openapi: 3.0.2
info:
  title: HashiCorp Vault Auth Secrets API
  description: HTTP API that gives you full access to Vault. All API routes are prefixed with `/v1/`.
  version: 1.9.3
  license:
    name: Mozilla Public License 2.0
    url: https://www.mozilla.org/en-US/MPL/2.0
tags:
- name: Secrets
paths:
  /cubbyhole/{path}:
    description: Pass-through secret storage to a token-specific cubbyhole in the storage backend, allowing you to read/write arbitrary data into secret storage.
    parameters:
    - name: path
      description: Specifies the path of the secret.
      in: path
      schema:
        type: string
      required: true
    x-vault-createSupported: true
    get:
      summary: HashiCorp Retrieve the secret at the specified location.
      operationId: getCubbyholePath
      tags:
      - Secrets
      parameters:
      - name: list
        description: Return a list if `true`
        in: query
        schema:
          type: string
      responses:
        '200':
          description: OK
    post:
      summary: HashiCorp Store a secret at the specified location.
      operationId: postCubbyholePath
      tags:
      - Secrets
      responses:
        '200':
          description: OK
    delete:
      summary: HashiCorp Deletes the secret at the specified location.
      operationId: deleteCubbyholePath
      tags:
      - Secrets
      responses:
        '204':
          description: empty body
  /secret/config:
    description: Configures settings for the KV store
    x-vault-createSupported: true
    get:
      summary: HashiCorp Read the backend level settings.
      operationId: getSecretConfig
      tags:
      - Secrets
      responses:
        '200':
          description: OK
    post:
      summary: HashiCorp Configure backend level settings that are applied to every key in the key-value store.
      operationId: postSecretConfig
      tags:
      - Secrets
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                cas_required:
                  type: boolean
                  description: If true, the backend will require the cas parameter to be set for each write
                delete_version_after:
                  type: integer
                  description: If set, the length of time before a version is deleted. A negative duration disables the use of delete_version_after on all keys. A zero duration clears the current setting. Accepts a Go duration format string.
                  format: seconds
                max_versions:
                  type: integer
                  description: The number of versions to keep for each key. Defaults to 10
      responses:
        '200':
          description: OK
  /secret/data/{path}:
    description: Write, Patch, Read, and Delete data in the Key-Value Store.
    parameters:
    - name: path
      description: Location of the secret.
      in: path
      schema:
        type: string
      required: true
    x-vault-createSupported: true
    get:
      summary: HashiCorp Write, Patch, Read, and Delete data in the Key-Value Store.
      operationId: getSecretDataPath
      tags:
      - Secrets
      responses:
        '200':
          description: OK
    post:
      summary: HashiCorp Write, Patch, Read, and Delete data in the Key-Value Store.
      operationId: postSecretDataPath
      tags:
      - Secrets
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                data:
                  type: object
                  description: The contents of the data map will be stored and returned on read.
                  format: map
                options:
                  type: object
                  description: Options for writing a KV entry. Set the "cas" value to use a Check-And-Set operation. If not set the write will be allowed. If set to 0 a write will only be allowed if the key doesn’t exist. If the index is non-zero the write will only be allowed if the key’s current version matches the version specified in the cas parameter.
                  format: map
                version:
                  type: integer
                  description: If provided during a read, the value at the version number will be returned
      responses:
        '200':
          description: OK
    delete:
      summary: HashiCorp Write, Patch, Read, and Delete data in the Key-Value Store.
      operationId: deleteSecretDataPath
      tags:
      - Secrets
      responses:
        '204':
          description: empty body
  /secret/delete/{path}:
    description: Marks one or more versions as deleted in the KV store.
    parameters:
    - name: path
      description: Location of the secret.
      in: path
      schema:
        type: string
      required: true
    x-vault-createSupported: true
    post:
      summary: HashiCorp Marks one or more versions as deleted in the KV store.
      operationId: postSecretDeletePath
      tags:
      - Secrets
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                versions:
                  type: array
                  description: The versions to be archived. The versioned data will not be deleted, but it will no longer be returned in normal get requests.
                  items:
                    type: integer
      responses:
        '200':
          description: OK
  /secret/destroy/{path}:
    description: Permanently removes one or more versions in the KV store
    parameters:
    - name: path
      description: Location of the secret.
      in: path
      schema:
        type: string
      required: true
    x-vault-createSupported: true
    post:
      summary: HashiCorp Permanently removes one or more versions in the KV store
      operationId: postSecretDestroyPath
      tags:
      - Secrets
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                versions:
                  type: array
                  description: The versions to destroy. Their data will be permanently deleted.
                  items:
                    type: integer
      responses:
        '200':
          description: OK
  /secret/metadata/{path}:
    description: Configures settings for the KV store
    parameters:
    - name: path
      description: Location of the secret.
      in: path
      schema:
        type: string
      required: true
    x-vault-createSupported: true
    get:
      summary: HashiCorp Configures settings for the KV store
      operationId: getSecretMetadataPath
      tags:
      - Secrets
      parameters:
      - name: list
        description: Return a list if `true`
        in: query
        schema:
          type: string
      responses:
        '200':
          description: OK
    post:
      summary: HashiCorp Configures settings for the KV store
      operationId: postSecretMetadataPath
      tags:
      - Secrets
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                cas_required:
                  type: boolean
                  description: If true the key will require the cas parameter to be set on all write requests. If false, the backend’s configuration will be used.
                custom_metadata:
                  type: object
                  description: User-provided key-value pairs that are used to describe arbitrary and version-agnostic information about a secret.
                  format: kvpairs
                delete_version_after:
                  type: integer
                  description: The length of time before a version is deleted. If not set, the backend's configured delete_version_after is used. Cannot be greater than the backend's delete_version_after. A zero duration clears the current setting. A negative duration will cause an error.
                  format: seconds
                max_versions:
                  type: integer
                  description: The number of versions to keep. If not set, the backend’s configured max version is used.
      responses:
        '200':
          description: OK
    delete:
      summary: HashiCorp Configures settings for the KV store
      operationId: deleteSecretMetadataPath
      tags:
      - Secrets
      responses:
        '204':
          description: empty body
  /secret/undelete/{path}:
    description: Undeletes one or more versions from the KV store.
    parameters:
    - name: path
      description: Location of the secret.
      in: path
      schema:
        type: string
      required: true
    x-vault-createSupported: true
    post:
      summary: HashiCorp Undeletes one or more versions from the KV store.
      operationId: postSecretUndeletePath
      tags:
      - Secrets
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                versions:
                  type: array
                  description: The versions to unarchive. The versions will be restored and their data will be returned on normal get requests.
                  items:
                    type: integer
      responses:
        '200':
          description: OK