{ "openapi": "3.0.3", "info": { "title": "Secret Vault API", "version": "1.0.0", "description": "The Versus Secret Vault \u2014 secrets, external-vault integrations, stored credentials, and rotation." }, "servers": [ { "url": "https://versus-demo.com" } ], "paths": { "/api/credentials/": { "get": { "operationId": "credentials_list", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "name": "ordering", "required": false, "in": "query", "description": "Which field to use when ordering the results.", "schema": { "type": "string" } }, { "name": "page", "required": false, "in": "query", "description": "A page number within the paginated result set.", "schema": { "type": "integer" } }, { "name": "page_size", "required": false, "in": "query", "description": "Number of results to return per page.", "schema": { "type": "integer" } }, { "name": "search", "required": false, "in": "query", "description": "A search term.", "schema": { "type": "string" } } ], "tags": [ "credentials" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaginatedCredentialList" } } }, "description": "" } }, "summary": "List credentials" }, "post": { "operationId": "credentials_create", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "tags": [ "credentials" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CredentialRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/CredentialRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/CredentialRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "201": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Credential" } } }, "description": "" } }, "summary": "Create credential" } }, "/api/credentials/{id}/": { "get": { "operationId": "credentials_retrieve", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this credential.", "required": true } ], "tags": [ "credentials" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Credential" } } }, "description": "" } }, "summary": "Retrieve credential" }, "put": { "operationId": "credentials_update", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this credential.", "required": true } ], "tags": [ "credentials" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CredentialRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/CredentialRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/CredentialRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Credential" } } }, "description": "" } }, "summary": "Update credential" }, "patch": { "operationId": "credentials_partial_update", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this credential.", "required": true } ], "tags": [ "credentials" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PatchedCredentialRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/PatchedCredentialRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/PatchedCredentialRequest" } } } }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Credential" } } }, "description": "" } }, "summary": "Update credential" }, "delete": { "operationId": "credentials_destroy", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this credential.", "required": true } ], "tags": [ "credentials" ], "security": [ { "jwtAuth": [] } ], "responses": { "204": { "description": "No response body" } }, "summary": "Delete credential" } }, "/api/extvault/connections/": { "get": { "operationId": "extvault_connections_list", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "name": "ordering", "required": false, "in": "query", "description": "Which field to use when ordering the results.", "schema": { "type": "string" } }, { "name": "page", "required": false, "in": "query", "description": "A page number within the paginated result set.", "schema": { "type": "integer" } }, { "name": "page_size", "required": false, "in": "query", "description": "Number of results to return per page.", "schema": { "type": "integer" } }, { "name": "search", "required": false, "in": "query", "description": "A search term.", "schema": { "type": "string" } } ], "tags": [ "extvault" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaginatedExternalVaultConnectionList" } } }, "description": "" } }, "summary": "List connections" }, "post": { "operationId": "extvault_connections_create", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "tags": [ "extvault" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExternalVaultConnectionRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/ExternalVaultConnectionRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/ExternalVaultConnectionRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "201": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExternalVaultConnection" } } }, "description": "" } }, "summary": "Create connection" } }, "/api/extvault/connections/{id}/": { "get": { "operationId": "extvault_connections_retrieve", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "string", "format": "uuid" }, "description": "A UUID string identifying this external vault connection.", "required": true } ], "tags": [ "extvault" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExternalVaultConnection" } } }, "description": "" } }, "summary": "Retrieve connection" }, "put": { "operationId": "extvault_connections_update", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "string", "format": "uuid" }, "description": "A UUID string identifying this external vault connection.", "required": true } ], "tags": [ "extvault" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExternalVaultConnectionRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/ExternalVaultConnectionRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/ExternalVaultConnectionRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExternalVaultConnection" } } }, "description": "" } }, "summary": "Update connection" }, "patch": { "operationId": "extvault_connections_partial_update", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "string", "format": "uuid" }, "description": "A UUID string identifying this external vault connection.", "required": true } ], "tags": [ "extvault" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PatchedExternalVaultConnectionRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/PatchedExternalVaultConnectionRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/PatchedExternalVaultConnectionRequest" } } } }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExternalVaultConnection" } } }, "description": "" } }, "summary": "Update connection" }, "delete": { "operationId": "extvault_connections_destroy", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "string", "format": "uuid" }, "description": "A UUID string identifying this external vault connection.", "required": true } ], "tags": [ "extvault" ], "security": [ { "jwtAuth": [] } ], "responses": { "204": { "description": "No response body" } }, "summary": "Delete connection" } }, "/api/extvault/connections/{id}/test/": { "post": { "operationId": "extvault_connections_test_create", "description": "Authenticate to the external vault + a cheap reachability check. Updates\nstate/last_ok_at/last_error. Never returns secret material.", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "string", "format": "uuid" }, "description": "A UUID string identifying this external vault connection.", "required": true } ], "tags": [ "extvault" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExternalVaultConnectionRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/ExternalVaultConnectionRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/ExternalVaultConnectionRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExternalVaultConnection" } } }, "description": "" } }, "summary": "Test: connection" } }, "/api/extvault/secrets/": { "get": { "operationId": "extvault_secrets_list", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "name": "ordering", "required": false, "in": "query", "description": "Which field to use when ordering the results.", "schema": { "type": "string" } }, { "name": "page", "required": false, "in": "query", "description": "A page number within the paginated result set.", "schema": { "type": "integer" } }, { "name": "page_size", "required": false, "in": "query", "description": "Number of results to return per page.", "schema": { "type": "integer" } }, { "name": "search", "required": false, "in": "query", "description": "A search term.", "schema": { "type": "string" } } ], "tags": [ "extvault" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaginatedExternalSecretRefList" } } }, "description": "" } }, "summary": "List secrets" }, "post": { "operationId": "extvault_secrets_create", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "tags": [ "extvault" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExternalSecretRefRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/ExternalSecretRefRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/ExternalSecretRefRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "201": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExternalSecretRef" } } }, "description": "" } }, "summary": "Create secret" } }, "/api/extvault/secrets/{id}/": { "get": { "operationId": "extvault_secrets_retrieve", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "string", "format": "uuid" }, "description": "A UUID string identifying this external secret ref.", "required": true } ], "tags": [ "extvault" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExternalSecretRef" } } }, "description": "" } }, "summary": "Retrieve secret" }, "put": { "operationId": "extvault_secrets_update", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "string", "format": "uuid" }, "description": "A UUID string identifying this external secret ref.", "required": true } ], "tags": [ "extvault" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExternalSecretRefRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/ExternalSecretRefRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/ExternalSecretRefRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExternalSecretRef" } } }, "description": "" } }, "summary": "Update secret" }, "patch": { "operationId": "extvault_secrets_partial_update", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "string", "format": "uuid" }, "description": "A UUID string identifying this external secret ref.", "required": true } ], "tags": [ "extvault" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PatchedExternalSecretRefRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/PatchedExternalSecretRefRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/PatchedExternalSecretRefRequest" } } } }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExternalSecretRef" } } }, "description": "" } }, "summary": "Update secret" }, "delete": { "operationId": "extvault_secrets_destroy", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "string", "format": "uuid" }, "description": "A UUID string identifying this external secret ref.", "required": true } ], "tags": [ "extvault" ], "security": [ { "jwtAuth": [] } ], "responses": { "204": { "description": "No response body" } }, "summary": "Delete secret" } }, "/api/extvault/secrets/{id}/test/": { "post": { "operationId": "extvault_secrets_test_create", "description": "Resolve the secret once to confirm the path + keys are correct. Returns\nwhether a username/password were found \u2014 NEVER the values.", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "string", "format": "uuid" }, "description": "A UUID string identifying this external secret ref.", "required": true } ], "tags": [ "extvault" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExternalSecretRefRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/ExternalSecretRefRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/ExternalSecretRefRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExternalSecretRef" } } }, "description": "" } }, "summary": "Test: secret" } }, "/api/password-changes/": { "get": { "operationId": "password_changes_list", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "name": "ordering", "required": false, "in": "query", "description": "Which field to use when ordering the results.", "schema": { "type": "string" } }, { "name": "page", "required": false, "in": "query", "description": "A page number within the paginated result set.", "schema": { "type": "integer" } }, { "name": "page_size", "required": false, "in": "query", "description": "Number of results to return per page.", "schema": { "type": "integer" } }, { "name": "search", "required": false, "in": "query", "description": "A search term.", "schema": { "type": "string" } }, { "in": "query", "name": "status", "schema": { "type": "string", "enum": [ "completed", "failed", "in_progress", "pending" ] }, "description": "* `pending` - Pending\n* `in_progress` - In Progress\n* `completed` - Completed\n* `failed` - Failed" } ], "tags": [ "password-changes" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaginatedPasswordChangeList" } } }, "description": "" } }, "summary": "List password changes" }, "post": { "operationId": "password_changes_create", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "tags": [ "password-changes" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PasswordChangeRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/PasswordChangeRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/PasswordChangeRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "201": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PasswordChange" } } }, "description": "" } }, "summary": "Create password change" } }, "/api/password-changes/{id}/": { "get": { "operationId": "password_changes_retrieve", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this password change.", "required": true } ], "tags": [ "password-changes" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PasswordChange" } } }, "description": "" } }, "summary": "Retrieve password change" }, "put": { "operationId": "password_changes_update", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this password change.", "required": true } ], "tags": [ "password-changes" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PasswordChangeRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/PasswordChangeRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/PasswordChangeRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PasswordChange" } } }, "description": "" } }, "summary": "Update password change" }, "patch": { "operationId": "password_changes_partial_update", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this password change.", "required": true } ], "tags": [ "password-changes" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PatchedPasswordChangeRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/PatchedPasswordChangeRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/PatchedPasswordChangeRequest" } } } }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PasswordChange" } } }, "description": "" } }, "summary": "Update password change" }, "delete": { "operationId": "password_changes_destroy", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this password change.", "required": true } ], "tags": [ "password-changes" ], "security": [ { "jwtAuth": [] } ], "responses": { "204": { "description": "No response body" } }, "summary": "Delete password change" } }, "/api/vault/app-principals/": { "get": { "operationId": "vault_app_principals_list", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "name": "page", "required": false, "in": "query", "description": "A page number within the paginated result set.", "schema": { "type": "integer" } }, { "name": "page_size", "required": false, "in": "query", "description": "Number of results to return per page.", "schema": { "type": "integer" } }, { "name": "search", "required": false, "in": "query", "description": "A search term.", "schema": { "type": "string" } } ], "tags": [ "vault" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaginatedVaultAppPrincipalList" } } }, "description": "" } }, "summary": "List app principals" }, "post": { "operationId": "vault_app_principals_create", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "tags": [ "vault" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VaultAppPrincipalRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/VaultAppPrincipalRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/VaultAppPrincipalRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "201": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VaultAppPrincipal" } } }, "description": "" } }, "summary": "Create app principal" } }, "/api/vault/app-principals/{id}/": { "get": { "operationId": "vault_app_principals_retrieve", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this vault app principal.", "required": true } ], "tags": [ "vault" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VaultAppPrincipal" } } }, "description": "" } }, "summary": "Retrieve app principal" }, "put": { "operationId": "vault_app_principals_update", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this vault app principal.", "required": true } ], "tags": [ "vault" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VaultAppPrincipalRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/VaultAppPrincipalRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/VaultAppPrincipalRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VaultAppPrincipal" } } }, "description": "" } }, "summary": "Update app principal" }, "patch": { "operationId": "vault_app_principals_partial_update", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this vault app principal.", "required": true } ], "tags": [ "vault" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PatchedVaultAppPrincipalRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/PatchedVaultAppPrincipalRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/PatchedVaultAppPrincipalRequest" } } } }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VaultAppPrincipal" } } }, "description": "" } }, "summary": "Update app principal" }, "delete": { "operationId": "vault_app_principals_destroy", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this vault app principal.", "required": true } ], "tags": [ "vault" ], "security": [ { "jwtAuth": [] } ], "responses": { "204": { "description": "No response body" } }, "summary": "Delete app principal" } }, "/api/vault/capabilities/": { "get": { "operationId": "vault_capabilities_retrieve", "tags": [ "vault" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "description": "No response body" } }, "summary": "List capabilitys" } }, "/api/vault/checkouts/": { "get": { "operationId": "vault_checkouts_retrieve", "tags": [ "vault" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "description": "No response body" } }, "summary": "List checkouts" } }, "/api/vault/checkouts/{id}/force-release/": { "post": { "operationId": "vault_checkouts_force_release_create", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "string" }, "required": true } ], "tags": [ "vault" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "description": "No response body" } }, "summary": "Force release: checkout" } }, "/api/vault/enrollments/": { "get": { "operationId": "vault_enrollments_retrieve", "tags": [ "vault" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "description": "No response body" } }, "summary": "List enrollments" }, "post": { "operationId": "vault_enrollments_create", "tags": [ "vault" ], "security": [ { "jwtAuth": [] } ], "responses": { "201": { "description": "No response body" } }, "summary": "Create enrollment" } }, "/api/vault/enrollments/{id}/": { "delete": { "operationId": "vault_enrollments_destroy", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "string" }, "required": true } ], "tags": [ "vault" ], "security": [ { "jwtAuth": [] } ], "responses": { "204": { "description": "No response body" } }, "summary": "Delete enrollment" } }, "/api/vault/enrollments/{id}/verify/": { "post": { "operationId": "vault_enrollments_verify_create", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "string" }, "required": true } ], "tags": [ "vault" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "description": "No response body" } }, "summary": "Verify: enrollment" } }, "/api/vault/enrollments/unenrolled_devices/": { "get": { "operationId": "vault_enrollments_unenrolled_devices_retrieve", "tags": [ "vault" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "description": "No response body" } }, "summary": "List unenrolled devices" } }, "/api/vault/fetch": { "get": { "operationId": "vault_fetch_retrieve", "description": "Machine secret fetch for service accounts. Authenticated ONLY by an app\nprincipal bearer token (never a human JWT), scoped by the D-11 hard-deny +\nallowed_paths glob + the principal's capabilities, and audited to the\nprincipal. This is the endpoint a computer uses to read a secret.\n\n GET /api/vault/fetch?ref=vault:///[&field=]\n Authorization: Bearer ", "tags": [ "vault" ], "security": [ {} ], "responses": { "200": { "description": "No response body" } }, "summary": "List fetchs" } }, "/api/vault/leases/": { "get": { "operationId": "vault_leases_retrieve", "tags": [ "vault" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "description": "No response body" } }, "summary": "List leases" }, "post": { "operationId": "vault_leases_create", "tags": [ "vault" ], "security": [ { "jwtAuth": [] } ], "responses": { "201": { "description": "No response body" } }, "summary": "Create lease" } }, "/api/vault/leases/{id}/renew/": { "post": { "operationId": "vault_leases_renew_create", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "string" }, "required": true } ], "tags": [ "vault" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "description": "No response body" } }, "summary": "Renew: lease" } }, "/api/vault/leases/{id}/revoke/": { "post": { "operationId": "vault_leases_revoke_create", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "string" }, "required": true } ], "tags": [ "vault" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "description": "No response body" } }, "summary": "Revoke: lease" } }, "/api/vault/mounts/": { "get": { "operationId": "vault_mounts_list", "parameters": [ { "name": "page", "required": false, "in": "query", "description": "A page number within the paginated result set.", "schema": { "type": "integer" } }, { "name": "page_size", "required": false, "in": "query", "description": "Number of results to return per page.", "schema": { "type": "integer" } }, { "name": "search", "required": false, "in": "query", "description": "A search term.", "schema": { "type": "string" } } ], "tags": [ "vault" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaginatedVaultMountList" } } }, "description": "" } }, "summary": "List mounts" }, "post": { "operationId": "vault_mounts_create", "tags": [ "vault" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VaultMountRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/VaultMountRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/VaultMountRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "201": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VaultMount" } } }, "description": "" } }, "summary": "Create mount" } }, "/api/vault/mounts/{id}/": { "get": { "operationId": "vault_mounts_retrieve", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this vault mount.", "required": true } ], "tags": [ "vault" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VaultMount" } } }, "description": "" } }, "summary": "Retrieve mount" }, "put": { "operationId": "vault_mounts_update", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this vault mount.", "required": true } ], "tags": [ "vault" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VaultMountRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/VaultMountRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/VaultMountRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VaultMount" } } }, "description": "" } }, "summary": "Update mount" }, "patch": { "operationId": "vault_mounts_partial_update", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this vault mount.", "required": true } ], "tags": [ "vault" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PatchedVaultMountRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/PatchedVaultMountRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/PatchedVaultMountRequest" } } } }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VaultMount" } } }, "description": "" } }, "summary": "Update mount" }, "delete": { "operationId": "vault_mounts_destroy", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this vault mount.", "required": true } ], "tags": [ "vault" ], "security": [ { "jwtAuth": [] } ], "responses": { "204": { "description": "No response body" } }, "summary": "Delete mount" } }, "/api/vault/mounts/{id}/test_connection/": { "post": { "operationId": "vault_mounts_test_connection_create", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this vault mount.", "required": true } ], "tags": [ "vault" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VaultMountRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/VaultMountRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/VaultMountRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VaultMount" } } }, "description": "" } }, "summary": "Test connection: mount" } }, "/api/vault/path-policies/": { "get": { "operationId": "vault_path_policies_list", "parameters": [ { "name": "page", "required": false, "in": "query", "description": "A page number within the paginated result set.", "schema": { "type": "integer" } }, { "name": "page_size", "required": false, "in": "query", "description": "Number of results to return per page.", "schema": { "type": "integer" } }, { "name": "search", "required": false, "in": "query", "description": "A search term.", "schema": { "type": "string" } } ], "tags": [ "vault" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaginatedVaultPathPolicyList" } } }, "description": "" } }, "summary": "List path policys" }, "post": { "operationId": "vault_path_policies_create", "tags": [ "vault" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VaultPathPolicyRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/VaultPathPolicyRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/VaultPathPolicyRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "201": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VaultPathPolicy" } } }, "description": "" } }, "summary": "Create path policy" } }, "/api/vault/path-policies/{id}/": { "get": { "operationId": "vault_path_policies_retrieve", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this vault path policy.", "required": true } ], "tags": [ "vault" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VaultPathPolicy" } } }, "description": "" } }, "summary": "Retrieve path policy" }, "put": { "operationId": "vault_path_policies_update", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this vault path policy.", "required": true } ], "tags": [ "vault" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VaultPathPolicyRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/VaultPathPolicyRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/VaultPathPolicyRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VaultPathPolicy" } } }, "description": "" } }, "summary": "Update path policy" }, "patch": { "operationId": "vault_path_policies_partial_update", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this vault path policy.", "required": true } ], "tags": [ "vault" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PatchedVaultPathPolicyRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/PatchedVaultPathPolicyRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/PatchedVaultPathPolicyRequest" } } } }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VaultPathPolicy" } } }, "description": "" } }, "summary": "Update path policy" }, "delete": { "operationId": "vault_path_policies_destroy", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this vault path policy.", "required": true } ], "tags": [ "vault" ], "security": [ { "jwtAuth": [] } ], "responses": { "204": { "description": "No response body" } }, "summary": "Delete path policy" } }, "/api/vault/reveals/": { "get": { "operationId": "vault_reveals_retrieve", "tags": [ "vault" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "description": "No response body" } }, "summary": "List reveals" } }, "/api/vault/reveals/{id}/approve/": { "post": { "operationId": "vault_reveals_approve_create", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "string" }, "required": true } ], "tags": [ "vault" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "description": "No response body" } }, "summary": "Approve: reveal" } }, "/api/vault/reveals/{id}/consume/": { "post": { "operationId": "vault_reveals_consume_create", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "string" }, "required": true } ], "tags": [ "vault" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "description": "No response body" } }, "summary": "Consume: reveal" } }, "/api/vault/reveals/{id}/deny/": { "post": { "operationId": "vault_reveals_deny_create", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "string" }, "required": true } ], "tags": [ "vault" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "description": "No response body" } }, "summary": "Deny: reveal" } }, "/api/vault/rotation-policies/": { "get": { "operationId": "vault_rotation_policies_list", "parameters": [ { "name": "ordering", "required": false, "in": "query", "description": "Which field to use when ordering the results.", "schema": { "type": "string" } }, { "name": "page", "required": false, "in": "query", "description": "A page number within the paginated result set.", "schema": { "type": "integer" } }, { "name": "page_size", "required": false, "in": "query", "description": "Number of results to return per page.", "schema": { "type": "integer" } }, { "name": "search", "required": false, "in": "query", "description": "A search term.", "schema": { "type": "string" } } ], "tags": [ "vault" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaginatedVaultRotationPolicyList" } } }, "description": "" } }, "summary": "List rotation policys" }, "post": { "operationId": "vault_rotation_policies_create", "tags": [ "vault" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VaultRotationPolicyRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/VaultRotationPolicyRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/VaultRotationPolicyRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "201": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VaultRotationPolicy" } } }, "description": "" } }, "summary": "Create rotation policy" } }, "/api/vault/rotation-policies/{id}/": { "get": { "operationId": "vault_rotation_policies_retrieve", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this vault rotation policy.", "required": true } ], "tags": [ "vault" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VaultRotationPolicy" } } }, "description": "" } }, "summary": "Retrieve rotation policy" }, "put": { "operationId": "vault_rotation_policies_update", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this vault rotation policy.", "required": true } ], "tags": [ "vault" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VaultRotationPolicyRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/VaultRotationPolicyRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/VaultRotationPolicyRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VaultRotationPolicy" } } }, "description": "" } }, "summary": "Update rotation policy" }, "patch": { "operationId": "vault_rotation_policies_partial_update", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this vault rotation policy.", "required": true } ], "tags": [ "vault" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PatchedVaultRotationPolicyRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/PatchedVaultRotationPolicyRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/PatchedVaultRotationPolicyRequest" } } } }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VaultRotationPolicy" } } }, "description": "" } }, "summary": "Update rotation policy" }, "delete": { "operationId": "vault_rotation_policies_destroy", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this vault rotation policy.", "required": true } ], "tags": [ "vault" ], "security": [ { "jwtAuth": [] } ], "responses": { "204": { "description": "No response body" } }, "summary": "Delete rotation policy" } }, "/api/vault/secrets/": { "get": { "operationId": "vault_secrets_retrieve", "tags": [ "vault" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "description": "No response body" } }, "summary": "List secrets" }, "post": { "operationId": "vault_secrets_create", "tags": [ "vault" ], "security": [ { "jwtAuth": [] } ], "responses": { "201": { "description": "No response body" } }, "summary": "Create secret" } }, "/api/vault/secrets/{id}/": { "get": { "operationId": "vault_secrets_retrieve_2", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "string" }, "required": true } ], "tags": [ "vault" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "description": "No response body" } }, "summary": "Retrieve secret" }, "delete": { "operationId": "vault_secrets_destroy", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "string" }, "required": true } ], "tags": [ "vault" ], "security": [ { "jwtAuth": [] } ], "responses": { "204": { "description": "No response body" } }, "summary": "Delete secret" } }, "/api/vault/secrets/{id}/checkin/": { "post": { "operationId": "vault_secrets_checkin_create", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "string" }, "required": true } ], "tags": [ "vault" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "description": "No response body" } }, "summary": "Checkin: secret" } }, "/api/vault/secrets/{id}/checkout/": { "post": { "operationId": "vault_secrets_checkout_create", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "string" }, "required": true } ], "tags": [ "vault" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "description": "No response body" } }, "summary": "Checkout: secret" } }, "/api/vault/secrets/{id}/hard_delete/": { "post": { "operationId": "vault_secrets_hard_delete_create", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "string" }, "required": true } ], "tags": [ "vault" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "description": "No response body" } }, "summary": "Hard delete: secret" } }, "/api/vault/secrets/{id}/read_value/": { "get": { "operationId": "vault_secrets_read_value_retrieve", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "string" }, "required": true } ], "tags": [ "vault" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "description": "No response body" } }, "summary": "Read value: secret" } }, "/api/vault/secrets/{id}/reveal-request/": { "post": { "operationId": "vault_secrets_reveal_request_create", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "string" }, "required": true } ], "tags": [ "vault" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "description": "No response body" } }, "summary": "Reveal request: secret" } }, "/api/vault/secrets/{id}/rotate/": { "post": { "operationId": "vault_secrets_rotate_create", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "string" }, "required": true } ], "tags": [ "vault" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "description": "No response body" } }, "summary": "Rotate: secret" } }, "/api/vault/secrets/{id}/rotation-policy/": { "post": { "operationId": "vault_secrets_rotation_policy_create", "description": "Attach (POST {\"policy_id\": }) or detach (DELETE) a rotation\npolicy on a secret \u2014 the link the Rotation Dashboard uses so a policy\nactually governs a secret. Managing that assignment is a network-admin\naction, the same bar as creating the rotation policies themselves.", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "string" }, "required": true } ], "tags": [ "vault" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "description": "No response body" } }, "summary": "Rotation policy: secret" }, "delete": { "operationId": "vault_secrets_rotation_policy_destroy", "description": "Attach (POST {\"policy_id\": }) or detach (DELETE) a rotation\npolicy on a secret \u2014 the link the Rotation Dashboard uses so a policy\nactually governs a secret. Managing that assignment is a network-admin\naction, the same bar as creating the rotation policies themselves.", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "string" }, "required": true } ], "tags": [ "vault" ], "security": [ { "jwtAuth": [] } ], "responses": { "204": { "description": "No response body" } }, "summary": "Rotation policy: secret" } }, "/api/vault/secrets/{id}/versions/": { "get": { "operationId": "vault_secrets_versions_retrieve", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "string" }, "required": true } ], "tags": [ "vault" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "description": "No response body" } }, "summary": "Versions: secret" } }, "/api/vault/token": { "post": { "operationId": "vault_token_create", "tags": [ "vault" ], "security": [ { "jwtAuth": [] }, {} ], "responses": { "200": { "description": "No response body" } }, "summary": "Create token" } } }, "components": { "schemas": { "ExternalVaultConnectionStateEnum": { "enum": [ "draft", "active", "error", "paused" ], "type": "string", "description": "* `draft` - Draft\n* `active` - Active\n* `error` - Error\n* `paused` - Paused" }, "VaultRotationPolicyRequest": { "type": "object", "properties": { "name": { "type": "string", "minLength": 1, "maxLength": 128 }, "interval_days": { "type": "integer", "maximum": 2147483647, "minimum": 0 }, "enabled": { "type": "boolean" }, "rotate_on_checkin": { "type": "boolean" }, "rotate_on_reveal": { "type": "boolean" } }, "required": [ "name" ] }, "Credential": { "type": "object", "properties": { "id": { "type": "integer", "readOnly": true }, "name": { "type": "string", "maxLength": 100 }, "username": { "type": "string", "maxLength": 100 }, "description": { "type": "string" }, "created_at": { "type": "string", "format": "date-time", "readOnly": true }, "updated_at": { "type": "string", "format": "date-time", "readOnly": true } }, "required": [ "created_at", "id", "name", "updated_at", "username" ] }, "PaginatedCredentialList": { "type": "object", "required": [ "count", "results" ], "properties": { "count": { "type": "integer", "example": 123 }, "next": { "type": "string", "nullable": true, "format": "uri", "example": "http://api.example.org/accounts/?page=4" }, "previous": { "type": "string", "nullable": true, "format": "uri", "example": "http://api.example.org/accounts/?page=2" }, "results": { "type": "array", "items": { "$ref": "#/components/schemas/Credential" } } } }, "VaultPathPolicyRequest": { "type": "object", "properties": { "path_glob": { "type": "string", "minLength": 1, "maxLength": 512 }, "role_slug": { "type": "string", "minLength": 1, "maxLength": 128 }, "capabilities": {} }, "required": [ "path_glob", "role_slug" ] }, "VaultRotationPolicy": { "type": "object", "properties": { "id": { "type": "integer", "readOnly": true }, "name": { "type": "string", "maxLength": 128 }, "interval_days": { "type": "integer", "maximum": 2147483647, "minimum": 0 }, "enabled": { "type": "boolean" }, "last_rotated_at": { "type": "string", "format": "date-time", "readOnly": true, "nullable": true }, "rotate_on_checkin": { "type": "boolean" }, "rotate_on_reveal": { "type": "boolean" }, "created_at": { "type": "string", "format": "date-time", "readOnly": true } }, "required": [ "created_at", "id", "last_rotated_at", "name" ] }, "VaultAppPrincipal": { "type": "object", "properties": { "id": { "type": "integer", "readOnly": true }, "name": { "type": "string", "maxLength": 128 }, "key_hash": { "type": "string", "readOnly": true }, "capabilities": {}, "allowed_paths": {}, "token_ttl_s": { "type": "integer", "maximum": 2147483647, "minimum": 0 }, "created_at": { "type": "string", "format": "date-time", "readOnly": true }, "created_by": { "type": "string", "maxLength": 256 }, "is_active": { "type": "boolean" } }, "required": [ "created_at", "id", "key_hash", "name" ] }, "PatchedVaultPathPolicyRequest": { "type": "object", "properties": { "path_glob": { "type": "string", "minLength": 1, "maxLength": 512 }, "role_slug": { "type": "string", "minLength": 1, "maxLength": 128 }, "capabilities": {} } }, "PaginatedVaultPathPolicyList": { "type": "object", "required": [ "count", "results" ], "properties": { "count": { "type": "integer", "example": 123 }, "next": { "type": "string", "nullable": true, "format": "uri", "example": "http://api.example.org/accounts/?page=4" }, "previous": { "type": "string", "nullable": true, "format": "uri", "example": "http://api.example.org/accounts/?page=2" }, "results": { "type": "array", "items": { "$ref": "#/components/schemas/VaultPathPolicy" } } } }, "ResolveAtEnum": { "enum": [ "cloud", "collector", "auto" ], "type": "string", "description": "* `cloud` - Cloud (Versus)\n* `collector` - On collector\n* `auto` - Auto" }, "DriverTypeEnum": { "enum": [ "native", "hashicorp", "cyberark", "awssm" ], "type": "string", "description": "* `native` - Native (Postgres)\n* `hashicorp` - HashiCorp Vault\n* `cyberark` - CyberArk\n* `awssm` - AWS Secrets Manager" }, "PaginatedExternalVaultConnectionList": { "type": "object", "required": [ "count", "results" ], "properties": { "count": { "type": "integer", "example": 123 }, "next": { "type": "string", "nullable": true, "format": "uri", "example": "http://api.example.org/accounts/?page=4" }, "previous": { "type": "string", "nullable": true, "format": "uri", "example": "http://api.example.org/accounts/?page=2" }, "results": { "type": "array", "items": { "$ref": "#/components/schemas/ExternalVaultConnection" } } } }, "PasswordChangeRequest": { "type": "object", "properties": { "tenant_id": { "type": "string", "format": "uuid", "nullable": true }, "name": { "type": "string", "minLength": 1, "maxLength": 200 }, "status": { "$ref": "#/components/schemas/PasswordChangeStatusEnum" }, "current_step": { "type": "integer", "maximum": 2147483647, "minimum": -2147483648 }, "created_by": { "type": "string", "maxLength": 100 }, "completed_at": { "type": "string", "format": "date-time", "nullable": true }, "device_group": { "type": "integer", "nullable": true } }, "required": [ "name" ] }, "VaultPathPolicy": { "type": "object", "properties": { "id": { "type": "integer", "readOnly": true }, "path_glob": { "type": "string", "maxLength": 512 }, "role_slug": { "type": "string", "maxLength": 128 }, "capabilities": {}, "created_at": { "type": "string", "format": "date-time", "readOnly": true } }, "required": [ "created_at", "id", "path_glob", "role_slug" ] }, "CredentialRequest": { "type": "object", "properties": { "name": { "type": "string", "minLength": 1, "maxLength": 100 }, "username": { "type": "string", "minLength": 1, "maxLength": 100 }, "password": { "type": "string", "writeOnly": true }, "description": { "type": "string" } }, "required": [ "name", "username" ] }, "VaultAppPrincipalRequest": { "type": "object", "properties": { "name": { "type": "string", "minLength": 1, "maxLength": 128 }, "capabilities": {}, "allowed_paths": {}, "token_ttl_s": { "type": "integer", "maximum": 2147483647, "minimum": 0 }, "created_by": { "type": "string", "maxLength": 256 }, "is_active": { "type": "boolean" }, "raw_key": { "type": "string", "writeOnly": true, "minLength": 1 } }, "required": [ "name" ] }, "VaultMountRequest": { "type": "object", "properties": { "name": { "type": "string", "minLength": 1, "maxLength": 128 }, "driver_type": { "$ref": "#/components/schemas/DriverTypeEnum" }, "driver_config": {}, "description": { "type": "string" } }, "required": [ "name" ] }, "ExternalSecretRefRequest": { "type": "object", "properties": { "connection": { "type": "string", "format": "uuid" }, "name": { "type": "string", "maxLength": 160 }, "secret_path": { "type": "string", "minLength": 1, "maxLength": 400 }, "username_key": { "type": "string", "minLength": 1, "maxLength": 80 }, "password_key": { "type": "string", "minLength": 1, "maxLength": 80 }, "secret_version": { "type": "string", "maxLength": 40 }, "dynamic": { "type": "boolean" }, "dynamic_role": { "type": "string", "maxLength": 120 }, "cache_ttl_s": { "type": "integer", "maximum": 2147483647, "minimum": -2147483648 } }, "required": [ "connection", "secret_path" ] }, "PatchedPasswordChangeRequest": { "type": "object", "properties": { "tenant_id": { "type": "string", "format": "uuid", "nullable": true }, "name": { "type": "string", "minLength": 1, "maxLength": 200 }, "status": { "$ref": "#/components/schemas/PasswordChangeStatusEnum" }, "current_step": { "type": "integer", "maximum": 2147483647, "minimum": -2147483648 }, "created_by": { "type": "string", "maxLength": 100 }, "completed_at": { "type": "string", "format": "date-time", "nullable": true }, "device_group": { "type": "integer", "nullable": true } } }, "PaginatedExternalSecretRefList": { "type": "object", "required": [ "count", "results" ], "properties": { "count": { "type": "integer", "example": 123 }, "next": { "type": "string", "nullable": true, "format": "uri", "example": "http://api.example.org/accounts/?page=4" }, "previous": { "type": "string", "nullable": true, "format": "uri", "example": "http://api.example.org/accounts/?page=2" }, "results": { "type": "array", "items": { "$ref": "#/components/schemas/ExternalSecretRef" } } } }, "PatchedVaultAppPrincipalRequest": { "type": "object", "properties": { "name": { "type": "string", "minLength": 1, "maxLength": 128 }, "capabilities": {}, "allowed_paths": {}, "token_ttl_s": { "type": "integer", "maximum": 2147483647, "minimum": 0 }, "created_by": { "type": "string", "maxLength": 256 }, "is_active": { "type": "boolean" }, "raw_key": { "type": "string", "writeOnly": true, "minLength": 1 } } }, "PatchedExternalSecretRefRequest": { "type": "object", "properties": { "connection": { "type": "string", "format": "uuid" }, "name": { "type": "string", "maxLength": 160 }, "secret_path": { "type": "string", "minLength": 1, "maxLength": 400 }, "username_key": { "type": "string", "minLength": 1, "maxLength": 80 }, "password_key": { "type": "string", "minLength": 1, "maxLength": 80 }, "secret_version": { "type": "string", "maxLength": 40 }, "dynamic": { "type": "boolean" }, "dynamic_role": { "type": "string", "maxLength": 120 }, "cache_ttl_s": { "type": "integer", "maximum": 2147483647, "minimum": -2147483648 } } }, "PatchedVaultRotationPolicyRequest": { "type": "object", "properties": { "name": { "type": "string", "minLength": 1, "maxLength": 128 }, "interval_days": { "type": "integer", "maximum": 2147483647, "minimum": 0 }, "enabled": { "type": "boolean" }, "rotate_on_checkin": { "type": "boolean" }, "rotate_on_reveal": { "type": "boolean" } } }, "ExternalVaultConnection": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid", "readOnly": true }, "name": { "type": "string", "maxLength": 120 }, "provider": { "$ref": "#/components/schemas/ExternalVaultConnectionProviderEnum" }, "address": { "type": "string", "maxLength": 300 }, "namespace": { "type": "string", "maxLength": 120 }, "mount": { "type": "string", "maxLength": 120 }, "kv_version": { "type": "integer", "maximum": 2147483647, "minimum": -2147483648 }, "auth_method": { "$ref": "#/components/schemas/ExternalVaultConnectionAuthMethodEnum" }, "auth_ref": { "type": "string", "maxLength": 300 }, "tls_ca_ref": { "type": "string", "maxLength": 300 }, "tls_verify": { "type": "boolean" }, "resolve_at": { "$ref": "#/components/schemas/ResolveAtEnum" }, "network": { "$ref": "#/components/schemas/ExternalVaultConnectionNetworkEnum" }, "state": { "allOf": [ { "$ref": "#/components/schemas/ExternalVaultConnectionStateEnum" } ], "readOnly": true }, "last_ok_at": { "type": "string", "format": "date-time", "readOnly": true, "nullable": true }, "last_error": { "type": "string", "readOnly": true }, "created_at": { "type": "string", "format": "date-time", "readOnly": true }, "updated_at": { "type": "string", "format": "date-time", "readOnly": true } }, "required": [ "address", "created_at", "id", "last_error", "last_ok_at", "name", "state", "updated_at" ] }, "PasswordChange": { "type": "object", "properties": { "id": { "type": "integer", "readOnly": true }, "steps": { "type": "string", "readOnly": true }, "tenant_id": { "type": "string", "format": "uuid", "nullable": true }, "name": { "type": "string", "maxLength": 200 }, "status": { "$ref": "#/components/schemas/PasswordChangeStatusEnum" }, "current_step": { "type": "integer", "maximum": 2147483647, "minimum": -2147483648 }, "created_by": { "type": "string", "maxLength": 100 }, "created_at": { "type": "string", "format": "date-time", "readOnly": true }, "completed_at": { "type": "string", "format": "date-time", "nullable": true }, "device_group": { "type": "integer", "nullable": true } }, "required": [ "created_at", "id", "name", "steps" ] }, "PatchedCredentialRequest": { "type": "object", "properties": { "name": { "type": "string", "minLength": 1, "maxLength": 100 }, "username": { "type": "string", "minLength": 1, "maxLength": 100 }, "password": { "type": "string", "writeOnly": true }, "description": { "type": "string" } } }, "ExternalVaultConnectionRequest": { "type": "object", "properties": { "name": { "type": "string", "minLength": 1, "maxLength": 120 }, "provider": { "$ref": "#/components/schemas/ExternalVaultConnectionProviderEnum" }, "address": { "type": "string", "minLength": 1, "maxLength": 300 }, "namespace": { "type": "string", "maxLength": 120 }, "mount": { "type": "string", "maxLength": 120 }, "kv_version": { "type": "integer", "maximum": 2147483647, "minimum": -2147483648 }, "auth_method": { "$ref": "#/components/schemas/ExternalVaultConnectionAuthMethodEnum" }, "auth_ref": { "type": "string", "maxLength": 300 }, "tls_ca_ref": { "type": "string", "maxLength": 300 }, "tls_verify": { "type": "boolean" }, "resolve_at": { "$ref": "#/components/schemas/ResolveAtEnum" }, "network": { "$ref": "#/components/schemas/ExternalVaultConnectionNetworkEnum" } }, "required": [ "address", "name" ] }, "PaginatedVaultRotationPolicyList": { "type": "object", "required": [ "count", "results" ], "properties": { "count": { "type": "integer", "example": 123 }, "next": { "type": "string", "nullable": true, "format": "uri", "example": "http://api.example.org/accounts/?page=4" }, "previous": { "type": "string", "nullable": true, "format": "uri", "example": "http://api.example.org/accounts/?page=2" }, "results": { "type": "array", "items": { "$ref": "#/components/schemas/VaultRotationPolicy" } } } }, "PaginatedVaultAppPrincipalList": { "type": "object", "required": [ "count", "results" ], "properties": { "count": { "type": "integer", "example": 123 }, "next": { "type": "string", "nullable": true, "format": "uri", "example": "http://api.example.org/accounts/?page=4" }, "previous": { "type": "string", "nullable": true, "format": "uri", "example": "http://api.example.org/accounts/?page=2" }, "results": { "type": "array", "items": { "$ref": "#/components/schemas/VaultAppPrincipal" } } } }, "PaginatedVaultMountList": { "type": "object", "required": [ "count", "results" ], "properties": { "count": { "type": "integer", "example": 123 }, "next": { "type": "string", "nullable": true, "format": "uri", "example": "http://api.example.org/accounts/?page=4" }, "previous": { "type": "string", "nullable": true, "format": "uri", "example": "http://api.example.org/accounts/?page=2" }, "results": { "type": "array", "items": { "$ref": "#/components/schemas/VaultMount" } } } }, "PatchedExternalVaultConnectionRequest": { "type": "object", "properties": { "name": { "type": "string", "minLength": 1, "maxLength": 120 }, "provider": { "$ref": "#/components/schemas/ExternalVaultConnectionProviderEnum" }, "address": { "type": "string", "minLength": 1, "maxLength": 300 }, "namespace": { "type": "string", "maxLength": 120 }, "mount": { "type": "string", "maxLength": 120 }, "kv_version": { "type": "integer", "maximum": 2147483647, "minimum": -2147483648 }, "auth_method": { "$ref": "#/components/schemas/ExternalVaultConnectionAuthMethodEnum" }, "auth_ref": { "type": "string", "maxLength": 300 }, "tls_ca_ref": { "type": "string", "maxLength": 300 }, "tls_verify": { "type": "boolean" }, "resolve_at": { "$ref": "#/components/schemas/ResolveAtEnum" }, "network": { "$ref": "#/components/schemas/ExternalVaultConnectionNetworkEnum" } } }, "ExternalVaultConnectionNetworkEnum": { "enum": [ "public", "privatelink", "collector_lan" ], "type": "string", "description": "* `public` - Public\n* `privatelink` - PrivateLink\n* `collector_lan` - Collector LAN" }, "PaginatedPasswordChangeList": { "type": "object", "required": [ "count", "results" ], "properties": { "count": { "type": "integer", "example": 123 }, "next": { "type": "string", "nullable": true, "format": "uri", "example": "http://api.example.org/accounts/?page=4" }, "previous": { "type": "string", "nullable": true, "format": "uri", "example": "http://api.example.org/accounts/?page=2" }, "results": { "type": "array", "items": { "$ref": "#/components/schemas/PasswordChange" } } } }, "ExternalVaultConnectionProviderEnum": { "enum": [ "hashicorp", "cyberark_ccp", "conjur", "azure_kv", "aws_sm", "gcp_sm", "delinea" ], "type": "string", "description": "* `hashicorp` - HashiCorp Vault\n* `cyberark_ccp` - CyberArk CCP/AIM\n* `conjur` - CyberArk Conjur\n* `azure_kv` - Azure Key Vault\n* `aws_sm` - AWS Secrets Manager\n* `gcp_sm` - GCP Secret Manager\n* `delinea` - Delinea Secret Server" }, "PasswordChangeStatusEnum": { "enum": [ "pending", "in_progress", "completed", "failed" ], "type": "string", "description": "* `pending` - Pending\n* `in_progress` - In Progress\n* `completed` - Completed\n* `failed` - Failed" }, "PatchedVaultMountRequest": { "type": "object", "properties": { "name": { "type": "string", "minLength": 1, "maxLength": 128 }, "driver_type": { "$ref": "#/components/schemas/DriverTypeEnum" }, "driver_config": {}, "description": { "type": "string" } } }, "VaultMount": { "type": "object", "properties": { "id": { "type": "integer", "readOnly": true }, "name": { "type": "string", "maxLength": 128 }, "driver_type": { "$ref": "#/components/schemas/DriverTypeEnum" }, "driver_config": {}, "description": { "type": "string" }, "created_at": { "type": "string", "format": "date-time", "readOnly": true }, "updated_at": { "type": "string", "format": "date-time", "readOnly": true } }, "required": [ "created_at", "id", "name", "updated_at" ] }, "ExternalSecretRef": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid", "readOnly": true }, "connection": { "type": "string", "format": "uuid" }, "connection_name": { "type": "string", "readOnly": true }, "name": { "type": "string", "maxLength": 160 }, "secret_path": { "type": "string", "maxLength": 400 }, "username_key": { "type": "string", "maxLength": 80 }, "password_key": { "type": "string", "maxLength": 80 }, "secret_version": { "type": "string", "maxLength": 40 }, "dynamic": { "type": "boolean" }, "dynamic_role": { "type": "string", "maxLength": 120 }, "cache_ttl_s": { "type": "integer", "maximum": 2147483647, "minimum": -2147483648 }, "created_at": { "type": "string", "format": "date-time", "readOnly": true }, "updated_at": { "type": "string", "format": "date-time", "readOnly": true } }, "required": [ "connection", "connection_name", "created_at", "id", "secret_path", "updated_at" ] }, "ExternalVaultConnectionAuthMethodEnum": { "enum": [ "token", "approle", "kubernetes", "tls_cert", "jwt_oidc", "aws_iam", "azure_msi", "gcp_iam" ], "type": "string", "description": "* `token` - Token\n* `approle` - AppRole\n* `kubernetes` - Kubernetes\n* `tls_cert` - TLS cert\n* `jwt_oidc` - JWT/OIDC\n* `aws_iam` - AWS IAM\n* `azure_msi` - Azure Managed Identity\n* `gcp_iam` - GCP IAM" } } } }