openapi: 3.0.1
info:
  title: Secret Manager APIs
  version: v1
  description: API documentation for Secret Manager, Policy Administration, Notifications, Approval service, etc.
servers:
- url: https://{tenantURL}
  description: The primary server
  variables:
    tenantURL:
      default: test.britive-app.com
      description: The host of the server
security:
- bearerAuth: []
tags:
- name: Approvals
- name: Notification Service
- name: Policy Administration
- name: Secrets Manager
- name: Secret Rotation
paths:
  /api/v1/approvals/:
    get:
      tags:
      - Approvals
      summary: Get the list of all approval requests
      operationId: getApprovals
      parameters:
      - name: filter
        in: query
        schema:
          type: string
      - name: requestType
        description: Specifies the type of request
        in: query
        schema:
          pattern: \s*(myRequests|myApprovals)\s*
          type: string
          enum:
          - myRequests
          - myApprovals
      - name: pageToken
        description: Autogenerated token for next page of records in case the results are more than one page. Append this
          token in requested API URL to access the next set of pages.
        in: query
        schema:
          type: string
      - name: consumer
        in: query
        schema:
          type: string
      - name: activeStatus
        in: query
        schema:
          type: string
          default: all
          enum:
          - all
          - active
          - inactive
      - name: createdWithinDays
        in: query
        schema:
          type: integer
          format: int32
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
  /api/v1/approvals/revoke:
    post:
      tags:
      - Approvals
      summary: Revoke bulk requests
      operationId: revokeBulkApprovals
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RevokeData'
        required: true
      responses:
        '202':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
  /api/v1/approvals/{id}:
    patch:
      tags:
      - Approvals
      summary: Approve/Reject/Revoke a specified request
      operationId: handleApproval
      parameters:
      - name: approveRequest
        in: query
        required: true
        schema:
          pattern: \s*(yes|no|revoke)\s*
          type: string
          enum:
          - 'yes'
          - 'no'
          - revoke
      - name: id
        in: path
        required: true
        schema:
          type: string
      - name: killSession
        in: query
        required: false
        schema:
          type: boolean
          default: true
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
    delete:
      tags:
      - Approvals
      summary: Cancel approval request
      operationId: cancelApprovalRequestMyRequest
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
    get:
      tags:
      - Approvals
      summary: Get approval request details
      operationId: getApproval
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
      - name: requestType
        in: query
        schema:
          pattern: \s*(myRequests|myApprovals)\s*
          type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
  /api/v1/notification-service/notificationmediums:
    post:
      tags:
      - Notification Service
      summary: Create a notification medium
      operationId: createNotificationMedium
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/NotificationMediumDto'
        required: false
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
    get:
      tags:
      - Notification Service
      summary: Get notification medium details
      operationId: getNotificationMediums
      parameters:
      - name: filter
        in: query
        description: Filter query
        schema:
          type: string
        example: name%20eq%20corporate_slack
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
  /api/v1/notification-service/notificationmediums/{id}:
    delete:
      tags:
      - Notification Service
      summary: Delete notification medium
      operationId: deleteNotificationMedium
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
    get:
      tags:
      - Notification Service
      summary: Get notification medium details for id
      operationId: getNotificationMedium
      parameters:
      - name: id
        in: path
        description: Id of notification medium
        required: true
        schema:
          type: string
        example: a6ed82f6-32b5-46d8-a3a3-c36cc574abd9
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
    patch:
      tags:
      - Notification Service
      summary: Update notification medium details
      operationId: updateNotificationMedium
      parameters:
      - name: id
        in: path
        description: Id of notification medium
        required: true
        schema:
          type: string
        example: a6ed82f6-32b5-46d8-a3a3-c36cc574abd9
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/NotificationMediumDto'
        required: false
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
  /api/v1/notification-service/notificationmediums/{id}/channels:
    get:
      tags:
      - Notification Service
      summary: Get channels for notification medium id
      operationId: getChannelsForNotificationMediumId
      parameters:
      - name: id
        in: path
        description: Id of notification medium
        required: true
        schema:
          type: string
        example: a6ed82f6-32b5-46d8-a3a3-c36cc574abd9
      - name: pageToken
        in: query
        description: Cursor for next page
        schema:
          type: string
        example: dGVhbTpDMDYxRkE1UEI=
      - name: limit
        in: query
        description: Page limit
        schema:
          default: '200'
        example: '100'
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
  /api/v1/notification-service/notificationmediums/{id}/channels/ismember:
    post:
      tags:
      - Notification Service
      summary: Check if user is member of channel(s)
      operationId: isMember
      parameters:
      - name: id
        in: path
        description: Id of notification medium
        required: true
        schema:
          type: string
        example: a6ed82f6-32b5-46d8-a3a3-c36cc574abd9
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ChannelMembership'
        required: false
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
  /api/v1/notification-service/notificationmediums/{id}/channels/validate:
    post:
      tags:
      - Notification Service
      summary: Validate channels
      operationId: validateChannels
      parameters:
      - name: id
        in: path
        description: Id of notification medium
        required: true
        schema:
          type: string
        example: a6ed82f6-32b5-46d8-a3a3-c36cc574abd9
      requestBody:
        content:
          application/json:
            schema:
              type: array
              items:
                type: string
        required: false
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
  /api/v1/notification-service/notificationmediums/{id}/channels/validate/names:
    post:
      tags:
      - Notification Service
      summary: Validate channel names
      operationId: validateChannelNames
      parameters:
      - name: id
        in: path
        description: Id of notification medium
        required: true
        schema:
          type: string
        example: a6ed82f6-32b5-46d8-a3a3-c36cc574abd9
      requestBody:
        content:
          application/json:
            schema:
              type: array
              items:
                type: string
        required: false
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
  /api/v1/notification-service/notificationmediums/{id}/channels/{channelId}:
    get:
      tags:
      - Notification Service
      summary: Get channel details for notification medium id and channel id
      operationId: getChannelInfoForNotificationMediumId
      parameters:
      - name: id
        in: path
        description: Id of notification medium
        required: true
        schema:
          type: string
        example: a6ed82f6-32b5-46d8-a3a3-c36cc574abd9
      - name: channelId
        in: path
        description: Id of slack channel
        required: true
        schema:
          type: string
        example: C012AB3CD
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
  /api/v1/notification-service/notifications:
    delete:
      tags:
      - Notification Service
      summary: Delete all notification message
      operationId: deleteNotificationAllMessage
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
  /api/v1/notification-service/notifications/{id}:
    delete:
      tags:
      - Notification Service
      summary: Delete notification message
      operationId: deleteNotificationMessage
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
  /api/v1/policy-admin/actions:
    get:
      tags:
      - Policy Administration
      summary: Get details of all actions
      operationId: getActions
      parameters:
      - name: filter
        in: query
        description: Filter query
        schema:
          type: string
        example: name%20eq%20iam.policy.create
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
  /api/v1/policy-admin/consumers:
    get:
      tags:
      - Policy Administration
      summary: Get a list of consumers
      operationId: getConsumers
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
  /api/v1/policy-admin/permissions:
    post:
      tags:
      - Policy Administration
      summary: Create a permission
      operationId: createPermission
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PermissionDto'
        required: false
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
    get:
      tags:
      - Policy Administration
      summary: Get permission details
      operationId: getPermissions
      parameters:
      - name: filter
        in: query
        description: Filter query
        schema:
          type: string
        example: name%20eq%20per1
      - name: pageToken
        in: query
        description: Page token
        schema:
          type: string
        example: 18CE4C10585F4525BE35801AC7F7EBA4C3
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
  /api/v1/policy-admin/permissions/{id}:
    delete:
      tags:
      - Policy Administration
      summary: Delete a specified permission
      operationId: deletePermission
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
    get:
      tags:
      - Policy Administration
      summary: Get permission details specified by Id
      operationId: getPermissionById
      parameters:
      - name: id
        in: path
        description: Id of permission
        required: true
        schema:
          type: string
        example: a6ed82f6-32b5-46d8-a3a3-c36cc574abd9
      - name: getReferences
        in: query
        description: Boolean to specify whether to get references in roles and/or policies
        schema:
          type: boolean
        example: 'true'
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
    patch:
      tags:
      - Policy Administration
      summary: Update permission details
      operationId: updatePermission
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PermissionDto'
        required: false
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
  /api/v1/policy-admin/policies:
    post:
      tags:
      - Policy Administration
      summary: Create a policy
      operationId: createPolicy
      parameters:
      - name: resource
        in: query
        description: Resource
        schema:
          type: string
        example: /a/b/c
      - name: consumer
        in: query
        description: Consumer
        schema:
          type: string
        example: secretmanager
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PolicyDto'
        required: false
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
    get:
      tags:
      - Policy Administration
      summary: Get all policies
      operationId: getAllPolicies
      parameters:
      - name: filter
        in: query
        description: Filter query
        schema:
          type: string
        example: name%20eq%20Role
      - name: returnAttrs
        in: query
        description: Attribute names
        schema:
          type: string
        example: name,resource
      - name: pageToken
        in: query
        description: Page token
        schema:
          type: string
        example: 18CE4C10585F4525BE35801AC7F7EBA4C3
      - name: resource
        in: query
        description: Resource
        schema:
          type: string
        example: /a/b/c
      - name: consumer
        in: query
        description: Consumer
        schema:
          type: string
        example: secretmanager
      - name: consumerResourceSpecific
        in: query
        description: ConsumerResourceSpecific
        schema:
          type: string
        example: 'true'
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
    patch:
      tags:
      - Policy Administration
      summary: Update policies details
      operationId: updatePoliciesForResource
      parameters:
      - name: attach
        in: query
        description: true/false
        schema:
          type: boolean
        example: 'true'
      - name: resource
        in: query
        description: Resource
        schema:
          type: string
        example: /a/b/c
      - name: consumer
        in: query
        description: Consumer
        schema:
          type: string
        example: secretmanager
      - name: isInternalCall
        in: query
        description: true/false
        schema:
          type: boolean
        example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PolicyDto'
        required: false
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
  /api/v1/policy-admin/policies/recache:
    post:
      tags:
      - Policy Administration
      summary: Re-cache policies with policyIds
      operationId: recachePolicies
      requestBody:
        content:
          application/json:
            schema:
              type: array
              items:
                type: string
        required: false
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
  /api/v1/policy-admin/policies/validate:
    get:
      tags:
      - Policy Administration
      summary: Validate policies
      operationId: validatePolicies
      parameters:
      - name: resource
        in: query
        description: Resource
        schema:
          type: string
        example: /a/b/c
      - name: consumer
        in: query
        description: Consumer
        schema:
          type: string
        example: secretmanager
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
  /api/v1/policy-admin/policies/{id}:
    delete:
      tags:
      - Policy Administration
      summary: Delete a policy
      operationId: deletePolicy
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
      - name: resource
        in: query
        description: Resource
        schema:
          type: string
        example: /a/b/c
      - name: consumer
        in: query
        description: Consumer
        schema:
          type: string
        example: secretmanager
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
    get:
      tags:
      - Policy Administration
      summary: Get policy with policyId
      operationId: getPolicy
      parameters:
      - name: id
        in: path
        description: Id of policy
        required: true
        schema:
          type: string
        example: a6ed82f6-32b5-46d8-a3a3-c36cc574abd9
      - name: compactResponse
        in: query
        description: Return conpact response or not
        schema:
          type: boolean
        example: 'true'
      - name: conditionJson
        in: query
        description: true or false
        schema:
          type: boolean
        example: 'true'
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
    patch:
      tags:
      - Policy Administration
      summary: Update policy details
      operationId: updatePolicy
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
      - name: attach
        in: query
        description: true/false
        schema:
          type: boolean
        example: 'true'
      - name: resource
        in: query
        description: Resource
        schema:
          type: string
        example: /a/b/c
      - name: consumer
        in: query
        description: Consumer
        schema:
          type: string
        example: secretmanager
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PolicyDto'
        required: false
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
  /api/v1/policy-admin/policies/{id}/recache:
    get:
      tags:
      - Policy Administration
      summary: Re-cache policy with policyId
      operationId: recachePolicy
      parameters:
      - name: id
        in: path
        description: Id of policy
        required: true
        schema:
          type: string
        example: a6ed82f6-32b5-46d8-a3a3-c36cc574abd9
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
  /api/v1/policy-admin/roles:
    post:
      tags:
      - Policy Administration
      summary: Create role
      operationId: createRole
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RoleDto'
        required: false
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
    get:
      tags:
      - Policy Administration
      summary: Get roles with tenantId
      operationId: getAllRoles
      parameters:
      - name: filter
        in: query
        description: Filter query
        schema:
          type: string
        example: name%20eq%20Role
      - name: returnAttrs
        in: query
        description: Attribute names
        schema:
          type: string
        example: name
      - name: pageToken
        in: query
        description: Page token
        schema:
          type: string
        example: 18CE4C10585F4525BE35801AC7F7EBA4C3
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
  /api/v1/policy-admin/roles/{id}:
    delete:
      tags:
      - Policy Administration
      summary: Delete role
      operationId: deleteRole
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
    get:
      tags:
      - Policy Administration
      summary: Get role with roleId
      operationId: getRole
      parameters:
      - name: id
        in: path
        description: Id of role
        required: true
        schema:
          type: string
        example: a6ed82f6-32b5-46d8-a3a3-c36cc574abd9
      - name: getReferences
        in: query
        description: Boolean to specify whether to get references in policies
        schema:
          type: boolean
        example: 'true'
      - name: compactResponse
        in: query
        description: Boolean to specify whether to get compact role object or not
        schema:
          type: boolean
        example: 'true'
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
    patch:
      tags:
      - Policy Administration
      summary: Update role details
      operationId: updateRole
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RoleDto'
        required: false
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
  /api/v1/secretmanager/keys/rotate:
    post:
      tags:
      - Secrets Manager
      summary: Rotate vault encryption key
      description: This operation will rotate key for tenant.
      operationId: rotateKey
      responses:
        '202':
          description: Accepted
  /api/v1/secretmanager/pwdpolicies:
    post:
      tags:
      - Secrets Manager
      summary: Create password policy for alphanumeric password
      operationId: createPasswordPolicy
      parameters:
      - name: action
        in: query
        description: Action
        schema:
          type: string
        example: validatePasswordOrPin
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PasswordPolicyDTO'
            example:
              name: DBPasswordPolicy
              description: Password Policy
              passwordType: alphanumeric
              minPasswordLength: '8'
              hasUpperCaseChars: 'false'
              hasLowerCaseChars: 'true'
              hasNumbers: 'true'
              hasSpecialChars: 'true'
              allowedSpecialChars: '@#$%('
        required: false
      responses:
        '201':
          description: Created
          content:
            application/json:
              schema:
                type: object
    get:
      tags:
      - Secrets Manager
      summary: Get a list of password policies
      operationId: getPasswordPolicies
      parameters:
      - name: filter
        in: query
        description: Filter query
        schema:
          type: string
        example: name%20eq%pwdPolicy
      - name: pageToken
        in: query
        description: Page token
        schema:
          type: string
        example: 18CE4C10585F4525BE35801AC7F7EBA4C3
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
  /api/v1/secretmanager/pwdpolicies/{id}:
    delete:
      tags:
      - Secrets Manager
      summary: Delete a specified password policy
      operationId: deletePasswordPolicy
      parameters:
      - name: id
        in: path
        description: Id of password policy
        required: true
        schema:
          type: string
        example: a6ed82f6-32b5-46d8-a3a3-c36cc574abd9
      responses:
        '204':
          description: No content
    get:
      tags:
      - Secrets Manager
      summary: Get specified password policy's details
      operationId: getPasswordPolicy
      parameters:
      - name: id
        in: path
        description: Id of password policy
        required: true
        schema:
          type: string
        example: a6ed82f6-32b5-46d8-a3a3-c36cc574abd9
      - name: action
        in: query
        description: Action
        schema:
          type: string
        example: generatePasswordOrPin
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
    patch:
      tags:
      - Secrets Manager
      summary: Update password policy details
      operationId: updatePasswordPolicy
      parameters:
      - name: id
        in: path
        description: Id of password policy
        required: true
        schema:
          type: string
        example: a6ed82f6-32b5-46d8-a3a3-c36cc574abd9
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PasswordPolicyDTO'
            example:
              name: DBPasswordPolicy
              description: Password Policy Updated
              passwordType: alphanumeric
              minPasswordLength: '8'
              hasUpperCaseChars: 'false'
              hasLowerCaseChars: 'true'
              hasNumbers: 'false'
              hasSpecialChars: 'true'
              allowedSpecialChars: '@#$%('
              pinLength: '9'
        required: false
      responses:
        '204':
          description: No content
  /api/v1/secretmanager/resourceContainers:
    get:
      tags:
      - Secrets Manager
      summary: Get IDs of all container resources
      operationId: getResourceContainers
      parameters:
      - name: path
        in: query
        description: Secret path
        required: true
        schema:
          type: string
        example: /machine/DB
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
  /api/v1/secretmanager/secret-templates/static:
    post:
      tags:
      - Secrets Manager
      summary: Create StaticSecretTemplate for static secret
      operationId: createSecretParam
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/StaticSecretTemplateDTO'
            example:
              secretType: AWSServiceSecretTes
              description: description
              rotationInterval: '30'
              parameters:
              - name: url
                description: DB Hostname
                mask: 'false'
                required: true
                type: singleLine
                metadata: 'true'
              - name: username
                description: DB Username
                mask: 'true'
                required: false
                type: multiLine
                metadata: 'false'
              - name: password
                description: DB Password
                mask: 'true'
                required: true
                type: password
                metadata: 'false'
              - name: test file
                description: test file upload
                mask: 'false'
                required: true
                type: fileUpload
                metadata: 'false'
              passwordPolicyId: 81910feb-92d3-4583-b9a9-dd3476381a6b
        required: false
      responses:
        '201':
          description: Created
          content:
            application/json:
              schema:
                type: object
    get:
      tags:
      - Secrets Manager
      summary: Get static secret template
      operationId: getSecretParams
      parameters:
      - name: filter
        in: query
        description: Filter query
        schema:
          type: string
        example: name%20eq%20secretType
      - name: pageToken
        in: query
        description: Page token
        schema:
          type: string
        example: 18CE4C10585F4525BE35801AC7F7EBA4C3
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
  /api/v1/secretmanager/secret-templates/static/{id}:
    delete:
      tags:
      - Secrets Manager
      summary: Delete static secret template
      operationId: deleteSecretParam
      parameters:
      - name: id
        in: path
        description: Id of static secret template
        required: true
        schema:
          type: string
        example: a6ed82f6-32b5-46d8-a3a3-c36cc574abd9
      responses:
        '204':
          description: No content
    get:
      tags:
      - Secrets Manager
      summary: Get a specified static secret template
      operationId: getSecretParam
      parameters:
      - name: id
        in: path
        description: Id of static secret template
        required: true
        schema:
          type: string
        example: a6ed82f6-32b5-46d8-a3a3-c36cc574abd9
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
    patch:
      tags:
      - Secrets Manager
      summary: Update static secret template parameteres
      operationId: updateSecretParam
      parameters:
      - name: id
        in: path
        description: Id of static secret template
        required: true
        schema:
          type: string
        example: a6ed82f6-32b5-46d8-a3a3-c36cc574abd9
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/StaticSecretTemplateDTO'
        required: false
      responses:
        '204':
          description: No content
  /api/v1/secretmanager/vault:
    post:
      tags:
      - Secrets Manager
      summary: Create a vault for the Secrets Manager
      description: This operation should be called only by administrator and only once per tenant.
      operationId: initializeVault
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/VaultDTO'
            example:
              name: my-vault
              description: Production secrets vault
              rotationTime: '90'
              encryptionAlgorithm: AES
              defaultNotificationMediumId: 01d4b73e-46b3-4347-842d-6b556dc7f9b2
              keyRotationScheduleTime: 04:00
              staticExpiryReminderFrequency: Daily
              staticExpiryReminderTime: 04:00
              dynamicRotationScheduleTime: 04:30
              dynamicRotationIntervalHours: '24'
              recipients:
                userIds:
                - g1bfrv2idml7sxfb5q70
                tags: []
                channelIds: null
        required: false
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
        '400':
          description: 'Bad request. Returned for the following violations:

            - `SM-0174` — `keyRotationScheduleTime` and `dynamicRotationScheduleTime` are less than 30 minutes apart. Both
            fields are validated against their resolved values; omitted fields are replaced by their defaults (`04:00` and
            `04:30`) before the check runs.

            - `SM-0175` — `staticExpiryReminderFrequency` is not one of `Daily`, `Weekly`, or `Off`.

            - `SM-0176` — `staticExpiryReminderDay` is missing or not in range 1–7 when `staticExpiryReminderFrequency` is
            `Weekly`.

            - `SM-0177` — `dynamicRotationIntervalHours` is not one of `4`, `8`, `12`, or `24`.

            - `SM-0178` — `keyRotationScheduleTime`, `staticExpiryReminderTime`, or `dynamicRotationScheduleTime` is not in
            `HH:mm` format. Message: `Invalid schedule time format. Expected HH:mm (e.g. 14:30).`

            '
    get:
      tags:
      - Secrets Manager
      summary: Get details of current active vault
      operationId: getVaults
      parameters:
      - name: searchName
        in: query
        schema:
          type: string
      - name: getmetadata
        in: query
        description: true/false
        schema:
          type: boolean
        example: 'true'
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
  /api/v1/secretmanager/vault/secrets:
    get:
      tags:
      - Secrets Manager
      summary: Get secret in vault hierarchy
      operationId: getResource
      parameters:
      - name: path
        in: query
        description: Secret path
        required: true
        schema:
          type: string
        example: /machine/DB
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
  /api/v1/secretmanager/vault/secrets/{id}:
    get:
      tags:
      - Secrets Manager
      summary: Get a specified secret details
      operationId: getResourceById
      parameters:
      - name: id
        in: path
        description: resource Id
        required: true
        schema:
          type: string
        example: a6ed82f6-32b5-46d8-a3a3-c36cc574abd9
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
  /api/v1/secretmanager/vault/{id}:
    delete:
      tags:
      - Secrets Manager
      summary: Delete a specified vault
      operationId: deleteVault
      parameters:
      - name: id
        in: path
        description: vault Id
        required: true
        schema:
          type: string
        example: a6ed82f6-32b5-46d8-a3a3-c36cc574abd9
      responses:
        '204':
          description: No content
    get:
      tags:
      - Secrets Manager
      summary: Get vault details
      operationId: getVault
      parameters:
      - name: id
        in: path
        description: vault Id
        required: true
        schema:
          type: string
        example: a6ed82f6-32b5-46d8-a3a3-c36cc574abd9
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
    patch:
      tags:
      - Secrets Manager
      summary: Update a specified vault's details
      operationId: updateVault
      parameters:
      - name: id
        in: path
        description: vault Id
        required: true
        schema:
          type: string
        example: a6ed82f6-32b5-46d8-a3a3-c36cc574abd9
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/VaultDTO'
            example:
              name: vault1
              description: vault description1
              rotationTime: '3'
              maxSecretRotationInterval: '60'
              defaultNotificationMediumId: 01d4b73e-46b3-4347-842d-6b556dc7f9b2
              keyRotationScheduleTime: 02:00
              staticExpiryReminderFrequency: Weekly
              staticExpiryReminderTime: 09:00
              staticExpiryReminderDay: '1'
              dynamicRotationScheduleTime: 03:00
              dynamicRotationIntervalHours: '24'
              recipients:
                userIds:
                - g1bfrv2idml7sxfb5q70
                tags: []
                channelIds: null
        required: false
      responses:
        '204':
          description: No content
        '400':
          description: 'Bad request. Returned for the following violations:

            - `SM-0174` — `keyRotationScheduleTime` and `dynamicRotationScheduleTime` are less than 30 minutes apart. Both
            fields are validated against each other; changing either one triggers the check.

            - `SM-0175` — `staticExpiryReminderFrequency` is not one of `Daily`, `Weekly`, or `Off`.

            - `SM-0176` — `staticExpiryReminderDay` is missing or not in range 1–7 when `staticExpiryReminderFrequency` is
            `Weekly`.

            - `SM-0177` — `dynamicRotationIntervalHours` is not one of `4`, `8`, `12`, or `24`.

            - `SM-0178` — `keyRotationScheduleTime`, `staticExpiryReminderTime`, or `dynamicRotationScheduleTime` is not in
            `HH:mm` format. Message: `Invalid schedule time format. Expected HH:mm (e.g. 14:30).`

            '
  /api/v1/secretmanager/vault/{vaultId}/accesssecrets:
    post:
      tags:
      - Secrets Manager
      summary: Access secret at a given path
      description: In case approval is required to access a secret then it sends an approval request with justification. Till
        the time the request is not approved, it sends the current status of the request in response. For example-"Pending
        Approval", "Approval Needed", "Access Denied".
      operationId: getSecretDataPost
      parameters:
      - name: vaultId
        in: path
        description: vault Id
        required: true
        schema:
          type: string
        example: a6ed82f6-32b5-46d8-a3a3-c36cc574abd9
      - name: path
        in: query
        description: Secret path
        required: true
        schema:
          type: string
        example: /machine/DB
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
    get:
      tags:
      - Secrets Manager
      summary: Get access secrets
      operationId: getSecretData
      parameters:
      - name: vaultId
        in: path
        description: vault Id
        required: true
        schema:
          type: string
        example: a6ed82f6-32b5-46d8-a3a3-c36cc574abd9
      - name: path
        in: query
        description: Secret path
        required: true
        schema:
          type: string
        example: /machine/DB
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
  /api/v1/secretmanager/vault/{vaultId}/downloadfile:
    get:
      tags:
      - Secrets Manager
      summary: Download secret file content
      operationId: downloadFile
      parameters:
      - name: vaultId
        in: path
        description: vault Id
        required: true
        schema:
          type: string
        example: a6ed82f6-32b5-46d8-a3a3-c36cc574abd9
      - name: path
        in: query
        description: Secret path
        required: true
        schema:
          type: string
        example: /machine/DB
      responses:
        '200':
          description: successful operation
          content:
            application/octet-stream:
              schema:
                type: object
  /api/v1/secretmanager/vault/{vaultId}/secret-metadata:
    get:
      tags:
      - Secrets Manager
      summary: Get secret metadata details
      operationId: getSecretMetaData
      parameters:
      - name: vaultId
        in: path
        description: vault Id
        required: true
        schema:
          type: string
        example: a6ed82f6-32b5-46d8-a3a3-c36cc574abd9
      - name: path
        in: query
        description: Secret path
        required: true
        schema:
          type: string
        example: /machine/DB
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
  /api/v1/secretmanager/vault/{vaultId}/secrets:
    post:
      tags:
      - Secrets Manager
      summary: Create a node/secret
      operationId: createSecretData
      parameters:
      - name: vaultId
        in: path
        description: vault Id
        required: true
        schema:
          type: string
        example: a6ed82f6-32b5-46d8-a3a3-c36cc574abd9
      - name: path
        in: query
        description: Secret/Node parent path
        required: true
        schema:
          type: string
        example: /machine/DB
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SecretDataDTO'
        required: false
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
        '400':
          description: 'Bad request. Returned for the following rotation interval violations when `rotationIntervalUnit` is
            `HOURS`:

            - `SM-0178` — `rotationInterval` in hours is not a valid multiple of the vault''s `dynamicRotationIntervalHours`.
            Message: `Secret rotation interval in hours must be a multiple of the vault''s dynamic rotation interval ({n}
            hours). Valid options: {list}.`

            - `SM-0179` — Hourly rotation is not allowed when the vault''s `dynamicRotationIntervalHours` is `24`. Message:
            `Hourly rotation interval is not allowed when the vault''s dynamic rotation frequency is set to 24 hours. Please
            use a days-based rotation interval.`

            - `SM-0180` — Hourly rotation interval is not allowed for static secrets (`secretNature: static`). Message: `Hourly
            rotation interval is not allowed for static secrets. Please use a days-based rotation interval.`

            '
    delete:
      tags:
      - Secrets Manager
      summary: Delete node/secret
      operationId: deleteSecretData
      parameters:
      - name: vaultId
        in: path
        description: vault Id
        required: true
        schema:
          type: string
        example: a6ed82f6-32b5-46d8-a3a3-c36cc574abd9
      - name: path
        in: query
        description: Secret path
        required: true
        schema:
          type: string
        example: /machine/DB
      responses:
        '204':
          description: No content
    get:
      tags:
      - Secrets Manager
      summary: Get Nodes/Secrets on one level under given parent
      operationId: getOneLevelSecretData
      parameters:
      - name: type
        in: query
        description: node or secret
        schema:
          type: string
        example: node
      - name: pageToken
        in: query
        description: Page Token
        schema:
          type: string
        example: 18CE4C10585F4525BE35801AC7F7EBA4C3
      - name: path
        in: query
        description: Secret path
        required: true
        schema:
          type: string
        example: /machine/DB
      - name: getmetadata
        in: query
        description: true or false
        schema:
          type: boolean
        example: 'true'
      - name: recursiveSecrets
        in: query
        description: boolean value
        schema:
          type: string
          default: 'false'
        example: 'true'
      - name: filter
        in: query
        description: Filter query
        schema:
          type: string
        example: name%20eq%20secretType
      - name: vaultId
        in: path
        description: vault Id
        required: true
        schema:
          type: string
        example: a6ed82f6-32b5-46d8-a3a3-c36cc574abd9
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
    patch:
      tags:
      - Secrets Manager
      summary: Update / Move Secret
      description: 'Updates a secret in the vault hierarchy. This endpoint handles three distinct operations — field-value
        update, rename, and move — determined by which fields are present in the request body. Only one operation should be
        performed per request.


        > **Note:** Only secrets (`entityType: secret`) can be moved. Folder nodes (`entityType: node`) cannot be moved using
        this endpoint.


        ---


        ### Update Field Values

        To update the credential data of a secret, include a `value` map in the request body containing the field names and
        their new values as defined by the secret''s template.


        For **dual-account secrets**, use `secondaryValue` instead of `value` to update the secondary credential fields. Attempting
        to update `value` (primary fields) on a dual-account secret is not allowed and returns `400 "Updating secret primary
        field values not allowed for dual account"`. Conversely, providing `secondaryValue` when dual account is not enabled
        on the secret returns `400 "Can not update secondary secret field values as dual account is not enabled"`.


        **Versioning and rotation behaviour** is controlled by two optional query parameters:

        - `saveAsVersion=true` — snapshots the current credential values as a new immutable version before applying the update.
        This allows the previous credential to be retrieved later via the versions endpoint. Defaults to `false`.

        - `syncToTarget=true` — after saving, pushes the new credential to all mapped rotation target accounts via the Britive
        Broker. When `syncToTarget` is omitted or set to `false`, the target resources are not updated automatically and must
        be rotated separately.


        For **dual-account secrets**, a successful `syncToTarget` sync triggers the Primary/Secondary account swap, alternating
        which account holds the active credential to ensure zero downtime during rotation.


        ---


        ### Rename

        To rename a secret, include the `name` field in the request body with the new name. The secret stays in its current
        folder; only its name changes.


        - The new name must be unique within the same parent folder.

        - Rename and move cannot be performed in the same request. If both `name` and `path` are changed simultaneously, the
        request is rejected with `400 "Not allowed to rename and move secret simultaneously."`


        ---


        ### Move (Secrets Only)

        To move a secret to a different folder, include the `path` field in the request body with the full destination vault-relative
        path including the secret name. The `path` query parameter identifies the secret''s current location; the `path` body
        field specifies where it should be moved to.


        For example, to move `my-secret` from `/folder1/subfolder1/my-secret` to `/folder1/my-secret`, send:

        ```

        PATCH /vault/{vaultId}/secrets?path=/folder1/subfolder1/my-secret

        { "path": "/folder1/my-secret" }

        ```


        **Path format rules** — violation returns `400 "Invalid secret path : {path}"`:

        - Must start with `/`

        - Must not contain `//` (double slashes)

        - Must not end with `/` (trailing slash)

        - The basename (last path segment) must equal the existing secret name — renaming and moving in the same request is
        not supported


        **Required permissions on the destination folder** — violation returns `403 "Move not allowed due to missing permissions
        : {folder}"`:

        - `sm.node.create` — must be non-null and not Deny

        - `sm.node.delete` — must be non-null and not Deny


        The destination parent folder must already exist in the vault; moving a secret to a non-existent folder is not supported.

        '
      operationId: updateSecretData
      parameters:
      - name: vaultId
        in: path
        description: vault Id
        required: true
        schema:
          type: string
        example: a6ed82f6-32b5-46d8-a3a3-c36cc574abd9
      - name: path
        in: query
        description: Current vault-relative path of the secret to update
        required: true
        schema:
          type: string
        example: /machine/DB
      - name: saveAsVersion
        in: query
        description: Archive the existing credential as a new version before applying the update
        required: false
        schema:
          type: boolean
          default: false
        example: 'true'
      - name: syncToTarget
        in: query
        description: Push the new credential to all mapped target accounts via the Broker
        required: false
        schema:
          type: boolean
          default: false
        example: 'false'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SecretDataDTO'
            examples:
              updateFieldValues:
                summary: Update secret field values (standard secret)
                value:
                  value:
                    url: https://new-app.example.com
                    username: admin
                    password: new-p@ssw0rd
              updateDualAccountSecondaryValues:
                summary: Update secondary credential values (dual-account secret only)
                value:
                  secondaryValue:
                    username: secondary-admin
                    password: secondary-p@ssw0rd
              moveSecret:
                summary: Move secret to a new folder
                value:
                  path: /new/destination/my-secret
        required: false
      responses:
        '204':
          description: No content
        '400':
          description: 'Bad request. Returned for the following violations:

            - `"Not allowed to rename and move secret simultaneously."` — the request body changed both `name` and `path`
            at the same time.

            - `"Invalid secret path : {path}"` — the destination path is malformed (missing leading `/`, contains `//`, ends
            with `/`, or the basename does not match the existing secret name).

            - `"Updating secret primary field values not allowed for dual account"` — `value` was provided in the request
            body for a dual-account secret; use `secondaryValue` instead.

            - `"Can not update secondary secret field values as dual account is not enabled"` — `secondaryValue` was provided
            but the secret does not have dual account enabled.

            - `SM-0178` — `rotationInterval` in hours is not a valid multiple of the vault''s `dynamicRotationIntervalHours`
            (when `rotationIntervalUnit` is `HOURS`).

            - `SM-0179` — Hourly rotation is not allowed when the vault''s `dynamicRotationIntervalHours` is `24`.

            - `SM-0180` — Hourly rotation interval is not allowed for static secrets.

            '
        '403':
          description: 'Forbidden. Returned when the caller does not have the required permissions on the destination folder.

            - `"Move not allowed due to missing permissions : {folder}"` — the caller is missing `sm.node.create` or `sm.node.delete`
            (or both) on the destination folder.

            '
  /api/v1/secretmanager/vault/{vaultId}/secrets/file:
    post:
      tags:
      - Secrets Manager
      summary: Create a secret file
      operationId: createSecretFileData
      parameters:
      - name: secretData
        in: query
        required: true
        schema:
          type: string
      - name: vaultId
        in: path
        description: vault Id
        required: true
        schema:
          type: string
        example: a6ed82f6-32b5-46d8-a3a3-c36cc574abd9
      - name: path
        in: query
        description: Secret/Node parent path
        required: true
        schema:
          type: string
        example: /machine/DB
      requestBody:
        content:
          multipart/form-data:
            schema:
              type: object
              properties:
                file:
                  type: string
                  format: binary
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
    patch:
      tags:
      - Secrets Manager
      summary: Update secret file
      operationId: updateSecretFileData
      parameters:
      - name: secretData
        in: query
        schema:
          type: string
      - name: vaultId
        in: path
        description: vault Id
        required: true
        schema:
          type: string
        example: a6ed82f6-32b5-46d8-a3a3-c36cc574abd9
      - name: path
        in: query
        description: Secret path
        required: true
        schema:
          type: string
        example: /machine/DB
      requestBody:
        content:
          multipart/form-data:
            schema:
              type: object
              properties:
                file:
                  type: string
                  format: binary
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
  /api/v1/secretmanager/vault/{vaultId}/secrets/{secretId}/rotate/history:
    get:
      tags:
      - Secret Rotation
      summary: List Secret Rotation History
      description: Lists all rotation history for a secret, ordered by date (newest first).
      operationId: listSecretRotationHistory
      parameters:
      - name: vaultId
        in: path
        description: Vault identifier
        required: true
        schema:
          type: string
        example: a6ed82f6-32b5-46d8-a3a3-c36cc574abd9
      - name: secretId
        in: path
        description: Secret identifier
        required: true
        schema:
          type: string
        example: secret-123
      - name: size
        in: query
        description: Page size for pagination
        required: false
        schema:
          type: integer
          format: int32
          default: 10
        example: '10'
      - name: lastKey
        in: query
        description: Last evaluated key for pagination
        required: false
        schema:
          type: string
      responses:
        '200':
          description: List of rotation history entries
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/SecretRotationHistoryDTO'
        '404':
          description: Secret not found
  /api/v1/secretmanager/vault/{vaultId}/secrets/{secretId}/rotate/history/{timeId}:
    get:
      tags:
      - Secret Rotation
      summary: Get Secret Rotation History for Time ID
      description: Returns rotation history for a specific Time ID.
      operationId: getSecretRotationHistoryByTimeId
      parameters:
      - name: vaultId
        in: path
        description: Vault identifier
        required: true
        schema:
          type: string
        example: a6ed82f6-32b5-46d8-a3a3-c36cc574abd9
      - name: secretId
        in: path
        description: Secret identifier
        required: true
        schema:
          type: string
        example: secret-123
      - name: timeId
        in: path
        description: Time ID of the rotation history entry
        required: true
        schema:
          type: integer
          format: int64
        example: '1'
      responses:
        '200':
          description: Rotation history entry
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecretRotationHistoryDTO'
        '404':
          description: Rotation history entry not found
  /api/v1/secretmanager/vault/{vaultId}/secrets/{secretId}/versions:
    get:
      tags:
      - Secrets Manager
      summary: List Secret Versions
      description: Lists all versions for a secret, ordered by version number (newest first).
      operationId: listSecretVersions
      parameters:
      - name: vaultId
        in: path
        description: Vault identifier
        required: true
        schema:
          type: string
        example: a6ed82f6-32b5-46d8-a3a3-c36cc574abd9
      - name: secretId
        in: path
        description: Secret identifier
        required: true
        schema:
          type: string
        example: secret-123
      - name: size
        in: query
        description: Page size for pagination
        required: false
        schema:
          type: integer
          format: int32
          default: 10
        example: '10'
      - name: lastKey
        in: query
        description: Last evaluated key for pagination
        required: false
        schema:
          type: string
      responses:
        '200':
          description: List of secret versions
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/SecretVersionDataDTO'
        '404':
          description: Secret not found
  /api/v1/secretmanager/vault/{vaultId}/secrets/{secretId}/versions/{version}:
    get:
      tags:
      - Secrets Manager
      summary: Get Secret Data for Version
      description: Returns the decrypted secret data for a specific version number.
      operationId: getSecretDataForVersion
      parameters:
      - name: vaultId
        in: path
        description: Vault identifier
        required: true
        schema:
          type: string
        example: a6ed82f6-32b5-46d8-a3a3-c36cc574abd9
      - name: secretId
        in: path
        description: Secret identifier
        required: true
        schema:
          type: string
        example: secret-123
      - name: version
        in: path
        description: Version number
        required: true
        schema:
          type: integer
          format: int32
        example: '1'
      responses:
        '200':
          description: Secret version data
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecretVersionDataDTO'
        '404':
          description: Version not found
components:
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
  schemas:
    AccountDetailsDTO:
      type: object
      description: Account on the target resource that receives the updated credential
      properties:
        name:
          type: string
          description: Account name on the target resource
          example: svc_account
        value:
          type: string
          description: Account identifier value
          example: svc_account
    ChannelMembership:
      type: object
      properties:
        userId:
          type: string
        emailId:
          type: string
        channels:
          uniqueItems: true
          type: array
          items:
            type: string
    IDNamePair:
      type: object
      properties:
        id:
          type: string
        name:
          type: string
    MemberDto:
      type: object
      properties:
        tags:
          uniqueItems: true
          type: array
          items:
            $ref: '#/components/schemas/IDNamePair'
        tokens:
          uniqueItems: true
          type: array
          items:
            $ref: '#/components/schemas/IDNamePair'
        users:
          uniqueItems: true
          type: array
          items:
            $ref: '#/components/schemas/IDNamePair'
        serviceIdentities:
          uniqueItems: true
          type: array
          items:
            $ref: '#/components/schemas/IDNamePair'
    NotificationMediumDto:
      type: object
      properties:
        id:
          type: string
        name:
          maxLength: '30'
          minLength: '1'
          pattern: \s*[a-zA-Z0-9\s*_-]+\s*
          type: string
        description:
          maxLength: '255'
          minLength: '0'
          type: string
        type:
          maxLength: '30'
          minLength: '1'
          pattern: \s*[a-zA-Z]+\s*
          type: string
        connectionParameters:
          type: object
          additionalProperties:
            type: string
        headers:
          type: object
          additionalProperties:
            type: string
        referenceCount:
          maximum: '1'
          minimum: '-1'
          type: integer
          format: int32
    PasswordPolicyDTO:
      type: object
      properties:
        id:
          type: string
        name:
          maxLength: '30'
          minLength: '1'
          pattern: ^[a-zA-Z0-9-_\s]{1,30}$
          type: string
        description:
          maxLength: '255'
          minLength: '0'
          type: string
        passwordType:
          pattern: \s*alphanumeric\s*|\s*pin\s*
          type: string
        allowedSpecialChars:
          pattern: '[^a-zA-Z0-9]+'
          type: string
        minPasswordLength:
          type: integer
          format: int32
        hasUpperCaseChars:
          type: boolean
        hasLowerCaseChars:
          type: boolean
        hasNumbers:
          type: boolean
        hasSpecialChars:
          type: boolean
        pinLength:
          type: integer
          format: int32
        passwordOrPin:
          type: string
    PermissionDto:
      required:
      - actions
      - resources
      type: object
      properties:
        id:
          type: string
        name:
          pattern: \s*[a-zA-Z0-9-_\s]+\s*
          type: string
        description:
          maxLength: '255'
          minLength: '0'
          type: string
        consumer:
          maxLength: '30'
          minLength: '0'
          pattern: \s*[a-zA-Z]+\s*
          type: string
        actions:
          uniqueItems: true
          type: array
          items:
            type: string
        resources:
          uniqueItems: true
          type: array
          items:
            type: string
        isInline:
          type: boolean
        isReadOnly:
          type: boolean
    PolicyDto:
      type: object
      properties:
        id:
          type: string
        name:
          maxLength: '128'
          minLength: '1'
          pattern: \s*[a-zA-Z0-9-_\s]+\s*
          type: string
        description:
          maxLength: '255'
          minLength: '0'
          type: string
        isActive:
          type: boolean
        isDraft:
          type: boolean
        isReadOnly:
          type: boolean
        condition:
          type: object
          properties: {}
        permissions:
          uniqueItems: true
          type: array
          items:
            $ref: '#/components/schemas/PermissionDto'
        members:
          $ref: '#/components/schemas/MemberDto'
        roles:
          uniqueItems: true
          type: array
          items:
            $ref: '#/components/schemas/RoleDto'
        resources:
          uniqueItems: true
          type: array
          items:
            type: string
        accessLevel:
          type: string
        resource:
          type: string
        consumer:
          type: string
        accessType:
          pattern: \s*Allow\s*|\s*Deny\s*
          type: string
        resourceLabels:
          type: object
          additionalProperties:
            type: array
            items:
              type: string
    Recipients:
      type: object
      properties:
        userIds:
          uniqueItems: true
          type: array
          items:
            type: string
        tags:
          uniqueItems: true
          type: array
          items:
            type: string
        approverGroups:
          uniqueItems: true
          type: array
          items:
            type: string
        channelIds:
          uniqueItems: true
          type: array
          items:
            type: string
        slackAppChannels:
          uniqueItems: true
          type: array
          items:
            type: string
        teamsAppChannels:
          type: array
          items:
            $ref: '#/components/schemas/TeamsAppChannels'
    RevokeData:
      type: object
      properties:
        revokerComment:
          maxLength: '255'
          minLength: '1'
          type: string
        killSession:
          type: boolean
        approvals:
          type: array
          items:
            type: string
    RoleDto:
      type: object
      properties:
        id:
          type: string
        name:
          maxLength: '64'
          minLength: '1'
          pattern: \s*[a-zA-Z0-9-_\s]+\s*
          type: string
        description:
          maxLength: '255'
          minLength: '0'
          type: string
        permissions:
          uniqueItems: true
          type: array
          items:
            $ref: '#/components/schemas/PermissionDto'
        isReadOnly:
          type: boolean
    RotationSettingsDTO:
      type: object
      description: Rotation target and notification settings embedded in a secret
      properties:
        notificationMedium:
          type: array
          description: Notification medium IDs
          items:
            type: string
        recipients:
          $ref: '#/components/schemas/Recipients'
        targetData:
          $ref: '#/components/schemas/RotationTargetDTO'
    RotationTargetDTO:
      type: object
      description: 'The target resource and account that will be updated during rotation, along with the rotation template
        the Broker executes

        '
      properties:
        resource:
          type: string
          description: Identifier of the target resource. Must have rotation enabled in Resource Manager.
          example: prod-linux-server
        accountDetails:
          $ref: '#/components/schemas/AccountDetailsDTO'
        rotationTemplate:
          $ref: '#/components/schemas/RotationTemplateDTO'
    RotationTemplateDTO:
      type: object
      description: Defines the script/logic the Broker executes to update the credential on the target resource
      properties:
        templateId:
          type: string
          description: Unique identifier of the rotation template
          example: linux-password-rotation
        templateName:
          type: string
          description: Human-readable name of the rotation template
          example: Linux Password Rotation
        templateVariables:
          type: array
          description: 'Variables required by the rotation template. System-defined variables are populated automatically;
            user-defined variables must be supplied.

            '
          items:
            $ref: '#/components/schemas/RotationTemplateVariableDTO'
    RotationTemplateVariableDTO:
      type: object
      description: A single variable used by the rotation template
      properties:
        name:
          type: string
          description: Variable name as referenced in the rotation script
          example: sudoUser
        isSystemDefined:
          type: boolean
          description: True if populated automatically by the system; false if user-supplied
          example: 'false'
        values:
          type: array
          description: One or more values for this variable
          items:
            type: string
          example:
          - root
    SecretDataDTO:
      type: object
      properties:
        entityType:
          pattern: \s*node\s*|\s*secret\s*
          type: string
        id:
          type: string
        name:
          maxLength: '128'
          minLength: '1'
          pattern: ^[a-zA-Z0-9~`!@#$^&*\\(\)_+=\{\}|;:"?\.>\s-]{1,128}$
          type: string
        value:
          type: object
          additionalProperties:
            type: string
        secretMetadata:
          type: object
          description: 'Read-only map of metadata field names to their plain-text values. Populated automatically from fields
            whose metadata flag is true in the static secret template. Changes to metadata fields do not trigger a new secret
            version.

            '
          additionalProperties:
            type: string
        description:
          maxLength: '255'
          minLength: '0'
          type: string
        staticSecretTemplateId:
          type: string
        secretMode:
          pattern: shared|non-shared
          type: string
        secretNature:
          pattern: static|dynamic
          type: string
        lastRotation:
          type: string
        nextRotation:
          type: string
        path:
          type: string
          description: 'Vault-relative path of the secret. When included in a PATCH request body with a value that differs
            from the current path, triggers a move operation. Only secrets (entityType=secret) can be moved; folder nodes
            cannot. Must start with ''/'', must not contain ''//'', must not end with ''/'', and the basename must match the
            existing secret name (rename and move are mutually exclusive). The destination folder must exist and the caller
            must have sm.node.create and sm.node.delete permissions on it.

            '
          example: /folder1/my-secret
        secretType:
          type: string
        rotationInterval:
          type: integer
          format: int32
        status:
          type: string
          enum:
          - Allow
          - Deny
          - Pending
          - Timeout
          - Rejected
          - ApprovalRequired
        metadata:
          type: object
          additionalProperties:
            type: string
            enum:
            - Allow
            - Deny
            - Pending
            - Timeout
            - Rejected
            - ApprovalRequired
        secondaryValue:
          type: object
          description: Secondary credential key-value map. Required only when dualAccount is true (Dual Account secrets).
          additionalProperties:
            type: string
        dualAccount:
          type: boolean
          description: 'When true the secret holds two sets of credentials (Primary in value and Secondary in secondaryValue)
            that alternate on each rotation cycle to ensure zero downtime.

            '
          default: false
        rotationSettings:
          $ref: '#/components/schemas/RotationSettingsDTO'
        filename:
          type: string
        registrationStatus:
          type: string
        delegationEnabled:
          type: boolean
        rotationIntervalUnit:
          type: string
          description: 'Unit for the secret rotation interval. `DAYS` for static secrets, `HOURS` for dynamic secrets. Defaults
            to `DAYS` if not provided.

            '
          enum:
          - DAYS
          - HOURS
          default: DAYS
          example: DAYS
    SecretRotationHistoryDTO:
      type: object
      properties:
        timeId:
          type: integer
          format: int64
        rotationStartedAt:
          type: string
        vaultId:
          type: string
        secretId:
          type: string
        secretNature:
          type: string
        rotationCompletedAt:
          type: string
        rotatedBy:
          type: string
        rotationType:
          type: string
        rotationStatus:
          type: string
        summary:
          type: string
    SecretVersionDataDTO:
      type: object
      properties:
        version:
          type: integer
          format: int32
        vaultId:
          type: string
        secretId:
          type: string
        name:
          type: string
        parent:
          type: string
        path:
          type: string
        secretNature:
          type: string
        versionCreationDate:
          type: string
        versionCreationType:
          type: string
        createdBy:
          type: string
        updatedBy:
          type: string
        isDraft:
          type: boolean
        description:
          type: string
        value:
          type: object
          additionalProperties:
            type: string
    StaticSecretFieldParamsDTO:
      required:
      - mask
      - required
      - type
      type: object
      properties:
        name:
          maxLength: '30'
          minLength: '1'
          pattern: ^[a-zA-Z0-9-_\s]{1,30}$
          type: string
        description:
          maxLength: '255'
          minLength: '0'
          type: string
        mask:
          type: boolean
        required:
          type: boolean
        type:
          pattern: singleLine|multiLine|password|fileUpload|otp|otpSeed|recoveryKeys|resource|account
          type: string
        allowDualValues:
          type: boolean
          description: 'Applicable only when type is account or password. When true, the secret must carry two values (Primary
            and Secondary) for this field, enabling the Dual Account rotation feature.

            '
        discoverable:
          type: boolean
          description: 'Applicable only when type is account. When true, users can browse and select accounts discovered from
            the linked resource in Resource Manager instead of entering an account name manually.

            '
        metadata:
          type: boolean
          description: Marks the field as metadata (non-sensitive). Changes to metadata fields do not trigger a new secret
            version.
    StaticSecretTemplateDTO:
      type: object
      properties:
        id:
          type: string
        secretType:
          maxLength: '30'
          minLength: '1'
          pattern: ^[a-zA-Z0-9-_\s]{1,30}$
          type: string
        description:
          maxLength: '255'
          minLength: '0'
          type: string
        rotationInterval:
          type: integer
          format: int32
        parameters:
          type: array
          items:
            $ref: '#/components/schemas/StaticSecretFieldParamsDTO'
        passwordPolicyId:
          type: string
        passwordRepetitionLimit:
          type: integer
          format: int32
          description: Minimum number of password versions to retain before a previous value can be reused.
        refCount:
          type: integer
          format: int32
          description: Number of active (non-deleted) secrets that reference this template. Maintained automatically by the
            system; cannot be set by the caller.
    TeamsAppChannels:
      type: object
      properties:
        team:
          type: string
        channels:
          uniqueItems: true
          type: array
          items:
            type: string
    VaultDTO:
      type: object
      properties:
        id:
          type: string
        name:
          maxLength: '30'
          minLength: '1'
          pattern: ^[a-zA-Z0-9-_\s]{1,30}$
          type: string
        description:
          maxLength: '255'
          minLength: '0'
          type: string
        lastRotation:
          type: string
        nextRotation:
          type: string
        status:
          type: string
        encryptionAlgorithm:
          type: string
        metadata:
          type: object
          additionalProperties:
            type: string
            enum:
            - Allow
            - Deny
            - Pending
            - Timeout
            - Rejected
            - ApprovalRequired
        defaultNotificationMediumId:
          type: string
        recipients:
          $ref: '#/components/schemas/Recipients'
        maxSecretRotationInterval:
          type: integer
          format: int32
        rotationTime:
          type: integer
          format: int32
        keyRotationScheduleTime:
          type: string
          description: 'Time of day (HH:mm, 24-hour) at which the daily vault key rotation task runs. Must be at least 30
            minutes apart from `dynamicRotationScheduleTime` (SM-0174). Invalid format returns SM-0178. Defaults to `04:00`
            if not provided.

            '
          default: 04:00
          example: 02:00
        staticExpiryReminderFrequency:
          type: string
          description: 'Frequency for sending static secret expiry reminders. Allowed values: `Daily`, `Weekly`, `Off` (SM-0175).
            Defaults to `Daily` if not provided.

            '
          enum:
          - Daily
          - Weekly
          - 'Off'
          default: Daily
          example: Weekly
        staticExpiryReminderTime:
          type: string
          description: 'Time of day (HH:mm, 24-hour) at which expiry reminder notifications are sent. Invalid format returns
            SM-0178. Defaults to `04:00` if not provided.

            '
          default: 04:00
          example: 09:00
        staticExpiryReminderDay:
          type: integer
          format: int32
          description: 'Day of week for weekly expiry reminders (1=Monday, 7=Sunday). Required when `staticExpiryReminderFrequency`
            is `Weekly` (SM-0176).

            '
          minimum: '1'
          maximum: '7'
          example: '1'
        dynamicRotationScheduleTime:
          type: string
          description: 'Start time (HH:mm, 24-hour) for the bulk dynamic secret rotation task. Must be at least 30 minutes
            apart from `keyRotationScheduleTime` (SM-0174). Invalid format returns SM-0178. Defaults to `04:30` if not provided.

            '
          default: 04:30
          example: 03:00
        dynamicRotationIntervalHours:
          type: integer
          format: int32
          description: 'How often (in hours) to run the bulk dynamic secret rotation task. Allowed values: `4`, `8`, `12`,
            `24` (SM-0177). Defaults to `24` if not provided.

            '
          enum:
          - '4'
          - '8'
          - '12'
          - '24'
          default: 24
          example: '24'
x-api-evangelist:
  assembled_from: https://docs.britive.com/apidocs/ (one OpenAPI fragment per operation page, .md variant)
  assembled_on: '2026-08-08'
  fragments: 71
  note: Britive publishes this contract only as per-operation fragments inside its Document360 API reference. This file is
    the faithful union of those fragments; the verbatim assembly is in openapi/_original/.