mirror of
https://github.com/hashicorp/vault.git
synced 2025-12-17 07:21:18 +01:00
Implement MDX Remote (#10581)
* implement mdx remote * fix an unfenced code block * fix partials path Co-authored-by: Jim Kalafut <jkalafut@hashicorp.com>
This commit is contained in:
parent
c019849e98
commit
179df992c0
@ -1,4 +0,0 @@
|
|||||||
module.exports = {
|
|
||||||
presets: ['next/babel'],
|
|
||||||
plugins: ['import-glob-array']
|
|
||||||
}
|
|
||||||
@ -1,27 +0,0 @@
|
|||||||
# Enterprise Alert Component
|
|
||||||
|
|
||||||
This component is an easy way to mark some content as only applicable to the enterprise version of vault. It can be used in any documentation pages in a variety of ways. The basic implementation is written as such, on its own line within a markdown file:
|
|
||||||
|
|
||||||
```jsx
|
|
||||||
<EnterpriseAlert />
|
|
||||||
```
|
|
||||||
|
|
||||||
And renders [like this](https://p176.p0.n0.cdn.getcloudapp.com/items/geuWOzkz/Screen%20Shot%202020-05-08%20at%204.17.34%20PM.png?v=2ace1c70f48cf1bbdd17f9ce96684453)
|
|
||||||
|
|
||||||
The default text can also be replaced with custom text as such:
|
|
||||||
|
|
||||||
```jsx
|
|
||||||
<EnterpriseAlert>
|
|
||||||
Custom text <a href="">with a link</a>
|
|
||||||
</EnterpriseAlert>
|
|
||||||
```
|
|
||||||
|
|
||||||
Which renders [as such](https://p176.p0.n0.cdn.getcloudapp.com/items/v1uDE2vQ/Screen%20Shot%202020-05-08%20at%204.18.22%20PM.png?v=3a45268830fac868be50047060bb4303)
|
|
||||||
|
|
||||||
Finally, it can be rendered inline as a "tag" to mark a section or option as enterprise only by adding the `inline` attribute:
|
|
||||||
|
|
||||||
```jsx
|
|
||||||
<EnterpriseAlert inline>
|
|
||||||
```
|
|
||||||
|
|
||||||
This is typically used after a list item, or after a headline. It renders [as such](https://p176.p0.n0.cdn.getcloudapp.com/items/KouqnrOm/Screen%20Shot%202020-05-08%20at%204.16.34%20PM.png?v=ac21328916aa98a1a853cde5989058bd)
|
|
||||||
@ -1,5 +0,0 @@
|
|||||||
import EnterpriseAlert from '@hashicorp/react-enterprise-alert'
|
|
||||||
|
|
||||||
export default function EnterpriseAlertConsul(props) {
|
|
||||||
return <EnterpriseAlert product="vault" {...props} />
|
|
||||||
}
|
|
||||||
@ -1,28 +0,0 @@
|
|||||||
import Search from '@hashicorp/react-search'
|
|
||||||
|
|
||||||
export default function SearchBar() {
|
|
||||||
return (
|
|
||||||
<Search
|
|
||||||
renderHitContent={({ hit, Highlight }) => (
|
|
||||||
<>
|
|
||||||
<span className="name">
|
|
||||||
<Highlight attribute="page_title" hit={hit} tagName="span" />
|
|
||||||
</span>
|
|
||||||
<span className="description">
|
|
||||||
<Highlight attribute="description" hit={hit} tagName="span" />
|
|
||||||
</span>
|
|
||||||
</>
|
|
||||||
)}
|
|
||||||
resolveHitLink={(hit) => ({
|
|
||||||
href: {
|
|
||||||
pathname: `/${transformIdtoUrl(hit.objectID)}`,
|
|
||||||
},
|
|
||||||
})}
|
|
||||||
placeholder="Search Vault documentation"
|
|
||||||
/>
|
|
||||||
)
|
|
||||||
}
|
|
||||||
|
|
||||||
function transformIdtoUrl(id) {
|
|
||||||
return id.replace(/\/index$/, '')
|
|
||||||
}
|
|
||||||
@ -1,4 +0,0 @@
|
|||||||
.g-search {
|
|
||||||
width: calc(100% - 2rem);
|
|
||||||
max-width: 600px;
|
|
||||||
}
|
|
||||||
@ -1,4 +1,4 @@
|
|||||||
@import '~@hashicorp/react-subnav/dist/style.css';
|
@import '~@hashicorp/react-subnav/style.css';
|
||||||
|
|
||||||
/* limit the inner width of the navigation to match the site layout */
|
/* limit the inner width of the navigation to match the site layout */
|
||||||
|
|
||||||
|
|||||||
@ -1,61 +0,0 @@
|
|||||||
# Tabs Component
|
|
||||||
|
|
||||||
> An MDX-compatible Tabs component
|
|
||||||
|
|
||||||
This React component renders tabbed content.
|
|
||||||
|
|
||||||
## Usage
|
|
||||||
|
|
||||||
- Use the `<Tabs>` tag in your markdown file to begin a tabbed content section.
|
|
||||||
- Use the `<Tab>` tag with a `heading` prop to separate your markdown
|
|
||||||
|
|
||||||
### Important
|
|
||||||
|
|
||||||
A line must be skipped between the `<Tab>` and your markdown (for both above and below said markdown). [This is a limitation of MDX also pointed out by the Docusaurus folks 🔗 ](https://v2.docusaurus.io/docs/markdown-features/#multi-language-support-code-blocks)
|
|
||||||
|
|
||||||
### Example
|
|
||||||
|
|
||||||
```mdx
|
|
||||||
<Tabs>
|
|
||||||
<Tab heading="CLI command">
|
|
||||||
<!-- Intentionally skipped line.. -->
|
|
||||||
### Content
|
|
||||||
<!-- Intentionally skipped line.. -->
|
|
||||||
</Tab>
|
|
||||||
<Tab heading="API call using cURL">
|
|
||||||
|
|
||||||
### Content
|
|
||||||
|
|
||||||
</Tab>
|
|
||||||
</Tabs>
|
|
||||||
```
|
|
||||||
|
|
||||||
### Component Props
|
|
||||||
|
|
||||||
`<Tabs>` can be provided any arbitrary `children` so long as the `heading` prop is present the React or HTML tag used to wrap markdown, that said, we provide the `<Tab>` component to separate your tab content without rendering extra, unnecessary markup.
|
|
||||||
|
|
||||||
This works:
|
|
||||||
|
|
||||||
```mdx
|
|
||||||
<Tabs>
|
|
||||||
<Tab heading="CLI command">
|
|
||||||
|
|
||||||
### Content
|
|
||||||
|
|
||||||
</Tab>
|
|
||||||
....
|
|
||||||
</Tabs>
|
|
||||||
```
|
|
||||||
|
|
||||||
This _does not_ work:
|
|
||||||
|
|
||||||
```mdx
|
|
||||||
<Tabs>
|
|
||||||
<Tab> <!-- missing the `heading` prop to provide a tab heading -->
|
|
||||||
|
|
||||||
### Content
|
|
||||||
|
|
||||||
</Tab>
|
|
||||||
....
|
|
||||||
</Tabs>
|
|
||||||
```
|
|
||||||
@ -1,17 +0,0 @@
|
|||||||
import ReactTabs from '@hashicorp/react-tabs'
|
|
||||||
|
|
||||||
export default function Tabs({ children }) {
|
|
||||||
return (
|
|
||||||
<ReactTabs
|
|
||||||
items={children.map((Block) => ({
|
|
||||||
heading: Block.props.heading,
|
|
||||||
// eslint-disable-next-line react/display-name
|
|
||||||
tabChildren: () => Block,
|
|
||||||
}))}
|
|
||||||
/>
|
|
||||||
)
|
|
||||||
}
|
|
||||||
|
|
||||||
export function Tab({ children }) {
|
|
||||||
return <>{children}</>
|
|
||||||
}
|
|
||||||
@ -1,8 +0,0 @@
|
|||||||
/* This is a CSS overwrite on top of the existing component styles to accommodate the Learn layout */
|
|
||||||
.g-tabs {
|
|
||||||
& .g-grid-container,
|
|
||||||
& > .g-grid-container {
|
|
||||||
padding-left: 0;
|
|
||||||
padding-right: 0;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@ -29,7 +29,7 @@ will be able to perform the login operation.
|
|||||||
- `role` `(string: <required>)` - Name of the role. Must correspond with the name of the role reflected in the arn.
|
- `role` `(string: <required>)` - Name of the role. Must correspond with the name of the role reflected in the arn.
|
||||||
- `arn` `(string: <required>)` - The role's arn.
|
- `arn` `(string: <required>)` - The role's arn.
|
||||||
|
|
||||||
@include 'partials/tokenfields.mdx'
|
@include 'tokenfields.mdx'
|
||||||
|
|
||||||
### Sample Payload
|
### Sample Payload
|
||||||
|
|
||||||
@ -77,7 +77,7 @@ enabled while creating or updating a role.
|
|||||||
using this role will be cluster local. This can only be set during role
|
using this role will be cluster local. This can only be set during role
|
||||||
creation and once set, it can't be reset later.
|
creation and once set, it can't be reset later.
|
||||||
|
|
||||||
@include 'partials/tokenfields.mdx'
|
@include 'tokenfields.mdx'
|
||||||
|
|
||||||
### Sample Payload
|
### Sample Payload
|
||||||
|
|
||||||
@ -600,7 +600,7 @@ endpoint directly. The endpoints for each field is provided separately
|
|||||||
to be able to delegate specific endpoints using Vault's ACL system.
|
to be able to delegate specific endpoints using Vault's ACL system.
|
||||||
|
|
||||||
| Method | Path |
|
| Method | Path |
|
||||||
| :---------------- | :---------------------------------------------------- |
|
| :---------------- | :---------------------------------------------------- | --------- |
|
||||||
| `GET/POST/DELETE` | `/auth/approle/role/:role_name/policies` | `200/204` |
|
| `GET/POST/DELETE` | `/auth/approle/role/:role_name/policies` | `200/204` |
|
||||||
| `GET/POST/DELETE` | `/auth/approle/role/:role_name/secret-id-num-uses` | `200/204` |
|
| `GET/POST/DELETE` | `/auth/approle/role/:role_name/secret-id-num-uses` | `200/204` |
|
||||||
| `GET/POST/DELETE` | `/auth/approle/role/:role_name/secret-id-ttl` | `200/204` |
|
| `GET/POST/DELETE` | `/auth/approle/role/:role_name/secret-id-ttl` | `200/204` |
|
||||||
@ -151,7 +151,7 @@ this method is called, Vault will now be the only entity that knows the AWS
|
|||||||
secret key is used to access AWS.
|
secret key is used to access AWS.
|
||||||
|
|
||||||
| Method | Path |
|
| Method | Path |
|
||||||
| :--------------------------- | :--------------------- |
|
| :----- | :----------------------------- |
|
||||||
| `POST` | `/auth/aws/config/rotate-root` |
|
| `POST` | `/auth/aws/config/rotate-root` |
|
||||||
|
|
||||||
### Parameters
|
### Parameters
|
||||||
@ -815,7 +815,7 @@ list in order to satisfy that constraint.
|
|||||||
This only applies to authentications via the ec2 auth method. This is mutually
|
This only applies to authentications via the ec2 auth method. This is mutually
|
||||||
exclusive with `allow_instance_migration`.
|
exclusive with `allow_instance_migration`.
|
||||||
|
|
||||||
@include 'partials/tokenfields.mdx'
|
@include 'tokenfields.mdx'
|
||||||
|
|
||||||
### Sample Payload
|
### Sample Payload
|
||||||
|
|
||||||
@ -130,7 +130,7 @@ entities attempting to login.
|
|||||||
- `bound_scale_sets` `(array: [])` - The list of scale set names that the
|
- `bound_scale_sets` `(array: [])` - The list of scale set names that the
|
||||||
login is restricted to.
|
login is restricted to.
|
||||||
|
|
||||||
@include 'partials/tokenfields.mdx'
|
@include 'tokenfields.mdx'
|
||||||
|
|
||||||
### Sample Payload
|
### Sample Payload
|
||||||
|
|
||||||
@ -64,7 +64,7 @@ Sets a CA cert and associated parameters in a role name.
|
|||||||
when authenticating against this CA certificate. If not set, defaults to the
|
when authenticating against this CA certificate. If not set, defaults to the
|
||||||
name of the role.
|
name of the role.
|
||||||
|
|
||||||
@include 'partials/tokenfields.mdx'
|
@include 'tokenfields.mdx'
|
||||||
|
|
||||||
### Sample Payload
|
### Sample Payload
|
||||||
|
|
||||||
@ -157,7 +157,7 @@ will be able to authenticate against this role.
|
|||||||
certificate presented. Should only be set to true if required, generally when a proxy
|
certificate presented. Should only be set to true if required, generally when a proxy
|
||||||
is used to perform logins.
|
is used to perform logins.
|
||||||
|
|
||||||
@include 'partials/tokenfields.mdx'
|
@include 'tokenfields.mdx'
|
||||||
|
|
||||||
### Sample Payload
|
### Sample Payload
|
||||||
|
|
||||||
@ -156,7 +156,7 @@ entities attempting to login.
|
|||||||
for the entities project and all its folder or organization ancestors. This
|
for the entities project and all its folder or organization ancestors. This
|
||||||
requires Vault to have IAM permission `resourcemanager.projects.get`.
|
requires Vault to have IAM permission `resourcemanager.projects.get`.
|
||||||
|
|
||||||
@include 'partials/tokenfields.mdx'
|
@include 'tokenfields.mdx'
|
||||||
|
|
||||||
#### `iam`-only Parameters
|
#### `iam`-only Parameters
|
||||||
|
|
||||||
@ -31,7 +31,7 @@ distinction between the `create` and `update` capabilities inside ACL policies.
|
|||||||
- `base_url` `(string: "")` - The API endpoint to use. Useful if you are running
|
- `base_url` `(string: "")` - The API endpoint to use. Useful if you are running
|
||||||
GitHub Enterprise or an API-compatible authentication server.
|
GitHub Enterprise or an API-compatible authentication server.
|
||||||
|
|
||||||
@include 'partials/tokenfields.mdx'
|
@include 'tokenfields.mdx'
|
||||||
|
|
||||||
### Sample Payload
|
### Sample Payload
|
||||||
|
|
||||||
@ -149,7 +149,7 @@ entities attempting to login. At least one of the bound values must be set.
|
|||||||
logging is active. Not recommended in production since sensitive information may be present
|
logging is active. Not recommended in production since sensitive information may be present
|
||||||
in OIDC responses.
|
in OIDC responses.
|
||||||
|
|
||||||
@include 'partials/tokenfields.mdx'
|
@include 'tokenfields.mdx'
|
||||||
|
|
||||||
### Sample Payload
|
### Sample Payload
|
||||||
|
|
||||||
@ -147,7 +147,7 @@ This endpoint configures LDAP in the Kerberos auth method.
|
|||||||
groupfilter queries returning _group_ objects, use: `cn`. For queries
|
groupfilter queries returning _group_ objects, use: `cn`. For queries
|
||||||
returning _user_ objects, use: `memberOf`. The default is `cn`.
|
returning _user_ objects, use: `memberOf`. The default is `cn`.
|
||||||
|
|
||||||
@include 'partials/tokenfields.mdx'
|
@include 'tokenfields.mdx'
|
||||||
|
|
||||||
### Sample Request
|
### Sample Request
|
||||||
|
|
||||||
@ -126,7 +126,7 @@ entities attempting to login.
|
|||||||
this and bound_service_account_names can not be set to "\*".
|
this and bound_service_account_names can not be set to "\*".
|
||||||
- `audience` `(string: "")` - Optional Audience claim to verify in the JWT.
|
- `audience` `(string: "")` - Optional Audience claim to verify in the JWT.
|
||||||
|
|
||||||
@include 'partials/tokenfields.mdx'
|
@include 'tokenfields.mdx'
|
||||||
|
|
||||||
### Sample Payload
|
### Sample Payload
|
||||||
|
|
||||||
@ -85,7 +85,7 @@ This endpoint configures the LDAP auth method.
|
|||||||
groupfilter queries returning _group_ objects, use: `cn`. For queries
|
groupfilter queries returning _group_ objects, use: `cn`. For queries
|
||||||
returning _user_ objects, use: `memberOf`. The default is `cn`.
|
returning _user_ objects, use: `memberOf`. The default is `cn`.
|
||||||
|
|
||||||
@include 'partials/tokenfields.mdx'
|
@include 'tokenfields.mdx'
|
||||||
|
|
||||||
### Sample Request
|
### Sample Request
|
||||||
|
|
||||||
@ -84,7 +84,7 @@ Create a Vault administrator role in the OCI Auth method.
|
|||||||
- `name` `(string: <required>)` - Name of the role.
|
- `name` `(string: <required>)` - Name of the role.
|
||||||
- `ocid_list` `(string: <required>)` - A comma separated list of Group or Dynamic Group OCIDs that can take this role.
|
- `ocid_list` `(string: <required>)` - A comma separated list of Group or Dynamic Group OCIDs that can take this role.
|
||||||
|
|
||||||
@include 'partials/tokenfields.mdx'
|
@include 'tokenfields.mdx'
|
||||||
|
|
||||||
### Sample Payload
|
### Sample Payload
|
||||||
|
|
||||||
@ -39,7 +39,7 @@ distinction between the `create` and `update` capabilities inside ACL policies.
|
|||||||
Useful if using one of Vault's built-in MFA mechanisms, but this will also
|
Useful if using one of Vault's built-in MFA mechanisms, but this will also
|
||||||
cause certain other statuses to be ignored, such as `PASSWORD_EXPIRED`.
|
cause certain other statuses to be ignored, such as `PASSWORD_EXPIRED`.
|
||||||
|
|
||||||
@include 'partials/tokenfields.mdx'
|
@include 'tokenfields.mdx'
|
||||||
|
|
||||||
### Sample Payload
|
### Sample Payload
|
||||||
|
|
||||||
@ -38,7 +38,7 @@ RADIUS.
|
|||||||
- `nas_port` `(integer: 10)` - The NAS-Port attribute of the RADIUS request.
|
- `nas_port` `(integer: 10)` - The NAS-Port attribute of the RADIUS request.
|
||||||
Defaults is 10.
|
Defaults is 10.
|
||||||
|
|
||||||
@include 'partials/tokenfields.mdx'
|
@include 'tokenfields.mdx'
|
||||||
|
|
||||||
### Sample Payload
|
### Sample Payload
|
||||||
|
|
||||||
@ -71,6 +71,7 @@ during this call.
|
|||||||
token ID is a randomly generated value.
|
token ID is a randomly generated value.
|
||||||
|
|
||||||
_Note:_ The ID should not start with the `s.` prefix.
|
_Note:_ The ID should not start with the `s.` prefix.
|
||||||
|
|
||||||
- `role_name` `(string: "")` – The name of the token role.
|
- `role_name` `(string: "")` – The name of the token role.
|
||||||
- `policies` `(array: "")` – A list of policies for the token. This must be a
|
- `policies` `(array: "")` – A list of policies for the token. This must be a
|
||||||
subset of the policies belonging to the token making the request, unless root.
|
subset of the policies belonging to the token making the request, unless root.
|
||||||
@ -709,7 +710,7 @@ tokens created against a role to be revoked using the
|
|||||||
of allowed entity aliases. If set, specifies the entity aliases which are
|
of allowed entity aliases. If set, specifies the entity aliases which are
|
||||||
allowed to be used during token generation. This field supports globbing.
|
allowed to be used during token generation. This field supports globbing.
|
||||||
|
|
||||||
@include 'partials/tokenstorefields.mdx'
|
@include 'tokenstorefields.mdx'
|
||||||
|
|
||||||
### Sample Payload
|
### Sample Payload
|
||||||
|
|
||||||
@ -792,7 +793,6 @@ have, then delete the accessor.
|
|||||||
Finally, any cubbyhole entries that are associated with tokens which weren't deemed
|
Finally, any cubbyhole entries that are associated with tokens which weren't deemed
|
||||||
valid in the above steps will be deleted.
|
valid in the above steps will be deleted.
|
||||||
|
|
||||||
|
|
||||||
| Method | Path |
|
| Method | Path |
|
||||||
| :----- | :----------------- |
|
| :----- | :----------------- |
|
||||||
| `POST` | `/auth/token/tidy` |
|
| `POST` | `/auth/token/tidy` |
|
||||||
@ -31,7 +31,7 @@ Create a new user or update an existing user. This path honors the distinction b
|
|||||||
- `password` `(string: <required>)` - The password for the user. Only required
|
- `password` `(string: <required>)` - The password for the user. Only required
|
||||||
when creating the user.
|
when creating the user.
|
||||||
|
|
||||||
@include 'partials/tokenfields.mdx'
|
@include 'tokenfields.mdx'
|
||||||
|
|
||||||
### Sample Payload
|
### Sample Payload
|
||||||
|
|
||||||
@ -29,6 +29,7 @@ The `config` endpoint configures the LDAP connection and binding parameters, as
|
|||||||
generate passwords from. Mutually exclusive with `length` and `formatter`.
|
generate passwords from. Mutually exclusive with `length` and `formatter`.
|
||||||
|
|
||||||
**Deprecated parameters**:
|
**Deprecated parameters**:
|
||||||
|
|
||||||
- `length` (string, optional) - The desired password length. Defaults to 64. Minimum is 14. Mutually exclusive
|
- `length` (string, optional) - The desired password length. Defaults to 64. Minimum is 14. Mutually exclusive
|
||||||
with `password_policy`.
|
with `password_policy`.
|
||||||
- `formatter` (string, optional) - Text into which the base64 password should be inserted, formatted like so:
|
- `formatter` (string, optional) - Text into which the base64 password should be inserted, formatted like so:
|
||||||
@ -88,6 +89,7 @@ $ curl \
|
|||||||
--data @payload.json \
|
--data @payload.json \
|
||||||
http://127.0.0.1:8200/v1/ad/config
|
http://127.0.0.1:8200/v1/ad/config
|
||||||
```
|
```
|
||||||
|
|
||||||
</Tab>
|
</Tab>
|
||||||
<Tab heading="CLI">
|
<Tab heading="CLI">
|
||||||
|
|
||||||
@ -98,6 +100,7 @@ $ vault write ad/config \
|
|||||||
url="ldaps://127.0.0.1" \
|
url="ldaps://127.0.0.1" \
|
||||||
userdn="dc=example,dc=com"
|
userdn="dc=example,dc=com"
|
||||||
```
|
```
|
||||||
|
|
||||||
</Tab>
|
</Tab>
|
||||||
</Tabs>
|
</Tabs>
|
||||||
|
|
||||||
@ -161,6 +164,7 @@ $ curl \
|
|||||||
--data @payload.json \
|
--data @payload.json \
|
||||||
http://127.0.0.1:8200/v1/ad/roles/my-application
|
http://127.0.0.1:8200/v1/ad/roles/my-application
|
||||||
```
|
```
|
||||||
|
|
||||||
</Tab>
|
</Tab>
|
||||||
<Tab heading="CLI">
|
<Tab heading="CLI">
|
||||||
|
|
||||||
@ -169,6 +173,7 @@ $ vault write ad/roles/my-application \
|
|||||||
service_account_name="my-application@example.com" \
|
service_account_name="my-application@example.com" \
|
||||||
ttl=100
|
ttl=100
|
||||||
```
|
```
|
||||||
|
|
||||||
</Tab>
|
</Tab>
|
||||||
</Tabs>
|
</Tabs>
|
||||||
|
|
||||||
@ -219,12 +224,14 @@ $ curl \
|
|||||||
--request GET \
|
--request GET \
|
||||||
http://127.0.0.1:8200/v1/ad/creds/my-application
|
http://127.0.0.1:8200/v1/ad/creds/my-application
|
||||||
```
|
```
|
||||||
|
|
||||||
</Tab>
|
</Tab>
|
||||||
<Tab heading="CLI">
|
<Tab heading="CLI">
|
||||||
|
|
||||||
```shell-session
|
```shell-session
|
||||||
$ vault read ad/creds/my-application
|
$ vault read ad/creds/my-application
|
||||||
```
|
```
|
||||||
|
|
||||||
</Tab>
|
</Tab>
|
||||||
</Tabs>
|
</Tabs>
|
||||||
|
|
||||||
@ -470,7 +477,7 @@ Rotate the `bindpass` to a new one known only to Vault.
|
|||||||
### Endpoints
|
### Endpoints
|
||||||
|
|
||||||
| Method | Path |
|
| Method | Path |
|
||||||
| :----- | :---------------- |
|
| :----- | :---------------- | -------------------------------------- |
|
||||||
| `GET` | `/ad/rotate-root` | `204 (empty body) or 200 with warning` |
|
| `GET` | `/ad/rotate-root` | `204 (empty body) or 200 with warning` |
|
||||||
| `POST` | `/ad/rotate-root` | `204 (empty body) or 200 with warning` |
|
| `POST` | `/ad/rotate-root` | `204 (empty body) or 200 with warning` |
|
||||||
|
|
||||||
@ -63,6 +63,7 @@ $ curl \
|
|||||||
--data @payload.json \
|
--data @payload.json \
|
||||||
https://127.0.0.1:8200/v1/azure/config
|
https://127.0.0.1:8200/v1/azure/config
|
||||||
```
|
```
|
||||||
|
|
||||||
</Tab>
|
</Tab>
|
||||||
<Tab heading="CLI">
|
<Tab heading="CLI">
|
||||||
|
|
||||||
@ -75,6 +76,7 @@ $ vault write azure/config \
|
|||||||
environment="AzureGermanCloud",
|
environment="AzureGermanCloud",
|
||||||
password_policy="azure_policy"
|
password_policy="azure_policy"
|
||||||
```
|
```
|
||||||
|
|
||||||
</Tab>
|
</Tab>
|
||||||
</Tabs>
|
</Tabs>
|
||||||
|
|
||||||
@ -97,12 +99,14 @@ $ curl \
|
|||||||
--request GET \
|
--request GET \
|
||||||
https://127.0.0.1:8200/v1/azure/config
|
https://127.0.0.1:8200/v1/azure/config
|
||||||
```
|
```
|
||||||
|
|
||||||
</Tab>
|
</Tab>
|
||||||
<Tab heading="CLI">
|
<Tab heading="CLI">
|
||||||
|
|
||||||
```shell-session
|
```shell-session
|
||||||
$ vault read azure/config
|
$ vault read azure/config
|
||||||
```
|
```
|
||||||
|
|
||||||
</Tab>
|
</Tab>
|
||||||
</Tabs>
|
</Tabs>
|
||||||
|
|
||||||
@ -139,12 +143,14 @@ $ curl \
|
|||||||
--request DELETE \
|
--request DELETE \
|
||||||
https://127.0.0.1:8200/v1/azure/config
|
https://127.0.0.1:8200/v1/azure/config
|
||||||
```
|
```
|
||||||
|
|
||||||
</Tab>
|
</Tab>
|
||||||
<Tab heading="CLI">
|
<Tab heading="CLI">
|
||||||
|
|
||||||
```shell-session
|
```shell-session
|
||||||
$ vault delete azure/config
|
$ vault delete azure/config
|
||||||
```
|
```
|
||||||
|
|
||||||
</Tab>
|
</Tab>
|
||||||
</Tabs>
|
</Tabs>
|
||||||
|
|
||||||
@ -223,12 +229,14 @@ $ curl \
|
|||||||
--request LIST \
|
--request LIST \
|
||||||
https://127.0.0.1:8200/v1/azure/roles
|
https://127.0.0.1:8200/v1/azure/roles
|
||||||
```
|
```
|
||||||
|
|
||||||
</Tab>
|
</Tab>
|
||||||
<Tab heading="CLI">
|
<Tab heading="CLI">
|
||||||
|
|
||||||
```shell-session
|
```shell-session
|
||||||
$ vault list azure/roles
|
$ vault list azure/roles
|
||||||
```
|
```
|
||||||
|
|
||||||
</Tab>
|
</Tab>
|
||||||
</Tabs>
|
</Tabs>
|
||||||
|
|
||||||
@ -264,12 +272,14 @@ $ curl \
|
|||||||
--header "X-Vault-Token: ..." \
|
--header "X-Vault-Token: ..." \
|
||||||
http://127.0.0.1:8200/v1/azure/creds/my-role
|
http://127.0.0.1:8200/v1/azure/creds/my-role
|
||||||
```
|
```
|
||||||
|
|
||||||
</Tab>
|
</Tab>
|
||||||
<Tab heading="CLI">
|
<Tab heading="CLI">
|
||||||
|
|
||||||
```shell-session
|
```shell-session
|
||||||
$ vault read azure/creds/my-role
|
$ vault read azure/creds/my-role
|
||||||
```
|
```
|
||||||
|
|
||||||
</Tab>
|
</Tab>
|
||||||
</Tabs>
|
</Tabs>
|
||||||
|
|
||||||
@ -197,7 +197,7 @@ $ curl \
|
|||||||
This endpoint deletes the role definition.
|
This endpoint deletes the role definition.
|
||||||
|
|
||||||
| Method | Path |
|
| Method | Path |
|
||||||
| :------- | :----------------------- |
|
| :------- | :----------------------- | --------------- |
|
||||||
| `DELETE` | `/cassandra/roles/:name` | `204 (no body)` |
|
| `DELETE` | `/cassandra/roles/:name` | `204 (no body)` |
|
||||||
|
|
||||||
### Parameters
|
### Parameters
|
||||||
@ -62,6 +62,7 @@ list of additional parameters.
|
|||||||
of the user configured in this step. The new password will **not** be viewable by users.
|
of the user configured in this step. The new password will **not** be viewable by users.
|
||||||
|
|
||||||
### Common fields
|
### Common fields
|
||||||
|
|
||||||
There are several common fields that you will see across many of the database plugins.
|
There are several common fields that you will see across many of the database plugins.
|
||||||
Please reference the individual plugin documentation for details on whether these fields
|
Please reference the individual plugin documentation for details on whether these fields
|
||||||
are supported and any additional details about them.
|
are supported and any additional details about them.
|
||||||
@ -617,7 +618,7 @@ $ curl \
|
|||||||
"password": "132ae3ef-5a64-7499-351e-bfe59f3a2a21",
|
"password": "132ae3ef-5a64-7499-351e-bfe59f3a2a21",
|
||||||
"last_vault_rotation": "2019-05-06T15:26:42.525302-05:00",
|
"last_vault_rotation": "2019-05-06T15:26:42.525302-05:00",
|
||||||
"rotation_period": 30,
|
"rotation_period": 30,
|
||||||
"ttl": 28,
|
"ttl": 28
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
```
|
```
|
||||||
@ -182,7 +182,7 @@ $ curl \
|
|||||||
## Rotate Roleset Account
|
## Rotate Roleset Account
|
||||||
|
|
||||||
| Method | Path |
|
| Method | Path |
|
||||||
| :----- | :-------------------------- |
|
| :----- | :-------------------------- | ------------------- |
|
||||||
| `POST` | `/gcp/roleset/:name/rotate` | `204 (empty body)`` |
|
| `POST` | `/gcp/roleset/:name/rotate` | `204 (empty body)`` |
|
||||||
|
|
||||||
This will rotate the service account this roleset uses to generate secrets.
|
This will rotate the service account this roleset uses to generate secrets.
|
||||||
@ -202,7 +202,7 @@ $ curl \
|
|||||||
## Rotate Roleset Account Key (`access_token` Roleset Only)
|
## Rotate Roleset Account Key (`access_token` Roleset Only)
|
||||||
|
|
||||||
| Method | Path |
|
| Method | Path |
|
||||||
| :----- | :------------------------------ |
|
| :----- | :------------------------------ | ------------------- |
|
||||||
| `POST` | `/gcp/roleset/:name/rotate-key` | `204 (empty body)`` |
|
| `POST` | `/gcp/roleset/:name/rotate-key` | `204 (empty body)`` |
|
||||||
|
|
||||||
This will rotate the service account key this roleset uses to generate
|
This will rotate the service account key this roleset uses to generate
|
||||||
@ -545,7 +545,7 @@ path "gcpkms/keys/my-key" {
|
|||||||
for the supported algorithms of each purpose.
|
for the supported algorithms of each purpose.
|
||||||
|
|
||||||
| Purpose | Supported Algorithms |
|
| Purpose | Supported Algorithms |
|
||||||
| :------ | :------------------- |
|
| :------------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
||||||
| `encrypt_decrypt` | `symmetric_encryption` |
|
| `encrypt_decrypt` | `symmetric_encryption` |
|
||||||
| `asymmetric_decrypt` | `rsa_decrypt_oaep_2048_sha256`<br/>`rsa_decrypt_oaep_3072_sha256`<br/>`rsa_decrypt_oaep_4096_sha256` |
|
| `asymmetric_decrypt` | `rsa_decrypt_oaep_2048_sha256`<br/>`rsa_decrypt_oaep_3072_sha256`<br/>`rsa_decrypt_oaep_4096_sha256` |
|
||||||
| `asymmetric_sign` | `rsa_sign_pss_2048_sha256`<br/>`rsa_sign_pss_3072_sha256`<br/>`rsa_sign_pss_4096_sha256`<br/>`rsa_sign_pkcs1_2048_sha256`<br/>`rsa_sign_pkcs1_3072_sha256`<br/>`rsa_sign_pkcs1_4096_sha256`<br/>`ec_sign_p256_sha256`<br/>`ec_sign_p384_sha384` |
|
| `asymmetric_sign` | `rsa_sign_pss_2048_sha256`<br/>`rsa_sign_pss_3072_sha256`<br/>`rsa_sign_pss_4096_sha256`<br/>`rsa_sign_pkcs1_2048_sha256`<br/>`rsa_sign_pkcs1_3072_sha256`<br/>`rsa_sign_pkcs1_4096_sha256`<br/>`ec_sign_p256_sha256`<br/>`ec_sign_p384_sha384` |
|
||||||
@ -196,7 +196,7 @@ This endpoint deletes a named key. The key must be removed from all KMS provider
|
|||||||
been distributed to and have `deletion_allowed` set to `true` in order to be deleted.
|
been distributed to and have `deletion_allowed` set to `true` in order to be deleted.
|
||||||
|
|
||||||
| Method | Path |
|
| Method | Path |
|
||||||
| :------- | :-------------------- |
|
| :------- | :------------------- |
|
||||||
| `DELETE` | `/keymgmt/key/:name` |
|
| `DELETE` | `/keymgmt/key/:name` |
|
||||||
|
|
||||||
### Parameters
|
### Parameters
|
||||||
@ -253,7 +253,7 @@ does not exist, it will be created. If the KMS provider exists, it will be updat
|
|||||||
the given parameter values.
|
the given parameter values.
|
||||||
|
|
||||||
| Method | Path |
|
| Method | Path |
|
||||||
| :----- | :-------------------- |
|
| :----- | :------------------- |
|
||||||
| `PUT` | `/keymgmt/kms/:name` |
|
| `PUT` | `/keymgmt/kms/:name` |
|
||||||
|
|
||||||
### Parameters
|
### Parameters
|
||||||
@ -270,6 +270,7 @@ the given parameter values.
|
|||||||
depending on the specified provider.
|
depending on the specified provider.
|
||||||
|
|
||||||
The following values are expected for each provider:
|
The following values are expected for each provider:
|
||||||
|
|
||||||
- `azurekeyvault`
|
- `azurekeyvault`
|
||||||
- The name of an existing Azure Key Vault instance.
|
- The name of an existing Azure Key Vault instance.
|
||||||
|
|
||||||
@ -280,6 +281,7 @@ the given parameter values.
|
|||||||
will differ depending on the specified provider.
|
will differ depending on the specified provider.
|
||||||
|
|
||||||
The following keys and values are expected for each provider:
|
The following keys and values are expected for each provider:
|
||||||
|
|
||||||
- `azurekeyvault`
|
- `azurekeyvault`
|
||||||
- `tenant_id` `(string: <required>)` - The tenant ID for the Azure Active Directory
|
- `tenant_id` `(string: <required>)` - The tenant ID for the Azure Active Directory
|
||||||
organization. May also be specified by the `AZURE_TENANT_ID` environment variable.
|
organization. May also be specified by the `AZURE_TENANT_ID` environment variable.
|
||||||
@ -319,7 +321,7 @@ $ curl \
|
|||||||
This endpoint returns information about a KMS provider.
|
This endpoint returns information about a KMS provider.
|
||||||
|
|
||||||
| Method | Path |
|
| Method | Path |
|
||||||
| :----- | :-------------------- |
|
| :----- | :------------------- |
|
||||||
| `GET` | `/keymgmt/kms/:name` |
|
| `GET` | `/keymgmt/kms/:name` |
|
||||||
|
|
||||||
### Parameters
|
### Parameters
|
||||||
@ -380,7 +382,7 @@ This endpoint deletes a KMS provider. A KMS provider cannot be deleted until all
|
|||||||
that have been distributed to it are removed.
|
that have been distributed to it are removed.
|
||||||
|
|
||||||
| Method | Path |
|
| Method | Path |
|
||||||
| :------- | :-------------------- |
|
| :------- | :------------------- |
|
||||||
| `DELETE` | `/keymgmt/kms/:name` |
|
| `DELETE` | `/keymgmt/kms/:name` |
|
||||||
|
|
||||||
### Parameters
|
### Parameters
|
||||||
@ -439,7 +439,7 @@ $ curl \
|
|||||||
## Sign CSR
|
## Sign CSR
|
||||||
|
|
||||||
| Method | Path |
|
| Method | Path |
|
||||||
| :----- | :-------------------------------------------------- |
|
| :----- | :---------------------------------------------- |
|
||||||
| `POST` | `/kmip/scope/:scope/role/:role/credential/sign` |
|
| `POST` | `/kmip/scope/:scope/role/:role/credential/sign` |
|
||||||
|
|
||||||
Create a new client certificate tied to the given role and scope,
|
Create a new client certificate tied to the given role and scope,
|
||||||
@ -34,8 +34,7 @@ to search and change entry passwords in OpenLDAP.
|
|||||||
Example: `cn=vault,ou=Users,dc=hashicorp,dc=com`
|
Example: `cn=vault,ou=Users,dc=hashicorp,dc=com`
|
||||||
- `bindpass` `(string: <required>)` - Password to use along with `binddn` for managing user entries.
|
- `bindpass` `(string: <required>)` - Password to use along with `binddn` for managing user entries.
|
||||||
- `url` `(string: "ldap://127.0.0.1")` - The LDAP server to connect to. Examples: `ldaps://ldap.myorg.com`,
|
- `url` `(string: "ldap://127.0.0.1")` - The LDAP server to connect to. Examples: `ldaps://ldap.myorg.com`,
|
||||||
`ldaps://ldap.myorg.com:636`. This can also be a comma-delineated list of URLs, e.g. `ldaps://ldap.myorg.com,
|
`ldaps://ldap.myorg.com:636`. This can also be a comma-delineated list of URLs, e.g. `ldaps://ldap.myorg.com, ldaps://ldap.myorg.com:636`, in which case the servers will be tried in-order if there are errors during the
|
||||||
ldaps://ldap.myorg.com:636`, in which case the servers will be tried in-order if there are errors during the
|
|
||||||
connection process.`.
|
connection process.`.
|
||||||
- `password_policy` `(string: <optional>)` - The name of the [password policy](/docs/concepts/password-policies)
|
- `password_policy` `(string: <optional>)` - The name of the [password policy](/docs/concepts/password-policies)
|
||||||
to use to generate passwords. Note that this accepts the name of the policy, not the policy itself.
|
to use to generate passwords. Note that this accepts the name of the policy, not the policy itself.
|
||||||
@ -60,6 +60,7 @@ $ curl \
|
|||||||
--data @payload.json \
|
--data @payload.json \
|
||||||
http://127.0.0.1:8200/v1/rabbitmq/config/connection
|
http://127.0.0.1:8200/v1/rabbitmq/config/connection
|
||||||
```
|
```
|
||||||
|
|
||||||
</Tab>
|
</Tab>
|
||||||
<Tab heading="CLI">
|
<Tab heading="CLI">
|
||||||
|
|
||||||
@ -70,6 +71,7 @@ $ vault write rabbitmq/config/connection \
|
|||||||
password="password" \
|
password="password" \
|
||||||
password_policy="rabbitmq_policy"
|
password_policy="rabbitmq_policy"
|
||||||
```
|
```
|
||||||
|
|
||||||
</Tab>
|
</Tab>
|
||||||
</Tabs>
|
</Tabs>
|
||||||
|
|
||||||
@ -108,6 +110,7 @@ $ curl \
|
|||||||
--data @payload.json \
|
--data @payload.json \
|
||||||
http://127.0.0.1:8200/v1/rabbitmq/config/lease
|
http://127.0.0.1:8200/v1/rabbitmq/config/lease
|
||||||
```
|
```
|
||||||
|
|
||||||
</Tab>
|
</Tab>
|
||||||
<Tab heading="CLI">
|
<Tab heading="CLI">
|
||||||
|
|
||||||
@ -116,6 +119,7 @@ $ vault write rabbitmq/config/lease \
|
|||||||
ttl=1800 \
|
ttl=1800 \
|
||||||
max_ttl=3600
|
max_ttl=3600
|
||||||
```
|
```
|
||||||
|
|
||||||
</Tab>
|
</Tab>
|
||||||
</Tabs>
|
</Tabs>
|
||||||
|
|
||||||
@ -162,6 +166,7 @@ $ curl \
|
|||||||
--data @payload.json \
|
--data @payload.json \
|
||||||
http://127.0.0.1:8200/v1/rabbitmq/roles/my-role
|
http://127.0.0.1:8200/v1/rabbitmq/roles/my-role
|
||||||
```
|
```
|
||||||
|
|
||||||
</Tab>
|
</Tab>
|
||||||
<Tab heading="CLI">
|
<Tab heading="CLI">
|
||||||
|
|
||||||
@ -171,6 +176,7 @@ $ vault write rabbitmq/roles/my-role \
|
|||||||
vhosts="..." \
|
vhosts="..." \
|
||||||
vhost_topics="..."
|
vhost_topics="..."
|
||||||
```
|
```
|
||||||
|
|
||||||
</Tab>
|
</Tab>
|
||||||
</Tabs>
|
</Tabs>
|
||||||
|
|
||||||
@ -197,12 +203,14 @@ $ curl \
|
|||||||
--header "X-Vault-Token: ..." \
|
--header "X-Vault-Token: ..." \
|
||||||
http://127.0.0.1:8200/v1/rabbitmq/roles/my-role
|
http://127.0.0.1:8200/v1/rabbitmq/roles/my-role
|
||||||
```
|
```
|
||||||
|
|
||||||
</Tab>
|
</Tab>
|
||||||
<Tab heading="CLI">
|
<Tab heading="CLI">
|
||||||
|
|
||||||
```shell-session
|
```shell-session
|
||||||
$ vault read rabbitmq/roles/my-role
|
$ vault read rabbitmq/roles/my-role
|
||||||
```
|
```
|
||||||
|
|
||||||
</Tab>
|
</Tab>
|
||||||
</Tabs>
|
</Tabs>
|
||||||
|
|
||||||
@ -242,12 +250,14 @@ $ curl \
|
|||||||
--request DELETE \
|
--request DELETE \
|
||||||
http://127.0.0.1:8200/v1/rabbitmq/roles/my-role
|
http://127.0.0.1:8200/v1/rabbitmq/roles/my-role
|
||||||
```
|
```
|
||||||
|
|
||||||
</Tab>
|
</Tab>
|
||||||
<Tab heading="CLI">
|
<Tab heading="CLI">
|
||||||
|
|
||||||
```shell-session
|
```shell-session
|
||||||
vault delete rabbitmq/roles/my-role
|
vault delete rabbitmq/roles/my-role
|
||||||
```
|
```
|
||||||
|
|
||||||
</Tab>
|
</Tab>
|
||||||
</Tabs>
|
</Tabs>
|
||||||
|
|
||||||
@ -275,12 +285,14 @@ $ curl \
|
|||||||
--header "X-Vault-Token: ..." \
|
--header "X-Vault-Token: ..." \
|
||||||
http://127.0.0.1:8200/v1/rabbitmq/creds/my-role
|
http://127.0.0.1:8200/v1/rabbitmq/creds/my-role
|
||||||
```
|
```
|
||||||
|
|
||||||
</Tab>
|
</Tab>
|
||||||
<Tab heading="CLI">
|
<Tab heading="CLI">
|
||||||
|
|
||||||
```shell-session
|
```shell-session
|
||||||
$ vault read rabbitmq/creds/my-role
|
$ vault read rabbitmq/creds/my-role
|
||||||
```
|
```
|
||||||
|
|
||||||
</Tab>
|
</Tab>
|
||||||
</Tabs>
|
</Tabs>
|
||||||
|
|
||||||
@ -629,7 +629,7 @@ key pair. _If you have already set a certificate and key, they will be
|
|||||||
overridden._
|
overridden._
|
||||||
|
|
||||||
| Method | Path |
|
| Method | Path |
|
||||||
| :----- | :--------------- |
|
| :----- | :--------------- | -------------------------- |
|
||||||
| `POST` | `/ssh/config/ca` | `200/204 application/json` |
|
| `POST` | `/ssh/config/ca` | `200/204 application/json` |
|
||||||
|
|
||||||
### Parameters
|
### Parameters
|
||||||
@ -703,7 +703,7 @@ This endpoint returns the configured/generated public key. This is an unauthenti
|
|||||||
endpoint.
|
endpoint.
|
||||||
|
|
||||||
| Method | Path |
|
| Method | Path |
|
||||||
| :----- | :---------------- |
|
| :----- | :---------------- | ---------------- |
|
||||||
| `GET` | `/ssh/public_key` | `200 text/plain` |
|
| `GET` | `/ssh/public_key` | `200 text/plain` |
|
||||||
|
|
||||||
### Sample Request
|
### Sample Request
|
||||||
@ -95,7 +95,6 @@ This endpoint lists all existing roles in the secrets engine.
|
|||||||
- `filter` `(string: "*")` –
|
- `filter` `(string: "*")` –
|
||||||
If provided, only returns role names that match the given glob.
|
If provided, only returns role names that match the given glob.
|
||||||
|
|
||||||
|
|
||||||
### Sample Request
|
### Sample Request
|
||||||
|
|
||||||
```shell-session
|
```shell-session
|
||||||
@ -145,9 +144,9 @@ transformation exists, it will be updated with the new attributes. This
|
|||||||
endpoint is deprecated as of version 1.6 in favor of the type specific
|
endpoint is deprecated as of version 1.6 in favor of the type specific
|
||||||
configuration endpoints, and will be removed in a future release.
|
configuration endpoints, and will be removed in a future release.
|
||||||
|
|
||||||
* [FPE](#create-update-fpe-transformation)
|
- [FPE](#create-update-fpe-transformation)
|
||||||
* [Masking](#create-update-masking-transformation)
|
- [Masking](#create-update-masking-transformation)
|
||||||
* [Tokenization](#create-update-tokenization-transformation)
|
- [Tokenization](#create-update-tokenization-transformation)
|
||||||
|
|
||||||
| Method | Path |
|
| Method | Path |
|
||||||
| :----- | :-------------------------------- |
|
| :----- | :-------------------------------- |
|
||||||
@ -239,7 +238,6 @@ transformation exists, it will be updated with the new attributes.
|
|||||||
|
|
||||||
```json
|
```json
|
||||||
{
|
{
|
||||||
|
|
||||||
"template": "builtin/creditcardnumber",
|
"template": "builtin/creditcardnumber",
|
||||||
"tweak_source": "internal",
|
"tweak_source": "internal",
|
||||||
"allowed_roles": ["example-role"]
|
"allowed_roles": ["example-role"]
|
||||||
@ -256,7 +254,6 @@ $ curl \
|
|||||||
https://127.0.0.1:8200/v1/transform/transformation/fpe/example-transformation
|
https://127.0.0.1:8200/v1/transform/transformation/fpe/example-transformation
|
||||||
```
|
```
|
||||||
|
|
||||||
|
|
||||||
## Create/Update Masking Transformation
|
## Create/Update Masking Transformation
|
||||||
|
|
||||||
This endpoint creates or updates a masking transformation with the given `name`. If a
|
This endpoint creates or updates a masking transformation with the given `name`. If a
|
||||||
@ -695,7 +692,6 @@ This endpoint creates or updates a storage configuration for use with tokenizati
|
|||||||
The database user configured here should only have permission to `SELECT`,
|
The database user configured here should only have permission to `SELECT`,
|
||||||
`INSERT`, and `UPDATE` rows in the tables.
|
`INSERT`, and `UPDATE` rows in the tables.
|
||||||
|
|
||||||
|
|
||||||
| Method | Path |
|
| Method | Path |
|
||||||
| :----- | :----------------------- |
|
| :----- | :----------------------- |
|
||||||
| `POST` | `/transform/store/:name` |
|
| `POST` | `/transform/store/:name` |
|
||||||
@ -709,8 +705,7 @@ The database user configured here should only have permission to `SELECT`,
|
|||||||
- `type` `(string: <required>)` -
|
- `type` `(string: <required>)` -
|
||||||
Specifies the type of store. Currently only `sql` is supported.
|
Specifies the type of store. Currently only `sql` is supported.
|
||||||
|
|
||||||
- `supported_transformations: `(list: ["tokenization"])`
|
- `supported_transformations: `(list: ["tokenization"])` The types of transformations this store can host. Currently only`tokenization`
|
||||||
The types of transformations this store can host. Currently only `tokenization`
|
|
||||||
is supported.
|
is supported.
|
||||||
|
|
||||||
- `connection_string` `(string: <required>)` -
|
- `connection_string` `(string: <required>)` -
|
||||||
@ -723,7 +718,6 @@ The database user configured here should only have permission to `SELECT`,
|
|||||||
- `password`: `(string: <required>)` -
|
- `password`: `(string: <required>)` -
|
||||||
The password value to use when connecting to the database.
|
The password value to use when connecting to the database.
|
||||||
|
|
||||||
|
|
||||||
- `schema`: `(string: "public")` -
|
- `schema`: `(string: "public")` -
|
||||||
The schema within the database to expect tokenization state tables.
|
The schema within the database to expect tokenization state tables.
|
||||||
|
|
||||||
@ -750,7 +744,6 @@ The database user configured here should only have permission to `SELECT`,
|
|||||||
|
|
||||||
### Sample Request
|
### Sample Request
|
||||||
|
|
||||||
|
|
||||||
```shell-session
|
```shell-session
|
||||||
$ curl \
|
$ curl \
|
||||||
--header "X-Vault-Token: ..." \
|
--header "X-Vault-Token: ..." \
|
||||||
@ -768,7 +761,7 @@ or update the schema, but still use a much more limited user for ordinary
|
|||||||
operation.
|
operation.
|
||||||
|
|
||||||
| Method | Path |
|
| Method | Path |
|
||||||
| :----- | :--------------------------------------------- |
|
| :----- | :------------------------------ |
|
||||||
| `POST` | `/transform/store/:name/schema` |
|
| `POST` | `/transform/store/:name/schema` |
|
||||||
|
|
||||||
### Parameters
|
### Parameters
|
||||||
@ -786,7 +779,6 @@ operation.
|
|||||||
- `password`: `(string: <required>)` -
|
- `password`: `(string: <required>)` -
|
||||||
The password value to use when connecting to the database.
|
The password value to use when connecting to the database.
|
||||||
|
|
||||||
|
|
||||||
### Sample Payload
|
### Sample Payload
|
||||||
|
|
||||||
```json
|
```json
|
||||||
@ -798,7 +790,6 @@ operation.
|
|||||||
|
|
||||||
### Sample Request
|
### Sample Request
|
||||||
|
|
||||||
|
|
||||||
```shell-session
|
```shell-session
|
||||||
$ curl \
|
$ curl \
|
||||||
--header "X-Vault-Token: ..." \
|
--header "X-Vault-Token: ..." \
|
||||||
@ -812,7 +803,7 @@ $ curl \
|
|||||||
This endpoint queries an existing store by the given name.
|
This endpoint queries an existing store by the given name.
|
||||||
|
|
||||||
| Method | Path |
|
| Method | Path |
|
||||||
| :----- | :-------------------------- |
|
| :----- | :----------------------- |
|
||||||
| `GET` | `/transform/store/:name` |
|
| `GET` | `/transform/store/:name` |
|
||||||
|
|
||||||
- `name` `(string: <required>)` –
|
- `name` `(string: <required>)` –
|
||||||
@ -843,7 +834,7 @@ $ curl \
|
|||||||
This endpoint lists all existing stores in the secrets engine.
|
This endpoint lists all existing stores in the secrets engine.
|
||||||
|
|
||||||
| Method | Path |
|
| Method | Path |
|
||||||
| :----- | :-------------------- |
|
| :----- | :----------------- |
|
||||||
| `LIST` | `/transform/store` |
|
| `LIST` | `/transform/store` |
|
||||||
|
|
||||||
### Sample Request
|
### Sample Request
|
||||||
@ -865,13 +856,12 @@ $ curl
|
|||||||
}
|
}
|
||||||
```
|
```
|
||||||
|
|
||||||
|
|
||||||
## Delete Store
|
## Delete Store
|
||||||
|
|
||||||
This endpoint deletes an existing store configuration by the given name.
|
This endpoint deletes an existing store configuration by the given name.
|
||||||
|
|
||||||
| Method | Path |
|
| Method | Path |
|
||||||
| :------- | :-------------------------- |
|
| :------- | :----------------------- |
|
||||||
| `DELETE` | `/transform/store/:name` |
|
| `DELETE` | `/transform/store/:name` |
|
||||||
|
|
||||||
### Parameters
|
### Parameters
|
||||||
@ -889,7 +879,6 @@ $ curl \
|
|||||||
http://127.0.0.1:8200/v1/transform/store/example-store
|
http://127.0.0.1:8200/v1/transform/store/example-store
|
||||||
```
|
```
|
||||||
|
|
||||||
|
|
||||||
## Encode
|
## Encode
|
||||||
|
|
||||||
This endpoint encodes the provided value using a named role.
|
This endpoint encodes the provided value using a named role.
|
||||||
@ -944,7 +933,8 @@ This endpoint encodes the provided value using a named role.
|
|||||||
"value": "2222-2222-2222-2222",
|
"value": "2222-2222-2222-2222",
|
||||||
"transformation": "ccn-masking"
|
"transformation": "ccn-masking"
|
||||||
},
|
},
|
||||||
{ "value": "3333-3333-3333-3333",
|
{
|
||||||
|
"value": "3333-3333-3333-3333",
|
||||||
"transformation": "ccn-tokenization",
|
"transformation": "ccn-tokenization",
|
||||||
"ttl": "42d"
|
"ttl": "42d"
|
||||||
}
|
}
|
||||||
@ -1016,14 +1006,14 @@ $ curl \
|
|||||||
|
|
||||||
```json
|
```json
|
||||||
{
|
{
|
||||||
data: {
|
"data": {
|
||||||
"batch_results": [
|
"batch_results": [
|
||||||
{
|
{
|
||||||
"encoded_value": "5682-4613-6822-8064"
|
"encoded_value": "5682-4613-6822-8064"
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"encoded_value": "Q4tYgFXHxURXf9MLekG82L51vSAQrDnpAiaB37J4VPRxoQEB3fRpwR"
|
"encoded_value": "Q4tYgFXHxURXf9MLekG82L51vSAQrDnpAiaB37J4VPRxoQEB3fRpwR"
|
||||||
},
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
@ -1131,18 +1121,19 @@ $ curl \
|
|||||||
|
|
||||||
```json
|
```json
|
||||||
{
|
{
|
||||||
data: {
|
"data": {
|
||||||
"batch_results": [
|
"batch_results": [
|
||||||
{
|
{
|
||||||
"encoded_value": "1111-2222-3333-4444"
|
"encoded_value": "1111-2222-3333-4444"
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"encoded_value": "1111-2222-3333-4444"
|
"encoded_value": "1111-2222-3333-4444"
|
||||||
},
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
```
|
```
|
||||||
|
|
||||||
## Validate Token
|
## Validate Token
|
||||||
|
|
||||||
This endpoint determines if a provided tokenized value is valid and unexpired.
|
This endpoint determines if a provided tokenized value is valid and unexpired.
|
||||||
@ -1281,7 +1272,6 @@ $ curl \
|
|||||||
}
|
}
|
||||||
```
|
```
|
||||||
|
|
||||||
|
|
||||||
## Retrieve Token Metadata
|
## Retrieve Token Metadata
|
||||||
|
|
||||||
This endpoint retrieves metadata for a tokenized value using a named role.
|
This endpoint retrieves metadata for a tokenized value using a named role.
|
||||||
@ -1350,4 +1340,3 @@ $ curl \
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
```
|
```
|
||||||
|
|
||||||
@ -215,8 +215,8 @@ $ curl \
|
|||||||
"non_entity_tokens": 15,
|
"non_entity_tokens": 15,
|
||||||
"clients": 20
|
"clients": 20
|
||||||
}
|
}
|
||||||
},
|
}
|
||||||
],
|
]
|
||||||
},
|
},
|
||||||
"wrap_info": null,
|
"wrap_info": null,
|
||||||
"warnings": null,
|
"warnings": null,
|
||||||
@ -238,7 +238,7 @@ $ curl \
|
|||||||
The `/sys/internal/counters/config` endpoint is used to configure logging of active clients.
|
The `/sys/internal/counters/config` endpoint is used to configure logging of active clients.
|
||||||
|
|
||||||
| Method | Path |
|
| Method | Path |
|
||||||
| :------ | :-------------------------------- |
|
| :----- | :------------------------------ |
|
||||||
| `POST` | `/sys/internal/counters/config` |
|
| `POST` | `/sys/internal/counters/config` |
|
||||||
|
|
||||||
### Parameters
|
### Parameters
|
||||||
@ -38,7 +38,7 @@ that can either be a namespace or mount.
|
|||||||
```json
|
```json
|
||||||
{
|
{
|
||||||
"path": "",
|
"path": "",
|
||||||
"max_leases": 1000,
|
"max_leases": 1000
|
||||||
}
|
}
|
||||||
```
|
```
|
||||||
|
|
||||||
@ -226,7 +226,6 @@ Generally, running this is not needed unless upgrade notes or support personnel
|
|||||||
suggest it. This may perform a lot of I/O to the storage method so should be
|
suggest it. This may perform a lot of I/O to the storage method so should be
|
||||||
used sparingly.
|
used sparingly.
|
||||||
|
|
||||||
|
|
||||||
| Method | Path |
|
| Method | Path |
|
||||||
| :----- | :----------------- |
|
| :----- | :----------------- |
|
||||||
| `POST` | `/sys/leases/tidy` |
|
| `POST` | `/sys/leases/tidy` |
|
||||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
x
Reference in New Issue
Block a user