; if you want more than one, specify the alternative names in the alt_names map. If email protection is enabled in the role, this may be an email address." }, "csr": { "type": "string", "description": "PEM-format CSR to be signed. Values will be taken verbatim from the CSR, except for basic constraints." }, "exclude_cn_from_sans": { "type": "boolean", "description": "If true, the Common Name will not be included in DNS or Email Subject Alternate Names. Defaults to false (CN is included).", "default": false }, "ext_key_usage": { "type": "array", "items": { "type": "string" }, "description": "A comma-separated string or list of extended key usages. Valid values can be found at https://golang.org/pkg/crypto/x509/#ExtKeyUsage -- simply drop the \"ExtKeyUsage\" part of the name. To remove all key usages from being set, set this value to an empty list.", "default": [] }, "ext_key_usage_oids": { "type": "array", "items": { "type": "string" }, "description": "A comma-separated string or list of extended key usage oids." }, "format": { "type": "string", "description": "Format for returned data. Can be \"pem\", \"der\", or \"pem_bundle\". If \"pem_bundle\" any private key and issuing cert will be appended to the certificate pem. Defaults to \"pem\".", "default": "pem" }, "ip_sans": { "type": "array", "items": { "type": "string" }, "description": "The requested IP SANs, if any, in a comma-delimited list" }, "key_usage": { "type": "array", "items": { "type": "string" }, "description": "A comma-separated string or list of key usages (not extended key usages). Valid values can be found at https://golang.org/pkg/crypto/x509/#KeyUsage -- simply drop the \"KeyUsage\" part of the name. To remove all key usages from being set, set this value to an empty list.", "default": [ "DigitalSignature", "KeyAgreement", "KeyEncipherment" ] }, "other_sans": { "type": "array", "items": { "type": "string" }, "description": "Requested other SANs, in an array with the format ;UTF8: for each entry." }, "private_key_format": { "type": "string", "description": "Format for the returned private key. Generally the default will be controlled by the \"format\" parameter as either base64-encoded DER or PEM-encoded DER. However, this can be set to \"pkcs8\" to have the returned private key contain base64-encoded pkcs8 or PEM-encoded pkcs8 instead. Defaults to \"der\".", "default": "der" }, "serial_number": { "type": "string", "description": "The requested serial number, if any. If you want more than one, specify alternative names in the alt_names map using OID 2.5.4.5." }, "ttl": { "type": "integer", "description": "The requested Time To Live for the certificate; sets the expiration date. If not specified the role default, backend default, or system default TTL is used, in that order. Cannot be larger than the role max TTL." }, "uri_sans": { "type": "array", "items": { "type": "string" }, "description": "The requested URI SANs, if any, in a comma-delimited list." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postCertSignVerbatimRole" }, "task": true }, { "name": "postCertSignRole", "summary": "postCertSignRole", "description": "Request certificates using a certain role with the provided details.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "role", "type": "string", "info": "The desired role with configuration for this request: string", "required": true, "schema": { "title": "role", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"alt_names\": \"string\", \"common_name\": \"string\", \"csr\": \"string\", \"exclude_cn_from_sans\": \"boolean\", \"format\": \"string\", \"ip_sans\": \"array\", \"other_sans\": \"array\", \"private_key_format\": \"string\", \"serial_number\": \"string\", \"ttl\": 123, \"uri_sans\": \"array\"}", "required": false, "schema": { "title": "CertSignRequest", "type": "object", "properties": { "alt_names": { "type": "string", "description": "The requested Subject Alternative Names, if any, in a comma-delimited list. If email protection is enabled for the role, this may contain email addresses." }, "common_name": { "type": "string", "description": "The requested common name; if you want more than one, specify the alternative names in the alt_names map. If email protection is enabled in the role, this may be an email address." }, "csr": { "type": "string", "description": "PEM-format CSR to be signed." }, "exclude_cn_from_sans": { "type": "boolean", "description": "If true, the Common Name will not be included in DNS or Email Subject Alternate Names. Defaults to false (CN is included).", "default": false }, "format": { "type": "string", "description": "Format for returned data. Can be \"pem\", \"der\", or \"pem_bundle\". If \"pem_bundle\" any private key and issuing cert will be appended to the certificate pem. Defaults to \"pem\".", "default": "pem" }, "ip_sans": { "type": "array", "items": { "type": "string" }, "description": "The requested IP SANs, if any, in a comma-delimited list" }, "other_sans": { "type": "array", "items": { "type": "string" }, "description": "Requested other SANs, in an array with the format ;UTF8: for each entry." }, "private_key_format": { "type": "string", "description": "Format for the returned private key. Generally the default will be controlled by the \"format\" parameter as either base64-encoded DER or PEM-encoded DER. However, this can be set to \"pkcs8\" to have the returned private key contain base64-encoded pkcs8 or PEM-encoded pkcs8 instead. Defaults to \"der\".", "default": "der" }, "serial_number": { "type": "string", "description": "The requested serial number, if any. If you want more than one, specify alternative names in the alt_names map using OID 2.5.4.5." }, "ttl": { "type": "integer", "description": "The requested Time To Live for the certificate; sets the expiration date. If not specified the role default, backend default, or system default TTL is used, in that order. Cannot be larger than the role max TTL." }, "uri_sans": { "type": "array", "items": { "type": "string" }, "description": "The requested URI SANs, if any, in a comma-delimited list." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postCertSignRole" }, "task": true }, { "name": "postCertTidy", "summary": "postCertTidy", "description": "Tidy up the backend by removing expired certificates, revocation information,\nor both.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"safety_buffer\": 123, \"tidy_cert_store\": \"boolean\", \"tidy_revocation_list\": \"boolean\", \"tidy_revoked_certs\": \"boolean\"}", "required": false, "schema": { "title": "CertTidyRequest", "type": "object", "properties": { "safety_buffer": { "type": "integer", "description": "The amount of extra time that must have passed beyond certificate expiration before it is removed from the backend storage and/or revocation list. Defaults to 72 hours.", "default": 259200 }, "tidy_cert_store": { "type": "boolean", "description": "Set to true to enable tidying up the certificate store" }, "tidy_revocation_list": { "type": "boolean", "description": "Deprecated; synonym for 'tidy_revoked_certs" }, "tidy_revoked_certs": { "type": "boolean", "description": "Set to true to expire all revoked and expired certificates, removing them both from the CRL and from storage. The CRL will be rotated if this causes any values to be removed." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postCertTidy" }, "task": true }, { "name": "getCertVenafi", "summary": "getCertVenafi", "description": "Return all venafi secrets.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "list", "type": "string", "info": "Return a list if `true`: string", "required": false, "schema": { "title": "list", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getCertVenafi" }, "task": true }, { "name": "getCertVenafiPolicy", "summary": "getCertVenafiPolicy", "description": "Fetch a CA, CRL, CA Chain, or non-revoked certificate.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "list", "type": "string", "info": "Return a list if `true`: string", "required": false, "schema": { "title": "list", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getCertVenafiPolicy" }, "task": true }, { "name": "getCertVenafiPolicyName", "summary": "getCertVenafiPolicyName", "description": "Return the Venafi policy specified in path", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the Venafi policy config: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getCertVenafiPolicyName" }, "task": true }, { "name": "postCertVenafiPolicyName", "summary": "postCertVenafiPolicyName", "description": "Configure the settings of a Venafi policy", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the Venafi policy config: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"auto_refresh_interval\": 123, \"create_role\": \"boolean\", \"defaults_roles\": \"array\", \"enforcement_roles\": \"array\", \"ext_key_usage\": \"array\", \"import_only_non_compliant\": \"boolean\", \"import_roles\": \"array\", \"import_timeout\": 123, \"import_workers\": 123, \"venafi_secret\": \"string\", \"zone\": \"string\"}", "required": false, "schema": { "title": "CertVenafiPolicyRequest", "required": [ "venafi_secret" ], "type": "object", "properties": { "auto_refresh_interval": { "type": "integer", "description": "Interval of policy update from Venafi in seconds. Set it to 0 to disable automatic policy update", "default": 0 }, "create_role": { "type": "boolean", "description": "Automatically create empty role for policy if it does not exists", "default": false }, "defaults_roles": { "type": "array", "items": { "type": "string" }, "description": "Roles list for filing with default values from Venafi", "default": [] }, "enforcement_roles": { "type": "array", "items": { "type": "string" }, "description": "Roles list for policy check", "default": [] }, "ext_key_usage": { "type": "array", "items": { "type": "string" }, "description": "A comma-separated string or list of allowed extended key usages. Valid values can be found at https://golang.org/pkg/crypto/x509/#ExtKeyUsage -- simply drop the \"ExtKeyUsage\" part of the name. Also you can use constants from this module (like 1, 5,8) direct or use OIDs (like 1.3.6.1.5.5.7.3.4)", "default": [] }, "import_only_non_compliant": { "type": "boolean", "description": "Only import certificates into Venafi that do not comply with zone policy", "default": false }, "import_roles": { "type": "array", "items": { "type": "string" }, "description": "Roles list for import to Venafi", "default": [] }, "import_timeout": { "type": "integer", "description": "Timeout in second to rerun import queue", "default": 15 }, "import_workers": { "type": "integer", "description": "Max amount of simultaneously working instances of vcert import", "default": 5 }, "venafi_secret": { "type": "string", "description": "The name of the credentials object to be used for authentication" }, "zone": { "type": "string", "description": "Name of Venafi Platform or Cloud policy. Example for Platform: testPolicy\\\\vault Example for Venafi Cloud: Default" } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postCertVenafiPolicyName" }, "task": true }, { "name": "deleteCertVenafiPolicyName", "summary": "deleteCertVenafiPolicyName", "description": "Removes the Venafi policy specified in path", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the Venafi policy config: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteCertVenafiPolicyName" }, "task": true }, { "name": "getCertVenafiPolicyNamePolicy", "summary": "getCertVenafiPolicyNamePolicy", "description": "help here", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the Venafi policy config: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getCertVenafiPolicyNamePolicy" }, "task": true }, { "name": "postCertVenafiPolicyNamePolicy", "summary": "postCertVenafiPolicyNamePolicy", "description": "help here", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the Venafi policy config: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postCertVenafiPolicyNamePolicy" }, "task": true }, { "name": "getCertVenafiSyncPolicies", "summary": "getCertVenafiSyncPolicies", "description": "getCertVenafiSyncPolicies", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getCertVenafiSyncPolicies" }, "task": true }, { "name": "getCertVenafiName", "summary": "getCertVenafiName", "description": "Return the venafi resource specified in path.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the Venafi secret.: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getCertVenafiName" }, "task": true }, { "name": "postCertVenafiName", "summary": "postCertVenafiName", "description": "Configure a Venafi resource for use with the Venafi Policy.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the Venafi secret.: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"access_token\": \"string\", \"apikey\": \"string\", \"cloud_url\": \"string\", \"refresh_token\": \"string\", \"tpp_password\": \"string\", \"tpp_url\": \"string\", \"tpp_user\": \"string\", \"trust_bundle_file\": \"string\", \"url\": \"string\", \"zone\": \"string\"}", "required": false, "schema": { "title": "CertVenafiRequest", "required": [ "access_token", "refresh_token", "tpp_password", "tpp_user", "url", "zone" ], "type": "object", "properties": { "access_token": { "type": "string", "description": "Access token for TPP, user should use this for authentication" }, "apikey": { "type": "string", "description": "API key for Venafi Cloud. Example: 142231b7-cvb0-412e-886b-6a1ght0bc93d" }, "cloud_url": { "type": "string", "description": "URL for Venafi Cloud. Set it only if you want to use non production Cloud. Deprecated, use 'url' instead", "x-deprecated": true }, "refresh_token": { "type": "string", "description": "Refresh token for obtaining a new access token for TPP" }, "tpp_password": { "type": "string", "description": "Password for web API user Example: password" }, "tpp_url": { "type": "string", "description": "URL of Venafi Platform. Deprecated, use 'url' instead", "x-deprecated": true }, "tpp_user": { "type": "string", "description": "web API user for Venafi Platform Example: admin" }, "trust_bundle_file": { "type": "string", "description": "Use to specify a PEM formatted file with certificates to be used as trust anchors when communicating with the remote server. Example: trust_bundle_file = \"/full/path/to/chain.pem\"\"" }, "url": { "type": "string", "description": "URL of Venafi API endpoint. Example: https://tpp.venafi.example/vedsdk" }, "zone": { "type": "string", "description": "Name of Venafi Platform or Cloud policy. Example for Platform: testPolicy\\\\vault Example for Venafi Cloud: Default" } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postCertVenafiName" }, "task": true }, { "name": "deleteCertVenafiName", "summary": "deleteCertVenafiName", "description": "Removes the Venafi resource specified in path.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the Venafi secret.: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteCertVenafiName" }, "task": true }, { "name": "getSecretEngineCodeName", "summary": "getSecretEngineCodeName", "description": "Request time-based one-time use password or validate a password for a certain key .", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the key.: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSecretEngineCodeName" }, "task": true }, { "name": "postSecretEngineCodeName", "summary": "postSecretEngineCodeName", "description": "Request time-based one-time use password or validate a password for a certain key .", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the key.: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"code\": \"string\"}", "required": false, "schema": { "title": "TotpCodeRequest", "type": "object", "properties": { "code": { "type": "string", "description": "TOTP code to be validated." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSecretEngineCodeName" }, "task": true }, { "name": "getSecretEngineKeysName", "summary": "getSecretEngineKeysName", "description": "Manage the keys that can be created with this backend.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the key.: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSecretEngineKeysName" }, "task": true }, { "name": "postSecretEngineKeysName", "summary": "postSecretEngineKeysName", "description": "Manage the keys that can be created with this backend.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the key.: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"account_name\": \"string\", \"algorithm\": \"string\", \"digits\": 123, \"exported\": \"boolean\", \"generate\": \"boolean\", \"issuer\": \"string\", \"key\": \"string\", \"key_size\": 123, \"period\": 123, \"qr_size\": 123, \"skew\": 123, \"url\": \"string\"}", "required": false, "schema": { "title": "TotpKeysRequest", "type": "object", "properties": { "account_name": { "type": "string", "description": "The name of the account associated with the key. Required if generate is true." }, "algorithm": { "type": "string", "description": "The hashing algorithm used to generate the TOTP token. Options include SHA1, SHA256 and SHA512.", "default": "SHA1" }, "digits": { "type": "integer", "description": "The number of digits in the generated TOTP token. This value can either be 6 or 8.", "default": 6 }, "exported": { "type": "boolean", "description": "Determines if a QR code and url are returned upon generating a key. Only used if generate is true.", "default": true }, "generate": { "type": "boolean", "description": "Determines if a key should be generated by Vault or if a key is being passed from another service.", "default": false }, "issuer": { "type": "string", "description": "The name of the key's issuing organization. Required if generate is true." }, "key": { "type": "string", "description": "The shared master key used to generate a TOTP token. Only used if generate is false." }, "key_size": { "type": "integer", "description": "Determines the size in bytes of the generated key. Only used if generate is true.", "default": 20 }, "period": { "type": "integer", "description": "The length of time used to generate a counter for the TOTP token calculation.", "default": 30 }, "qr_size": { "type": "integer", "description": "The pixel size of the generated square QR code. Only used if generate is true and exported is true. If this value is 0, a QR code will not be returned.", "default": 200 }, "skew": { "type": "integer", "description": "The number of delay periods that are allowed when validating a TOTP token. This value can either be 0 or 1. Only used if generate is true.", "default": 1 }, "url": { "type": "string", "description": "A TOTP url string containing all of the parameters for key setup. Only used if generate is false." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSecretEngineKeysName" }, "task": true }, { "name": "deleteSecretEngineKeysName", "summary": "deleteSecretEngineKeysName", "description": "Manage the keys that can be created with this backend.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the key.: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteSecretEngineKeysName" }, "task": true }, { "name": "getSecretEngineBackupName", "summary": "getSecretEngineBackupName", "description": "Backup the named key", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the key: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSecretEngineBackupName" }, "task": true }, { "name": "getSecretEngineCacheConfig", "summary": "getSecretEngineCacheConfig", "description": "Returns the size of the active cache", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSecretEngineCacheConfig" }, "task": true }, { "name": "postSecretEngineCacheConfig", "summary": "postSecretEngineCacheConfig", "description": "Configures a new cache of the specified size", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"size\": 123}", "required": false, "schema": { "title": "TransitCacheConfigRequest", "type": "object", "properties": { "size": { "type": "integer", "description": "Size of cache, use 0 for an unlimited cache size, defaults to 0", "default": 0 } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSecretEngineCacheConfig" }, "task": true }, { "name": "postSecretEngineDatakeyPlaintextName", "summary": "postSecretEngineDatakeyPlaintextName", "description": "Generate a data key", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "name", "type": "string", "info": "The backend key used for encrypting the data key: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "plaintext", "type": "string", "info": "\"plaintext\" will return the key in both plaintext and ciphertext; \"wrapped\" will return the ciphertext only.: string", "required": true, "schema": { "title": "plaintext", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"bits\": 123, \"context\": \"string\", \"key_version\": 123, \"nonce\": \"string\"}", "required": false, "schema": { "title": "TransitDatakeyRequest", "type": "object", "properties": { "bits": { "type": "integer", "description": "Number of bits for the key; currently 128, 256, and 512 bits are supported. Defaults to 256.", "default": 256 }, "context": { "type": "string", "description": "Context for key derivation. Required for derived keys." }, "key_version": { "type": "integer", "description": "The version of the Vault key to use for encryption of the data key. Must be 0 (for latest) or a value greater than or equal to the min_encryption_version configured on the key." }, "nonce": { "type": "string", "description": "Nonce for when convergent encryption v1 is used (only in Vault 0.6.1)" } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSecretEngineDatakeyPlaintextName" }, "task": true }, { "name": "postSecretEngineDecryptName", "summary": "postSecretEngineDecryptName", "description": "Decrypt a ciphertext value using a named key", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the policy: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"ciphertext\": \"string\", \"context\": \"string\", \"nonce\": \"string\"}", "required": false, "schema": { "title": "TransitDecryptRequest", "type": "object", "properties": { "ciphertext": { "type": "string", "description": "The ciphertext to decrypt, provided as returned by encrypt." }, "context": { "type": "string", "description": "Base64 encoded context for key derivation. Required if key derivation is enabled." }, "nonce": { "type": "string", "description": "Base64 encoded nonce value used during encryption. Must be provided if convergent encryption is enabled for this key and the key was generated with Vault 0.6.1. Not required for keys created in 0.6.2+." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSecretEngineDecryptName" }, "task": true }, { "name": "postSecretEngineEncryptName", "summary": "postSecretEngineEncryptName", "description": "Encrypt a plaintext value or a batch of plaintext\nblocks using a named key", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the policy: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"context\": \"string\", \"convergent_encryption\": \"boolean\", \"key_version\": 123, \"nonce\": \"string\", \"plaintext\": \"string\", \"type\": \"string\"}", "required": false, "schema": { "title": "TransitEncryptRequest", "type": "object", "properties": { "context": { "type": "string", "description": "Base64 encoded context for key derivation. Required if key derivation is enabled" }, "convergent_encryption": { "type": "boolean", "description": "This parameter will only be used when a key is expected to be created. Whether to support convergent encryption. This is only supported when using a key with key derivation enabled and will require all requests to carry both a context and 96-bit (12-byte) nonce. The given nonce will be used in place of a randomly generated nonce. As a result, when the same context and nonce are supplied, the same ciphertext is generated. It is *very important* when using this mode that you ensure that all nonces are unique for a given context. Failing to do so will severely impact the ciphertext's security." }, "key_version": { "type": "integer", "description": "The version of the key to use for encryption. Must be 0 (for latest) or a value greater than or equal to the min_encryption_version configured on the key." }, "nonce": { "type": "string", "description": "Base64 encoded nonce value. Must be provided if convergent encryption is enabled for this key and the key was generated with Vault 0.6.1. Not required for keys created in 0.6.2+. The value must be exactly 96 bits (12 bytes) long and the user must ensure that for any given context (and thus, any given encryption key) this nonce value is **never reused**." }, "plaintext": { "type": "string", "description": "Base64 encoded plaintext value to be encrypted" }, "type": { "type": "string", "description": "This parameter is required when encryption key is expected to be created. When performing an upsert operation, the type of key to create. Currently, \"aes128-gcm96\" (symmetric) and \"aes256-gcm96\" (symmetric) are the only types supported. Defaults to \"aes256-gcm96\".", "default": "aes256-gcm96" } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSecretEngineEncryptName" }, "task": true }, { "name": "getSecretEngineExportTypeName", "summary": "getSecretEngineExportTypeName", "description": "Export named encryption or signing key", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the key: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "type", "type": "string", "info": "Type of key to export (encryption-key, signing-key, hmac-key): string", "required": true, "schema": { "title": "type", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSecretEngineExportTypeName" }, "task": true }, { "name": "getSecretEngineExportTypeNameVersion", "summary": "getSecretEngineExportTypeNameVersion", "description": "Export named encryption or signing key", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the key: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "type", "type": "string", "info": "Type of key to export (encryption-key, signing-key, hmac-key): string", "required": true, "schema": { "title": "type", "type": "string" } }, { "name": "version", "type": "string", "info": "Version of the key: string", "required": true, "schema": { "title": "version", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSecretEngineExportTypeNameVersion" }, "task": true }, { "name": "postSecretEngineHash", "summary": "postSecretEngineHash", "description": "Generate a hash sum for input data", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"algorithm\": \"string\", \"format\": \"string\", \"input\": \"string\", \"urlalgorithm\": \"string\"}", "required": false, "schema": { "title": "TransitHashRequest", "type": "object", "properties": { "algorithm": { "type": "string", "description": "Algorithm to use (POST body parameter). Valid values are: * sha2-224 * sha2-256 * sha2-384 * sha2-512 Defaults to \"sha2-256\".", "default": "sha2-256" }, "format": { "type": "string", "description": "Encoding format to use. Can be \"hex\" or \"base64\". Defaults to \"hex\".", "default": "hex" }, "input": { "type": "string", "description": "The base64-encoded input data" }, "urlalgorithm": { "type": "string", "description": "Algorithm to use (POST URL parameter)" } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSecretEngineHash" }, "task": true }, { "name": "postSecretEngineHashUrlalgorithm", "summary": "postSecretEngineHashUrlalgorithm", "description": "Generate a hash sum for input data", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "urlalgorithm", "type": "string", "info": "Algorithm to use (POST URL parameter): string", "required": true, "schema": { "title": "urlalgorithm", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"algorithm\": \"string\", \"format\": \"string\", \"input\": \"string\"}", "required": false, "schema": { "title": "TransitHashRequest1", "type": "object", "properties": { "algorithm": { "type": "string", "description": "Algorithm to use (POST body parameter). Valid values are: * sha2-224 * sha2-256 * sha2-384 * sha2-512 Defaults to \"sha2-256\".", "default": "sha2-256" }, "format": { "type": "string", "description": "Encoding format to use. Can be \"hex\" or \"base64\". Defaults to \"hex\".", "default": "hex" }, "input": { "type": "string", "description": "The base64-encoded input data" } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSecretEngineHashUrlalgorithm" }, "task": true }, { "name": "postSecretEngineHmacName", "summary": "postSecretEngineHmacName", "description": "Generate an HMAC for input data using the named key", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "name", "type": "string", "info": "The key to use for the HMAC function: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"algorithm\": \"string\", \"input\": \"string\", \"key_version\": 123, \"urlalgorithm\": \"string\"}", "required": false, "schema": { "title": "TransitHmacRequest", "type": "object", "properties": { "algorithm": { "type": "string", "description": "Algorithm to use (POST body parameter). Valid values are: * sha2-224 * sha2-256 * sha2-384 * sha2-512 Defaults to \"sha2-256\".", "default": "sha2-256" }, "input": { "type": "string", "description": "The base64-encoded input data" }, "key_version": { "type": "integer", "description": "The version of the key to use for generating the HMAC. Must be 0 (for latest) or a value greater than or equal to the min_encryption_version configured on the key." }, "urlalgorithm": { "type": "string", "description": "Algorithm to use (POST URL parameter)" } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSecretEngineHmacName" }, "task": true }, { "name": "postSecretEngineHmacNameUrlalgorithm", "summary": "postSecretEngineHmacNameUrlalgorithm", "description": "Generate an HMAC for input data using the named key", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "name", "type": "string", "info": "The key to use for the HMAC function: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "urlalgorithm", "type": "string", "info": "Algorithm to use (POST URL parameter): string", "required": true, "schema": { "title": "urlalgorithm", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"algorithm\": \"string\", \"input\": \"string\", \"key_version\": 123}", "required": false, "schema": { "title": "TransitHmacRequest1", "type": "object", "properties": { "algorithm": { "type": "string", "description": "Algorithm to use (POST body parameter). Valid values are: * sha2-224 * sha2-256 * sha2-384 * sha2-512 Defaults to \"sha2-256\".", "default": "sha2-256" }, "input": { "type": "string", "description": "The base64-encoded input data" }, "key_version": { "type": "integer", "description": "The version of the key to use for generating the HMAC. Must be 0 (for latest) or a value greater than or equal to the min_encryption_version configured on the key." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSecretEngineHmacNameUrlalgorithm" }, "task": true }, { "name": "postSecretEngineKeysNameConfig", "summary": "postSecretEngineKeysNameConfig", "description": "Configure a named encryption key", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the key: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"allow_plaintext_backup\": \"boolean\", \"deletion_allowed\": \"boolean\", \"exportable\": \"boolean\", \"min_decryption_version\": 123, \"min_encryption_version\": 123}", "required": false, "schema": { "title": "TransitKeysConfigRequest", "type": "object", "properties": { "allow_plaintext_backup": { "type": "boolean", "description": "Enables taking a backup of the named key in plaintext format. Once set, this cannot be disabled." }, "deletion_allowed": { "type": "boolean", "description": "Whether to allow deletion of the key" }, "exportable": { "type": "boolean", "description": "Enables export of the key. Once set, this cannot be disabled." }, "min_decryption_version": { "type": "integer", "description": "If set, the minimum version of the key allowed to be decrypted. For signing keys, the minimum version allowed to be used for verification." }, "min_encryption_version": { "type": "integer", "description": "If set, the minimum version of the key allowed to be used for encryption; or for signing keys, to be used for signing. If set to zero, only the latest version of the key is allowed." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSecretEngineKeysNameConfig" }, "task": true }, { "name": "postSecretEngineKeysNameRotate", "summary": "postSecretEngineKeysNameRotate", "description": "Rotate named encryption key", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the key: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSecretEngineKeysNameRotate" }, "task": true }, { "name": "postSecretEngineKeysNameTrim", "summary": "postSecretEngineKeysNameTrim", "description": "Trim key versions of a named key", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the key: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"min_available_version\": 123}", "required": false, "schema": { "title": "TransitKeysTrimRequest", "type": "object", "properties": { "min_available_version": { "type": "integer", "description": "The minimum available version for the key ring. All versions before this version will be permanently deleted. This value can at most be equal to the lesser of 'min_decryption_version' and 'min_encryption_version'. This is not allowed to be set when either 'min_encryption_version' or 'min_decryption_version' is set to zero." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSecretEngineKeysNameTrim" }, "task": true }, { "name": "postSecretEngineRandom", "summary": "postSecretEngineRandom", "description": "Generate random bytes", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"bytes\": 123, \"format\": \"string\", \"urlbytes\": \"string\"}", "required": false, "schema": { "title": "TransitRandomRequest", "type": "object", "properties": { "bytes": { "type": "integer", "description": "The number of bytes to generate (POST body parameter). Defaults to 32 (256 bits).", "default": 32 }, "format": { "type": "string", "description": "Encoding format to use. Can be \"hex\" or \"base64\". Defaults to \"base64\".", "default": "base64" }, "urlbytes": { "type": "string", "description": "The number of bytes to generate (POST URL parameter)" } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSecretEngineRandom" }, "task": true }, { "name": "postSecretEngineRandomUrlbytes", "summary": "postSecretEngineRandomUrlbytes", "description": "Generate random bytes", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "urlbytes", "type": "string", "info": "The number of bytes to generate (POST URL parameter): string", "required": true, "schema": { "title": "urlbytes", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"bytes\": 123, \"format\": \"string\"}", "required": false, "schema": { "title": "TransitRandomRequest1", "type": "object", "properties": { "bytes": { "type": "integer", "description": "The number of bytes to generate (POST body parameter). Defaults to 32 (256 bits).", "default": 32 }, "format": { "type": "string", "description": "Encoding format to use. Can be \"hex\" or \"base64\". Defaults to \"base64\".", "default": "base64" } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSecretEngineRandomUrlbytes" }, "task": true }, { "name": "postSecretEngineRestore", "summary": "postSecretEngineRestore", "description": "Restore the named key", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"backup\": \"string\", \"force\": \"boolean\", \"name\": \"string\"}", "required": false, "schema": { "title": "TransitRestoreRequest", "type": "object", "properties": { "backup": { "type": "string", "description": "Backed up key data to be restored. This should be the output from the 'backup/' endpoint." }, "force": { "type": "boolean", "description": "If set and a key by the given name exists, force the restore operation and override the key.", "default": false }, "name": { "type": "string", "description": "If set, this will be the name of the restored key." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSecretEngineRestore" }, "task": true }, { "name": "postSecretEngineRestoreName", "summary": "postSecretEngineRestoreName", "description": "Restore the named key", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "name", "type": "string", "info": "If set, this will be the name of the restored key.: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"backup\": \"string\", \"force\": \"boolean\"}", "required": false, "schema": { "title": "TransitRestoreRequest1", "type": "object", "properties": { "backup": { "type": "string", "description": "Backed up key data to be restored. This should be the output from the 'backup/' endpoint." }, "force": { "type": "boolean", "description": "If set and a key by the given name exists, force the restore operation and override the key.", "default": false } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSecretEngineRestoreName" }, "task": true }, { "name": "postSecretEngineRewrapName", "summary": "postSecretEngineRewrapName", "description": "Rewrap ciphertext", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the key: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"ciphertext\": \"string\", \"context\": \"string\", \"key_version\": 123, \"nonce\": \"string\"}", "required": false, "schema": { "title": "TransitRewrapRequest", "type": "object", "properties": { "ciphertext": { "type": "string", "description": "Ciphertext value to rewrap" }, "context": { "type": "string", "description": "Base64 encoded context for key derivation. Required for derived keys." }, "key_version": { "type": "integer", "description": "The version of the key to use for encryption. Must be 0 (for latest) or a value greater than or equal to the min_encryption_version configured on the key." }, "nonce": { "type": "string", "description": "Nonce for when convergent encryption is used" } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSecretEngineRewrapName" }, "task": true }, { "name": "postSecretEngineSignName", "summary": "postSecretEngineSignName", "description": "Generate a signature for input data using the named key", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "name", "type": "string", "info": "The key to use: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"algorithm\": \"string\", \"context\": \"string\", \"hash_algorithm\": \"string\", \"input\": \"string\", \"key_version\": 123, \"marshaling_algorithm\": \"string\", \"prehashed\": \"boolean\", \"signature_algorithm\": \"string\", \"urlalgorithm\": \"string\"}", "required": false, "schema": { "title": "TransitSignRequest", "type": "object", "properties": { "algorithm": { "type": "string", "description": "Deprecated: use \"hash_algorithm\" instead.", "default": "sha2-256" }, "context": { "type": "string", "description": "Base64 encoded context for key derivation. Required if key derivation is enabled; currently only available with ed25519 keys." }, "hash_algorithm": { "type": "string", "description": "Hash algorithm to use (POST body parameter). Valid values are: * sha1 * sha2-224 * sha2-256 * sha2-384 * sha2-512 Defaults to \"sha2-256\". Not valid for all key types, including ed25519.", "default": "sha2-256" }, "input": { "type": "string", "description": "The base64-encoded input data" }, "key_version": { "type": "integer", "description": "The version of the key to use for signing. Must be 0 (for latest) or a value greater than or equal to the min_encryption_version configured on the key." }, "marshaling_algorithm": { "type": "string", "description": "The method by which to marshal the signature. The default is 'asn1' which is used by openssl and X.509. It can also be set to 'jws' which is used for JWT signatures; setting it to this will also cause the encoding of the signature to be url-safe base64 instead of using standard base64 encoding. Currently only valid for ECDSA P-256 key types\".", "default": "asn1" }, "prehashed": { "type": "boolean", "description": "Set to 'true' when the input is already hashed. If the key type is 'rsa-2048', 'rsa-3072' or 'rsa-4096', then the algorithm used to hash the input should be indicated by the 'algorithm' parameter." }, "signature_algorithm": { "type": "string", "description": "The signature algorithm to use for signing. Currently only applies to RSA key types. Options are 'pss' or 'pkcs1v15'. Defaults to 'pss'" }, "urlalgorithm": { "type": "string", "description": "Hash algorithm to use (POST URL parameter)" } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSecretEngineSignName" }, "task": true }, { "name": "postSecretEngineSignNameUrlalgorithm", "summary": "postSecretEngineSignNameUrlalgorithm", "description": "Generate a signature for input data using the named key", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "name", "type": "string", "info": "The key to use: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "urlalgorithm", "type": "string", "info": "Hash algorithm to use (POST URL parameter): string", "required": true, "schema": { "title": "urlalgorithm", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"algorithm\": \"string\", \"context\": \"string\", \"hash_algorithm\": \"string\", \"input\": \"string\", \"key_version\": 123, \"marshaling_algorithm\": \"string\", \"prehashed\": \"boolean\", \"signature_algorithm\": \"string\"}", "required": false, "schema": { "title": "TransitSignRequest1", "type": "object", "properties": { "algorithm": { "type": "string", "description": "Deprecated: use \"hash_algorithm\" instead.", "default": "sha2-256" }, "context": { "type": "string", "description": "Base64 encoded context for key derivation. Required if key derivation is enabled; currently only available with ed25519 keys." }, "hash_algorithm": { "type": "string", "description": "Hash algorithm to use (POST body parameter). Valid values are: * sha1 * sha2-224 * sha2-256 * sha2-384 * sha2-512 Defaults to \"sha2-256\". Not valid for all key types, including ed25519.", "default": "sha2-256" }, "input": { "type": "string", "description": "The base64-encoded input data" }, "key_version": { "type": "integer", "description": "The version of the key to use for signing. Must be 0 (for latest) or a value greater than or equal to the min_encryption_version configured on the key." }, "marshaling_algorithm": { "type": "string", "description": "The method by which to marshal the signature. The default is 'asn1' which is used by openssl and X.509. It can also be set to 'jws' which is used for JWT signatures; setting it to this will also cause the encoding of the signature to be url-safe base64 instead of using standard base64 encoding. Currently only valid for ECDSA P-256 key types\".", "default": "asn1" }, "prehashed": { "type": "boolean", "description": "Set to 'true' when the input is already hashed. If the key type is 'rsa-2048', 'rsa-3072' or 'rsa-4096', then the algorithm used to hash the input should be indicated by the 'algorithm' parameter." }, "signature_algorithm": { "type": "string", "description": "The signature algorithm to use for signing. Currently only applies to RSA key types. Options are 'pss' or 'pkcs1v15'. Defaults to 'pss'" } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSecretEngineSignNameUrlalgorithm" }, "task": true }, { "name": "postSecretEngineVerifyName", "summary": "postSecretEngineVerifyName", "description": "Verify a signature or HMAC for input data created using the named key", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "name", "type": "string", "info": "The key to use: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"algorithm\": \"string\", \"context\": \"string\", \"hash_algorithm\": \"string\", \"hmac\": \"string\", \"input\": \"string\", \"marshaling_algorithm\": \"string\", \"prehashed\": \"boolean\", \"signature\": \"string\", \"signature_algorithm\": \"string\", \"urlalgorithm\": \"string\"}", "required": false, "schema": { "title": "TransitVerifyRequest", "type": "object", "properties": { "algorithm": { "type": "string", "description": "Deprecated: use \"hash_algorithm\" instead.", "default": "sha2-256" }, "context": { "type": "string", "description": "Base64 encoded context for key derivation. Required if key derivation is enabled; currently only available with ed25519 keys." }, "hash_algorithm": { "type": "string", "description": "Hash algorithm to use (POST body parameter). Valid values are: * sha1 * sha2-224 * sha2-256 * sha2-384 * sha2-512 Defaults to \"sha2-256\". Not valid for all key types.", "default": "sha2-256" }, "hmac": { "type": "string", "description": "The HMAC, including vault header/key version" }, "input": { "type": "string", "description": "The base64-encoded input data to verify" }, "marshaling_algorithm": { "type": "string", "description": "The method by which to unmarshal the signature when verifying. The default is 'asn1' which is used by openssl and X.509; can also be set to 'jws' which is used for JWT signatures in which case the signature is also expected to be url-safe base64 encoding instead of standard base64 encoding. Currently only valid for ECDSA P-256 key types\".", "default": "asn1" }, "prehashed": { "type": "boolean", "description": "Set to 'true' when the input is already hashed. If the key type is 'rsa-2048', 'rsa-3072' or 'rsa-4096', then the algorithm used to hash the input should be indicated by the 'algorithm' parameter." }, "signature": { "type": "string", "description": "The signature, including vault header/key version" }, "signature_algorithm": { "type": "string", "description": "The signature algorithm to use for signature verification. Currently only applies to RSA key types. Options are 'pss' or 'pkcs1v15'. Defaults to 'pss'" }, "urlalgorithm": { "type": "string", "description": "Hash algorithm to use (POST URL parameter)" } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSecretEngineVerifyName" }, "task": true }, { "name": "postSecretEngineVerifyNameUrlalgorithm", "summary": "postSecretEngineVerifyNameUrlalgorithm", "description": "Verify a signature or HMAC for input data created using the named key", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "secretmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "secretmount", "type": "string" } }, { "name": "name", "type": "string", "info": "The key to use: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "urlalgorithm", "type": "string", "info": "Hash algorithm to use (POST URL parameter): string", "required": true, "schema": { "title": "urlalgorithm", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"algorithm\": \"string\", \"context\": \"string\", \"hash_algorithm\": \"string\", \"hmac\": \"string\", \"input\": \"string\", \"marshaling_algorithm\": \"string\", \"prehashed\": \"boolean\", \"signature\": \"string\", \"signature_algorithm\": \"string\"}", "required": false, "schema": { "title": "TransitVerifyRequest1", "type": "object", "properties": { "algorithm": { "type": "string", "description": "Deprecated: use \"hash_algorithm\" instead.", "default": "sha2-256" }, "context": { "type": "string", "description": "Base64 encoded context for key derivation. Required if key derivation is enabled; currently only available with ed25519 keys." }, "hash_algorithm": { "type": "string", "description": "Hash algorithm to use (POST body parameter). Valid values are: * sha1 * sha2-224 * sha2-256 * sha2-384 * sha2-512 Defaults to \"sha2-256\". Not valid for all key types.", "default": "sha2-256" }, "hmac": { "type": "string", "description": "The HMAC, including vault header/key version" }, "input": { "type": "string", "description": "The base64-encoded input data to verify" }, "marshaling_algorithm": { "type": "string", "description": "The method by which to unmarshal the signature when verifying. The default is 'asn1' which is used by openssl and X.509; can also be set to 'jws' which is used for JWT signatures in which case the signature is also expected to be url-safe base64 encoding instead of standard base64 encoding. Currently only valid for ECDSA P-256 key types\".", "default": "asn1" }, "prehashed": { "type": "boolean", "description": "Set to 'true' when the input is already hashed. If the key type is 'rsa-2048', 'rsa-3072' or 'rsa-4096', then the algorithm used to hash the input should be indicated by the 'algorithm' parameter." }, "signature": { "type": "string", "description": "The signature, including vault header/key version" }, "signature_algorithm": { "type": "string", "description": "The signature algorithm to use for signature verification. Currently only applies to RSA key types. Options are 'pss' or 'pkcs1v15'. Defaults to 'pss'" } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSecretEngineVerifyNameUrlalgorithm" }, "task": true }, { "name": "getSshConfigCa", "summary": "getSshConfigCa", "description": "Set the SSH private key used for signing certificates.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "sshmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "sshmount", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSshConfigCa" }, "task": true }, { "name": "postSshConfigCa", "summary": "postSshConfigCa", "description": "Set the SSH private key used for signing certificates.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "sshmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "sshmount", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"generate_signing_key\": \"boolean\", \"private_key\": \"string\", \"public_key\": \"string\"}", "required": false, "schema": { "title": "SshConfigCaRequest", "type": "object", "properties": { "generate_signing_key": { "type": "boolean", "description": "Generate SSH key pair internally rather than use the private_key and public_key fields.", "default": true }, "private_key": { "type": "string", "description": "Private half of the SSH key that will be used to sign certificates." }, "public_key": { "type": "string", "description": "Public half of the SSH key that will be used to sign certificates." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSshConfigCa" }, "task": true }, { "name": "deleteSshConfigCa", "summary": "deleteSshConfigCa", "description": "Set the SSH private key used for signing certificates.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "sshmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "sshmount", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteSshConfigCa" }, "task": true }, { "name": "getSshConfigZeroaddress", "summary": "getSshConfigZeroaddress", "description": "Assign zero address as default CIDR block for select roles.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "sshmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "sshmount", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSshConfigZeroaddress" }, "task": true }, { "name": "postSshConfigZeroaddress", "summary": "postSshConfigZeroaddress", "description": "Assign zero address as default CIDR block for select roles.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "sshmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "sshmount", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"roles\": \"array\"}", "required": false, "schema": { "title": "SshConfigZeroaddressRequest", "type": "object", "properties": { "roles": { "type": "array", "items": { "type": "string" }, "description": "[Required] Comma separated list of role names which allows credentials to be requested for any IP address. CIDR blocks previously registered under these roles will be ignored." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSshConfigZeroaddress" }, "task": true }, { "name": "deleteSshConfigZeroaddress", "summary": "deleteSshConfigZeroaddress", "description": "Assign zero address as default CIDR block for select roles.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "sshmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "sshmount", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteSshConfigZeroaddress" }, "task": true }, { "name": "postSshCredsRole", "summary": "postSshCredsRole", "description": "Creates a credential for establishing SSH connection with the remote host.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "sshmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "sshmount", "type": "string" } }, { "name": "role", "type": "string", "info": "[Required] Name of the role: string", "required": true, "schema": { "title": "role", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"ip\": \"string\", \"username\": \"string\"}", "required": false, "schema": { "title": "SshCredsRequest", "type": "object", "properties": { "ip": { "type": "string", "description": "[Required] IP of the remote host" }, "username": { "type": "string", "description": "[Optional] Username in remote host" } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSshCredsRole" }, "task": true }, { "name": "postSshKeysKeyName", "summary": "postSshKeysKey_name", "description": "Register a shared private key with Vault.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "sshmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "sshmount", "type": "string" } }, { "name": "keyName", "type": "string", "info": "[Required] Name of the key: string", "required": true, "schema": { "title": "keyName", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"key\": \"string\"}", "required": false, "schema": { "title": "SshKeysRequest", "type": "object", "properties": { "key": { "type": "string", "description": "[Required] SSH private key with super user privileges in host" } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSshKeysKeyName" }, "task": true }, { "name": "deleteSshKeysKeyName", "summary": "deleteSshKeysKey_name", "description": "Register a shared private key with Vault.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "sshmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "sshmount", "type": "string" } }, { "name": "keyName", "type": "string", "info": "[Required] Name of the key: string", "required": true, "schema": { "title": "keyName", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteSshKeysKeyName" }, "task": true }, { "name": "postSshLookup", "summary": "postSshLookup", "description": "List all the roles associated with the given IP address.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "sshmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "sshmount", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"ip\": \"string\"}", "required": false, "schema": { "title": "SshLookupRequest", "type": "object", "properties": { "ip": { "type": "string", "description": "[Required] IP address of remote host" } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSshLookup" }, "task": true }, { "name": "getSshPublicKey", "summary": "getSshPublic_key", "description": "Retrieve the public key.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "sshmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "sshmount", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSshPublicKey" }, "task": true }, { "name": "postSshSignRole", "summary": "postSshSignRole", "description": "Request signing an SSH key using a certain role with the provided details.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "sshmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "sshmount", "type": "string" } }, { "name": "role", "type": "string", "info": "The desired role with configuration for this request.: string", "required": true, "schema": { "title": "role", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"cert_type\": \"string\", \"critical_options\": \"object\", \"extensions\": \"object\", \"key_id\": \"string\", \"public_key\": \"string\", \"ttl\": 123, \"valid_principals\": \"string\"}", "required": false, "schema": { "title": "SshSignRequest", "type": "object", "properties": { "cert_type": { "type": "string", "description": "Type of certificate to be created; either \"user\" or \"host\".", "default": "user" }, "critical_options": { "type": "object", "description": "Critical options that the certificate should be signed for." }, "extensions": { "type": "object", "description": "Extensions that the certificate should be signed for." }, "key_id": { "type": "string", "description": "Key id that the created certificate should have. If not specified, the display name of the token will be used." }, "public_key": { "type": "string", "description": "SSH public key that should be signed." }, "ttl": { "type": "integer", "description": "The requested Time To Live for the SSH certificate; sets the expiration date. If not specified the role default, backend default, or system default TTL is used, in that order. Cannot be later than the role max TTL." }, "valid_principals": { "type": "string", "description": "Valid principals, either usernames or hostnames, that the certificate should be signed for." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSshSignRole" }, "task": true }, { "name": "postSshVerify", "summary": "postSshVerify", "description": "Validate the OTP provided by Vault SSH Agent.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "sshmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "sshmount", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"otp\": \"string\"}", "required": false, "schema": { "title": "SshVerifyRequest", "type": "object", "properties": { "otp": { "type": "string", "description": "[Required] One-Time-Key that needs to be validated" } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSshVerify" }, "task": true }, { "name": "getTotpCodeName", "summary": "getTotpCodeName", "description": "Request time-based one-time use password or validate a password for a certain key .", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "totpmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "totpmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the key.: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getTotpCodeName" }, "task": true }, { "name": "postTotpCodeName", "summary": "postTotpCodeName", "description": "Request time-based one-time use password or validate a password for a certain key .", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "totpmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "totpmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the key.: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"code\": \"string\"}", "required": false, "schema": { "title": "TotpCodeRequest", "type": "object", "properties": { "code": { "type": "string", "description": "TOTP code to be validated." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postTotpCodeName" }, "task": true }, { "name": "getTotpKeys", "summary": "getTotpKeys", "description": "Manage the keys that can be created with this backend.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "totpmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "totpmount", "type": "string" } }, { "name": "list", "type": "string", "info": "Return a list if `true`: string", "required": false, "schema": { "title": "list", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getTotpKeys" }, "task": true }, { "name": "getTotpKeysName", "summary": "getTotpKeysName", "description": "Manage the keys that can be created with this backend.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "totpmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "totpmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the key.: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getTotpKeysName" }, "task": true }, { "name": "postTotpKeysName", "summary": "postTotpKeysName", "description": "Manage the keys that can be created with this backend.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "totpmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "totpmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the key.: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"account_name\": \"string\", \"algorithm\": \"string\", \"digits\": 123, \"exported\": \"boolean\", \"generate\": \"boolean\", \"issuer\": \"string\", \"key\": \"string\", \"key_size\": 123, \"period\": 123, \"qr_size\": 123, \"skew\": 123, \"url\": \"string\"}", "required": false, "schema": { "title": "TotpKeysRequest", "type": "object", "properties": { "account_name": { "type": "string", "description": "The name of the account associated with the key. Required if generate is true." }, "algorithm": { "type": "string", "description": "The hashing algorithm used to generate the TOTP token. Options include SHA1, SHA256 and SHA512.", "default": "SHA1" }, "digits": { "type": "integer", "description": "The number of digits in the generated TOTP token. This value can either be 6 or 8.", "default": 6 }, "exported": { "type": "boolean", "description": "Determines if a QR code and url are returned upon generating a key. Only used if generate is true.", "default": true }, "generate": { "type": "boolean", "description": "Determines if a key should be generated by Vault or if a key is being passed from another service.", "default": false }, "issuer": { "type": "string", "description": "The name of the key's issuing organization. Required if generate is true." }, "key": { "type": "string", "description": "The shared master key used to generate a TOTP token. Only used if generate is false." }, "key_size": { "type": "integer", "description": "Determines the size in bytes of the generated key. Only used if generate is true.", "default": 20 }, "period": { "type": "integer", "description": "The length of time used to generate a counter for the TOTP token calculation.", "default": 30 }, "qr_size": { "type": "integer", "description": "The pixel size of the generated square QR code. Only used if generate is true and exported is true. If this value is 0, a QR code will not be returned.", "default": 200 }, "skew": { "type": "integer", "description": "The number of delay periods that are allowed when validating a TOTP token. This value can either be 0 or 1. Only used if generate is true.", "default": 1 }, "url": { "type": "string", "description": "A TOTP url string containing all of the parameters for key setup. Only used if generate is false." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postTotpKeysName" }, "task": true }, { "name": "deleteTotpKeysName", "summary": "deleteTotpKeysName", "description": "Manage the keys that can be created with this backend.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "totpmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "totpmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the key.: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteTotpKeysName" }, "task": true }, { "name": "getTransitBackupName", "summary": "getTransitBackupName", "description": "Backup the named key", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "transitmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "transitmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the key: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getTransitBackupName" }, "task": true }, { "name": "getTransitCacheConfig", "summary": "getTransitCacheConfig", "description": "Returns the size of the active cache", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "transitmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "transitmount", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getTransitCacheConfig" }, "task": true }, { "name": "postTransitCacheConfig", "summary": "postTransitCacheConfig", "description": "Configures a new cache of the specified size", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "transitmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "transitmount", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"size\": 123}", "required": false, "schema": { "title": "TransitCacheConfigRequest", "type": "object", "properties": { "size": { "type": "integer", "description": "Size of cache, use 0 for an unlimited cache size, defaults to 0", "default": 0 } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postTransitCacheConfig" }, "task": true }, { "name": "postTransitDatakeyPlaintextName", "summary": "postTransitDatakeyPlaintextName", "description": "Generate a data key", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "transitmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "transitmount", "type": "string" } }, { "name": "name", "type": "string", "info": "The backend key used for encrypting the data key: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "plaintext", "type": "string", "info": "\"plaintext\" will return the key in both plaintext and ciphertext; \"wrapped\" will return the ciphertext only.: string", "required": true, "schema": { "title": "plaintext", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"bits\": 123, \"context\": \"string\", \"key_version\": 123, \"nonce\": \"string\"}", "required": false, "schema": { "title": "TransitDatakeyRequest", "type": "object", "properties": { "bits": { "type": "integer", "description": "Number of bits for the key; currently 128, 256, and 512 bits are supported. Defaults to 256.", "default": 256 }, "context": { "type": "string", "description": "Context for key derivation. Required for derived keys." }, "key_version": { "type": "integer", "description": "The version of the Vault key to use for encryption of the data key. Must be 0 (for latest) or a value greater than or equal to the min_encryption_version configured on the key." }, "nonce": { "type": "string", "description": "Nonce for when convergent encryption v1 is used (only in Vault 0.6.1)" } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postTransitDatakeyPlaintextName" }, "task": true }, { "name": "postTransitDecryptName", "summary": "postTransitDecryptName", "description": "Decrypt a ciphertext value using a named key", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "transitmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "transitmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the policy: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"ciphertext\": \"string\", \"context\": \"string\", \"nonce\": \"string\"}", "required": false, "schema": { "title": "TransitDecryptRequest", "type": "object", "properties": { "ciphertext": { "type": "string", "description": "The ciphertext to decrypt, provided as returned by encrypt." }, "context": { "type": "string", "description": "Base64 encoded context for key derivation. Required if key derivation is enabled." }, "nonce": { "type": "string", "description": "Base64 encoded nonce value used during encryption. Must be provided if convergent encryption is enabled for this key and the key was generated with Vault 0.6.1. Not required for keys created in 0.6.2+." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postTransitDecryptName" }, "task": true }, { "name": "postTransitEncryptName", "summary": "postTransitEncryptName", "description": "Encrypt a plaintext value or a batch of plaintext\nblocks using a named key", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "transitmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "transitmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the policy: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"context\": \"string\", \"convergent_encryption\": \"boolean\", \"key_version\": 123, \"nonce\": \"string\", \"plaintext\": \"string\", \"type\": \"string\"}", "required": false, "schema": { "title": "TransitEncryptRequest", "type": "object", "properties": { "context": { "type": "string", "description": "Base64 encoded context for key derivation. Required if key derivation is enabled" }, "convergent_encryption": { "type": "boolean", "description": "This parameter will only be used when a key is expected to be created. Whether to support convergent encryption. This is only supported when using a key with key derivation enabled and will require all requests to carry both a context and 96-bit (12-byte) nonce. The given nonce will be used in place of a randomly generated nonce. As a result, when the same context and nonce are supplied, the same ciphertext is generated. It is *very important* when using this mode that you ensure that all nonces are unique for a given context. Failing to do so will severely impact the ciphertext's security." }, "key_version": { "type": "integer", "description": "The version of the key to use for encryption. Must be 0 (for latest) or a value greater than or equal to the min_encryption_version configured on the key." }, "nonce": { "type": "string", "description": "Base64 encoded nonce value. Must be provided if convergent encryption is enabled for this key and the key was generated with Vault 0.6.1. Not required for keys created in 0.6.2+. The value must be exactly 96 bits (12 bytes) long and the user must ensure that for any given context (and thus, any given encryption key) this nonce value is **never reused**." }, "plaintext": { "type": "string", "description": "Base64 encoded plaintext value to be encrypted" }, "type": { "type": "string", "description": "This parameter is required when encryption key is expected to be created. When performing an upsert operation, the type of key to create. Currently, \"aes128-gcm96\" (symmetric) and \"aes256-gcm96\" (symmetric) are the only types supported. Defaults to \"aes256-gcm96\".", "default": "aes256-gcm96" } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postTransitEncryptName" }, "task": true }, { "name": "getTransitExportTypeName", "summary": "getTransitExportTypeName", "description": "Export named encryption or signing key", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "transitmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "transitmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the key: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "type", "type": "string", "info": "Type of key to export (encryption-key, signing-key, hmac-key): string", "required": true, "schema": { "title": "type", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getTransitExportTypeName" }, "task": true }, { "name": "getTransitExportTypeNameVersion", "summary": "getTransitExportTypeNameVersion", "description": "Export named encryption or signing key", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "transitmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "transitmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the key: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "type", "type": "string", "info": "Type of key to export (encryption-key, signing-key, hmac-key): string", "required": true, "schema": { "title": "type", "type": "string" } }, { "name": "version", "type": "string", "info": "Version of the key: string", "required": true, "schema": { "title": "version", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getTransitExportTypeNameVersion" }, "task": true }, { "name": "postTransitHash", "summary": "postTransitHash", "description": "Generate a hash sum for input data", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "transitmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "transitmount", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"algorithm\": \"string\", \"format\": \"string\", \"input\": \"string\", \"urlalgorithm\": \"string\"}", "required": false, "schema": { "title": "TransitHashRequest", "type": "object", "properties": { "algorithm": { "type": "string", "description": "Algorithm to use (POST body parameter). Valid values are: * sha2-224 * sha2-256 * sha2-384 * sha2-512 Defaults to \"sha2-256\".", "default": "sha2-256" }, "format": { "type": "string", "description": "Encoding format to use. Can be \"hex\" or \"base64\". Defaults to \"hex\".", "default": "hex" }, "input": { "type": "string", "description": "The base64-encoded input data" }, "urlalgorithm": { "type": "string", "description": "Algorithm to use (POST URL parameter)" } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postTransitHash" }, "task": true }, { "name": "postTransitHashUrlalgorithm", "summary": "postTransitHashUrlalgorithm", "description": "Generate a hash sum for input data", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "transitmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "transitmount", "type": "string" } }, { "name": "urlalgorithm", "type": "string", "info": "Algorithm to use (POST URL parameter): string", "required": true, "schema": { "title": "urlalgorithm", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"algorithm\": \"string\", \"format\": \"string\", \"input\": \"string\"}", "required": false, "schema": { "title": "TransitHashRequest1", "type": "object", "properties": { "algorithm": { "type": "string", "description": "Algorithm to use (POST body parameter). Valid values are: * sha2-224 * sha2-256 * sha2-384 * sha2-512 Defaults to \"sha2-256\".", "default": "sha2-256" }, "format": { "type": "string", "description": "Encoding format to use. Can be \"hex\" or \"base64\". Defaults to \"hex\".", "default": "hex" }, "input": { "type": "string", "description": "The base64-encoded input data" } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postTransitHashUrlalgorithm" }, "task": true }, { "name": "postTransitHmacName", "summary": "postTransitHmacName", "description": "Generate an HMAC for input data using the named key", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "transitmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "transitmount", "type": "string" } }, { "name": "name", "type": "string", "info": "The key to use for the HMAC function: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"algorithm\": \"string\", \"input\": \"string\", \"key_version\": 123, \"urlalgorithm\": \"string\"}", "required": false, "schema": { "title": "TransitHmacRequest", "type": "object", "properties": { "algorithm": { "type": "string", "description": "Algorithm to use (POST body parameter). Valid values are: * sha2-224 * sha2-256 * sha2-384 * sha2-512 Defaults to \"sha2-256\".", "default": "sha2-256" }, "input": { "type": "string", "description": "The base64-encoded input data" }, "key_version": { "type": "integer", "description": "The version of the key to use for generating the HMAC. Must be 0 (for latest) or a value greater than or equal to the min_encryption_version configured on the key." }, "urlalgorithm": { "type": "string", "description": "Algorithm to use (POST URL parameter)" } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postTransitHmacName" }, "task": true }, { "name": "postTransitHmacNameUrlalgorithm", "summary": "postTransitHmacNameUrlalgorithm", "description": "Generate an HMAC for input data using the named key", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "transitmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "transitmount", "type": "string" } }, { "name": "name", "type": "string", "info": "The key to use for the HMAC function: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "urlalgorithm", "type": "string", "info": "Algorithm to use (POST URL parameter): string", "required": true, "schema": { "title": "urlalgorithm", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"algorithm\": \"string\", \"input\": \"string\", \"key_version\": 123}", "required": false, "schema": { "title": "TransitHmacRequest1", "type": "object", "properties": { "algorithm": { "type": "string", "description": "Algorithm to use (POST body parameter). Valid values are: * sha2-224 * sha2-256 * sha2-384 * sha2-512 Defaults to \"sha2-256\".", "default": "sha2-256" }, "input": { "type": "string", "description": "The base64-encoded input data" }, "key_version": { "type": "integer", "description": "The version of the key to use for generating the HMAC. Must be 0 (for latest) or a value greater than or equal to the min_encryption_version configured on the key." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postTransitHmacNameUrlalgorithm" }, "task": true }, { "name": "getTransitKeys", "summary": "getTransitKeys", "description": "Managed named encryption keys", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "transitmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "transitmount", "type": "string" } }, { "name": "list", "type": "string", "info": "Return a list if `true`: string", "required": false, "schema": { "title": "list", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getTransitKeys" }, "task": true }, { "name": "getTransitKeysName", "summary": "getTransitKeysName", "description": "Managed named encryption keys", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "transitmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "transitmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the key: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getTransitKeysName" }, "task": true }, { "name": "postTransitKeysName", "summary": "postTransitKeysName", "description": "Managed named encryption keys", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "transitmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "transitmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the key: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"allow_plaintext_backup\": \"boolean\", \"context\": \"string\", \"convergent_encryption\": \"boolean\", \"derived\": \"boolean\", \"exportable\": \"boolean\", \"type\": \"string\"}", "required": false, "schema": { "title": "TransitKeysRequest", "type": "object", "properties": { "allow_plaintext_backup": { "type": "boolean", "description": "Enables taking a backup of the named key in plaintext format. Once set, this cannot be disabled." }, "context": { "type": "string", "description": "Base64 encoded context for key derivation. When reading a key with key derivation enabled, if the key type supports public keys, this will return the public key for the given context." }, "convergent_encryption": { "type": "boolean", "description": "Whether to support convergent encryption. This is only supported when using a key with key derivation enabled and will require all requests to carry both a context and 96-bit (12-byte) nonce. The given nonce will be used in place of a randomly generated nonce. As a result, when the same context and nonce are supplied, the same ciphertext is generated. It is *very important* when using this mode that you ensure that all nonces are unique for a given context. Failing to do so will severely impact the ciphertext's security." }, "derived": { "type": "boolean", "description": "Enables key derivation mode. This allows for per-transaction unique keys for encryption operations." }, "exportable": { "type": "boolean", "description": "Enables keys to be exportable. This allows for all the valid keys in the key ring to be exported." }, "type": { "type": "string", "description": "The type of key to create. Currently, \"aes128-gcm96\" (symmetric), \"aes256-gcm96\" (symmetric), \"ecdsa-p256\" (asymmetric), \"ecdsa-p384\" (asymmetric), \"ecdsa-p521\" (asymmetric), \"ed25519\" (asymmetric), \"rsa-2048\" (asymmetric), \"rsa-3072\" (asymmetric), \"rsa-4096\" (asymmetric) are supported. Defaults to \"aes256-gcm96\".", "default": "aes256-gcm96" } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postTransitKeysName" }, "task": true }, { "name": "deleteTransitKeysName", "summary": "deleteTransitKeysName", "description": "Managed named encryption keys", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "transitmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "transitmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the key: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteTransitKeysName" }, "task": true }, { "name": "postTransitKeysNameConfig", "summary": "postTransitKeysNameConfig", "description": "Configure a named encryption key", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "transitmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "transitmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the key: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"allow_plaintext_backup\": \"boolean\", \"deletion_allowed\": \"boolean\", \"exportable\": \"boolean\", \"min_decryption_version\": 123, \"min_encryption_version\": 123}", "required": false, "schema": { "title": "TransitKeysConfigRequest", "type": "object", "properties": { "allow_plaintext_backup": { "type": "boolean", "description": "Enables taking a backup of the named key in plaintext format. Once set, this cannot be disabled." }, "deletion_allowed": { "type": "boolean", "description": "Whether to allow deletion of the key" }, "exportable": { "type": "boolean", "description": "Enables export of the key. Once set, this cannot be disabled." }, "min_decryption_version": { "type": "integer", "description": "If set, the minimum version of the key allowed to be decrypted. For signing keys, the minimum version allowed to be used for verification." }, "min_encryption_version": { "type": "integer", "description": "If set, the minimum version of the key allowed to be used for encryption; or for signing keys, to be used for signing. If set to zero, only the latest version of the key is allowed." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postTransitKeysNameConfig" }, "task": true }, { "name": "postTransitKeysNameRotate", "summary": "postTransitKeysNameRotate", "description": "Rotate named encryption key", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "transitmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "transitmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the key: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postTransitKeysNameRotate" }, "task": true }, { "name": "postTransitKeysNameTrim", "summary": "postTransitKeysNameTrim", "description": "Trim key versions of a named key", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "transitmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "transitmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the key: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"min_available_version\": 123}", "required": false, "schema": { "title": "TransitKeysTrimRequest", "type": "object", "properties": { "min_available_version": { "type": "integer", "description": "The minimum available version for the key ring. All versions before this version will be permanently deleted. This value can at most be equal to the lesser of 'min_decryption_version' and 'min_encryption_version'. This is not allowed to be set when either 'min_encryption_version' or 'min_decryption_version' is set to zero." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postTransitKeysNameTrim" }, "task": true }, { "name": "postTransitRandom", "summary": "postTransitRandom", "description": "Generate random bytes", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "transitmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "transitmount", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"bytes\": 123, \"format\": \"string\", \"urlbytes\": \"string\"}", "required": false, "schema": { "title": "TransitRandomRequest", "type": "object", "properties": { "bytes": { "type": "integer", "description": "The number of bytes to generate (POST body parameter). Defaults to 32 (256 bits).", "default": 32 }, "format": { "type": "string", "description": "Encoding format to use. Can be \"hex\" or \"base64\". Defaults to \"base64\".", "default": "base64" }, "urlbytes": { "type": "string", "description": "The number of bytes to generate (POST URL parameter)" } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postTransitRandom" }, "task": true }, { "name": "postTransitRandomUrlbytes", "summary": "postTransitRandomUrlbytes", "description": "Generate random bytes", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "transitmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "transitmount", "type": "string" } }, { "name": "urlbytes", "type": "string", "info": "The number of bytes to generate (POST URL parameter): string", "required": true, "schema": { "title": "urlbytes", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"bytes\": 123, \"format\": \"string\"}", "required": false, "schema": { "title": "TransitRandomRequest1", "type": "object", "properties": { "bytes": { "type": "integer", "description": "The number of bytes to generate (POST body parameter). Defaults to 32 (256 bits).", "default": 32 }, "format": { "type": "string", "description": "Encoding format to use. Can be \"hex\" or \"base64\". Defaults to \"base64\".", "default": "base64" } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postTransitRandomUrlbytes" }, "task": true }, { "name": "postTransitRestore", "summary": "postTransitRestore", "description": "Restore the named key", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "transitmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "transitmount", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"backup\": \"string\", \"force\": \"boolean\", \"name\": \"string\"}", "required": false, "schema": { "title": "TransitRestoreRequest", "type": "object", "properties": { "backup": { "type": "string", "description": "Backed up key data to be restored. This should be the output from the 'backup/' endpoint." }, "force": { "type": "boolean", "description": "If set and a key by the given name exists, force the restore operation and override the key.", "default": false }, "name": { "type": "string", "description": "If set, this will be the name of the restored key." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postTransitRestore" }, "task": true }, { "name": "postTransitRestoreName", "summary": "postTransitRestoreName", "description": "Restore the named key", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "transitmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "transitmount", "type": "string" } }, { "name": "name", "type": "string", "info": "If set, this will be the name of the restored key.: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"backup\": \"string\", \"force\": \"boolean\"}", "required": false, "schema": { "title": "TransitRestoreRequest1", "type": "object", "properties": { "backup": { "type": "string", "description": "Backed up key data to be restored. This should be the output from the 'backup/' endpoint." }, "force": { "type": "boolean", "description": "If set and a key by the given name exists, force the restore operation and override the key.", "default": false } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postTransitRestoreName" }, "task": true }, { "name": "postTransitRewrapName", "summary": "postTransitRewrapName", "description": "Rewrap ciphertext", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "transitmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "transitmount", "type": "string" } }, { "name": "name", "type": "string", "info": "Name of the key: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"ciphertext\": \"string\", \"context\": \"string\", \"key_version\": 123, \"nonce\": \"string\"}", "required": false, "schema": { "title": "TransitRewrapRequest", "type": "object", "properties": { "ciphertext": { "type": "string", "description": "Ciphertext value to rewrap" }, "context": { "type": "string", "description": "Base64 encoded context for key derivation. Required for derived keys." }, "key_version": { "type": "integer", "description": "The version of the key to use for encryption. Must be 0 (for latest) or a value greater than or equal to the min_encryption_version configured on the key." }, "nonce": { "type": "string", "description": "Nonce for when convergent encryption is used" } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postTransitRewrapName" }, "task": true }, { "name": "postTransitSignName", "summary": "postTransitSignName", "description": "Generate a signature for input data using the named key", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "transitmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "transitmount", "type": "string" } }, { "name": "name", "type": "string", "info": "The key to use: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"algorithm\": \"string\", \"context\": \"string\", \"hash_algorithm\": \"string\", \"input\": \"string\", \"key_version\": 123, \"marshaling_algorithm\": \"string\", \"prehashed\": \"boolean\", \"signature_algorithm\": \"string\", \"urlalgorithm\": \"string\"}", "required": false, "schema": { "title": "TransitSignRequest", "type": "object", "properties": { "algorithm": { "type": "string", "description": "Deprecated: use \"hash_algorithm\" instead.", "default": "sha2-256" }, "context": { "type": "string", "description": "Base64 encoded context for key derivation. Required if key derivation is enabled; currently only available with ed25519 keys." }, "hash_algorithm": { "type": "string", "description": "Hash algorithm to use (POST body parameter). Valid values are: * sha1 * sha2-224 * sha2-256 * sha2-384 * sha2-512 Defaults to \"sha2-256\". Not valid for all key types, including ed25519.", "default": "sha2-256" }, "input": { "type": "string", "description": "The base64-encoded input data" }, "key_version": { "type": "integer", "description": "The version of the key to use for signing. Must be 0 (for latest) or a value greater than or equal to the min_encryption_version configured on the key." }, "marshaling_algorithm": { "type": "string", "description": "The method by which to marshal the signature. The default is 'asn1' which is used by openssl and X.509. It can also be set to 'jws' which is used for JWT signatures; setting it to this will also cause the encoding of the signature to be url-safe base64 instead of using standard base64 encoding. Currently only valid for ECDSA P-256 key types\".", "default": "asn1" }, "prehashed": { "type": "boolean", "description": "Set to 'true' when the input is already hashed. If the key type is 'rsa-2048', 'rsa-3072' or 'rsa-4096', then the algorithm used to hash the input should be indicated by the 'algorithm' parameter." }, "signature_algorithm": { "type": "string", "description": "The signature algorithm to use for signing. Currently only applies to RSA key types. Options are 'pss' or 'pkcs1v15'. Defaults to 'pss'" }, "urlalgorithm": { "type": "string", "description": "Hash algorithm to use (POST URL parameter)" } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postTransitSignName" }, "task": true }, { "name": "postTransitSignNameUrlalgorithm", "summary": "postTransitSignNameUrlalgorithm", "description": "Generate a signature for input data using the named key", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "transitmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "transitmount", "type": "string" } }, { "name": "name", "type": "string", "info": "The key to use: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "urlalgorithm", "type": "string", "info": "Hash algorithm to use (POST URL parameter): string", "required": true, "schema": { "title": "urlalgorithm", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"algorithm\": \"string\", \"context\": \"string\", \"hash_algorithm\": \"string\", \"input\": \"string\", \"key_version\": 123, \"marshaling_algorithm\": \"string\", \"prehashed\": \"boolean\", \"signature_algorithm\": \"string\"}", "required": false, "schema": { "title": "TransitSignRequest1", "type": "object", "properties": { "algorithm": { "type": "string", "description": "Deprecated: use \"hash_algorithm\" instead.", "default": "sha2-256" }, "context": { "type": "string", "description": "Base64 encoded context for key derivation. Required if key derivation is enabled; currently only available with ed25519 keys." }, "hash_algorithm": { "type": "string", "description": "Hash algorithm to use (POST body parameter). Valid values are: * sha1 * sha2-224 * sha2-256 * sha2-384 * sha2-512 Defaults to \"sha2-256\". Not valid for all key types, including ed25519.", "default": "sha2-256" }, "input": { "type": "string", "description": "The base64-encoded input data" }, "key_version": { "type": "integer", "description": "The version of the key to use for signing. Must be 0 (for latest) or a value greater than or equal to the min_encryption_version configured on the key." }, "marshaling_algorithm": { "type": "string", "description": "The method by which to marshal the signature. The default is 'asn1' which is used by openssl and X.509. It can also be set to 'jws' which is used for JWT signatures; setting it to this will also cause the encoding of the signature to be url-safe base64 instead of using standard base64 encoding. Currently only valid for ECDSA P-256 key types\".", "default": "asn1" }, "prehashed": { "type": "boolean", "description": "Set to 'true' when the input is already hashed. If the key type is 'rsa-2048', 'rsa-3072' or 'rsa-4096', then the algorithm used to hash the input should be indicated by the 'algorithm' parameter." }, "signature_algorithm": { "type": "string", "description": "The signature algorithm to use for signing. Currently only applies to RSA key types. Options are 'pss' or 'pkcs1v15'. Defaults to 'pss'" } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postTransitSignNameUrlalgorithm" }, "task": true }, { "name": "postTransitVerifyName", "summary": "postTransitVerifyName", "description": "Verify a signature or HMAC for input data created using the named key", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "transitmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "transitmount", "type": "string" } }, { "name": "name", "type": "string", "info": "The key to use: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"algorithm\": \"string\", \"context\": \"string\", \"hash_algorithm\": \"string\", \"hmac\": \"string\", \"input\": \"string\", \"marshaling_algorithm\": \"string\", \"prehashed\": \"boolean\", \"signature\": \"string\", \"signature_algorithm\": \"string\", \"urlalgorithm\": \"string\"}", "required": false, "schema": { "title": "TransitVerifyRequest", "type": "object", "properties": { "algorithm": { "type": "string", "description": "Deprecated: use \"hash_algorithm\" instead.", "default": "sha2-256" }, "context": { "type": "string", "description": "Base64 encoded context for key derivation. Required if key derivation is enabled; currently only available with ed25519 keys." }, "hash_algorithm": { "type": "string", "description": "Hash algorithm to use (POST body parameter). Valid values are: * sha1 * sha2-224 * sha2-256 * sha2-384 * sha2-512 Defaults to \"sha2-256\". Not valid for all key types.", "default": "sha2-256" }, "hmac": { "type": "string", "description": "The HMAC, including vault header/key version" }, "input": { "type": "string", "description": "The base64-encoded input data to verify" }, "marshaling_algorithm": { "type": "string", "description": "The method by which to unmarshal the signature when verifying. The default is 'asn1' which is used by openssl and X.509; can also be set to 'jws' which is used for JWT signatures in which case the signature is also expected to be url-safe base64 encoding instead of standard base64 encoding. Currently only valid for ECDSA P-256 key types\".", "default": "asn1" }, "prehashed": { "type": "boolean", "description": "Set to 'true' when the input is already hashed. If the key type is 'rsa-2048', 'rsa-3072' or 'rsa-4096', then the algorithm used to hash the input should be indicated by the 'algorithm' parameter." }, "signature": { "type": "string", "description": "The signature, including vault header/key version" }, "signature_algorithm": { "type": "string", "description": "The signature algorithm to use for signature verification. Currently only applies to RSA key types. Options are 'pss' or 'pkcs1v15'. Defaults to 'pss'" }, "urlalgorithm": { "type": "string", "description": "Hash algorithm to use (POST URL parameter)" } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postTransitVerifyName" }, "task": true }, { "name": "postTransitVerifyNameUrlalgorithm", "summary": "postTransitVerifyNameUrlalgorithm", "description": "Verify a signature or HMAC for input data created using the named key", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "transitmount", "type": "string", "info": "The desired secret engine for this request.: string", "required": false, "schema": { "title": "transitmount", "type": "string" } }, { "name": "name", "type": "string", "info": "The key to use: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "urlalgorithm", "type": "string", "info": "Hash algorithm to use (POST URL parameter): string", "required": true, "schema": { "title": "urlalgorithm", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"algorithm\": \"string\", \"context\": \"string\", \"hash_algorithm\": \"string\", \"hmac\": \"string\", \"input\": \"string\", \"marshaling_algorithm\": \"string\", \"prehashed\": \"boolean\", \"signature\": \"string\", \"signature_algorithm\": \"string\"}", "required": false, "schema": { "title": "TransitVerifyRequest1", "type": "object", "properties": { "algorithm": { "type": "string", "description": "Deprecated: use \"hash_algorithm\" instead.", "default": "sha2-256" }, "context": { "type": "string", "description": "Base64 encoded context for key derivation. Required if key derivation is enabled; currently only available with ed25519 keys." }, "hash_algorithm": { "type": "string", "description": "Hash algorithm to use (POST body parameter). Valid values are: * sha1 * sha2-224 * sha2-256 * sha2-384 * sha2-512 Defaults to \"sha2-256\". Not valid for all key types.", "default": "sha2-256" }, "hmac": { "type": "string", "description": "The HMAC, including vault header/key version" }, "input": { "type": "string", "description": "The base64-encoded input data to verify" }, "marshaling_algorithm": { "type": "string", "description": "The method by which to unmarshal the signature when verifying. The default is 'asn1' which is used by openssl and X.509; can also be set to 'jws' which is used for JWT signatures in which case the signature is also expected to be url-safe base64 encoding instead of standard base64 encoding. Currently only valid for ECDSA P-256 key types\".", "default": "asn1" }, "prehashed": { "type": "boolean", "description": "Set to 'true' when the input is already hashed. If the key type is 'rsa-2048', 'rsa-3072' or 'rsa-4096', then the algorithm used to hash the input should be indicated by the 'algorithm' parameter." }, "signature": { "type": "string", "description": "The signature, including vault header/key version" }, "signature_algorithm": { "type": "string", "description": "The signature algorithm to use for signature verification. Currently only applies to RSA key types. Options are 'pss' or 'pkcs1v15'. Defaults to 'pss'" } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postTransitVerifyNameUrlalgorithm" }, "task": true }, { "name": "getSysInternalCountersActivity", "summary": "getSysInternalCountersActivity", "description": "Report the client count metrics, for this namespace and all child namespaces.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSysInternalCountersActivity" }, "task": true }, { "name": "getSysInternalCountersActivityMonthly", "summary": "getSysInternalCountersActivityMonthly", "description": "Report the number of clients for this month, for this namespace and all child namespaces.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSysInternalCountersActivityMonthly" }, "task": true }, { "name": "getSysInternalCountersConfig", "summary": "getSysInternalCountersConfig", "description": "Read the client count tracking configuration.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSysInternalCountersConfig" }, "task": true }, { "name": "postSysInternalCountersConfig", "summary": "postSysInternalCountersConfig", "description": "Enable or disable collection of client count, set retention period, or set default reporting period.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"default_report_months\": 123, \"enabled\": \"string\", \"retention_months\": 123}", "required": false, "schema": { "title": "SysInternalCountersConfigRequest", "type": "object", "properties": { "default_report_months": { "type": "integer", "description": "Number of months to report if no start date specified.", "default": 12 }, "enabled": { "type": "string", "description": "Enable or disable collection of client count: enable, disable, or default.", "default": "default" }, "retention_months": { "type": "integer", "description": "Number of months of client data to retain. Setting to 0 will clear all existing data.", "default": 24 } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysInternalCountersConfig" }, "task": true }, { "name": "getSysInternalUiFeatureFlags", "summary": "getSysInternalUiFeatureFlags", "description": "Lists enabled feature flags.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSysInternalUiFeatureFlags" }, "task": true }, { "name": "getSysPprofAllocs", "summary": "getSysPprofAllocs", "description": "Returns a sampling of all past memory allocations.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSysPprofAllocs" }, "task": true }, { "name": "getSysPprofBlock", "summary": "getSysPprofBlock", "description": "Returns stack traces that led to blocking on synchronization primitives", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSysPprofBlock" }, "task": true }, { "name": "getSysPprofMutex", "summary": "getSysPprofMutex", "description": "Returns stack traces of holders of contended mutexes", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSysPprofMutex" }, "task": true }, { "name": "getSysPprofThreadcreate", "summary": "getSysPprofThreadcreate", "description": "Returns stack traces that led to the creation of new OS threads", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSysPprofThreadcreate" }, "task": true }, { "name": "getSysRotateConfig", "summary": "getSysRotateConfig", "description": "Configures settings related to the backend encryption key management.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSysRotateConfig" }, "task": true }, { "name": "postSysRotateConfig", "summary": "postSysRotateConfig", "description": "Configures settings related to the backend encryption key management.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"enabled\": \"boolean\", \"interval\": 123, \"max_operations\": 123}", "required": false, "schema": { "title": "SysRotateConfigRequest", "type": "object", "properties": { "enabled": { "type": "boolean", "description": "Whether automatic rotation is enabled." }, "interval": { "type": "integer", "description": "How long after installation of an active key term that the key will be automatically rotated." }, "max_operations": { "type": "integer", "description": "The number of encryption operations performed before the barrier key is automatically rotated." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysRotateConfig" }, "task": true }, { "name": "getSysStorageRaftAutopilotConfiguration", "summary": "getSysStorageRaftAutopilotConfiguration", "description": "Returns autopilot configuration.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSysStorageRaftAutopilotConfiguration" }, "task": true }, { "name": "postSysStorageRaftAutopilotConfiguration", "summary": "postSysStorageRaftAutopilotConfiguration", "description": "Returns autopilot configuration.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"cleanup_dead_servers\": \"boolean\", \"dead_server_last_contact_threshold\": 123, \"last_contact_threshold\": 123, \"max_trailing_logs\": 123, \"min_quorum\": 123, \"server_stabilization_time\": 123}", "required": false, "schema": { "title": "SysStorageRaftAutopilotConfigurationRequest", "type": "object", "properties": { "cleanup_dead_servers": { "type": "boolean", "description": "Controls whether to remove dead servers from the Raft peer list periodically or when a new server joins." }, "dead_server_last_contact_threshold": { "type": "integer", "description": "Limit on the amount of time a server can go without leader contact before being considered failed. This takes effect only when cleanup_dead_servers is set." }, "last_contact_threshold": { "type": "integer", "description": "Limit on the amount of time a server can go without leader contact before being considered unhealthy." }, "max_trailing_logs": { "type": "integer", "description": "Amount of entries in the Raft Log that a server can be behind before being considered unhealthy." }, "min_quorum": { "type": "integer", "description": "Minimum number of servers allowed in a cluster before autopilot can prune dead servers. This should at least be 3." }, "server_stabilization_time": { "type": "integer", "description": "Minimum amount of time a server must be in a stable, healthy state before it can be added to the cluster." } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysStorageRaftAutopilotConfiguration" }, "task": true }, { "name": "getSysStorageRaftAutopilotState", "summary": "getSysStorageRaftAutopilotState", "description": "Returns the state of the raft cluster under integrated storage as seen by autopilot.", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSysStorageRaftAutopilotState" }, "task": true }, { "name": "getSysStorageRaftSnapshotAutoConfig", "summary": "getSysStorageRaftSnapshotAutoConfig", "description": "List automated raft snapshot configurations", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "list", "type": "string", "info": "Return a list if `true`: string", "required": false, "schema": { "title": "list", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSysStorageRaftSnapshotAutoConfig" }, "task": true }, { "name": "getSysStorageRaftSnapshotAutoConfigName", "summary": "getSysStorageRaftSnapshotAutoConfigName", "description": "Read automated raft snapshot configuration", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "name", "type": "string", "info": "name of configuration to update: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSysStorageRaftSnapshotAutoConfigName" }, "task": true }, { "name": "postSysStorageRaftSnapshotAutoConfigName", "summary": "postSysStorageRaftSnapshotAutoConfigName", "description": "Update automated raft snapshot configuration", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "name", "type": "string", "info": "name of configuration to update: string", "required": true, "schema": { "title": "name", "type": "string" } }, { "name": "body", "type": "object", "info": ": {\"aws_access_key_id\": \"string\", \"aws_s3_bucket\": \"string\", \"aws_s3_disable_tls\": \"boolean\", \"aws_s3_enable_kms\": \"boolean\", \"aws_s3_endpoint\": \"string\", \"aws_s3_force_path_style\": \"boolean\", \"aws_s3_kms_key\": \"string\", \"aws_s3_region\": \"string\", \"aws_s3_server_side_encryption\": \"boolean\", \"aws_secret_access_key\": \"string\", \"aws_session_token\": \"string\", \"azure_account_key\": \"string\", \"azure_account_name\": \"string\", \"azure_blob_environment\": \"string\", \"azure_container_name\": \"string\", \"azure_endpoint\": \"string\", \"file_prefix\": \"string\", \"google_disable_tls\": \"boolean\", \"google_endpoint\": \"string\", \"google_gcs_bucket\": \"string\", \"google_service_account_key\": \"string\", \"interval\": 123, \"local_max_space\": 123, \"path_prefix\": \"string\", \"retain\": 123, \"storage_type\": \"Must be one of [local, azure-blob, aws-s3, google-gcs]\"}", "required": false, "schema": { "title": "SysStorageRaftSnapshotAutoConfigRequest", "type": "object", "properties": { "aws_access_key_id": { "type": "string", "description": "AWS access key ID" }, "aws_s3_bucket": { "type": "string", "description": "AWS bucket" }, "aws_s3_disable_tls": { "type": "boolean", "description": "Disable TLS for the AWS endpoint, intended only for testing" }, "aws_s3_enable_kms": { "type": "boolean", "description": "Use KMS to encrypt bucket contents" }, "aws_s3_endpoint": { "type": "string", "description": "AWS endpoint, typically only set when using a non-AWS S3 instance like Minio" }, "aws_s3_force_path_style": { "type": "boolean", "description": "Use the endpoint/bucket URL style instead of bucket.endpoint" }, "aws_s3_kms_key": { "type": "string", "description": "Use named KMS key" }, "aws_s3_region": { "type": "string", "description": "AWS region" }, "aws_s3_server_side_encryption": { "type": "boolean", "description": "Use AES256 to encrypt bucket contents" }, "aws_secret_access_key": { "type": "string", "description": "AWS secret access key" }, "aws_session_token": { "type": "string", "description": "AWS session token" }, "azure_account_key": { "type": "string", "description": "Azure account key" }, "azure_account_name": { "type": "string", "description": "Azure account name" }, "azure_blob_environment": { "type": "string", "description": "Azure blob environment", "default": "AZUREPUBLICCLOUD" }, "azure_container_name": { "type": "string", "description": "Azure container name" }, "azure_endpoint": { "type": "string", "description": "Azure blob storage endpoint" }, "file_prefix": { "type": "string", "description": "file/object prefix prepended to snapshot ID", "default": "vault-snapshot" }, "google_disable_tls": { "type": "boolean", "description": "Disable TLS, normally only for testing" }, "google_endpoint": { "type": "string", "description": "GCS endpoint" }, "google_gcs_bucket": { "type": "string", "description": "GCS bucket" }, "google_service_account_key": { "type": "string", "description": "Service account key in JSON format" }, "interval": { "type": "integer", "description": "snapshot schedule" }, "local_max_space": { "type": "integer", "description": "max space on disk to use for snapshots" }, "path_prefix": { "type": "string", "description": "directory (local) or bucket prefix (cloud) for snapshot" }, "retain": { "type": "integer", "description": "how many snapshots to keep", "default": 1 }, "storage_type": { "title": "StorageType", "enum": [ "local", "azure-blob", "aws-s3", "google-gcs" ], "type": "string", "description": "type of storage to use for the snapshots" } }, "definitions": {} } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/postSysStorageRaftSnapshotAutoConfigName" }, "task": true }, { "name": "deleteSysStorageRaftSnapshotAutoConfigName", "summary": "deleteSysStorageRaftSnapshotAutoConfigName", "description": "Delete automated raft snapshot configuration", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "name", "type": "string", "info": "name of configuration to update: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/deleteSysStorageRaftSnapshotAutoConfigName" }, "task": true }, { "name": "getSysStorageRaftSnapshotAutoStatusName", "summary": "getSysStorageRaftSnapshotAutoStatusName", "description": "Delete automated raft snapshot configuration", "input": [ { "name": "namespace", "type": "string", "info": "the namespace within Vault: string", "required": false, "schema": { "title": "namespace", "type": "string" } }, { "name": "name", "type": "string", "info": "name of configuration to update: string", "required": true, "schema": { "title": "name", "type": "string" } } ], "output": { "name": "result", "type": "object", "description": "A JSON Object containing status, code and the result", "schema": { "title": "result", "type": "object" } }, "roles": [ "admin" ], "route": { "verb": "POST", "path": "/getSysStorageRaftSnapshotAutoStatusName" }, "task": true } ], "views": [] }