openapi: 3.1.0
info:
  title: HashiCorp Vault HTTP Auth - AppRole Secrets - Transit API
  description: The Vault HTTP API provides full access to Vault functionality via HTTP. Every aspect of Vault can be controlled via this API including secrets management, authentication, system configuration, identity, and policy management.
  version: 1.15.0
  contact:
    name: HashiCorp
    url: https://www.vaultproject.io/
  license:
    name: Business Source License 1.1
    url: https://github.com/hashicorp/vault/blob/main/LICENSE
servers:
- url: https://127.0.0.1:8200/v1
  description: Local Vault server
- url: https://{vault_host}:{port}/v1
  description: Custom Vault server
  variables:
    vault_host:
      default: 127.0.0.1
    port:
      default: '8200'
security:
- VaultToken: []
tags:
- name: Secrets - Transit
  description: Transit secrets engine (encryption as a service)
paths:
  /transit/encrypt/{name}:
    post:
      operationId: transitEncrypt
      summary: Encrypt data
      description: Encrypts the provided plaintext using the named key.
      tags:
      - Secrets - Transit
      parameters:
      - name: name
        in: path
        required: true
        schema:
          type: string
        description: Name of the encryption key
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - plaintext
              properties:
                plaintext:
                  type: string
                  description: Base64-encoded plaintext
                context:
                  type: string
                  description: Base64-encoded context for key derivation
                key_version:
                  type: integer
                nonce:
                  type: string
                type:
                  type: string
                  enum:
                  - aes128-gcm96
                  - aes256-gcm96
                  - chacha20-poly1305
                  - rsa-2048
                  - rsa-3072
                  - rsa-4096
      responses:
        '200':
          description: Encrypted data
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    properties:
                      ciphertext:
                        type: string
                      key_version:
                        type: integer
  /transit/decrypt/{name}:
    post:
      operationId: transitDecrypt
      summary: Decrypt data
      description: Decrypts the provided ciphertext using the named key.
      tags:
      - Secrets - Transit
      parameters:
      - name: name
        in: path
        required: true
        schema:
          type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - ciphertext
              properties:
                ciphertext:
                  type: string
                context:
                  type: string
                nonce:
                  type: string
      responses:
        '200':
          description: Decrypted data
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    properties:
                      plaintext:
                        type: string
                        description: Base64-encoded plaintext
  /transit/keys/{name}:
    post:
      operationId: createTransitKey
      summary: Create an encryption key
      tags:
      - Secrets - Transit
      parameters:
      - name: name
        in: path
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                type:
                  type: string
                  enum:
                  - aes128-gcm96
                  - aes256-gcm96
                  - chacha20-poly1305
                  - ed25519
                  - ecdsa-p256
                  - ecdsa-p384
                  - ecdsa-p521
                  - rsa-2048
                  - rsa-3072
                  - rsa-4096
                derived:
                  type: boolean
                exportable:
                  type: boolean
                allow_plaintext_backup:
                  type: boolean
                convergent_encryption:
                  type: boolean
      responses:
        '204':
          description: Key created
    get:
      operationId: getTransitKey
      summary: Read an encryption key
      tags:
      - Secrets - Transit
      parameters:
      - name: name
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Key information
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    properties:
                      name:
                        type: string
                      type:
                        type: string
                      deletion_allowed:
                        type: boolean
                      derived:
                        type: boolean
                      exportable:
                        type: boolean
                      latest_version:
                        type: integer
                      min_available_version:
                        type: integer
                      min_decryption_version:
                        type: integer
                      min_encryption_version:
                        type: integer
                      supports_encryption:
                        type: boolean
                      supports_decryption:
                        type: boolean
                      supports_signing:
                        type: boolean
                      supports_derivation:
                        type: boolean
    delete:
      operationId: deleteTransitKey
      summary: Delete an encryption key
      tags:
      - Secrets - Transit
      parameters:
      - name: name
        in: path
        required: true
        schema:
          type: string
      responses:
        '204':
          description: Key deleted
components:
  securitySchemes:
    VaultToken:
      type: apiKey
      name: X-Vault-Token
      in: header
      description: Vault client token