Secrets
All operations require authentication.
List secretsProduction
Lists secret paths with metadata (versions, CAS settings). The content of secret versions is not accessible through this API.
Path parameters
Okms ID
Query parameters
Filter resources on IAM tags
Headers
Pagination cursor
Pagination size
Response
IAM resource metadata
Secret metadata
Unique identifier of the secret
Data of the secret version
Example uses okmsId = 00000000-0000-0000-0000-000000000000
$ curl https:/[ { "iam": { "displayName": "string", "id": "00000000-0000-0000-0000-000000000000", "state": "EXPIRED", "tags": { "key": "string" }, "urn": "string" }, "metadata": { "casRequired": true, "createdAt": "2024-01-01T12:00:00Z", "currentVersion": 0, "customMetadata": { "key": "string" }, "deactivateVersionAfter": "string", "maxVersions": 0, "oldestVersion": 0, "updatedAt": "2024-01-01T12:00:00Z" }, "path": "string", "version": { "createdAt": "2024-01-01T12:00:00Z", "data": "This is a content of any type !", "deactivatedAt": "2024-01-01T12:00:00Z", "id": 0, "state": "ACTIVE" } }]
Create a secretProduction
Creates a secret at the given path and stores the first version. Path and engine defaults (CAS, max versions) apply from the service secret config unless overridden in the body.
Path parameters
Okms ID
Request body (required)
Secret metadata
Secret path
Data of the secret version
Response
Secret metadata
Secret identifier
Example uses okmsId = 00000000-0000-0000-0000-000000000000
$ curl https:/{ "metadata": { "casRequired": true, "createdAt": "2024-01-01T12:00:00Z", "currentVersion": 0, "customMetadata": { "key": "string" }, "deactivateVersionAfter": "string", "maxVersions": 0, "oldestVersion": 0, "updatedAt": "2024-01-01T12:00:00Z" }, "path": "string"}
Get a secretProduction
Returns a secret's metadata. By default the latest version is selected. Pass version to target another one.
Set includeData=true to also return that version's data (requires the matching IAM action).
Path parameters
Okms ID
Path
Query parameters
Secret data
Secret version. When omitted, the latest version will be returned.
Response
IAM resource metadata
Secret metadata
Unique identifier of the secret
Data of the secret version
Example uses okmsId = 00000000-0000-0000-0000-000000000000, path = string
$ curl https:/{ "iam": { "displayName": "string", "id": "00000000-0000-0000-0000-000000000000", "state": "EXPIRED", "tags": { "key": "string" }, "urn": "string" }, "metadata": { "casRequired": true, "createdAt": "2024-01-01T12:00:00Z", "currentVersion": 0, "customMetadata": { "key": "string" }, "deactivateVersionAfter": "string", "maxVersions": 0, "oldestVersion": 0, "updatedAt": "2024-01-01T12:00:00Z" }, "path": "string", "version": { "createdAt": "2024-01-01T12:00:00Z", "data": "This is a content of any type !", "deactivatedAt": "2024-01-01T12:00:00Z", "id": 0, "state": "ACTIVE" }}
Update a secretProduction
Updates the secret: include version.data to add a new version, and/or metadata to change this secret's engine settings.
When cas is set, it must equal the current version for the write to succeed.
Path parameters
Okms ID
Path
Query parameters
Current secret version number. When the cas (Check and set) is specified, the current version of the secret is verified before updating it. In order for a write to be successful,cas must be set to the current version of the secret.
Request body (required)
Secret metadata
Secret version
Response
Secret metadata
Secret identifier
Example uses okmsId = 00000000-0000-0000-0000-000000000000, path = string
$ curl https:/{ "metadata": { "casRequired": true, "createdAt": "2024-01-01T12:00:00Z", "currentVersion": 0, "customMetadata": { "key": "string" }, "deactivateVersionAfter": "string", "maxVersions": 0, "oldestVersion": 0, "updatedAt": "2024-01-01T12:00:00Z" }, "path": "string"}
Delete a secretProduction
Deletes the secret and all its versions.
Path parameters
Okms ID
Path
Response
Example uses okmsId = 00000000-0000-0000-0000-000000000000, path = string
$ curl https:/List secret versionsProduction
Lists version numbers and states for the secret. Version data is not returned by this API.
Path parameters
Okms ID
Path
Headers
Pagination cursor
Pagination size
Response
Time of creation of the secret version
Secret version data
Time of deactivation of the secret version
Secret version
State of the secret version
ACTIVEDEACTIVATEDDELETEDExample uses okmsId = 00000000-0000-0000-0000-000000000000, path = string
$ curl https:/[ { "createdAt": "2024-01-01T12:00:00Z", "data": "This is a content of any type !", "deactivatedAt": "2024-01-01T12:00:00Z", "id": 0, "state": "ACTIVE" }]
Create a secret versionProduction
Appends a new version of the secret data. Optional cas must match the current version or the write is rejected.
Path parameters
Okms ID
Path
Query parameters
Current secret version number. When the cas (Check and set) is specified, the current version of the secret is verified before updating it. In order for a write to be successful,cas must be set to the current version of the secret.
Request body (required)
Secret version data in key value json format
Response
Time of creation of the secret version
Secret version data
Time of deactivation of the secret version
Secret version
State of the secret version
ACTIVEDEACTIVATEDDELETEDExample uses okmsId = 00000000-0000-0000-0000-000000000000, path = string
$ curl https:/{ "createdAt": "2024-01-01T12:00:00Z", "data": "This is a content of any type !", "deactivatedAt": "2024-01-01T12:00:00Z", "id": 0, "state": "ACTIVE"}
Get a secret versionProduction
Returns one version's metadata. Set includeData=true to also return the version data.
Reading the data requires a specific IAM right.
Path parameters
Okms ID
Path
Version
Query parameters
Secret version data
Response
Time of creation of the secret version
Secret version data
Time of deactivation of the secret version
Secret version
State of the secret version
ACTIVEDEACTIVATEDDELETEDExample uses okmsId = 00000000-0000-0000-0000-000000000000, path = string, version = 0
$ curl https:/{ "createdAt": "2024-01-01T12:00:00Z", "data": "This is a content of any type !", "deactivatedAt": "2024-01-01T12:00:00Z", "id": 0, "state": "ACTIVE"}
Update the state of a secret versionProduction
Changes the version state: activate, deactivate, or delete.
To modify the secret data, create a new version.
Path parameters
Okms ID
Path
Version
Request body (required)
State of the secret version
ACTIVEDEACTIVATEDDELETEDResponse
Time of creation of the secret version
Time of deactivation of the secret version
Secret version
State of the secret version
ACTIVEDEACTIVATEDDELETEDExample uses okmsId = 00000000-0000-0000-0000-000000000000, path = string, version = 0
$ curl https:/{ "createdAt": "2024-01-01T12:00:00Z", "deactivatedAt": "2024-01-01T12:00:00Z", "id": 0, "state": "ACTIVE"}
Get the secret configurationProduction
Returns the service-level defaults applied to new secrets: casRequired, maxVersions and deactivateVersionAfter.
Path parameters
Okms ID
Response
If set to true, the Cas (Check And Set) parameter will be required and verified for each secret update
Time duration before a version is deactivated. If 0s, default configuration (unlimited) is applied.
The number of versions to keep. If 0, default configuration (10) is applied.
Example uses okmsId = 00000000-0000-0000-0000-000000000000
$ curl https:/{ "casRequired": true, "deactivateVersionAfter": "string", "maxVersions": 0}
Update the secret configurationProduction
Updates the service-level defaults applied to new secrets. Existing secrets keep the metadata they were created with.
Path parameters
Okms ID
Request body (required)
If set to true, the Cas (Check And Set) parameter will be required and verified for each secret update
Time duration before a version is deactivated. If 0s, default configuration (unlimited) is applied.
The number of versions to keep. If 0, default configuration (10) is applied.
Response
If set to true, the Cas (Check And Set) parameter will be required and verified for each secret update
Time duration before a version is deactivated. If 0s, default configuration (unlimited) is applied.
The number of versions to keep. If 0, default configuration (10) is applied.
Example uses okmsId = 00000000-0000-0000-0000-000000000000
$ curl https:/{ "casRequired": true, "deactivateVersionAfter": "string", "maxVersions": 0}