openapi: 3.1.0
info:
  title: Apache APISIX Admin Consumer Groups Secrets API
  description: The Apache APISIX Admin API provides a RESTful interface to dynamically control and configure your deployed Apache APISIX instance. It allows management of routes, services, upstreams, consumers, SSL certificates, global rules, plugin configurations, consumer groups, secrets, and more. By default, the Admin API listens on port 9180 and requires API key authentication via the X-API-KEY header.
  version: 3.14.0
  contact:
    name: Apache APISIX
    url: https://apisix.apache.org
  license:
    name: Apache 2.0
    url: https://www.apache.org/licenses/LICENSE-2.0.html
servers:
- url: http://127.0.0.1:9180/apisix/admin
  description: Default local Admin API server
security:
- apiKey: []
tags:
- name: Secrets
  description: Manage secrets from external secret managers.
paths:
  /secrets/{secret_manager}/{secret_id}:
    get:
      operationId: getSecret
      summary: Apache APISIX Get a Secret
      description: Fetches the specified secret resource from the given secret manager.
      tags:
      - Secrets
      parameters:
      - $ref: '#/components/parameters/SecretManager'
      - $ref: '#/components/parameters/SecretId'
      responses:
        '200':
          description: Successful response with secret details.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResourceResponse'
        '404':
          description: Secret not found.
    put:
      operationId: createOrUpdateSecret
      summary: Apache APISIX Create or Update a Secret
      description: Creates a secret with the specified ID in the given manager, or updates it if it already exists.
      tags:
      - Secrets
      parameters:
      - $ref: '#/components/parameters/SecretManager'
      - $ref: '#/components/parameters/SecretId'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Secret'
      responses:
        '200':
          description: Secret updated successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResourceResponse'
        '201':
          description: Secret created successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResourceCreated'
    patch:
      operationId: patchSecret
      summary: Apache APISIX Patch a Secret
      description: Updates partial attributes of the specified secret.
      tags:
      - Secrets
      parameters:
      - $ref: '#/components/parameters/SecretManager'
      - $ref: '#/components/parameters/SecretId'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Secret'
      responses:
        '200':
          description: Secret patched successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResourceResponse'
    delete:
      operationId: deleteSecret
      summary: Apache APISIX Delete a Secret
      description: Removes the specified secret resource.
      tags:
      - Secrets
      parameters:
      - $ref: '#/components/parameters/SecretManager'
      - $ref: '#/components/parameters/SecretId'
      responses:
        '200':
          description: Secret deleted successfully.
        '404':
          description: Secret not found.
components:
  schemas:
    ResourceResponse:
      type: object
      description: Standard response wrapper for a single resource.
      properties:
        key:
          type: string
          description: The etcd key path for the resource.
        value:
          type: object
          description: The resource configuration.
        modifiedIndex:
          type: integer
          description: The etcd modification index.
        createdIndex:
          type: integer
          description: The etcd creation index.
    ResourceCreated:
      type: object
      description: Response wrapper for a newly created resource.
      properties:
        key:
          type: string
          description: The etcd key path for the created resource.
        value:
          type: object
          description: The created resource configuration.
    Secret:
      type: object
      description: A Secret resource manages integration with external secret managers such as HashiCorp Vault or AWS Secrets Manager.
      properties:
        uri:
          type: string
          description: URI of the secret manager endpoint.
        prefix:
          type: string
          description: Path prefix in the secret manager.
        token:
          type: string
          description: Authentication token for the secret manager.
  parameters:
    SecretManager:
      name: secret_manager
      in: path
      required: true
      description: The secret manager type (e.g. vault, aws).
      schema:
        type: string
    SecretId:
      name: secret_id
      in: path
      required: true
      description: Unique identifier of the secret.
      schema:
        type: string
  securitySchemes:
    apiKey:
      type: apiKey
      in: header
      name: X-API-KEY
      description: Admin API key for authentication.