Vault

A dictionary of key-values are stored under a given name.

Values can be stored directly (strings) or base64 encoded (binary values). Use base64 when the data contains characters that are not suitable for a string representation.

If a value is mounted as a file by the scheduler, then the decoded value will be used, ie base64 values will be unpacked.

Create a new vault

Vaults storing versioned key/value secrets with optional metadata, retention policies, and access controls.

SecurityaccessToken

Request

query Parameters

validate

string <enumeration>

Validate the request but do not actually perform the requested operation

Value: "true"

Request Body schema:
application/yaml

name required	string <name> ^[a-z0-9]([a-z0-9\-]*[a-z0-9])?$ Unique name of this vault within the tenant.
max-versions	integer <uint32> The maximum number of versions allowed to exist at any given time. Old versions are removed when new are added. Defaults to 1 if unset.
cas-required	boolean Default: false When set to true, a CAS (check and set) value is required, allowing cooperative concurrency. Setting a new value then requires a CAS value that corresponds to the current version. If the CAS value is missing or differs from the current version, the set is rejected.
delete-version-after	string <duration> A duration in years, days, hours, minutes and seconds. Format is `[<digits>y][<digits>d][<digits>m][<digits>s]`. Examples: `1y2d5h`, `5h` or `10m30s` Delete version after the duration. If not set, then the value will remain until explicitly deleted. Not yet implemented.
	to (object) or sites (object) or deployments (object) Default: "to" Selects how this object is distributed across sites.

Responses

201

Created

400

Bad Request

401

Unauthorized

403

Forbidden

404

Not Found

409

Conflict (instance exists)

503

Service Unavailable (strongbox sealed)

post/v1/config/strongbox/vaults

Request samples

Payload

name: some-vault
max-versions: 1
cas-required: false
delete-version-after: 0s
distribute:
  sites:
    - stockholm-sergel
    - gotenburg-bergakungen

Retrieve the configuration of all vaults

Vaults storing versioned key/value secrets with optional metadata, retention policies, and access controls.

SecurityaccessToken

Request

query Parameters

fields	string Retrieve only requested fields from the resource See section fields
where	string Retrieve only items matching the given expression. See section where
validate	string <enumeration> Validate the request but do not actually perform the requested operation Value: "true"
keys	string <enumeration> Retrieve only the keys for the list Value: "true"
count	string <enumeration> Retrieve only the number of elements in the list Value: "true"

Responses

200

400

Bad Request

401

Unauthorized

403

Forbidden

404

Not Found

412

Precondition Failed

503

Service Unavailable (strongbox sealed)

get/v1/config/strongbox/vaults

Response samples

- name: some-vault
  max-versions: 1
  cas-required: false
  delete-version-after: 0s
  distribute:
    sites:
      - stockholm-sergel
      - gotenburg-bergakungen

Update a vault

Vaults storing versioned key/value secrets with optional metadata, retention policies, and access controls.

SecurityaccessToken

Request

path Parameters

vault-name

required

string <name> ^[a-z0-9]([a-z0-9\-]*[a-z0-9])?$

Unique name of this vault within the tenant.

query Parameters

validate

string <enumeration>

Validate the request but do not actually perform the requested operation

Value: "true"

Request Body schema:
application/yaml

name required	string <name> ^[a-z0-9]([a-z0-9\-]*[a-z0-9])?$ Unique name of this vault within the tenant.
max-versions	integer <uint32> The maximum number of versions allowed to exist at any given time. Old versions are removed when new are added. Defaults to 1 if unset.
cas-required	boolean Default: false When set to true, a CAS (check and set) value is required, allowing cooperative concurrency. Setting a new value then requires a CAS value that corresponds to the current version. If the CAS value is missing or differs from the current version, the set is rejected.
delete-version-after	string <duration> A duration in years, days, hours, minutes and seconds. Format is `[<digits>y][<digits>d][<digits>m][<digits>s]`. Examples: `1y2d5h`, `5h` or `10m30s` Delete version after the duration. If not set, then the value will remain until explicitly deleted. Not yet implemented.
	to (object) or sites (object) or deployments (object) Default: "to" Selects how this object is distributed across sites.

Responses

204

No Content

400

Bad Request

401

Unauthorized

403

Forbidden

404

Not Found

412

Precondition Failed

503

Service Unavailable (strongbox sealed)

patch/v1/config/strongbox/vaults/{vault-name}

Request samples

Payload

name: some-vault
max-versions: 1
cas-required: false
delete-version-after: 0s
distribute:
  sites:
    - stockholm-sergel
    - gotenburg-bergakungen

Delete a vault

Vaults storing versioned key/value secrets with optional metadata, retention policies, and access controls.

SecurityaccessToken

Request

path Parameters

vault-name

required

string <name> ^[a-z0-9]([a-z0-9\-]*[a-z0-9])?$

Unique name of this vault within the tenant.

query Parameters

validate

string <enumeration>

Validate the request but do not actually perform the requested operation

Value: "true"

Responses

204

No Content

400

Bad Request

401

Unauthorized

403

Forbidden

404

Not Found

412

Precondition Failed

503

Service Unavailable (strongbox sealed)

delete/v1/config/strongbox/vaults/{vault-name}

Replace or create a new vault

Vaults storing versioned key/value secrets with optional metadata, retention policies, and access controls.

SecurityaccessToken

Request

path Parameters

vault-name

required

string <name> ^[a-z0-9]([a-z0-9\-]*[a-z0-9])?$

Unique name of this vault within the tenant.

query Parameters

validate

string <enumeration>

Validate the request but do not actually perform the requested operation

Value: "true"

Request Body schema:
application/yaml

name required	string <name> ^[a-z0-9]([a-z0-9\-]*[a-z0-9])?$ Unique name of this vault within the tenant.
max-versions	integer <uint32> The maximum number of versions allowed to exist at any given time. Old versions are removed when new are added. Defaults to 1 if unset.
cas-required	boolean Default: false When set to true, a CAS (check and set) value is required, allowing cooperative concurrency. Setting a new value then requires a CAS value that corresponds to the current version. If the CAS value is missing or differs from the current version, the set is rejected.
delete-version-after	string <duration> A duration in years, days, hours, minutes and seconds. Format is `[<digits>y][<digits>d][<digits>m][<digits>s]`. Examples: `1y2d5h`, `5h` or `10m30s` Delete version after the duration. If not set, then the value will remain until explicitly deleted. Not yet implemented.
	to (object) or sites (object) or deployments (object) Default: "to" Selects how this object is distributed across sites.

Responses

201

Created

204

No Content

400

Bad Request

401

Unauthorized

403

Forbidden

404

Not Found

412

Precondition Failed

503

Service Unavailable (strongbox sealed)

put/v1/config/strongbox/vaults/{vault-name}

Request samples

Payload

name: some-vault
max-versions: 1
cas-required: false
delete-version-after: 0s
distribute:
  sites:
    - stockholm-sergel
    - gotenburg-bergakungen

Retrieve the configuration of a vault

Vaults storing versioned key/value secrets with optional metadata, retention policies, and access controls.

SecurityaccessToken

Request

path Parameters

vault-name

required

string <name> ^[a-z0-9]([a-z0-9\-]*[a-z0-9])?$

Unique name of this vault within the tenant.

query Parameters

fields	string Retrieve only requested fields from the resource See section fields
where	string Retrieve only items matching the given expression. See section where
validate	string <enumeration> Validate the request but do not actually perform the requested operation Value: "true"
version-list	string <enumeration> Retrieve list of old versions Value: "true"
version	string Retrieve requested old version of the resource

Responses

200

400

Bad Request

401

Unauthorized

403

Forbidden

404

Not Found

412

Precondition Failed

503

Service Unavailable (strongbox sealed)

get/v1/config/strongbox/vaults/{vault-name}

Response samples

name: some-vault
max-versions: 1
cas-required: false
delete-version-after: 0s
distribute:
  sites:
    - stockholm-sergel
    - gotenburg-bergakungen

Create a new vault secret

Versioned secrets within a vault. Each entry holds the current and historical secret data and metadata.

SecurityaccessToken

Request

path Parameters

vault-name

required

string <name> ^[a-z0-9]([a-z0-9\-]*[a-z0-9])?$

Unique name of this vault within the tenant.

query Parameters

validate

string <enumeration>

Validate the request but do not actually perform the requested operation

Value: "true"

Request Body schema:
application/yaml

name required	string <name> ^[a-z0-9]([a-z0-9\-]*[a-z0-9])?$ Name of the vault secret.
	object A dictionary of key-value pairs are stored under a given key. Values should be base64 encoded before being stored. Key under which the base64-encoded value is stored.
	object A dictionary of key-value pairs are stored under a given key. Key under which the value is stored.
	object If these setting are configured then a certificate will be created on demand, and renewed when needed. Three key-value pairs will appear in the `dict` list; `cert.pem`, `cert.key`, and `ca-cert.pem`. Optionally `ca-root.pem` and `ca-chain.pem` may also appear for imported intermediate ca certificates. `ca-root.pem` will contain all valid root certificates for the issuing CA and should be used when validating certificates issued by the same CA. `ca-cert.pem` contains the certificate that was used to issue `cert.pem` in addition to the root certificates of all active versions of the issuing CA. Variables may be used in the `host` leaf and in the `alt-name` leaf when the type is DNSName. Variables are expanded at certificate generation time. The following system-defined variables are available: SYS_DNS_ZONES Available if the tenant has configured DNS zones. This is an array of the DNS zones defined for the tenant. The domain of a specific named zone is accessed with the syntax `${SYS_DNS_ZONES[name]}`. A zone named `default` is always available, and contains the default domain for this tenant. It is accessed using `${SYS_DNS_ZONES[default]}`. SYS_GLOBAL_DOMAIN Contains the name of the top level domain used by all sites in the environment. SYS_SITE Contains the name of the site where the certificate is generated. SYS_SITE_LABELS This is an array of all labels defined on the site. The value of a specific label is accessed with the syntax `${SYS_SITE_LABELS[label]}`. If the label has multiple values, it expands to a comma-separated string of these values. It is an error if no label is given, or if the label doesn't exist. SYS_TENANT Contains the name of the tenant. When the secret is shared across tenants and consumed by an application in a different tenant, this resolves to the consuming tenant (the tenant owning the application that mounts the secret). The tenant-scoped variables SYS_DNS_ZONES and SYS_SITE_LABELS follow the same resolution. SYS_APP If the secret is referred to in an application specification, this variable contains the name of the application. SYS_SERVICE If the secret is referred to in an application specification, this variable contains the name of the application service Auto-certs generated for an application always include application IP address, ingress IP addresses, and DNS names as alternate names. Certificates are not issued or returned by default when a secret is retrieved. To include generated certificates in the response to a GET request, the `with-certs=true` query parameter MUST be specified. In the `supctl` CLI, this corresponds to using the `--with-certs` option when running `show` on vaults or secrets.
	object If a ssh certificate is specified it will be created on demand, and renewed when needed. Four key-value pairs will appear in the `dict` list; `ssh-cert`, `ssh-private-key`, `ssh-public-key`, and `ssh-ca-public-key`
	object If a certificate is specified it will be requested on demand from the ACME service, and renewed when needed. Two key-value pairs will appear in the `dict` list; `acme-cert.pem`, `acme-cert.key`, and optionally `acme-cohain.pem` and `acme-fullchain.pem`. Variables may be used in the `names` leaf. Variables are expanded at certificate request time. The following system-defined variables are available: SYS_DNS_ZONES Available if the tenant has configured DNS zones. This is an array of the DNS zones defined for the tenant. The domain of a specific named zone is accessed with the syntax `${SYS_DNS_ZONES[name]}`. A zone named `default` is always available, and contains the default domain for this tenant. It is accessed using `${SYS_DNS_ZONES[default]}`. SYS_GLOBAL_DOMAIN Contains the name of the top level domain used by all sites in the environment. SYS_SITE Contains the name of the site where the certificate is generated. SYS_SITE_LABELS This is an array of all labels defined on the site. The value of a specific label is accessed with the syntax `${SYS_SITE_LABELS[label]}`. If the label has multiple values, it expands to a comma-separated string of these values. It is an error if no label is given, or if the label doesn't exist. SYS_TENANT Contains the name of the tenant. When the secret is shared across tenants and consumed by an application in a different tenant, this resolves to the consuming tenant (the tenant owning the application that mounts the secret). The tenant-scoped variables SYS_DNS_ZONES and SYS_SITE_LABELS follow the same resolution. SYS_APP If the secret is referred to in an application specification, this variable contains the name of the application. SYS_SERVICE If the secret is referred to in an application specification, this variable contains the name of the application service.
allow-image-access	Array of strings DEPRECATED - will be removed. Use allow-application-access instead. Allow listed images to mount the key-value map. The string is the image's hash id. The special value `*` indicates that all images have access.
allow-application-access	Array of strings Allow listed applications to access the secret from the application specification. If this field and `allow-tenant-access` are set, both checks must succeed for access to be granted. The string should be `<application>.<service>.<container>` where trailing parts may be left out to indicate that all containers have access, or all services have access, ie `<application>.<service>` to allow all containers in a service access, or `<application>` to allow all containers in all services in an application access. The special value `*` indicates that all applications have access.
allow-tenant-access	Array of strings <* \| name> **: - `\` name Allow listed tenants to access the secret from application specification, remote registries and volga webhooks. If this field and `allow-application-access` are set, both checks must succeed for access to be granted to applications. The special value `*` indicates that all tenants have access.
ttl	string <duration> A duration in years, days, hours, minutes and seconds. Format is `[<digits>y][<digits>d][<digits>m][<digits>s]`. Examples: `1y2d5h`, `5h` or `10m30s` The TTL is not enforced and only serve as indication to the user of the key-value map.

Responses

201

Created

400

Bad Request

401

Unauthorized

403

Forbidden

404

Not Found

409

Conflict (instance exists)

503

Service Unavailable (strongbox sealed)

post/v1/config/strongbox/vaults/{vault-name}/secrets

Request samples

Payload

name: credentials
base64-data:
  xx: eXk=
  yy: aGVg
data:
  password: reallysecret
  user: admin
auto-cert:
  issuing-ca: root
  refresh-threshold: 10d
  ttl: 20d
  align-to-midnight: true
  truncate-ttl: false
  host: www.server.com
  public-key: |
    -----BEGIN PUBLIC KEY-----
    MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAECMA6yO9x3I3qSjbEZ7nWlAFF/aiA
    puUfIlWEHcTwgiFvCdvV4rnXzdoSxZh5B6oK6KEDA4hqCV9Re8bIQ8VLlA==
    -----END PUBLIC KEY-----
  cert-type: server
  alt-name:
    - type: DNSName
      value: www.server.com
  server-ext-usage: true
  client-ext-usage: true
  code-signing-ext-usage: true
  full-authority-key-identifier: false
  serial-prefix: fe:ed:ba:be
auto-ssh-cert:
  issuing-ca: root
  issuing-role: admin
  public-key: ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAstFt4AUzsP1iEC9a4tO2G3ISbTSSthvUvWYoq0yWy0dzbnditXgw5rVBTuIC1oltNuAdsol+lOBbZLS2ZE6rDCeAq82AYu3EsdVBiHsZMocEjgg45xxd8+0tzaVZjevQWo9gkIqMesHEYgUGiwFZF4747AILemSwKz+X6HD78fs= joe@acme.com
  refresh-threshold: 10d
  ttl: 15d
  valid-principals:
    - joe
  cert-type: user
  key-id: joe
  critical-options:
    - force-command
  extensions:
    - permit-X11-forwarding
    - permit-agent-forwarding
    - permit-pty
auto-acme-cert:
  acme-service: pebble
  refresh-threshold: 30d
  names:
    - foo.site.test
  wait: 1m
allow-image-access:
  - "*"
allow-application-access:
  - popcorn-controller.popcorn-controller-service.kettle-popper-manager
allow-tenant-access:
  - acme
ttl: 4h

Retrieve the configuration of all vault secrets

Versioned secrets within a vault. Each entry holds the current and historical secret data and metadata.

SecurityaccessToken

Request

path Parameters

vault-name

required

string <name> ^[a-z0-9]([a-z0-9\-]*[a-z0-9])?$

Unique name of this vault within the tenant.

query Parameters

fields	string Retrieve only requested fields from the resource See section fields
where	string Retrieve only items matching the given expression. See section where
validate	string <enumeration> Validate the request but do not actually perform the requested operation Value: "true"
keys	string <enumeration> Retrieve only the keys for the list Value: "true"
count	string <enumeration> Retrieve only the number of elements in the list Value: "true"

Responses

200

400

Bad Request

401

Unauthorized

403

Forbidden

404

Not Found

412

Precondition Failed

503

Service Unavailable (strongbox sealed)

get/v1/config/strongbox/vaults/{vault-name}/secrets

Response samples

- name: credentials
  base64-data:
    xx: eXk=
    yy: aGVg
  data:
    password: reallysecret
    user: admin
  auto-cert:
    issuing-ca: root
    refresh-threshold: 10d
    ttl: 20d
    align-to-midnight: true
    truncate-ttl: false
    host: www.server.com
    public-key: |
      -----BEGIN PUBLIC KEY-----
      MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAECMA6yO9x3I3qSjbEZ7nWlAFF/aiA
      puUfIlWEHcTwgiFvCdvV4rnXzdoSxZh5B6oK6KEDA4hqCV9Re8bIQ8VLlA==
      -----END PUBLIC KEY-----
    cert-type: server
    alt-name:
      - type: DNSName
        value: www.server.com
    server-ext-usage: true
    client-ext-usage: true
    code-signing-ext-usage: true
    full-authority-key-identifier: false
    serial-prefix: fe:ed:ba:be
  auto-ssh-cert:
    issuing-ca: root
    issuing-role: admin
    public-key: ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAstFt4AUzsP1iEC9a4tO2G3ISbTSSthvUvWYoq0yWy0dzbnditXgw5rVBTuIC1oltNuAdsol+lOBbZLS2ZE6rDCeAq82AYu3EsdVBiHsZMocEjgg45xxd8+0tzaVZjevQWo9gkIqMesHEYgUGiwFZF4747AILemSwKz+X6HD78fs= joe@acme.com
    refresh-threshold: 10d
    ttl: 15d
    valid-principals:
      - joe
    cert-type: user
    key-id: joe
    critical-options:
      - force-command
    extensions:
      - permit-X11-forwarding
      - permit-agent-forwarding
      - permit-pty
  auto-acme-cert:
    acme-service: pebble
    refresh-threshold: 30d
    names:
      - foo.site.test
    wait: 1m
  allow-image-access:
    - "*"
  allow-application-access:
    - popcorn-controller.popcorn-controller-service.kettle-popper-manager
  allow-tenant-access:
    - acme
  ttl: 4h

Update a vault secret

Versioned secrets within a vault. Each entry holds the current and historical secret data and metadata.

SecurityaccessToken

Request

path Parameters

vault-name required	string <name> ^[a-z0-9]([a-z0-9\-]*[a-z0-9])?$ Unique name of this vault within the tenant.
vault-secret-name required	string <name> ^[a-z0-9]([a-z0-9\-]*[a-z0-9])?$ Name of the vault secret.

query Parameters

validate

string <enumeration>

Validate the request but do not actually perform the requested operation

Value: "true"

Request Body schema:
application/yaml

name required	string <name> ^[a-z0-9]([a-z0-9\-]*[a-z0-9])?$ Name of the vault secret.
	object A dictionary of key-value pairs are stored under a given key. Values should be base64 encoded before being stored. Key under which the base64-encoded value is stored.
	object A dictionary of key-value pairs are stored under a given key. Key under which the value is stored.
	object If these setting are configured then a certificate will be created on demand, and renewed when needed. Three key-value pairs will appear in the `dict` list; `cert.pem`, `cert.key`, and `ca-cert.pem`. Optionally `ca-root.pem` and `ca-chain.pem` may also appear for imported intermediate ca certificates. `ca-root.pem` will contain all valid root certificates for the issuing CA and should be used when validating certificates issued by the same CA. `ca-cert.pem` contains the certificate that was used to issue `cert.pem` in addition to the root certificates of all active versions of the issuing CA. Variables may be used in the `host` leaf and in the `alt-name` leaf when the type is DNSName. Variables are expanded at certificate generation time. The following system-defined variables are available: SYS_DNS_ZONES Available if the tenant has configured DNS zones. This is an array of the DNS zones defined for the tenant. The domain of a specific named zone is accessed with the syntax `${SYS_DNS_ZONES[name]}`. A zone named `default` is always available, and contains the default domain for this tenant. It is accessed using `${SYS_DNS_ZONES[default]}`. SYS_GLOBAL_DOMAIN Contains the name of the top level domain used by all sites in the environment. SYS_SITE Contains the name of the site where the certificate is generated. SYS_SITE_LABELS This is an array of all labels defined on the site. The value of a specific label is accessed with the syntax `${SYS_SITE_LABELS[label]}`. If the label has multiple values, it expands to a comma-separated string of these values. It is an error if no label is given, or if the label doesn't exist. SYS_TENANT Contains the name of the tenant. When the secret is shared across tenants and consumed by an application in a different tenant, this resolves to the consuming tenant (the tenant owning the application that mounts the secret). The tenant-scoped variables SYS_DNS_ZONES and SYS_SITE_LABELS follow the same resolution. SYS_APP If the secret is referred to in an application specification, this variable contains the name of the application. SYS_SERVICE If the secret is referred to in an application specification, this variable contains the name of the application service Auto-certs generated for an application always include application IP address, ingress IP addresses, and DNS names as alternate names. Certificates are not issued or returned by default when a secret is retrieved. To include generated certificates in the response to a GET request, the `with-certs=true` query parameter MUST be specified. In the `supctl` CLI, this corresponds to using the `--with-certs` option when running `show` on vaults or secrets.
	object If a ssh certificate is specified it will be created on demand, and renewed when needed. Four key-value pairs will appear in the `dict` list; `ssh-cert`, `ssh-private-key`, `ssh-public-key`, and `ssh-ca-public-key`
	object If a certificate is specified it will be requested on demand from the ACME service, and renewed when needed. Two key-value pairs will appear in the `dict` list; `acme-cert.pem`, `acme-cert.key`, and optionally `acme-cohain.pem` and `acme-fullchain.pem`. Variables may be used in the `names` leaf. Variables are expanded at certificate request time. The following system-defined variables are available: SYS_DNS_ZONES Available if the tenant has configured DNS zones. This is an array of the DNS zones defined for the tenant. The domain of a specific named zone is accessed with the syntax `${SYS_DNS_ZONES[name]}`. A zone named `default` is always available, and contains the default domain for this tenant. It is accessed using `${SYS_DNS_ZONES[default]}`. SYS_GLOBAL_DOMAIN Contains the name of the top level domain used by all sites in the environment. SYS_SITE Contains the name of the site where the certificate is generated. SYS_SITE_LABELS This is an array of all labels defined on the site. The value of a specific label is accessed with the syntax `${SYS_SITE_LABELS[label]}`. If the label has multiple values, it expands to a comma-separated string of these values. It is an error if no label is given, or if the label doesn't exist. SYS_TENANT Contains the name of the tenant. When the secret is shared across tenants and consumed by an application in a different tenant, this resolves to the consuming tenant (the tenant owning the application that mounts the secret). The tenant-scoped variables SYS_DNS_ZONES and SYS_SITE_LABELS follow the same resolution. SYS_APP If the secret is referred to in an application specification, this variable contains the name of the application. SYS_SERVICE If the secret is referred to in an application specification, this variable contains the name of the application service.
allow-image-access	Array of strings DEPRECATED - will be removed. Use allow-application-access instead. Allow listed images to mount the key-value map. The string is the image's hash id. The special value `*` indicates that all images have access.
allow-application-access	Array of strings Allow listed applications to access the secret from the application specification. If this field and `allow-tenant-access` are set, both checks must succeed for access to be granted. The string should be `<application>.<service>.<container>` where trailing parts may be left out to indicate that all containers have access, or all services have access, ie `<application>.<service>` to allow all containers in a service access, or `<application>` to allow all containers in all services in an application access. The special value `*` indicates that all applications have access.
allow-tenant-access	Array of strings <* \| name> **: - `\` name Allow listed tenants to access the secret from application specification, remote registries and volga webhooks. If this field and `allow-application-access` are set, both checks must succeed for access to be granted to applications. The special value `*` indicates that all tenants have access.
ttl	string <duration> A duration in years, days, hours, minutes and seconds. Format is `[<digits>y][<digits>d][<digits>m][<digits>s]`. Examples: `1y2d5h`, `5h` or `10m30s` The TTL is not enforced and only serve as indication to the user of the key-value map.

Responses

204

No Content

400

Bad Request

401

Unauthorized

403

Forbidden

404

Not Found

412

Precondition Failed

503

Service Unavailable (strongbox sealed)

patch/v1/config/strongbox/vaults/{vault-name}/secrets/{vault-secret-name}

Request samples

Payload

name: credentials
base64-data:
  xx: eXk=
  yy: aGVg
data:
  password: reallysecret
  user: admin
auto-cert:
  issuing-ca: root
  refresh-threshold: 10d
  ttl: 20d
  align-to-midnight: true
  truncate-ttl: false
  host: www.server.com
  public-key: |
    -----BEGIN PUBLIC KEY-----
    MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAECMA6yO9x3I3qSjbEZ7nWlAFF/aiA
    puUfIlWEHcTwgiFvCdvV4rnXzdoSxZh5B6oK6KEDA4hqCV9Re8bIQ8VLlA==
    -----END PUBLIC KEY-----
  cert-type: server
  alt-name:
    - type: DNSName
      value: www.server.com
  server-ext-usage: true
  client-ext-usage: true
  code-signing-ext-usage: true
  full-authority-key-identifier: false
  serial-prefix: fe:ed:ba:be
auto-ssh-cert:
  issuing-ca: root
  issuing-role: admin
  public-key: ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAstFt4AUzsP1iEC9a4tO2G3ISbTSSthvUvWYoq0yWy0dzbnditXgw5rVBTuIC1oltNuAdsol+lOBbZLS2ZE6rDCeAq82AYu3EsdVBiHsZMocEjgg45xxd8+0tzaVZjevQWo9gkIqMesHEYgUGiwFZF4747AILemSwKz+X6HD78fs= joe@acme.com
  refresh-threshold: 10d
  ttl: 15d
  valid-principals:
    - joe
  cert-type: user
  key-id: joe
  critical-options:
    - force-command
  extensions:
    - permit-X11-forwarding
    - permit-agent-forwarding
    - permit-pty
auto-acme-cert:
  acme-service: pebble
  refresh-threshold: 30d
  names:
    - foo.site.test
  wait: 1m
allow-image-access:
  - "*"
allow-application-access:
  - popcorn-controller.popcorn-controller-service.kettle-popper-manager
allow-tenant-access:
  - acme
ttl: 4h

Delete a vault secret

Versioned secrets within a vault. Each entry holds the current and historical secret data and metadata.

SecurityaccessToken

Request

path Parameters

vault-name required	string <name> ^[a-z0-9]([a-z0-9\-]*[a-z0-9])?$ Unique name of this vault within the tenant.
vault-secret-name required	string <name> ^[a-z0-9]([a-z0-9\-]*[a-z0-9])?$ Name of the vault secret.

query Parameters

validate

string <enumeration>

Validate the request but do not actually perform the requested operation

Value: "true"

Responses

204

No Content

400

Bad Request

401

Unauthorized

403

Forbidden

404

Not Found

412

Precondition Failed

503

Service Unavailable (strongbox sealed)

delete/v1/config/strongbox/vaults/{vault-name}/secrets/{vault-secret-name}

Replace or create a new vault secret

Versioned secrets within a vault. Each entry holds the current and historical secret data and metadata.

SecurityaccessToken

Request

path Parameters

vault-name required	string <name> ^[a-z0-9]([a-z0-9\-]*[a-z0-9])?$ Unique name of this vault within the tenant.
vault-secret-name required	string <name> ^[a-z0-9]([a-z0-9\-]*[a-z0-9])?$ Name of the vault secret.

query Parameters

validate

string <enumeration>

Validate the request but do not actually perform the requested operation

Value: "true"

Request Body schema:
application/yaml

name required	string <name> ^[a-z0-9]([a-z0-9\-]*[a-z0-9])?$ Name of the vault secret.
	object A dictionary of key-value pairs are stored under a given key. Values should be base64 encoded before being stored. Key under which the base64-encoded value is stored.
	object A dictionary of key-value pairs are stored under a given key. Key under which the value is stored.
	object If these setting are configured then a certificate will be created on demand, and renewed when needed. Three key-value pairs will appear in the `dict` list; `cert.pem`, `cert.key`, and `ca-cert.pem`. Optionally `ca-root.pem` and `ca-chain.pem` may also appear for imported intermediate ca certificates. `ca-root.pem` will contain all valid root certificates for the issuing CA and should be used when validating certificates issued by the same CA. `ca-cert.pem` contains the certificate that was used to issue `cert.pem` in addition to the root certificates of all active versions of the issuing CA. Variables may be used in the `host` leaf and in the `alt-name` leaf when the type is DNSName. Variables are expanded at certificate generation time. The following system-defined variables are available: SYS_DNS_ZONES Available if the tenant has configured DNS zones. This is an array of the DNS zones defined for the tenant. The domain of a specific named zone is accessed with the syntax `${SYS_DNS_ZONES[name]}`. A zone named `default` is always available, and contains the default domain for this tenant. It is accessed using `${SYS_DNS_ZONES[default]}`. SYS_GLOBAL_DOMAIN Contains the name of the top level domain used by all sites in the environment. SYS_SITE Contains the name of the site where the certificate is generated. SYS_SITE_LABELS This is an array of all labels defined on the site. The value of a specific label is accessed with the syntax `${SYS_SITE_LABELS[label]}`. If the label has multiple values, it expands to a comma-separated string of these values. It is an error if no label is given, or if the label doesn't exist. SYS_TENANT Contains the name of the tenant. When the secret is shared across tenants and consumed by an application in a different tenant, this resolves to the consuming tenant (the tenant owning the application that mounts the secret). The tenant-scoped variables SYS_DNS_ZONES and SYS_SITE_LABELS follow the same resolution. SYS_APP If the secret is referred to in an application specification, this variable contains the name of the application. SYS_SERVICE If the secret is referred to in an application specification, this variable contains the name of the application service Auto-certs generated for an application always include application IP address, ingress IP addresses, and DNS names as alternate names. Certificates are not issued or returned by default when a secret is retrieved. To include generated certificates in the response to a GET request, the `with-certs=true` query parameter MUST be specified. In the `supctl` CLI, this corresponds to using the `--with-certs` option when running `show` on vaults or secrets.
	object If a ssh certificate is specified it will be created on demand, and renewed when needed. Four key-value pairs will appear in the `dict` list; `ssh-cert`, `ssh-private-key`, `ssh-public-key`, and `ssh-ca-public-key`
	object If a certificate is specified it will be requested on demand from the ACME service, and renewed when needed. Two key-value pairs will appear in the `dict` list; `acme-cert.pem`, `acme-cert.key`, and optionally `acme-cohain.pem` and `acme-fullchain.pem`. Variables may be used in the `names` leaf. Variables are expanded at certificate request time. The following system-defined variables are available: SYS_DNS_ZONES Available if the tenant has configured DNS zones. This is an array of the DNS zones defined for the tenant. The domain of a specific named zone is accessed with the syntax `${SYS_DNS_ZONES[name]}`. A zone named `default` is always available, and contains the default domain for this tenant. It is accessed using `${SYS_DNS_ZONES[default]}`. SYS_GLOBAL_DOMAIN Contains the name of the top level domain used by all sites in the environment. SYS_SITE Contains the name of the site where the certificate is generated. SYS_SITE_LABELS This is an array of all labels defined on the site. The value of a specific label is accessed with the syntax `${SYS_SITE_LABELS[label]}`. If the label has multiple values, it expands to a comma-separated string of these values. It is an error if no label is given, or if the label doesn't exist. SYS_TENANT Contains the name of the tenant. When the secret is shared across tenants and consumed by an application in a different tenant, this resolves to the consuming tenant (the tenant owning the application that mounts the secret). The tenant-scoped variables SYS_DNS_ZONES and SYS_SITE_LABELS follow the same resolution. SYS_APP If the secret is referred to in an application specification, this variable contains the name of the application. SYS_SERVICE If the secret is referred to in an application specification, this variable contains the name of the application service.
allow-image-access	Array of strings DEPRECATED - will be removed. Use allow-application-access instead. Allow listed images to mount the key-value map. The string is the image's hash id. The special value `*` indicates that all images have access.
allow-application-access	Array of strings Allow listed applications to access the secret from the application specification. If this field and `allow-tenant-access` are set, both checks must succeed for access to be granted. The string should be `<application>.<service>.<container>` where trailing parts may be left out to indicate that all containers have access, or all services have access, ie `<application>.<service>` to allow all containers in a service access, or `<application>` to allow all containers in all services in an application access. The special value `*` indicates that all applications have access.
allow-tenant-access	Array of strings <* \| name> **: - `\` name Allow listed tenants to access the secret from application specification, remote registries and volga webhooks. If this field and `allow-application-access` are set, both checks must succeed for access to be granted to applications. The special value `*` indicates that all tenants have access.
ttl	string <duration> A duration in years, days, hours, minutes and seconds. Format is `[<digits>y][<digits>d][<digits>m][<digits>s]`. Examples: `1y2d5h`, `5h` or `10m30s` The TTL is not enforced and only serve as indication to the user of the key-value map.

Responses

201

Created

204

No Content

400

Bad Request

401

Unauthorized

403

Forbidden

404

Not Found

412

Precondition Failed

503

Service Unavailable (strongbox sealed)

put/v1/config/strongbox/vaults/{vault-name}/secrets/{vault-secret-name}

Request samples

Payload

name: credentials
base64-data:
  xx: eXk=
  yy: aGVg
data:
  password: reallysecret
  user: admin
auto-cert:
  issuing-ca: root
  refresh-threshold: 10d
  ttl: 20d
  align-to-midnight: true
  truncate-ttl: false
  host: www.server.com
  public-key: |
    -----BEGIN PUBLIC KEY-----
    MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAECMA6yO9x3I3qSjbEZ7nWlAFF/aiA
    puUfIlWEHcTwgiFvCdvV4rnXzdoSxZh5B6oK6KEDA4hqCV9Re8bIQ8VLlA==
    -----END PUBLIC KEY-----
  cert-type: server
  alt-name:
    - type: DNSName
      value: www.server.com
  server-ext-usage: true
  client-ext-usage: true
  code-signing-ext-usage: true
  full-authority-key-identifier: false
  serial-prefix: fe:ed:ba:be
auto-ssh-cert:
  issuing-ca: root
  issuing-role: admin
  public-key: ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAstFt4AUzsP1iEC9a4tO2G3ISbTSSthvUvWYoq0yWy0dzbnditXgw5rVBTuIC1oltNuAdsol+lOBbZLS2ZE6rDCeAq82AYu3EsdVBiHsZMocEjgg45xxd8+0tzaVZjevQWo9gkIqMesHEYgUGiwFZF4747AILemSwKz+X6HD78fs= joe@acme.com
  refresh-threshold: 10d
  ttl: 15d
  valid-principals:
    - joe
  cert-type: user
  key-id: joe
  critical-options:
    - force-command
  extensions:
    - permit-X11-forwarding
    - permit-agent-forwarding
    - permit-pty
auto-acme-cert:
  acme-service: pebble
  refresh-threshold: 30d
  names:
    - foo.site.test
  wait: 1m
allow-image-access:
  - "*"
allow-application-access:
  - popcorn-controller.popcorn-controller-service.kettle-popper-manager
allow-tenant-access:
  - acme
ttl: 4h

Retrieve the configuration of a vault secret

Versioned secrets within a vault. Each entry holds the current and historical secret data and metadata.

SecurityaccessToken

Request

path Parameters

vault-name required	string <name> ^[a-z0-9]([a-z0-9\-]*[a-z0-9])?$ Unique name of this vault within the tenant.
vault-secret-name required	string <name> ^[a-z0-9]([a-z0-9\-]*[a-z0-9])?$ Name of the vault secret.

query Parameters

fields	string Retrieve only requested fields from the resource See section fields
where	string Retrieve only items matching the given expression. See section where
validate	string <enumeration> Validate the request but do not actually perform the requested operation Value: "true"
version-list	string <enumeration> Retrieve list of old versions Value: "true"
version	string Retrieve requested old version of the resource

Responses

200

400

Bad Request

401

Unauthorized

403

Forbidden

404

Not Found

412

Precondition Failed

503

Service Unavailable (strongbox sealed)

get/v1/config/strongbox/vaults/{vault-name}/secrets/{vault-secret-name}

Response samples

name: credentials
base64-data:
  xx: eXk=
  yy: aGVg
data:
  password: reallysecret
  user: admin
auto-cert:
  issuing-ca: root
  refresh-threshold: 10d
  ttl: 20d
  align-to-midnight: true
  truncate-ttl: false
  host: www.server.com
  public-key: |
    -----BEGIN PUBLIC KEY-----
    MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAECMA6yO9x3I3qSjbEZ7nWlAFF/aiA
    puUfIlWEHcTwgiFvCdvV4rnXzdoSxZh5B6oK6KEDA4hqCV9Re8bIQ8VLlA==
    -----END PUBLIC KEY-----
  cert-type: server
  alt-name:
    - type: DNSName
      value: www.server.com
  server-ext-usage: true
  client-ext-usage: true
  code-signing-ext-usage: true
  full-authority-key-identifier: false
  serial-prefix: fe:ed:ba:be
auto-ssh-cert:
  issuing-ca: root
  issuing-role: admin
  public-key: ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAstFt4AUzsP1iEC9a4tO2G3ISbTSSthvUvWYoq0yWy0dzbnditXgw5rVBTuIC1oltNuAdsol+lOBbZLS2ZE6rDCeAq82AYu3EsdVBiHsZMocEjgg45xxd8+0tzaVZjevQWo9gkIqMesHEYgUGiwFZF4747AILemSwKz+X6HD78fs= joe@acme.com
  refresh-threshold: 10d
  ttl: 15d
  valid-principals:
    - joe
  cert-type: user
  key-id: joe
  critical-options:
    - force-command
  extensions:
    - permit-X11-forwarding
    - permit-agent-forwarding
    - permit-pty
auto-acme-cert:
  acme-service: pebble
  refresh-threshold: 30d
  names:
    - foo.site.test
  wait: 1m
allow-image-access:
  - "*"
allow-application-access:
  - popcorn-controller.popcorn-controller-service.kettle-popper-manager
allow-tenant-access:
  - acme
ttl: 4h

Retrieve the state of all vaults

Vaults storing versioned key/value secrets with optional metadata, retention policies, and access controls.

SecurityaccessToken

Request

query Parameters

fields	string Retrieve only requested fields from the resource See section fields
where	string Retrieve only items matching the given expression. See section where
site	string Send the request to the specfifed site
content	string <enumeration> Filter descendant nodes in the response Enum: "config" "nonconfig"
keys	string <enumeration> Retrieve only the keys for the list Value: "true"
count	string <enumeration> Retrieve only the number of elements in the list Value: "true"

Responses

200

400

Bad Request

401

Unauthorized

403

Forbidden

404

Not Found

503

Service Unavailable (strongbox sealed)

get/v1/state/strongbox/vaults

Response samples

- name: some-vault
  max-versions: 1
  cas-required: false
  delete-version-after: 0s
  distribute:
    sites:
      - stockholm-sergel
      - gotenburg-bergakungen
  distribution-status:
    sites:
      - stockholm-sergel
      - gotenburg-bergakungen

Retrieve the state of a vault

Vaults storing versioned key/value secrets with optional metadata, retention policies, and access controls.

SecurityaccessToken

Request

path Parameters

vault-name

required

string <name> ^[a-z0-9]([a-z0-9\-]*[a-z0-9])?$

Unique name of this vault within the tenant.

query Parameters

fields	string Retrieve only requested fields from the resource See section fields
where	string Retrieve only items matching the given expression. See section where
site	string Send the request to the specfifed site
content	string <enumeration> Filter descendant nodes in the response Enum: "config" "nonconfig"

Responses

200

400

Bad Request

401

Unauthorized

403

Forbidden

404

Not Found

503

Service Unavailable (strongbox sealed)

get/v1/state/strongbox/vaults/{vault-name}

Response samples

name: some-vault
max-versions: 1
cas-required: false
delete-version-after: 0s
distribute:
  sites:
    - stockholm-sergel
    - gotenburg-bergakungen
distribution-status:
  sites:
    - stockholm-sergel
    - gotenburg-bergakungen

Retrieve the state of all vault secrets

Versioned secrets within a vault. Each entry holds the current and historical secret data and metadata.

SecurityaccessToken

Request

path Parameters

vault-name

required

string <name> ^[a-z0-9]([a-z0-9\-]*[a-z0-9])?$

Unique name of this vault within the tenant.

query Parameters

fields	string Retrieve only requested fields from the resource See section fields
where	string Retrieve only items matching the given expression. See section where
site	string Send the request to the specfifed site
content	string <enumeration> Filter descendant nodes in the response Enum: "config" "nonconfig"
keys	string <enumeration> Retrieve only the keys for the list Value: "true"
count	string <enumeration> Retrieve only the number of elements in the list Value: "true"

Responses

200

400

Bad Request

401

Unauthorized

403

Forbidden

404

Not Found

503

Service Unavailable (strongbox sealed)

get/v1/state/strongbox/vaults/{vault-name}/secrets

Response samples

- name: credentials
  base64-data:
    xx: eXk=
    yy: aGVg
  data:
    password: reallysecret
    user: admin
  auto-cert:
    issuing-ca: root
    refresh-threshold: 10d
    ttl: 20d
    align-to-midnight: true
    truncate-ttl: false
    host: www.server.com
    public-key: |
      -----BEGIN PUBLIC KEY-----
      MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAECMA6yO9x3I3qSjbEZ7nWlAFF/aiA
      puUfIlWEHcTwgiFvCdvV4rnXzdoSxZh5B6oK6KEDA4hqCV9Re8bIQ8VLlA==
      -----END PUBLIC KEY-----
    cert-type: server
    alt-name:
      - type: DNSName
        value: www.server.com
    server-ext-usage: true
    client-ext-usage: true
    code-signing-ext-usage: true
    full-authority-key-identifier: false
    serial-prefix: fe:ed:ba:be
  cert:
    cert.pem: |
      -----BEGIN CERTIFICATE-----
      MIICeTCCAiCgAwIBAgITAJoov8FFieL9BHIIv+WenC4f8jAKBggqhkjOPQQDAjBa
      MQ8wDQYDVQQDEwZBdmFzc2ExEjAQBgNVBAcTCVN0b2NraG9sbTELMAkGA1UEBhMC
      U0UxDzANBgNVBAoTBkF2YXNzYTEVMBMGA1UECxMMZGlzdHJpYnV0aW9uMCIYDzIw
      MjIwMTEyMTEwMzM2WhgPMjAyMjAyMDExNTUxMzZaMGIxFzAVBgNVBAMTDnd3dy5z
      ZXJ2ZXIuY29tMRIwEAYDVQQHEwlTdG9ja2hvbG0xCzAJBgNVBAYTAlNFMQ8wDQYD
      VQQKEwZBdmFzc2ExFTATBgNVBAsTDGRpc3RyaWJ1dGlvbjBZMBMGByqGSM49AgEG
      CCqGSM49AwEHA0IABGVqGAt14O1helv02eAi3510lAoMNnyQCYl+fj+AI0aj2OqJ
      2pfACv+1D/8SS0EeBNOpuyK31wJUBMAvfbNVsMWjgbgwgbUwfQYDVR0jBHYwdKFe
      pFwwWjEPMA0GA1UEAxMGQXZhc3NhMRIwEAYDVQQHEwlTdG9ja2hvbG0xCzAJBgNV
      BAYTAlNFMQ8wDQYDVQQKEwZBdmFzc2ExFTATBgNVBAsTDGRpc3RyaWJ1dGlvboIS
      LL8LSoDJCZYPbe4M+XG6StKZMBkGA1UdEQQSMBCCDnd3dy5zZXJ2ZXIuY29tMAsG
      A1UdDwQEAwIDiDAMBgNVHRMBAf8EAjAAMAoGCCqGSM49BAMCA0cAMEQCIAqAfJK+
      8Duk8Qrj55YwkuRyt97Cv4/bbIpRwaNJxafIAiAn7GO/fkOjhWZCYfB8yx92Kl3Y
      Tl0y+hIVaLkKoXuMhg==
      -----END CERTIFICATE-----
    cert.key: |
      -----BEGIN EC PRIVATE KEY-----
      MHcCAQEEIOtZk70H7MTVQOPOJFQPVzM0Kjc0B8wXj7OtrjtyBYVLoAoGCCqGSM49
      AwEHoUQDQgAEZWoYC3Xg7WF6W/TZ4CLfnXSUCgw2fJAJiX5+P4AjRqPY6onal8AK
      /7UP/xJLQR4E06m7IrfXAlQEwC99s1WwxQ==
      -----END EC PRIVATE KEY-----
    ca-cert.pem: |
      -----BEGIN CERTIFICATE-----
      MIICAzCCAaqgAwIBAgISLL8LSoDJCZYPbe4M+XG6StKZMAoGCCqGSM49BAMCMFox
      DzANBgNVBAMTBkF2YXNzYTESMBAGA1UEBxMJU3RvY2tob2xtMQswCQYDVQQGEwJT
      RTEPMA0GA1UEChMGQXZhc3NhMRUwEwYDVQQLEwxkaXN0cmlidXRpb24wIhgPMjAy
      MjAxMDkwMDEzMDZaGA8yMDIzMDExMjE1NDkwNlowWjEPMA0GA1UEAxMGQXZhc3Nh
      MRIwEAYDVQQHEwlTdG9ja2hvbG0xCzAJBgNVBAYTAlNFMQ8wDQYDVQQKEwZBdmFz
      c2ExFTATBgNVBAsTDGRpc3RyaWJ1dGlvbjBZMBMGByqGSM49AgEGCCqGSM49AwEH
      A0IABAjAOsjvcdyN6ko2xGe51pQBRf2ogKblHyJVhB3E8IIhbwnb1eK5183aEsWY
      eQeqCuihAwOIaglfUXvGyEPFS5SjTDBKMA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMB
      Af8EBTADAQH/MCcGA1UdHwQgMB4wHKAaoBiGFmh0dHA6Ly9jcmwuYXZhc3NhLm5l
      dC8wCgYIKoZIzj0EAwIDRwAwRAIgGMkKpCKX1zpsdKY7SuB2sPvM1i1eAJtR10PE
      /x29sRsCIF/jigjXX52APfotfWAhRmcd3Cp1D1/oKai03cnSM/K8
      -----END CERTIFICATE-----
  auto-ssh-cert:
    issuing-ca: root
    issuing-role: admin
    public-key: ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAstFt4AUzsP1iEC9a4tO2G3ISbTSSthvUvWYoq0yWy0dzbnditXgw5rVBTuIC1oltNuAdsol+lOBbZLS2ZE6rDCeAq82AYu3EsdVBiHsZMocEjgg45xxd8+0tzaVZjevQWo9gkIqMesHEYgUGiwFZF4747AILemSwKz+X6HD78fs= joe@acme.com
    refresh-threshold: 10d
    ttl: 15d
    valid-principals:
      - joe
    cert-type: user
    key-id: joe
    critical-options:
      - force-command
    extensions:
      - permit-X11-forwarding
      - permit-agent-forwarding
      - permit-pty
  auto-acme-cert:
    acme-service: pebble
    refresh-threshold: 30d
    names:
      - foo.site.test
    wait: 1m
  dict:
    xx: eXk=
    cert.pem: |
      -----BEGIN CERTIFICATE-----
      MIICeTCCAiCgAwIBAgITAJoov8FFieL9BHIIv+WenC4f8jAKBggqhkjOPQQDAjBa
      MQ8wDQYDVQQDEwZBdmFzc2ExEjAQBgNVBAcTCVN0b2NraG9sbTELMAkGA1UEBhMC
      U0UxDzANBgNVBAoTBkF2YXNzYTEVMBMGA1UECxMMZGlzdHJpYnV0aW9uMCIYDzIw
      MjIwMTEyMTEwMzM2WhgPMjAyMjAyMDExNTUxMzZaMGIxFzAVBgNVBAMTDnd3dy5z
      ZXJ2ZXIuY29tMRIwEAYDVQQHEwlTdG9ja2hvbG0xCzAJBgNVBAYTAlNFMQ8wDQYD
      VQQKEwZBdmFzc2ExFTATBgNVBAsTDGRpc3RyaWJ1dGlvbjBZMBMGByqGSM49AgEG
      CCqGSM49AwEHA0IABGVqGAt14O1helv02eAi3510lAoMNnyQCYl+fj+AI0aj2OqJ
      2pfACv+1D/8SS0EeBNOpuyK31wJUBMAvfbNVsMWjgbgwgbUwfQYDVR0jBHYwdKFe
      pFwwWjEPMA0GA1UEAxMGQXZhc3NhMRIwEAYDVQQHEwlTdG9ja2hvbG0xCzAJBgNV
      BAYTAlNFMQ8wDQYDVQQKEwZBdmFzc2ExFTATBgNVBAsTDGRpc3RyaWJ1dGlvboIS
      LL8LSoDJCZYPbe4M+XG6StKZMBkGA1UdEQQSMBCCDnd3dy5zZXJ2ZXIuY29tMAsG
      A1UdDwQEAwIDiDAMBgNVHRMBAf8EAjAAMAoGCCqGSM49BAMCA0cAMEQCIAqAfJK+
      8Duk8Qrj55YwkuRyt97Cv4/bbIpRwaNJxafIAiAn7GO/fkOjhWZCYfB8yx92Kl3Y
      Tl0y+hIVaLkKoXuMhg==
      -----END CERTIFICATE-----
    cert.key: |
      -----BEGIN EC PRIVATE KEY-----
      MHcCAQEEIOtZk70H7MTVQOPOJFQPVzM0Kjc0B8wXj7OtrjtyBYVLoAoGCCqGSM49
      AwEHoUQDQgAEZWoYC3Xg7WF6W/TZ4CLfnXSUCgw2fJAJiX5+P4AjRqPY6onal8AK
      /7UP/xJLQR4E06m7IrfXAlQEwC99s1WwxQ==
      -----END EC PRIVATE KEY-----
    ca-cert.pem: |
      -----BEGIN CERTIFICATE-----
      MIICAzCCAaqgAwIBAgISLL8LSoDJCZYPbe4M+XG6StKZMAoGCCqGSM49BAMCMFox
      DzANBgNVBAMTBkF2YXNzYTESMBAGA1UEBxMJU3RvY2tob2xtMQswCQYDVQQGEwJT
      RTEPMA0GA1UEChMGQXZhc3NhMRUwEwYDVQQLEwxkaXN0cmlidXRpb24wIhgPMjAy
      MjAxMDkwMDEzMDZaGA8yMDIzMDExMjE1NDkwNlowWjEPMA0GA1UEAxMGQXZhc3Nh
      MRIwEAYDVQQHEwlTdG9ja2hvbG0xCzAJBgNVBAYTAlNFMQ8wDQYDVQQKEwZBdmFz
      c2ExFTATBgNVBAsTDGRpc3RyaWJ1dGlvbjBZMBMGByqGSM49AgEGCCqGSM49AwEH
      A0IABAjAOsjvcdyN6ko2xGe51pQBRf2ogKblHyJVhB3E8IIhbwnb1eK5183aEsWY
      eQeqCuihAwOIaglfUXvGyEPFS5SjTDBKMA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMB
      Af8EBTADAQH/MCcGA1UdHwQgMB4wHKAaoBiGFmh0dHA6Ly9jcmwuYXZhc3NhLm5l
      dC8wCgYIKoZIzj0EAwIDRwAwRAIgGMkKpCKX1zpsdKY7SuB2sPvM1i1eAJtR10PE
      /x29sRsCIF/jigjXX52APfotfWAhRmcd3Cp1D1/oKai03cnSM/K8
      -----END CERTIFICATE-----
    password: reallysecret
    yy: aGVg
    user: admin
  allow-image-access:
    - "*"
  allow-application-access:
    - popcorn-controller.popcorn-controller-service.kettle-popper-manager
  allow-tenant-access:
    - acme
  creation-time: 2022-01-12T14:56:10.018462Z
  deletion-time: 2022-01-12T14:56:10.018462Z
  destroyed: false
  cert-refresh-time: 2022-01-13T01:51:34.308328Z
  version: 1
  metadata:
    current-version: 1
    modified-time: 2022-01-12T14:56:10.018463Z
    creation-time: 2022-01-12T14:56:10.018462Z
    oldest-version: 1
  ttl: 4h
  error: tls CA does not exist

Retrieve the state of a vault secret

Versioned secrets within a vault. Each entry holds the current and historical secret data and metadata.

SecurityaccessToken

Request

path Parameters

vault-name required	string <name> ^[a-z0-9]([a-z0-9\-]*[a-z0-9])?$ Unique name of this vault within the tenant.
vault-secret-name required	string <name> ^[a-z0-9]([a-z0-9\-]*[a-z0-9])?$ Name of the vault secret.

query Parameters

fields	string Retrieve only requested fields from the resource See section fields
where	string Retrieve only items matching the given expression. See section where
site	string Send the request to the specfifed site
content	string <enumeration> Filter descendant nodes in the response Enum: "config" "nonconfig"

Responses

200

400

Bad Request

401

Unauthorized

403

Forbidden

404

Not Found

503

Service Unavailable (strongbox sealed)

get/v1/state/strongbox/vaults/{vault-name}/secrets/{vault-secret-name}

Response samples

name: credentials
base64-data:
  xx: eXk=
  yy: aGVg
data:
  password: reallysecret
  user: admin
auto-cert:
  issuing-ca: root
  refresh-threshold: 10d
  ttl: 20d
  align-to-midnight: true
  truncate-ttl: false
  host: www.server.com
  public-key: |
    -----BEGIN PUBLIC KEY-----
    MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAECMA6yO9x3I3qSjbEZ7nWlAFF/aiA
    puUfIlWEHcTwgiFvCdvV4rnXzdoSxZh5B6oK6KEDA4hqCV9Re8bIQ8VLlA==
    -----END PUBLIC KEY-----
  cert-type: server
  alt-name:
    - type: DNSName
      value: www.server.com
  server-ext-usage: true
  client-ext-usage: true
  code-signing-ext-usage: true
  full-authority-key-identifier: false
  serial-prefix: fe:ed:ba:be
cert:
  cert.pem: |
    -----BEGIN CERTIFICATE-----
    MIICeTCCAiCgAwIBAgITAJoov8FFieL9BHIIv+WenC4f8jAKBggqhkjOPQQDAjBa
    MQ8wDQYDVQQDEwZBdmFzc2ExEjAQBgNVBAcTCVN0b2NraG9sbTELMAkGA1UEBhMC
    U0UxDzANBgNVBAoTBkF2YXNzYTEVMBMGA1UECxMMZGlzdHJpYnV0aW9uMCIYDzIw
    MjIwMTEyMTEwMzM2WhgPMjAyMjAyMDExNTUxMzZaMGIxFzAVBgNVBAMTDnd3dy5z
    ZXJ2ZXIuY29tMRIwEAYDVQQHEwlTdG9ja2hvbG0xCzAJBgNVBAYTAlNFMQ8wDQYD
    VQQKEwZBdmFzc2ExFTATBgNVBAsTDGRpc3RyaWJ1dGlvbjBZMBMGByqGSM49AgEG
    CCqGSM49AwEHA0IABGVqGAt14O1helv02eAi3510lAoMNnyQCYl+fj+AI0aj2OqJ
    2pfACv+1D/8SS0EeBNOpuyK31wJUBMAvfbNVsMWjgbgwgbUwfQYDVR0jBHYwdKFe
    pFwwWjEPMA0GA1UEAxMGQXZhc3NhMRIwEAYDVQQHEwlTdG9ja2hvbG0xCzAJBgNV
    BAYTAlNFMQ8wDQYDVQQKEwZBdmFzc2ExFTATBgNVBAsTDGRpc3RyaWJ1dGlvboIS
    LL8LSoDJCZYPbe4M+XG6StKZMBkGA1UdEQQSMBCCDnd3dy5zZXJ2ZXIuY29tMAsG
    A1UdDwQEAwIDiDAMBgNVHRMBAf8EAjAAMAoGCCqGSM49BAMCA0cAMEQCIAqAfJK+
    8Duk8Qrj55YwkuRyt97Cv4/bbIpRwaNJxafIAiAn7GO/fkOjhWZCYfB8yx92Kl3Y
    Tl0y+hIVaLkKoXuMhg==
    -----END CERTIFICATE-----
  cert.key: |
    -----BEGIN EC PRIVATE KEY-----
    MHcCAQEEIOtZk70H7MTVQOPOJFQPVzM0Kjc0B8wXj7OtrjtyBYVLoAoGCCqGSM49
    AwEHoUQDQgAEZWoYC3Xg7WF6W/TZ4CLfnXSUCgw2fJAJiX5+P4AjRqPY6onal8AK
    /7UP/xJLQR4E06m7IrfXAlQEwC99s1WwxQ==
    -----END EC PRIVATE KEY-----
  ca-cert.pem: |
    -----BEGIN CERTIFICATE-----
    MIICAzCCAaqgAwIBAgISLL8LSoDJCZYPbe4M+XG6StKZMAoGCCqGSM49BAMCMFox
    DzANBgNVBAMTBkF2YXNzYTESMBAGA1UEBxMJU3RvY2tob2xtMQswCQYDVQQGEwJT
    RTEPMA0GA1UEChMGQXZhc3NhMRUwEwYDVQQLEwxkaXN0cmlidXRpb24wIhgPMjAy
    MjAxMDkwMDEzMDZaGA8yMDIzMDExMjE1NDkwNlowWjEPMA0GA1UEAxMGQXZhc3Nh
    MRIwEAYDVQQHEwlTdG9ja2hvbG0xCzAJBgNVBAYTAlNFMQ8wDQYDVQQKEwZBdmFz
    c2ExFTATBgNVBAsTDGRpc3RyaWJ1dGlvbjBZMBMGByqGSM49AgEGCCqGSM49AwEH
    A0IABAjAOsjvcdyN6ko2xGe51pQBRf2ogKblHyJVhB3E8IIhbwnb1eK5183aEsWY
    eQeqCuihAwOIaglfUXvGyEPFS5SjTDBKMA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMB
    Af8EBTADAQH/MCcGA1UdHwQgMB4wHKAaoBiGFmh0dHA6Ly9jcmwuYXZhc3NhLm5l
    dC8wCgYIKoZIzj0EAwIDRwAwRAIgGMkKpCKX1zpsdKY7SuB2sPvM1i1eAJtR10PE
    /x29sRsCIF/jigjXX52APfotfWAhRmcd3Cp1D1/oKai03cnSM/K8
    -----END CERTIFICATE-----
auto-ssh-cert:
  issuing-ca: root
  issuing-role: admin
  public-key: ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAstFt4AUzsP1iEC9a4tO2G3ISbTSSthvUvWYoq0yWy0dzbnditXgw5rVBTuIC1oltNuAdsol+lOBbZLS2ZE6rDCeAq82AYu3EsdVBiHsZMocEjgg45xxd8+0tzaVZjevQWo9gkIqMesHEYgUGiwFZF4747AILemSwKz+X6HD78fs= joe@acme.com
  refresh-threshold: 10d
  ttl: 15d
  valid-principals:
    - joe
  cert-type: user
  key-id: joe
  critical-options:
    - force-command
  extensions:
    - permit-X11-forwarding
    - permit-agent-forwarding
    - permit-pty
auto-acme-cert:
  acme-service: pebble
  refresh-threshold: 30d
  names:
    - foo.site.test
  wait: 1m
dict:
  xx: eXk=
  cert.pem: |
    -----BEGIN CERTIFICATE-----
    MIICeTCCAiCgAwIBAgITAJoov8FFieL9BHIIv+WenC4f8jAKBggqhkjOPQQDAjBa
    MQ8wDQYDVQQDEwZBdmFzc2ExEjAQBgNVBAcTCVN0b2NraG9sbTELMAkGA1UEBhMC
    U0UxDzANBgNVBAoTBkF2YXNzYTEVMBMGA1UECxMMZGlzdHJpYnV0aW9uMCIYDzIw
    MjIwMTEyMTEwMzM2WhgPMjAyMjAyMDExNTUxMzZaMGIxFzAVBgNVBAMTDnd3dy5z
    ZXJ2ZXIuY29tMRIwEAYDVQQHEwlTdG9ja2hvbG0xCzAJBgNVBAYTAlNFMQ8wDQYD
    VQQKEwZBdmFzc2ExFTATBgNVBAsTDGRpc3RyaWJ1dGlvbjBZMBMGByqGSM49AgEG
    CCqGSM49AwEHA0IABGVqGAt14O1helv02eAi3510lAoMNnyQCYl+fj+AI0aj2OqJ
    2pfACv+1D/8SS0EeBNOpuyK31wJUBMAvfbNVsMWjgbgwgbUwfQYDVR0jBHYwdKFe
    pFwwWjEPMA0GA1UEAxMGQXZhc3NhMRIwEAYDVQQHEwlTdG9ja2hvbG0xCzAJBgNV
    BAYTAlNFMQ8wDQYDVQQKEwZBdmFzc2ExFTATBgNVBAsTDGRpc3RyaWJ1dGlvboIS
    LL8LSoDJCZYPbe4M+XG6StKZMBkGA1UdEQQSMBCCDnd3dy5zZXJ2ZXIuY29tMAsG
    A1UdDwQEAwIDiDAMBgNVHRMBAf8EAjAAMAoGCCqGSM49BAMCA0cAMEQCIAqAfJK+
    8Duk8Qrj55YwkuRyt97Cv4/bbIpRwaNJxafIAiAn7GO/fkOjhWZCYfB8yx92Kl3Y
    Tl0y+hIVaLkKoXuMhg==
    -----END CERTIFICATE-----
  cert.key: |
    -----BEGIN EC PRIVATE KEY-----
    MHcCAQEEIOtZk70H7MTVQOPOJFQPVzM0Kjc0B8wXj7OtrjtyBYVLoAoGCCqGSM49
    AwEHoUQDQgAEZWoYC3Xg7WF6W/TZ4CLfnXSUCgw2fJAJiX5+P4AjRqPY6onal8AK
    /7UP/xJLQR4E06m7IrfXAlQEwC99s1WwxQ==
    -----END EC PRIVATE KEY-----
  ca-cert.pem: |
    -----BEGIN CERTIFICATE-----
    MIICAzCCAaqgAwIBAgISLL8LSoDJCZYPbe4M+XG6StKZMAoGCCqGSM49BAMCMFox
    DzANBgNVBAMTBkF2YXNzYTESMBAGA1UEBxMJU3RvY2tob2xtMQswCQYDVQQGEwJT
    RTEPMA0GA1UEChMGQXZhc3NhMRUwEwYDVQQLEwxkaXN0cmlidXRpb24wIhgPMjAy
    MjAxMDkwMDEzMDZaGA8yMDIzMDExMjE1NDkwNlowWjEPMA0GA1UEAxMGQXZhc3Nh
    MRIwEAYDVQQHEwlTdG9ja2hvbG0xCzAJBgNVBAYTAlNFMQ8wDQYDVQQKEwZBdmFz
    c2ExFTATBgNVBAsTDGRpc3RyaWJ1dGlvbjBZMBMGByqGSM49AgEGCCqGSM49AwEH
    A0IABAjAOsjvcdyN6ko2xGe51pQBRf2ogKblHyJVhB3E8IIhbwnb1eK5183aEsWY
    eQeqCuihAwOIaglfUXvGyEPFS5SjTDBKMA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMB
    Af8EBTADAQH/MCcGA1UdHwQgMB4wHKAaoBiGFmh0dHA6Ly9jcmwuYXZhc3NhLm5l
    dC8wCgYIKoZIzj0EAwIDRwAwRAIgGMkKpCKX1zpsdKY7SuB2sPvM1i1eAJtR10PE
    /x29sRsCIF/jigjXX52APfotfWAhRmcd3Cp1D1/oKai03cnSM/K8
    -----END CERTIFICATE-----
  password: reallysecret
  yy: aGVg
  user: admin
allow-image-access:
  - "*"
allow-application-access:
  - popcorn-controller.popcorn-controller-service.kettle-popper-manager
allow-tenant-access:
  - acme
creation-time: 2022-01-12T14:56:10.018462Z
deletion-time: 2022-01-12T14:56:10.018462Z
destroyed: false
cert-refresh-time: 2022-01-13T01:51:34.308328Z
version: 1
metadata:
  current-version: 1
  modified-time: 2022-01-12T14:56:10.018463Z
  creation-time: 2022-01-12T14:56:10.018462Z
  oldest-version: 1
ttl: 4h
error: tls CA does not exist

Invoke the delete operation

Deletes one or more versions of a secret. The version can later be un-deleted using the undelete operation.

SecurityaccessToken

Request

path Parameters

vault-name required	string <name> ^[a-z0-9]([a-z0-9\-]*[a-z0-9])?$ Unique name of this vault within the tenant.
vault-secret-name required	string <name> ^[a-z0-9]([a-z0-9\-]*[a-z0-9])?$ Name of the vault secret.

Request Body schema:
application/yaml

versions

Array of integers <uint32>

If not present, soft-delete the latest version.

Responses

204

No Content

400

Bad Request

401

Unauthorized

403

Forbidden

404

Not Found

503

Service Unavailable (strongbox sealed)

post/v1/state/strongbox/vaults/{vault-name}/secrets/{vault-secret-name}/delete

Request samples

Payload

versions:
  - 1

Invoke the destroy operation

Completely removes one or more versions of a secret. When the last version is removed, the entire secret is removed.

SecurityaccessToken

Request

path Parameters

vault-name required	string <name> ^[a-z0-9]([a-z0-9\-]*[a-z0-9])?$ Unique name of this vault within the tenant.
vault-secret-name required	string <name> ^[a-z0-9]([a-z0-9\-]*[a-z0-9])?$ Name of the vault secret.

Request Body schema:
application/yaml

One of:

versions

Array of integers <uint32>

If not present, destroy the entire map.

Responses

204

No Content

400

Bad Request

401

Unauthorized

403

Forbidden

404

Not Found

503

Service Unavailable (strongbox sealed)

post/v1/state/strongbox/vaults/{vault-name}/secrets/{vault-secret-name}/destroy

Request samples

Payload

versions:
  - 1

Invoke the undelete operation

Restores one or more versions of a secret.

SecurityaccessToken

Request

path Parameters

vault-name required	string <name> ^[a-z0-9]([a-z0-9\-]*[a-z0-9])?$ Unique name of this vault within the tenant.
vault-secret-name required	string <name> ^[a-z0-9]([a-z0-9\-]*[a-z0-9])?$ Name of the vault secret.

Request Body schema:
application/yaml

versions

Array of integers <uint32>

If not present, undelete the latest version.

Responses

204

No Content

400

Bad Request

401

Unauthorized

403

Forbidden

404

Not Found

503

Service Unavailable (strongbox sealed)

post/v1/state/strongbox/vaults/{vault-name}/secrets/{vault-secret-name}/undelete

Request samples

Payload

versions:
  - 1

➔ Next to Wrapped data

Vault

Create a new vault

query Parameters

Request Body schema: application/yamlapplication/jsonapplication/yaml

Retrieve the configuration of all vaults

query Parameters

Update a vault

path Parameters

query Parameters

Request Body schema: application/yamlapplication/jsonapplication/yaml

Delete a vault

path Parameters

query Parameters

Replace or create a new vault

path Parameters

query Parameters

Request Body schema: application/yamlapplication/jsonapplication/yaml

Retrieve the configuration of a vault

path Parameters

query Parameters

Create a new vault secret

path Parameters

query Parameters

Request Body schema: application/yamlapplication/jsonapplication/yaml

Retrieve the configuration of all vault secrets

path Parameters

query Parameters

Update a vault secret

path Parameters

query Parameters

Request Body schema: application/yamlapplication/jsonapplication/yaml

Delete a vault secret

path Parameters

query Parameters

Replace or create a new vault secret

path Parameters

query Parameters

Request Body schema: application/yamlapplication/jsonapplication/yaml

Retrieve the configuration of a vault secret

path Parameters

query Parameters

Retrieve the state of all vaults

query Parameters

Retrieve the state of a vault

path Parameters

query Parameters

Retrieve the state of all vault secrets

path Parameters

query Parameters

Retrieve the state of a vault secret

path Parameters

query Parameters

Invoke the delete operation

path Parameters

Request Body schema: application/yamlapplication/jsonapplication/yaml

Invoke the destroy operation

path Parameters

Request Body schema: application/yamlapplication/jsonapplication/yaml

Invoke the undelete operation

path Parameters

Request Body schema: application/yamlapplication/jsonapplication/yaml

Request Body schema:
application/yaml

Request Body schema:
application/yaml

Request Body schema:
application/yaml

Request Body schema:
application/yaml

Request Body schema:
application/yaml

Request Body schema:
application/yaml

Request Body schema:
application/yaml

Request Body schema:
application/yaml

Request Body schema:
application/yaml