HashiCorp Vault MCP Server for Cloudflare Workers
250 tools available in the HashiCorp Vault MCP server. Each tool can be called by AI assistants to perform specific actions.
vault_identity_read_groupRead an identity group by ID.
{
"type": "object",
"required": [
"id"
],
"properties": {
"id": {
"type": "string",
"description": "Group ID"
}
}
}vault_totp_create_keyCreate or update a TOTP key.
{
"type": "object",
"properties": {}
}vault_identity_read_group_by_nameRead an identity group by name.
{
"type": "object",
"required": [
"name"
],
"properties": {
"name": {
"type": "string",
"description": "Group name"
}
}
}vault_kubernetes_write_configConfigure the Kubernetes auth method.
{
"type": "object",
"properties": {}
}vault_list_token_rolesList all token roles.
{
"type": "object",
"properties": {}
}vault_kubernetes_list_rolesList all Kubernetes auth roles.
{
"type": "object",
"properties": {
"mount_path": {
"type": "string",
"default": "kubernetes",
"description": "Mount path of the Kubernetes auth method"
}
}
}vault_rabbitmq_delete_roleDelete a RabbitMQ role.
{
"type": "object",
"properties": {}
}vault_cert_list_crlsList all CRLs.
{
"type": "object",
"properties": {
"mount_path": {
"type": "string",
"default": "cert",
"description": "Mount path of the Cert auth method"
}
}
}vault_disable_secrets_engineDisable a secrets engine. WARNING: This will revoke all secrets from this engine.
{
"type": "object",
"required": [
"path"
],
"properties": {
"path": {
"type": "string",
"description": "Mount path of the secrets engine to disable"
}
}
}vault_delete_token_roleDelete a token role.
{
"type": "object",
"required": [
"name"
],
"properties": {
"name": {
"type": "string",
"description": "Role name to delete"
}
}
}vault_totp_list_keysList all TOTP keys.
{
"type": "object",
"properties": {
"mount_path": {
"type": "string",
"default": "totp",
"description": "Mount path of the TOTP engine"
}
}
}vault_unwrapUnwrap a wrapping token to retrieve the wrapped data.
{
"type": "object",
"properties": {
"token": {
"type": "string",
"description": "Wrapping token (uses current token if not provided)"
}
}
}vault_cert_list_certsList all certificate roles.
{
"type": "object",
"properties": {
"mount_path": {
"type": "string",
"default": "cert",
"description": "Mount path of the Cert auth method"
}
}
}vault_get_token_roleGet configuration for a token role.
{
"type": "object",
"required": [
"name"
],
"properties": {
"name": {
"type": "string",
"description": "Role name"
}
}
}vault_lookup_wrappingLook up information about a wrapping token without unwrapping it.
{
"type": "object",
"required": [
"token"
],
"properties": {
"token": {
"type": "string",
"description": "Wrapping token to look up"
}
}
}vault_rewrapRewrap a wrapping token with a new token.
{
"type": "object",
"required": [
"token"
],
"properties": {
"token": {
"type": "string",
"description": "Wrapping token to rewrap"
}
}
}vault_cubbyhole_writeWrite a secret to cubbyhole storage (token-isolated).
{
"type": "object",
"required": [
"path",
"data"
],
"properties": {
"data": {
"type": "object",
"description": "Secret data as key-value pairs"
},
"path": {
"type": "string",
"description": "Path to the secret"
}
}
}vault_cubbyhole_deleteDelete a secret from cubbyhole storage.
{
"type": "object",
"required": [
"path"
],
"properties": {
"path": {
"type": "string",
"description": "Path to the secret"
}
}
}vault_cubbyhole_listList secrets in cubbyhole storage.
{
"type": "object",
"properties": {
"path": {
"type": "string",
"description": "Path to list (empty for root)"
}
}
}vault_cert_read_certRead a certificate role.
{
"type": "object",
"required": [
"name"
],
"properties": {
"name": {
"type": "string",
"description": "Certificate role name"
},
"mount_path": {
"type": "string",
"default": "cert",
"description": "Mount path of the Cert auth method"
}
}
}vault_cert_create_certCreate or update a certificate role.
{
"type": "object",
"properties": {}
}vault_approle_list_secret_idsList all Secret ID accessors for an AppRole role.
{
"type": "object",
"required": [
"role_name"
],
"properties": {
"role_name": {
"type": "string",
"description": "Role name"
},
"mount_path": {
"type": "string",
"default": "approle",
"description": "Mount path of the AppRole auth method"
}
}
}vault_aws_get_static_credentialsGet current credentials for an AWS static role.
{
"type": "object",
"required": [
"name"
],
"properties": {
"name": {
"type": "string",
"description": "Static role name"
},
"mount_path": {
"type": "string",
"default": "aws",
"description": "Mount path of the AWS engine"
}
}
}vault_cert_delete_certDelete a certificate role.
{
"type": "object",
"properties": {}
}vault_cert_read_configRead the TLS Certificate auth method configuration.
{
"type": "object",
"properties": {
"mount_path": {
"type": "string",
"default": "cert",
"description": "Mount path of the Cert auth method"
}
}
}vault_approle_list_rolesList all AppRole roles.
{
"type": "object",
"properties": {
"mount_path": {
"type": "string",
"default": "approle",
"description": "Mount path of the AppRole auth method"
}
}
}vault_approle_read_roleRead configuration of an AppRole role.
{
"type": "object",
"required": [
"role_name"
],
"properties": {
"role_name": {
"type": "string",
"description": "Role name"
},
"mount_path": {
"type": "string",
"default": "approle",
"description": "Mount path of the AppRole auth method"
}
}
}vault_db_list_connectionsList all database connections configured in the Database secrets engine.
{
"type": "object",
"properties": {
"mount_path": {
"type": "string",
"default": "database",
"description": "Mount path of the Database engine"
}
}
}vault_db_read_connectionRead configuration of a database connection.
{
"type": "object",
"required": [
"name"
],
"properties": {
"name": {
"type": "string",
"description": "Connection name"
},
"mount_path": {
"type": "string",
"default": "database",
"description": "Mount path of the Database engine"
}
}
}vault_approle_create_roleCreate or update an AppRole role.
{
"type": "object",
"required": [
"role_name"
],
"properties": {
"role_name": {
"type": "string",
"description": "Role name"
},
"token_ttl": {
"type": "string",
"description": "Default token TTL"
},
"mount_path": {
"type": "string",
"default": "approle",
"description": "Mount path of the AppRole auth method"
},
"secret_id_ttl": {
"type": "string",
"description": "TTL for secret IDs (e.g., \"24h"
},
"token_max_ttl": {
"type": "string",
"description": "Maximum token TTL"
},
"bind_secret_id": {
"type": "boolean",
"description": "Require secret ID for login (default: true)"
},
"token_num_uses": {
"type": "integer",
"description": "Number of times a token can be used"
},
"token_policies": {
"type": "array",
"items": {
"type": "string"
},
"description": "Policies to attach to tokens"
},
"token_bound_cidrs": {
"type": "array",
"items": {
"type": "string"
},
"description": "CIDRs that can use tokens"
},
"secret_id_num_uses": {
"type": "integer",
"description": "Number of times a secret ID can be used (0 = unlimited)"
},
"secret_id_bound_cidrs": {
"type": "array",
"items": {
"type": "string"
},
"description": "CIDRs that can use secret IDs"
}
}
}vault_approle_delete_roleDelete an AppRole role.
{
"type": "object",
"required": [
"role_name"
],
"properties": {
"role_name": {
"type": "string",
"description": "Role name to delete"
},
"mount_path": {
"type": "string",
"default": "approle",
"description": "Mount path of the AppRole auth method"
}
}
}vault_approle_get_role_idGet the Role ID for an AppRole role.
{
"type": "object",
"required": [
"role_name"
],
"properties": {
"role_name": {
"type": "string",
"description": "Role name"
},
"mount_path": {
"type": "string",
"default": "approle",
"description": "Mount path of the AppRole auth method"
}
}
}vault_approle_set_role_idSet a custom Role ID for an AppRole role.
{
"type": "object",
"required": [
"role_name",
"role_id"
],
"properties": {
"role_id": {
"type": "string",
"description": "Custom Role ID to set"
},
"role_name": {
"type": "string",
"description": "Role name"
},
"mount_path": {
"type": "string",
"default": "approle",
"description": "Mount path of the AppRole auth method"
}
}
}vault_approle_generate_secret_idGenerate a new Secret ID for an AppRole role.
{
"type": "object",
"required": [
"role_name"
],
"properties": {
"ttl": {
"type": "string",
"description": "TTL for this secret ID"
},
"metadata": {
"type": "string",
"description": "JSON metadata to attach to the secret ID"
},
"num_uses": {
"type": "integer",
"description": "Number of times this secret ID can be used"
},
"cidr_list": {
"type": "array",
"items": {
"type": "string"
},
"description": "CIDRs that can use this secret ID"
},
"role_name": {
"type": "string",
"description": "Role name"
},
"mount_path": {
"type": "string",
"default": "approle",
"description": "Mount path of the AppRole auth method"
}
}
}vault_approle_lookup_secret_idLook up a Secret ID by its value.
{
"type": "object",
"required": [
"role_name",
"secret_id"
],
"properties": {
"role_name": {
"type": "string",
"description": "Role name"
},
"secret_id": {
"type": "string",
"description": "Secret ID to look up"
},
"mount_path": {
"type": "string",
"default": "approle",
"description": "Mount path of the AppRole auth method"
}
}
}vault_approle_destroy_secret_idDestroy a Secret ID.
{
"type": "object",
"required": [
"role_name",
"secret_id"
],
"properties": {
"role_name": {
"type": "string",
"description": "Role name"
},
"secret_id": {
"type": "string",
"description": "Secret ID to destroy"
},
"mount_path": {
"type": "string",
"default": "approle",
"description": "Mount path of the AppRole auth method"
}
}
}vault_approle_loginLogin using AppRole credentials to obtain a token.
{
"type": "object",
"required": [
"role_id",
"secret_id"
],
"properties": {
"role_id": {
"type": "string",
"description": "Role ID"
},
"secret_id": {
"type": "string",
"description": "Secret ID"
},
"mount_path": {
"type": "string",
"default": "approle",
"description": "Mount path of the AppRole auth method"
}
}
}vault_aws_read_root_configRead the AWS root configuration (credentials are not returned).
{
"type": "object",
"properties": {
"mount_path": {
"type": "string",
"default": "aws",
"description": "Mount path of the AWS engine"
}
}
}vault_aws_write_root_configConfigure the root credentials for AWS.
{
"type": "object",
"properties": {
"region": {
"type": "string",
"description": "AWS region"
},
"access_key": {
"type": "string",
"description": "AWS access key ID"
},
"mount_path": {
"type": "string",
"default": "aws",
"description": "Mount path of the AWS engine"
},
"secret_key": {
"type": "string",
"description": "AWS secret access key"
},
"max_retries": {
"type": "integer",
"description": "Max retries for API calls"
},
"iam_endpoint": {
"type": "string",
"description": "Custom IAM endpoint"
},
"sts_endpoint": {
"type": "string",
"description": "Custom STS endpoint"
}
}
}vault_aws_rotate_rootRotate the root credentials for AWS.
{
"type": "object",
"properties": {
"mount_path": {
"type": "string",
"default": "aws",
"description": "Mount path of the AWS engine"
}
}
}vault_aws_read_lease_configRead the lease configuration for AWS credentials.
{
"type": "object",
"properties": {
"mount_path": {
"type": "string",
"default": "aws",
"description": "Mount path of the AWS engine"
}
}
}vault_aws_write_lease_configConfigure the lease settings for AWS credentials.
{
"type": "object",
"required": [
"lease",
"lease_max"
],
"properties": {
"lease": {
"type": "string",
"description": "Default lease duration (e.g., \"1h"
},
"lease_max": {
"type": "string",
"description": "Maximum lease duration"
},
"mount_path": {
"type": "string",
"default": "aws",
"description": "Mount path of the AWS engine"
}
}
}vault_aws_list_rolesList all AWS roles.
{
"type": "object",
"properties": {
"mount_path": {
"type": "string",
"default": "aws",
"description": "Mount path of the AWS engine"
}
}
}vault_aws_read_roleRead an AWS role configuration.
{
"type": "object",
"required": [
"name"
],
"properties": {
"name": {
"type": "string",
"description": "Role name"
},
"mount_path": {
"type": "string",
"default": "aws",
"description": "Mount path of the AWS engine"
}
}
}vault_github_write_configConfigure the GitHub auth method.
{
"type": "object",
"properties": {}
}vault_aws_create_roleCreate or update an AWS role.
{
"type": "object",
"required": [
"name",
"credential_type"
],
"properties": {
"name": {
"type": "string",
"description": "Role name"
},
"role_arns": {
"type": "array",
"items": {
"type": "string"
},
"description": "ARNs of AWS roles to assume"
},
"user_path": {
"type": "string",
"description": "IAM user path for iam_user type"
},
"iam_groups": {
"type": "array",
"items": {
"type": "string"
},
"description": "IAM groups for iam_user type"
},
"mount_path": {
"type": "string",
"default": "aws",
"description": "Mount path of the AWS engine"
},
"max_sts_ttl": {
"type": "string",
"description": "Maximum STS credential TTL"
},
"policy_arns": {
"type": "array",
"items": {
"type": "string"
},
"description": "ARNs of AWS managed policies"
},
"credential_type": {
"enum": [
"iam_user",
"assumed_role",
"federation_token",
"session_token"
],
"type": "string",
"description": "Credential type"
},
"default_sts_ttl": {
"type": "string",
"description": "Default STS credential TTL"
},
"policy_document": {
"type": "string",
"description": "Inline IAM policy document (JSON)"
},
"permissions_boundary_arn": {
"type": "string",
"description": "Permissions boundary ARN"
}
}
}vault_aws_delete_roleDelete an AWS role.
{
"type": "object",
"required": [
"name"
],
"properties": {
"name": {
"type": "string",
"description": "Role name to delete"
},
"mount_path": {
"type": "string",
"default": "aws",
"description": "Mount path of the AWS engine"
}
}
}vault_aws_generate_credentialsGenerate AWS credentials for a role.
{
"type": "object",
"required": [
"role_name"
],
"properties": {
"ttl": {
"type": "string",
"description": "Credential TTL"
},
"role_name": {
"type": "string",
"description": "Role name"
},
"mount_path": {
"type": "string",
"default": "aws",
"description": "Mount path of the AWS engine"
}
}
}vault_aws_generate_sts_credentialsGenerate AWS STS credentials for a role.
{
"type": "object",
"required": [
"role_name"
],
"properties": {
"ttl": {
"type": "string",
"description": "Credential TTL"
},
"role_arn": {
"type": "string",
"description": "Specific role ARN to assume"
},
"role_name": {
"type": "string",
"description": "Role name"
},
"mount_path": {
"type": "string",
"default": "aws",
"description": "Mount path of the AWS engine"
}
}
}vault_aws_list_static_rolesList all AWS static roles.
{
"type": "object",
"properties": {
"mount_path": {
"type": "string",
"default": "aws",
"description": "Mount path of the AWS engine"
}
}
}vault_aws_read_static_roleRead an AWS static role configuration.
{
"type": "object",
"required": [
"name"
],
"properties": {
"name": {
"type": "string",
"description": "Static role name"
},
"mount_path": {
"type": "string",
"default": "aws",
"description": "Mount path of the AWS engine"
}
}
}vault_aws_create_static_roleCreate or update an AWS static role.
{
"type": "object",
"required": [
"name",
"username",
"rotation_period"
],
"properties": {
"name": {
"type": "string",
"description": "Static role name"
},
"username": {
"type": "string",
"description": "AWS IAM username to manage"
},
"mount_path": {
"type": "string",
"default": "aws",
"description": "Mount path of the AWS engine"
},
"rotation_period": {
"type": "string",
"description": "Rotation period (e.g., \"24h"
}
}
}vault_aws_delete_static_roleDelete an AWS static role.
{
"type": "object",
"required": [
"name"
],
"properties": {
"name": {
"type": "string",
"description": "Static role name to delete"
},
"mount_path": {
"type": "string",
"default": "aws",
"description": "Mount path of the AWS engine"
}
}
}vault_cert_write_configConfigure the TLS Certificate auth method.
{
"type": "object",
"properties": {}
}vault_cert_read_crlRead a CRL.
{
"type": "object",
"required": [
"name"
],
"properties": {
"name": {
"type": "string",
"description": "CRL name"
},
"mount_path": {
"type": "string",
"default": "cert",
"description": "Mount path of the Cert auth method"
}
}
}vault_cert_write_crlCreate or update a CRL.
{
"type": "object",
"properties": {}
}vault_cert_delete_crlDelete a CRL.
{
"type": "object",
"properties": {}
}vault_cert_loginLogin using a TLS client certificate. Note: The client certificate must be provided at the TLS layer.
{
"type": "object",
"properties": {}
}vault_consul_read_access_configRead the Consul access configuration.
{
"type": "object",
"properties": {
"mount_path": {
"type": "string",
"default": "consul",
"description": "Mount path of the Consul engine"
}
}
}vault_consul_write_access_configConfigure the Consul access credentials.
{
"type": "object",
"properties": {}
}vault_consul_list_rolesList all Consul roles.
{
"type": "object",
"properties": {
"mount_path": {
"type": "string",
"default": "consul",
"description": "Mount path of the Consul engine"
}
}
}vault_consul_read_roleRead a Consul role.
{
"type": "object",
"required": [
"name"
],
"properties": {
"name": {
"type": "string",
"description": "Role name"
},
"mount_path": {
"type": "string",
"default": "consul",
"description": "Mount path of the Consul engine"
}
}
}vault_consul_create_roleCreate or update a Consul role.
{
"type": "object",
"properties": {}
}vault_consul_delete_roleDelete a Consul role.
{
"type": "object",
"properties": {}
}vault_consul_generate_credentialsGenerate Consul credentials (ACL token) for a role.
{
"type": "object",
"required": [
"role_name"
],
"properties": {
"role_name": {
"type": "string",
"description": "Role name"
},
"mount_path": {
"type": "string",
"default": "consul",
"description": "Mount path of the Consul engine"
}
}
}vault_cubbyhole_readRead a secret from cubbyhole storage (token-isolated).
{
"type": "object",
"required": [
"path"
],
"properties": {
"path": {
"type": "string",
"description": "Path to the secret"
}
}
}vault_github_list_teamsList all GitHub team mappings.
{
"type": "object",
"properties": {
"mount_path": {
"type": "string",
"default": "github",
"description": "Mount path of the GitHub auth method"
}
}
}vault_db_create_connectionCreate or update a database connection.
{
"type": "object",
"required": [
"name",
"plugin_name",
"connection_url"
],
"properties": {
"name": {
"type": "string",
"description": "Connection name"
},
"password": {
"type": "string",
"description": "Root password for the database"
},
"username": {
"type": "string",
"description": "Root username for the database"
},
"mount_path": {
"type": "string",
"default": "database",
"description": "Mount path of the Database engine"
},
"plugin_name": {
"type": "string",
"description": "Database plugin (postgresql-database-plugin, mysql-database-plugin, etc.)"
},
"allowed_roles": {
"type": "array",
"items": {
"type": "string"
},
"description": "Roles allowed to use this connection"
},
"connection_url": {
"type": "string",
"description": "Connection URL with {{username}} and {{password}} templates"
},
"verify_connection": {
"type": "boolean",
"description": "Verify connection on creation"
}
}
}vault_db_delete_connectionDelete a database connection.
{
"type": "object",
"required": [
"name"
],
"properties": {
"name": {
"type": "string",
"description": "Connection name to delete"
},
"mount_path": {
"type": "string",
"default": "database",
"description": "Mount path of the Database engine"
}
}
}vault_db_reset_connectionReset a database connection by closing and reconnecting.
{
"type": "object",
"required": [
"name"
],
"properties": {
"name": {
"type": "string",
"description": "Connection name to reset"
},
"mount_path": {
"type": "string",
"default": "database",
"description": "Mount path of the Database engine"
}
}
}vault_db_rotate_rootRotate the root credentials for a database connection.
{
"type": "object",
"required": [
"name"
],
"properties": {
"name": {
"type": "string",
"description": "Connection name"
},
"mount_path": {
"type": "string",
"default": "database",
"description": "Mount path of the Database engine"
}
}
}vault_db_list_rolesList all dynamic roles in the Database secrets engine.
{
"type": "object",
"properties": {
"mount_path": {
"type": "string",
"default": "database",
"description": "Mount path of the Database engine"
}
}
}vault_db_read_roleRead configuration of a dynamic database role.
{
"type": "object",
"required": [
"name"
],
"properties": {
"name": {
"type": "string",
"description": "Role name"
},
"mount_path": {
"type": "string",
"default": "database",
"description": "Mount path of the Database engine"
}
}
}vault_db_create_roleCreate or update a dynamic database role.
{
"type": "object",
"required": [
"name",
"db_name",
"creation_statements"
],
"properties": {
"name": {
"type": "string",
"description": "Role name"
},
"db_name": {
"type": "string",
"description": "Database connection to use"
},
"max_ttl": {
"type": "string",
"description": "Maximum credential TTL"
},
"mount_path": {
"type": "string",
"default": "database",
"description": "Mount path of the Database engine"
},
"default_ttl": {
"type": "string",
"description": "Default credential TTL (e.g., \"1h"
},
"creation_statements": {
"type": "array",
"items": {
"type": "string"
},
"description": "SQL statements to create user"
},
"revocation_statements": {
"type": "array",
"items": {
"type": "string"
},
"description": "SQL statements to revoke user"
}
}
}vault_db_delete_roleDelete a dynamic database role.
{
"type": "object",
"required": [
"name"
],
"properties": {
"name": {
"type": "string",
"description": "Role name to delete"
},
"mount_path": {
"type": "string",
"default": "database",
"description": "Mount path of the Database engine"
}
}
}vault_db_generate_credentialsGenerate dynamic database credentials for a role.
{
"type": "object",
"required": [
"role_name"
],
"properties": {
"role_name": {
"type": "string",
"description": "Role name to generate credentials for"
},
"mount_path": {
"type": "string",
"default": "database",
"description": "Mount path of the Database engine"
}
}
}vault_db_list_static_rolesList all static roles in the Database secrets engine.
{
"type": "object",
"properties": {
"mount_path": {
"type": "string",
"default": "database",
"description": "Mount path of the Database engine"
}
}
}vault_db_read_static_roleRead configuration of a static database role.
{
"type": "object",
"required": [
"name"
],
"properties": {
"name": {
"type": "string",
"description": "Role name"
},
"mount_path": {
"type": "string",
"default": "database",
"description": "Mount path of the Database engine"
}
}
}vault_db_create_static_roleCreate or update a static database role.
{
"type": "object",
"required": [
"name",
"db_name",
"username"
],
"properties": {
"name": {
"type": "string",
"description": "Role name"
},
"db_name": {
"type": "string",
"description": "Database connection to use"
},
"username": {
"type": "string",
"description": "Database username to manage"
},
"mount_path": {
"type": "string",
"default": "database",
"description": "Mount path of the Database engine"
},
"rotation_period": {
"type": "string",
"description": "Password rotation period (e.g., \"24h"
},
"rotation_statements": {
"type": "array",
"items": {
"type": "string"
},
"description": "SQL statements for password rotation"
}
}
}vault_db_delete_static_roleDelete a static database role.
{
"type": "object",
"required": [
"name"
],
"properties": {
"name": {
"type": "string",
"description": "Role name to delete"
},
"mount_path": {
"type": "string",
"default": "database",
"description": "Mount path of the Database engine"
}
}
}vault_db_get_static_credentialsGet current credentials for a static role.
{
"type": "object",
"required": [
"role_name"
],
"properties": {
"role_name": {
"type": "string",
"description": "Role name to get credentials for"
},
"mount_path": {
"type": "string",
"default": "database",
"description": "Mount path of the Database engine"
}
}
}vault_db_rotate_static_roleManually rotate the password for a static role.
{
"type": "object",
"required": [
"role_name"
],
"properties": {
"role_name": {
"type": "string",
"description": "Role name to rotate"
},
"mount_path": {
"type": "string",
"default": "database",
"description": "Mount path of the Database engine"
}
}
}vault_github_read_configRead the GitHub auth method configuration.
{
"type": "object",
"properties": {
"mount_path": {
"type": "string",
"default": "github",
"description": "Mount path of the GitHub auth method"
}
}
}vault_github_read_teamRead a GitHub team mapping.
{
"type": "object",
"required": [
"team_name"
],
"properties": {
"team_name": {
"type": "string",
"description": "GitHub team name"
},
"mount_path": {
"type": "string",
"default": "github",
"description": "Mount path of the GitHub auth method"
}
}
}vault_github_write_teamCreate or update a GitHub team mapping.
{
"type": "object",
"properties": {}
}vault_github_delete_teamDelete a GitHub team mapping.
{
"type": "object",
"properties": {}
}vault_github_list_usersList all GitHub user mappings.
{
"type": "object",
"properties": {
"mount_path": {
"type": "string",
"default": "github",
"description": "Mount path of the GitHub auth method"
}
}
}vault_github_read_userRead a GitHub user mapping.
{
"type": "object",
"required": [
"username"
],
"properties": {
"username": {
"type": "string",
"description": "GitHub username"
},
"mount_path": {
"type": "string",
"default": "github",
"description": "Mount path of the GitHub auth method"
}
}
}vault_github_write_userCreate or update a GitHub user mapping.
{
"type": "object",
"properties": {}
}vault_github_delete_userDelete a GitHub user mapping.
{
"type": "object",
"properties": {}
}vault_github_loginLogin using a GitHub personal access token.
{
"type": "object",
"properties": {}
}vault_identity_list_entitiesList all identity entities by ID.
{
"type": "object",
"properties": {}
}vault_identity_list_entities_by_nameList all identity entities by name.
{
"type": "object",
"properties": {}
}vault_identity_create_entityCreate a new identity entity.
{
"type": "object",
"properties": {
"name": {
"type": "string",
"description": "Entity name"
},
"disabled": {
"type": "boolean",
"description": "Whether entity is disabled"
},
"metadata": {
"type": "object",
"description": "Entity metadata"
},
"policies": {
"type": "array",
"items": {
"type": "string"
},
"description": "Policies to attach"
}
}
}vault_identity_read_entityRead an identity entity by ID.
{
"type": "object",
"required": [
"id"
],
"properties": {
"id": {
"type": "string",
"description": "Entity ID"
}
}
}vault_identity_read_entity_by_nameRead an identity entity by name.
{
"type": "object",
"required": [
"name"
],
"properties": {
"name": {
"type": "string",
"description": "Entity name"
}
}
}vault_identity_update_entityUpdate an identity entity.
{
"type": "object",
"required": [
"id"
],
"properties": {
"id": {
"type": "string",
"description": "Entity ID"
},
"name": {
"type": "string",
"description": "New entity name"
},
"disabled": {
"type": "boolean",
"description": "Whether entity is disabled"
},
"metadata": {
"type": "object",
"description": "Entity metadata"
},
"policies": {
"type": "array",
"items": {
"type": "string"
},
"description": "Policies to attach"
}
}
}vault_identity_delete_entityDelete an identity entity and all its aliases.
{
"type": "object",
"required": [
"id"
],
"properties": {
"id": {
"type": "string",
"description": "Entity ID"
}
}
}vault_identity_merge_entitiesMerge multiple entities into one.
{
"type": "object",
"required": [
"from_entity_ids",
"to_entity_id"
],
"properties": {
"force": {
"type": "boolean",
"description": "Force merge even with conflicts"
},
"to_entity_id": {
"type": "string",
"description": "Entity ID to merge into"
},
"from_entity_ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Entity IDs to merge from"
},
"conflicting_alias_ids_to_keep": {
"type": "array",
"items": {
"type": "string"
},
"description": "Alias IDs to keep on conflict"
}
}
}vault_identity_list_entity_aliasesList all entity aliases.
{
"type": "object",
"properties": {}
}vault_identity_create_entity_aliasCreate an entity alias.
{
"type": "object",
"required": [
"name",
"canonical_id",
"mount_accessor"
],
"properties": {
"name": {
"type": "string",
"description": "Alias name (usually username from auth method)"
},
"metadata": {
"type": "object",
"description": "Alias metadata"
},
"canonical_id": {
"type": "string",
"description": "Entity ID to link to"
},
"mount_accessor": {
"type": "string",
"description": "Auth method mount accessor"
}
}
}vault_identity_read_entity_aliasRead an entity alias.
{
"type": "object",
"required": [
"id"
],
"properties": {
"id": {
"type": "string",
"description": "Alias ID"
}
}
}vault_identity_update_entity_aliasUpdate an entity alias.
{
"type": "object",
"required": [
"id"
],
"properties": {
"id": {
"type": "string",
"description": "Alias ID"
},
"name": {
"type": "string",
"description": "New alias name"
},
"metadata": {
"type": "object",
"description": "Alias metadata"
},
"canonical_id": {
"type": "string",
"description": "New entity ID"
},
"mount_accessor": {
"type": "string",
"description": "New mount accessor"
}
}
}vault_identity_delete_entity_aliasDelete an entity alias.
{
"type": "object",
"required": [
"id"
],
"properties": {
"id": {
"type": "string",
"description": "Alias ID"
}
}
}vault_identity_list_groupsList all identity groups by ID.
{
"type": "object",
"properties": {}
}vault_identity_list_groups_by_nameList all identity groups by name.
{
"type": "object",
"properties": {}
}vault_identity_create_groupCreate an identity group.
{
"type": "object",
"properties": {
"name": {
"type": "string",
"description": "Group name"
},
"type": {
"enum": [
"internal",
"external"
],
"type": "string",
"description": "Group type"
},
"metadata": {
"type": "object",
"description": "Group metadata"
},
"policies": {
"type": "array",
"items": {
"type": "string"
},
"description": "Policies to attach"
},
"member_group_ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Member group IDs (nested groups)"
},
"member_entity_ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Member entity IDs"
}
}
}vault_identity_update_groupUpdate an identity group.
{
"type": "object",
"required": [
"id"
],
"properties": {
"id": {
"type": "string",
"description": "Group ID"
},
"name": {
"type": "string",
"description": "New group name"
},
"metadata": {
"type": "object",
"description": "Group metadata"
},
"policies": {
"type": "array",
"items": {
"type": "string"
},
"description": "Policies to attach"
},
"member_group_ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Member group IDs"
},
"member_entity_ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Member entity IDs"
}
}
}vault_identity_delete_groupDelete an identity group.
{
"type": "object",
"required": [
"id"
],
"properties": {
"id": {
"type": "string",
"description": "Group ID"
}
}
}vault_identity_list_group_aliasesList all group aliases.
{
"type": "object",
"properties": {}
}vault_identity_create_group_aliasCreate a group alias (for external groups).
{
"type": "object",
"required": [
"name",
"mount_accessor",
"canonical_id"
],
"properties": {
"name": {
"type": "string",
"description": "Alias name"
},
"canonical_id": {
"type": "string",
"description": "Group ID to link to"
},
"mount_accessor": {
"type": "string",
"description": "Auth method mount accessor"
}
}
}vault_identity_read_group_aliasRead a group alias.
{
"type": "object",
"required": [
"id"
],
"properties": {
"id": {
"type": "string",
"description": "Alias ID"
}
}
}vault_identity_update_group_aliasUpdate a group alias.
{
"type": "object",
"required": [
"id"
],
"properties": {
"id": {
"type": "string",
"description": "Alias ID"
},
"name": {
"type": "string",
"description": "New alias name"
},
"canonical_id": {
"type": "string",
"description": "New group ID"
},
"mount_accessor": {
"type": "string",
"description": "New mount accessor"
}
}
}vault_identity_delete_group_aliasDelete a group alias.
{
"type": "object",
"required": [
"id"
],
"properties": {
"id": {
"type": "string",
"description": "Alias ID"
}
}
}vault_jwt_read_configRead the JWT/OIDC auth method configuration.
{
"type": "object",
"properties": {
"mount_path": {
"type": "string",
"default": "jwt",
"description": "Mount path of the JWT auth method"
}
}
}vault_jwt_write_configConfigure the JWT/OIDC auth method.
{
"type": "object",
"properties": {
"jwks_url": {
"type": "string",
"description": "JWKS URL for JWT validation"
},
"mount_path": {
"type": "string",
"default": "jwt",
"description": "Mount path of the JWT auth method"
},
"jwks_ca_pem": {
"type": "string",
"description": "CA certificate for JWKS"
},
"bound_issuer": {
"type": "string",
"description": "Required JWT issuer"
},
"default_role": {
"type": "string",
"description": "Default role for login"
},
"oidc_client_id": {
"type": "string",
"description": "OIDC client ID"
},
"jwt_supported_algs": {
"type": "array",
"items": {
"type": "string"
},
"description": "Supported JWT algorithms"
},
"namespace_in_state": {
"type": "boolean",
"description": "Include namespace in OIDC state"
},
"oidc_client_secret": {
"type": "string",
"description": "OIDC client secret"
},
"oidc_discovery_url": {
"type": "string",
"description": "OIDC discovery URL"
},
"oidc_response_mode": {
"type": "string",
"description": "OIDC response mode"
},
"oidc_response_types": {
"type": "array",
"items": {
"type": "string"
},
"description": "OIDC response types"
},
"oidc_discovery_ca_pem": {
"type": "string",
"description": "CA certificate for OIDC discovery"
},
"jwt_validation_pubkeys": {
"type": "array",
"items": {
"type": "string"
},
"description": "Public keys for JWT validation"
}
}
}vault_jwt_list_rolesList all JWT/OIDC roles.
{
"type": "object",
"properties": {
"mount_path": {
"type": "string",
"default": "jwt",
"description": "Mount path of the JWT auth method"
}
}
}vault_jwt_read_roleRead a JWT/OIDC role configuration.
{
"type": "object",
"required": [
"name"
],
"properties": {
"name": {
"type": "string",
"description": "Role name"
},
"mount_path": {
"type": "string",
"default": "jwt",
"description": "Mount path of the JWT auth method"
}
}
}vault_jwt_create_roleCreate or update a JWT/OIDC role.
{
"type": "object",
"required": [
"name",
"user_claim"
],
"properties": {
"name": {
"type": "string",
"description": "Role name"
},
"role_type": {
"enum": [
"jwt",
"oidc"
],
"type": "string",
"description": "Role type"
},
"token_ttl": {
"type": "string",
"description": "Token TTL"
},
"mount_path": {
"type": "string",
"default": "jwt",
"description": "Mount path of the JWT auth method"
},
"token_type": {
"type": "string",
"description": "Token type"
},
"user_claim": {
"type": "string",
"description": "Claim to use as user identity"
},
"oidc_scopes": {
"type": "array",
"items": {
"type": "string"
},
"description": "OIDC scopes to request"
},
"bound_claims": {
"type": "object",
"description": "Required claim values"
},
"groups_claim": {
"type": "string",
"description": "Claim containing group membership"
},
"token_period": {
"type": "string",
"description": "Token period for periodic tokens"
},
"bound_subject": {
"type": "string",
"description": "Required JWT subject"
},
"token_max_ttl": {
"type": "string",
"description": "Maximum token TTL"
},
"claim_mappings": {
"type": "object",
"description": "Claim to metadata mappings"
},
"token_num_uses": {
"type": "integer",
"description": "Number of times token can be used"
},
"token_policies": {
"type": "array",
"items": {
"type": "string"
},
"description": "Policies to attach"
},
"bound_audiences": {
"type": "array",
"items": {
"type": "string"
},
"description": "Required JWT audiences"
},
"bound_claims_type": {
"enum": [
"string",
"glob"
],
"type": "string",
"description": "How to match bound claims"
},
"token_bound_cidrs": {
"type": "array",
"items": {
"type": "string"
},
"description": "CIDRs that can use the token"
},
"allowed_redirect_uris": {
"type": "array",
"items": {
"type": "string"
},
"description": "Allowed OIDC redirect URIs"
},
"token_no_default_policy": {
"type": "boolean",
"description": "Do not attach default policy"
},
"user_claim_json_pointer": {
"type": "boolean",
"description": "User claim is a JSON pointer"
}
}
}vault_jwt_delete_roleDelete a JWT/OIDC role.
{
"type": "object",
"required": [
"name"
],
"properties": {
"name": {
"type": "string",
"description": "Role name to delete"
},
"mount_path": {
"type": "string",
"default": "jwt",
"description": "Mount path of the JWT auth method"
}
}
}vault_jwt_loginLogin using a JWT to obtain a Vault token.
{
"type": "object",
"required": [
"role",
"jwt"
],
"properties": {
"jwt": {
"type": "string",
"description": "Signed JWT"
},
"role": {
"type": "string",
"description": "Role to authenticate against"
},
"mount_path": {
"type": "string",
"default": "jwt",
"description": "Mount path of the JWT auth method"
}
}
}vault_oidc_get_auth_urlGet the OIDC authorization URL for browser-based login.
{
"type": "object",
"required": [
"role",
"redirect_uri"
],
"properties": {
"role": {
"type": "string",
"description": "Role to authenticate against"
},
"mount_path": {
"type": "string",
"default": "oidc",
"description": "Mount path of the OIDC auth method"
},
"redirect_uri": {
"type": "string",
"description": "Redirect URI after authentication"
}
}
}vault_kubernetes_read_configRead the Kubernetes auth method configuration.
{
"type": "object",
"properties": {
"mount_path": {
"type": "string",
"default": "kubernetes",
"description": "Mount path of the Kubernetes auth method"
}
}
}vault_kubernetes_read_roleRead a Kubernetes auth role.
{
"type": "object",
"required": [
"name"
],
"properties": {
"name": {
"type": "string",
"description": "Role name"
},
"mount_path": {
"type": "string",
"default": "kubernetes",
"description": "Mount path of the Kubernetes auth method"
}
}
}vault_kubernetes_create_roleCreate or update a Kubernetes auth role.
{
"type": "object",
"properties": {}
}vault_kubernetes_delete_roleDelete a Kubernetes auth role.
{
"type": "object",
"properties": {}
}vault_kubernetes_loginLogin using a Kubernetes service account JWT.
{
"type": "object",
"properties": {}
}vault_kv_readRead a secret from KV v2 secrets engine.
{
"type": "object",
"required": [
"path"
],
"properties": {
"path": {
"type": "string",
"description": "Path to the secret"
},
"version": {
"type": "integer",
"description": "Specific version to read (default: latest)"
},
"mount_path": {
"type": "string",
"default": "secret",
"description": "Mount path of the KV v2 engine"
}
}
}vault_kv_writeWrite a secret to KV v2 secrets engine.
{
"type": "object",
"required": [
"path",
"data"
],
"properties": {
"cas": {
"type": "integer",
"description": "Check-and-set version (for optimistic locking)"
},
"data": {
"type": "object",
"description": "Secret data as key-value pairs"
},
"path": {
"type": "string",
"description": "Path to the secret"
},
"mount_path": {
"type": "string",
"default": "secret",
"description": "Mount path of the KV v2 engine"
}
}
}vault_kv_deleteDelete the latest version of a secret (soft delete in KV v2).
{
"type": "object",
"required": [
"path"
],
"properties": {
"path": {
"type": "string",
"description": "Path to the secret"
},
"mount_path": {
"type": "string",
"default": "secret",
"description": "Mount path of the KV v2 engine"
}
}
}vault_kv_delete_versionsDelete specific versions of a secret (soft delete).
{
"type": "object",
"required": [
"path",
"versions"
],
"properties": {
"path": {
"type": "string",
"description": "Path to the secret"
},
"versions": {
"type": "array",
"items": {
"type": "number"
},
"description": "Version numbers to delete"
},
"mount_path": {
"type": "string",
"default": "secret",
"description": "Mount path of the KV v2 engine"
}
}
}vault_kv_undeleteUndelete (restore) soft-deleted versions of a secret.
{
"type": "object",
"required": [
"path",
"versions"
],
"properties": {
"path": {
"type": "string",
"description": "Path to the secret"
},
"versions": {
"type": "array",
"items": {
"type": "number"
},
"description": "Version numbers to restore"
},
"mount_path": {
"type": "string",
"default": "secret",
"description": "Mount path of the KV v2 engine"
}
}
}vault_kv_destroyPermanently destroy versions of a secret (cannot be recovered).
{
"type": "object",
"required": [
"path",
"versions"
],
"properties": {
"path": {
"type": "string",
"description": "Path to the secret"
},
"versions": {
"type": "array",
"items": {
"type": "number"
},
"description": "Version numbers to permanently destroy"
},
"mount_path": {
"type": "string",
"default": "secret",
"description": "Mount path of the KV v2 engine"
}
}
}vault_kv_listList secrets at a path in KV v2 engine.
{
"type": "object",
"properties": {
"path": {
"type": "string",
"description": "Path to list (default: root)"
},
"mount_path": {
"type": "string",
"default": "secret",
"description": "Mount path of the KV v2 engine"
}
}
}vault_kv_read_metadataRead metadata for a secret including version history.
{
"type": "object",
"required": [
"path"
],
"properties": {
"path": {
"type": "string",
"description": "Path to the secret"
},
"mount_path": {
"type": "string",
"default": "secret",
"description": "Mount path of the KV v2 engine"
}
}
}vault_kv_write_metadataUpdate metadata for a secret.
{
"type": "object",
"required": [
"path"
],
"properties": {
"path": {
"type": "string",
"description": "Path to the secret"
},
"mount_path": {
"type": "string",
"default": "secret",
"description": "Mount path of the KV v2 engine"
},
"cas_required": {
"type": "boolean",
"description": "Require check-and-set for writes"
},
"max_versions": {
"type": "integer",
"description": "Maximum number of versions to keep"
},
"custom_metadata": {
"type": "object",
"description": "Custom metadata key-value pairs"
},
"delete_version_after": {
"type": "string",
"description": "Auto-delete versions after duration (e.g., \"30d"
}
}
}vault_kv_delete_metadataDelete all versions and metadata for a secret permanently.
{
"type": "object",
"required": [
"path"
],
"properties": {
"path": {
"type": "string",
"description": "Path to the secret"
},
"mount_path": {
"type": "string",
"default": "secret",
"description": "Mount path of the KV v2 engine"
}
}
}vault_kv_read_configRead the configuration of a KV v2 secrets engine.
{
"type": "object",
"properties": {
"mount_path": {
"type": "string",
"default": "secret",
"description": "Mount path of the KV v2 engine"
}
}
}vault_kv_write_configConfigure a KV v2 secrets engine.
{
"type": "object",
"properties": {
"mount_path": {
"type": "string",
"default": "secret",
"description": "Mount path of the KV v2 engine"
},
"cas_required": {
"type": "boolean",
"description": "Require check-and-set by default"
},
"max_versions": {
"type": "integer",
"description": "Default maximum versions to keep"
},
"delete_version_after": {
"type": "string",
"description": "Default auto-delete duration"
}
}
}vault_kv_v1_readRead a secret from KV v1 secrets engine.
{
"type": "object",
"required": [
"mount_path",
"path"
],
"properties": {
"path": {
"type": "string",
"description": "Path to the secret"
},
"mount_path": {
"type": "string",
"description": "Mount path of the KV v1 engine"
}
}
}vault_kv_v1_writeWrite a secret to KV v1 secrets engine.
{
"type": "object",
"required": [
"mount_path",
"path",
"data"
],
"properties": {
"data": {
"type": "object",
"description": "Secret data as key-value pairs"
},
"path": {
"type": "string",
"description": "Path to the secret"
},
"mount_path": {
"type": "string",
"description": "Mount path of the KV v1 engine"
}
}
}vault_kv_v1_deleteDelete a secret from KV v1 secrets engine.
{
"type": "object",
"required": [
"mount_path",
"path"
],
"properties": {
"path": {
"type": "string",
"description": "Path to the secret"
},
"mount_path": {
"type": "string",
"description": "Mount path of the KV v1 engine"
}
}
}vault_kv_v1_listList secrets at a path in KV v1 engine.
{
"type": "object",
"required": [
"mount_path"
],
"properties": {
"path": {
"type": "string",
"description": "Path to list (default: root)"
},
"mount_path": {
"type": "string",
"description": "Mount path of the KV v1 engine"
}
}
}vault_ldap_read_configRead the LDAP auth method configuration.
{
"type": "object",
"properties": {
"mount_path": {
"type": "string",
"default": "ldap",
"description": "Mount path of the LDAP auth method"
}
}
}vault_ldap_write_configConfigure the LDAP auth method.
{
"type": "object",
"properties": {}
}vault_ldap_list_groupsList all LDAP group mappings.
{
"type": "object",
"properties": {
"mount_path": {
"type": "string",
"default": "ldap",
"description": "Mount path of the LDAP auth method"
}
}
}vault_ldap_read_groupRead an LDAP group mapping.
{
"type": "object",
"required": [
"name"
],
"properties": {
"name": {
"type": "string",
"description": "Group name"
},
"mount_path": {
"type": "string",
"default": "ldap",
"description": "Mount path of the LDAP auth method"
}
}
}vault_ldap_write_groupCreate or update an LDAP group mapping.
{
"type": "object",
"properties": {}
}vault_ldap_delete_groupDelete an LDAP group mapping.
{
"type": "object",
"properties": {}
}vault_ldap_list_usersList all LDAP user mappings.
{
"type": "object",
"properties": {
"mount_path": {
"type": "string",
"default": "ldap",
"description": "Mount path of the LDAP auth method"
}
}
}vault_ldap_read_userRead an LDAP user mapping.
{
"type": "object",
"required": [
"username"
],
"properties": {
"username": {
"type": "string",
"description": "Username"
},
"mount_path": {
"type": "string",
"default": "ldap",
"description": "Mount path of the LDAP auth method"
}
}
}vault_ldap_write_userCreate or update an LDAP user mapping.
{
"type": "object",
"properties": {}
}vault_ldap_delete_userDelete an LDAP user mapping.
{
"type": "object",
"properties": {}
}vault_ldap_loginLogin using LDAP credentials.
{
"type": "object",
"properties": {}
}vault_lookup_leaseLook up information about a lease.
{
"type": "object",
"required": [
"lease_id"
],
"properties": {
"lease_id": {
"type": "string",
"description": "Lease ID to look up"
}
}
}vault_renew_leaseRenew a lease to extend its validity.
{
"type": "object",
"required": [
"lease_id"
],
"properties": {
"lease_id": {
"type": "string",
"description": "Lease ID to renew"
},
"increment": {
"type": "integer",
"description": "Requested increment in seconds"
}
}
}vault_revoke_leaseRevoke a lease immediately.
{
"type": "object",
"required": [
"lease_id"
],
"properties": {
"sync": {
"type": "boolean",
"description": "Wait for revocation to complete (default: false)"
},
"lease_id": {
"type": "string",
"description": "Lease ID to revoke"
}
}
}vault_revoke_lease_prefixRevoke all leases under a prefix. Requires sudo capability.
{
"type": "object",
"required": [
"prefix"
],
"properties": {
"sync": {
"type": "boolean",
"description": "Wait for revocation to complete (default: false)"
},
"prefix": {
"type": "string",
"description": "Lease prefix to revoke (e.g., \"database/creds/readonly"
}
}
}vault_pki_issue_certificateIssue a new certificate using a PKI role.
{
"type": "object",
"required": [
"role_name",
"common_name"
],
"properties": {
"ttl": {
"type": "string",
"description": "Certificate TTL (e.g., \"24h\", \"30d"
},
"format": {
"enum": [
"pem",
"der",
"pem_bundle"
],
"type": "string",
"description": "Output format"
},
"ip_sans": {
"type": "string",
"description": "Comma-separated IP SANs"
},
"uri_sans": {
"type": "string",
"description": "Comma-separated URI SANs"
},
"alt_names": {
"type": "string",
"description": "Comma-separated SANs (Subject Alternative Names)"
},
"role_name": {
"type": "string",
"description": "PKI role to use for issuance"
},
"mount_path": {
"type": "string",
"default": "pki",
"description": "Mount path of the PKI engine"
},
"common_name": {
"type": "string",
"description": "Common name for the certificate"
},
"private_key_format": {
"enum": [
"der",
"pem",
"pkcs8"
],
"type": "string",
"description": "Private key format"
},
"exclude_cn_from_sans": {
"type": "boolean",
"description": "Exclude CN from SANs"
}
}
}vault_pki_sign_certificateSign a CSR using a PKI role.
{
"type": "object",
"required": [
"role_name",
"csr"
],
"properties": {
"csr": {
"type": "string",
"description": "PEM-encoded Certificate Signing Request"
},
"ttl": {
"type": "string",
"description": "Certificate TTL"
},
"format": {
"enum": [
"pem",
"der",
"pem_bundle"
],
"type": "string",
"description": "Output format"
},
"ip_sans": {
"type": "string",
"description": "Comma-separated IP SANs"
},
"uri_sans": {
"type": "string",
"description": "Comma-separated URI SANs"
},
"alt_names": {
"type": "string",
"description": "Comma-separated SANs"
},
"role_name": {
"type": "string",
"description": "PKI role to use for signing"
},
"mount_path": {
"type": "string",
"default": "pki",
"description": "Mount path of the PKI engine"
},
"common_name": {
"type": "string",
"description": "Override the CN from CSR"
}
}
}vault_pki_revoke_certificateRevoke a certificate by serial number.
{
"type": "object",
"required": [
"serial_number"
],
"properties": {
"mount_path": {
"type": "string",
"default": "pki",
"description": "Mount path of the PKI engine"
},
"serial_number": {
"type": "string",
"description": "Serial number of the certificate to revoke"
}
}
}vault_pki_list_certificatesList all issued certificate serial numbers.
{
"type": "object",
"properties": {
"mount_path": {
"type": "string",
"default": "pki",
"description": "Mount path of the PKI engine"
}
}
}vault_pki_read_certificateRead a certificate by serial number.
{
"type": "object",
"required": [
"serial"
],
"properties": {
"serial": {
"type": "string",
"description": "Serial number of the certificate"
},
"mount_path": {
"type": "string",
"default": "pki",
"description": "Mount path of the PKI engine"
}
}
}vault_pki_get_caGet the CA certificate.
{
"type": "object",
"properties": {
"mount_path": {
"type": "string",
"default": "pki",
"description": "Mount path of the PKI engine"
}
}
}vault_pki_get_ca_chainGet the CA certificate chain.
{
"type": "object",
"properties": {
"mount_path": {
"type": "string",
"default": "pki",
"description": "Mount path of the PKI engine"
}
}
}vault_pki_list_issuersList all issuers in the PKI engine.
{
"type": "object",
"properties": {
"mount_path": {
"type": "string",
"default": "pki",
"description": "Mount path of the PKI engine"
}
}
}vault_pki_read_issuerRead details of a specific issuer.
{
"type": "object",
"required": [
"issuer_id"
],
"properties": {
"issuer_id": {
"type": "string",
"description": "Issuer ID or name"
},
"mount_path": {
"type": "string",
"default": "pki",
"description": "Mount path of the PKI engine"
}
}
}vault_pki_list_rolesList all PKI roles.
{
"type": "object",
"properties": {
"mount_path": {
"type": "string",
"default": "pki",
"description": "Mount path of the PKI engine"
}
}
}vault_pki_read_roleRead configuration of a PKI role.
{
"type": "object",
"required": [
"name"
],
"properties": {
"name": {
"type": "string",
"description": "Role name"
},
"mount_path": {
"type": "string",
"default": "pki",
"description": "Mount path of the PKI engine"
}
}
}vault_pki_create_roleCreate or update a PKI role.
{
"type": "object",
"required": [
"name"
],
"properties": {
"ttl": {
"type": "string",
"description": "Default TTL for certificates"
},
"name": {
"type": "string",
"description": "Role name"
},
"max_ttl": {
"type": "string",
"description": "Maximum TTL for certificates"
},
"key_bits": {
"type": "integer",
"description": "Key size in bits"
},
"key_type": {
"enum": [
"rsa",
"ec",
"ed25519"
],
"type": "string",
"description": "Key type for generated certificates"
},
"mount_path": {
"type": "string",
"default": "pki",
"description": "Mount path of the PKI engine"
},
"client_flag": {
"type": "boolean",
"description": "Set client flag in certificates"
},
"server_flag": {
"type": "boolean",
"description": "Set server flag in certificates"
},
"allow_ip_sans": {
"type": "boolean",
"description": "Allow IP SANs"
},
"allow_any_name": {
"type": "boolean",
"description": "Allow any common name"
},
"allow_localhost": {
"type": "boolean",
"description": "Allow localhost in SANs"
},
"allowed_domains": {
"type": "array",
"items": {
"type": "string"
},
"description": "Allowed domains for certificates"
},
"allow_subdomains": {
"type": "boolean",
"description": "Allow subdomains"
},
"enforce_hostnames": {
"type": "boolean",
"description": "Enforce hostnames in certificates"
},
"allow_bare_domains": {
"type": "boolean",
"description": "Allow bare domains"
},
"allow_glob_domains": {
"type": "boolean",
"description": "Allow glob patterns in domains"
}
}
}vault_pki_delete_roleDelete a PKI role.
{
"type": "object",
"required": [
"name"
],
"properties": {
"name": {
"type": "string",
"description": "Role name to delete"
},
"mount_path": {
"type": "string",
"default": "pki",
"description": "Mount path of the PKI engine"
}
}
}vault_pki_read_urls_configRead the URLs configuration for the PKI engine.
{
"type": "object",
"properties": {
"mount_path": {
"type": "string",
"default": "pki",
"description": "Mount path of the PKI engine"
}
}
}vault_pki_write_urls_configConfigure URLs for the PKI engine.
{
"type": "object",
"properties": {
"mount_path": {
"type": "string",
"default": "pki",
"description": "Mount path of the PKI engine"
},
"ocsp_servers": {
"type": "array",
"items": {
"type": "string"
},
"description": "OCSP server URLs"
},
"issuing_certificates": {
"type": "array",
"items": {
"type": "string"
},
"description": "URLs for issuing certificates"
},
"crl_distribution_points": {
"type": "array",
"items": {
"type": "string"
},
"description": "CRL distribution point URLs"
}
}
}vault_pki_rotate_crlRotate the Certificate Revocation List.
{
"type": "object",
"properties": {
"mount_path": {
"type": "string",
"default": "pki",
"description": "Mount path of the PKI engine"
}
}
}vault_unsealProvide an unseal key to unseal Vault. Multiple keys may be required based on threshold.
{
"type": "object",
"required": [
"key"
],
"properties": {
"key": {
"type": "string",
"description": "Unseal key (one of the key shares)"
},
"reset": {
"type": "boolean",
"description": "Reset the unseal progress"
}
}
}vault_pki_tidyTidy up the PKI backend by removing expired certificates.
{
"type": "object",
"properties": {
"mount_path": {
"type": "string",
"default": "pki",
"description": "Mount path of the PKI engine"
},
"safety_buffer": {
"type": "string",
"description": "Safety buffer duration (e.g., \"72h"
},
"tidy_cert_store": {
"type": "boolean",
"description": "Tidy the certificate store"
},
"tidy_revoked_certs": {
"type": "boolean",
"description": "Tidy revoked certificates"
},
"tidy_revoked_cert_issuer_associations": {
"type": "boolean",
"description": "Tidy revoked cert issuer associations"
}
}
}vault_rabbitmq_write_connection_configConfigure the RabbitMQ connection.
{
"type": "object",
"properties": {}
}vault_rabbitmq_write_lease_configConfigure the RabbitMQ lease settings.
{
"type": "object",
"properties": {}
}vault_rabbitmq_list_rolesList all RabbitMQ roles.
{
"type": "object",
"properties": {
"mount_path": {
"type": "string",
"default": "rabbitmq",
"description": "Mount path of the RabbitMQ engine"
}
}
}vault_rabbitmq_read_roleRead a RabbitMQ role.
{
"type": "object",
"required": [
"name"
],
"properties": {
"name": {
"type": "string",
"description": "Role name"
},
"mount_path": {
"type": "string",
"default": "rabbitmq",
"description": "Mount path of the RabbitMQ engine"
}
}
}vault_rabbitmq_create_roleCreate or update a RabbitMQ role.
{
"type": "object",
"properties": {}
}vault_rabbitmq_generate_credentialsGenerate RabbitMQ credentials for a role.
{
"type": "object",
"required": [
"role_name"
],
"properties": {
"role_name": {
"type": "string",
"description": "Role name"
},
"mount_path": {
"type": "string",
"default": "rabbitmq",
"description": "Mount path of the RabbitMQ engine"
}
}
}vault_ssh_list_rolesList all SSH roles.
{
"type": "object",
"properties": {
"mount_path": {
"type": "string",
"default": "ssh",
"description": "Mount path of the SSH engine"
}
}
}vault_ssh_read_roleRead configuration of an SSH role.
{
"type": "object",
"required": [
"name"
],
"properties": {
"name": {
"type": "string",
"description": "Role name"
},
"mount_path": {
"type": "string",
"default": "ssh",
"description": "Mount path of the SSH engine"
}
}
}vault_ssh_create_roleCreate or update an SSH role.
{
"type": "object",
"required": [
"name",
"key_type"
],
"properties": {
"ttl": {
"type": "string",
"description": "Certificate TTL for CA roles"
},
"name": {
"type": "string",
"description": "Role name"
},
"max_ttl": {
"type": "string",
"description": "Maximum certificate TTL"
},
"key_type": {
"enum": [
"otp",
"ca",
"dynamic"
],
"type": "string",
"description": "SSH key type"
},
"cidr_list": {
"type": "string",
"description": "Comma-separated CIDR blocks for OTP roles"
},
"mount_path": {
"type": "string",
"default": "ssh",
"description": "Mount path of the SSH engine"
},
"default_user": {
"type": "string",
"description": "Default username"
},
"allowed_users": {
"type": "string",
"description": "Comma-separated allowed usernames or \"*\" for any"
},
"algorithm_signer": {
"type": "string",
"description": "Signing algorithm (rsa-sha2-256, rsa-sha2-512, etc.)"
},
"allowed_extensions": {
"type": "string",
"description": "Allowed certificate extensions"
},
"allow_host_certificates": {
"type": "boolean",
"description": "Allow host certificates"
},
"allow_user_certificates": {
"type": "boolean",
"description": "Allow user certificates"
}
}
}vault_ssh_delete_roleDelete an SSH role.
{
"type": "object",
"required": [
"name"
],
"properties": {
"name": {
"type": "string",
"description": "Role name to delete"
},
"mount_path": {
"type": "string",
"default": "ssh",
"description": "Mount path of the SSH engine"
}
}
}vault_ssh_generate_credentialsGenerate SSH credentials (OTP or dynamic key) for a role.
{
"type": "object",
"required": [
"role_name",
"ip"
],
"properties": {
"ip": {
"type": "string",
"description": "Target IP address"
},
"username": {
"type": "string",
"description": "Username (uses role default if not specified)"
},
"role_name": {
"type": "string",
"description": "Role name"
},
"mount_path": {
"type": "string",
"default": "ssh",
"description": "Mount path of the SSH engine"
}
}
}vault_ssh_sign_keySign an SSH public key using a CA role.
{
"type": "object",
"required": [
"role_name",
"public_key"
],
"properties": {
"ttl": {
"type": "string",
"description": "Certificate TTL"
},
"key_id": {
"type": "string",
"description": "Key identifier"
},
"cert_type": {
"enum": [
"user",
"host"
],
"type": "string",
"description": "Certificate type"
},
"role_name": {
"type": "string",
"description": "CA role name"
},
"mount_path": {
"type": "string",
"default": "ssh",
"description": "Mount path of the SSH engine"
},
"public_key": {
"type": "string",
"description": "SSH public key to sign"
},
"valid_principals": {
"type": "string",
"description": "Comma-separated list of principals"
}
}
}vault_ssh_verify_otpVerify an SSH OTP.
{
"type": "object",
"required": [
"otp"
],
"properties": {
"otp": {
"type": "string",
"description": "One-time password to verify"
},
"mount_path": {
"type": "string",
"default": "ssh",
"description": "Mount path of the SSH engine"
}
}
}vault_ssh_read_ca_configRead the SSH CA public key.
{
"type": "object",
"properties": {
"mount_path": {
"type": "string",
"default": "ssh",
"description": "Mount path of the SSH engine"
}
}
}vault_ssh_write_ca_configConfigure the SSH CA.
{
"type": "object",
"properties": {
"key_bits": {
"type": "integer",
"description": "Key size in bits"
},
"key_type": {
"type": "string",
"description": "Key type (rsa, ecdsa, ed25519)"
},
"mount_path": {
"type": "string",
"default": "ssh",
"description": "Mount path of the SSH engine"
},
"public_key": {
"type": "string",
"description": "Public key for CA (if not generating)"
},
"private_key": {
"type": "string",
"description": "Private key for CA (if not generating)"
},
"generate_signing_key": {
"type": "boolean",
"description": "Generate a new signing key"
}
}
}vault_ssh_delete_ca_configDelete the SSH CA configuration.
{
"type": "object",
"properties": {
"mount_path": {
"type": "string",
"default": "ssh",
"description": "Mount path of the SSH engine"
}
}
}vault_healthGet Vault health status including initialization, seal state, and version.
{
"type": "object",
"properties": {}
}vault_seal_statusGet Vault seal status including key shares and threshold.
{
"type": "object",
"properties": {}
}vault_leaderGet Vault cluster leader information for HA deployments.
{
"type": "object",
"properties": {}
}vault_sealSeal the Vault. WARNING: This will make Vault unavailable until unsealed.
{
"type": "object",
"properties": {}
}vault_initInitialize a new Vault instance. Only works on uninitialized Vault.
{
"type": "object",
"required": [
"secret_shares",
"secret_threshold"
],
"properties": {
"secret_shares": {
"type": "integer",
"minimum": 1,
"description": "Number of key shares to generate"
},
"secret_threshold": {
"type": "integer",
"minimum": 1,
"description": "Number of key shares required to unseal"
}
}
}vault_list_mountsList all mounted secrets engines.
{
"type": "object",
"properties": {}
}vault_enable_secrets_engineEnable a new secrets engine at the specified path.
{
"type": "object",
"required": [
"path",
"type"
],
"properties": {
"path": {
"type": "string",
"description": "Mount path for the secrets engine"
},
"type": {
"type": "string",
"description": "Type of secrets engine (kv, transit, pki, database, etc.)"
},
"options": {
"type": "object",
"description": "Engine-specific options (e.g., {\"version\": \"2\"} for KV)"
},
"description": {
"type": "string",
"description": "Human-friendly description"
}
}
}vault_tune_mountTune configuration of a mounted secrets engine.
{
"type": "object",
"required": [
"path"
],
"properties": {
"path": {
"type": "string",
"description": "Mount path"
},
"description": {
"type": "string",
"description": "Updated description"
},
"max_lease_ttl": {
"type": "string",
"description": "Maximum lease TTL"
},
"default_lease_ttl": {
"type": "string",
"description": "Default lease TTL (e.g., \"1h\", \"24h"
}
}
}vault_list_auth_methodsList all enabled authentication methods.
{
"type": "object",
"properties": {}
}vault_enable_auth_methodEnable a new authentication method at the specified path.
{
"type": "object",
"required": [
"path",
"type"
],
"properties": {
"path": {
"type": "string",
"description": "Mount path for the auth method"
},
"type": {
"type": "string",
"description": "Type of auth method (approle, ldap, userpass, etc.)"
},
"description": {
"type": "string",
"description": "Human-friendly description"
}
}
}vault_disable_auth_methodDisable an authentication method.
{
"type": "object",
"required": [
"path"
],
"properties": {
"path": {
"type": "string",
"description": "Mount path of the auth method to disable"
}
}
}vault_list_policiesList all ACL policies.
{
"type": "object",
"properties": {}
}vault_get_policyGet the rules for a specific policy.
{
"type": "object",
"required": [
"name"
],
"properties": {
"name": {
"type": "string",
"description": "Policy name"
}
}
}vault_create_policyCreate or update an ACL policy.
{
"type": "object",
"required": [
"name",
"policy"
],
"properties": {
"name": {
"type": "string",
"description": "Policy name"
},
"policy": {
"type": "string",
"description": "Policy rules in HCL format"
}
}
}vault_delete_policyDelete an ACL policy.
{
"type": "object",
"required": [
"name"
],
"properties": {
"name": {
"type": "string",
"description": "Policy name to delete"
}
}
}vault_list_audit_devicesList all enabled audit devices.
{
"type": "object",
"properties": {}
}vault_enable_audit_deviceEnable a new audit device.
{
"type": "object",
"required": [
"path",
"type"
],
"properties": {
"path": {
"type": "string",
"description": "Path for the audit device"
},
"type": {
"type": "string",
"description": "Type of audit device (file, socket, syslog)"
},
"options": {
"type": "object",
"description": "Device-specific options (e.g., {\"file_path\": \"/var/log/vault.log\"})"
},
"description": {
"type": "string",
"description": "Human-friendly description"
}
}
}vault_disable_audit_deviceDisable an audit device.
{
"type": "object",
"required": [
"path"
],
"properties": {
"path": {
"type": "string",
"description": "Path of the audit device to disable"
}
}
}vault_check_capabilitiesCheck what capabilities a token has on given paths.
{
"type": "object",
"required": [
"paths"
],
"properties": {
"paths": {
"type": "array",
"items": {
"type": "string"
},
"description": "Paths to check capabilities for"
},
"token": {
"type": "string",
"description": "Token to check (defaults to current token)"
}
}
}vault_lookup_selfLook up information about the current token.
{
"type": "object",
"properties": {}
}vault_lookup_tokenLook up information about a specific token.
{
"type": "object",
"required": [
"token"
],
"properties": {
"token": {
"type": "string",
"description": "Token to look up"
}
}
}vault_create_tokenCreate a new token with specified policies and settings.
{
"type": "object",
"properties": {
"ttl": {
"type": "string",
"description": "Token TTL (e.g., \"1h\", \"24h\", \"768h"
},
"metadata": {
"type": "object",
"description": "Metadata to attach to the token"
},
"num_uses": {
"type": "integer",
"description": "Number of times token can be used (0 = unlimited)"
},
"policies": {
"type": "array",
"items": {
"type": "string"
},
"description": "List of policies to attach"
},
"no_parent": {
"type": "boolean",
"description": "Create orphan token"
},
"renewable": {
"type": "boolean",
"description": "Whether token can be renewed"
},
"display_name": {
"type": "string",
"description": "Display name for the token"
},
"no_default_policy": {
"type": "boolean",
"description": "Do not attach default policy"
}
}
}vault_renew_selfRenew the current token.
{
"type": "object",
"properties": {
"increment": {
"type": "string",
"description": "Requested increment for the renewal (e.g., \"1h"
}
}
}vault_renew_tokenRenew a specific token.
{
"type": "object",
"required": [
"token"
],
"properties": {
"token": {
"type": "string",
"description": "Token to renew"
},
"increment": {
"type": "string",
"description": "Requested increment for the renewal"
}
}
}vault_revoke_selfRevoke the current token and all its child tokens.
{
"type": "object",
"properties": {}
}vault_revoke_tokenRevoke a specific token and all its child tokens.
{
"type": "object",
"required": [
"token"
],
"properties": {
"token": {
"type": "string",
"description": "Token to revoke"
}
}
}vault_revoke_accessorRevoke a token using its accessor.
{
"type": "object",
"required": [
"accessor"
],
"properties": {
"accessor": {
"type": "string",
"description": "Token accessor"
}
}
}vault_list_accessorsList all token accessors. Requires sudo capability.
{
"type": "object",
"properties": {}
}vault_create_token_roleCreate or update a token role.
{
"type": "object",
"required": [
"name"
],
"properties": {
"name": {
"type": "string",
"description": "Role name"
},
"orphan": {
"type": "boolean",
"description": "Tokens created are orphans"
},
"renewable": {
"type": "boolean",
"description": "Tokens are renewable"
},
"token_period": {
"type": "integer",
"description": "Token period in seconds"
},
"allowed_policies": {
"type": "array",
"items": {
"type": "string"
},
"description": "Allowed policies for tokens"
},
"disallowed_policies": {
"type": "array",
"items": {
"type": "string"
},
"description": "Disallowed policies"
},
"token_explicit_max_ttl": {
"type": "integer",
"description": "Explicit max TTL in seconds"
}
}
}vault_totp_read_keyRead a TOTP key configuration.
{
"type": "object",
"required": [
"name"
],
"properties": {
"name": {
"type": "string",
"description": "Key name"
},
"mount_path": {
"type": "string",
"default": "totp",
"description": "Mount path of the TOTP engine"
}
}
}vault_totp_delete_keyDelete a TOTP key.
{
"type": "object",
"required": [
"name"
],
"properties": {
"name": {
"type": "string",
"description": "Key name to delete"
},
"mount_path": {
"type": "string",
"default": "totp",
"description": "Mount path of the TOTP engine"
}
}
}vault_totp_generate_codeGenerate a TOTP code for a key.
{
"type": "object",
"required": [
"name"
],
"properties": {
"name": {
"type": "string",
"description": "Key name"
},
"mount_path": {
"type": "string",
"default": "totp",
"description": "Mount path of the TOTP engine"
}
}
}vault_totp_validate_codeValidate a TOTP code.
{
"type": "object",
"required": [
"name",
"code"
],
"properties": {
"code": {
"type": "string",
"description": "TOTP code to validate"
},
"name": {
"type": "string",
"description": "Key name"
},
"mount_path": {
"type": "string",
"default": "totp",
"description": "Mount path of the TOTP engine"
}
}
}vault_transit_create_keyCreate a new encryption key in the Transit secrets engine.
{
"type": "object",
"required": [
"name"
],
"properties": {
"name": {
"type": "string",
"description": "Name of the encryption key"
},
"type": {
"enum": [
"aes128-gcm96",
"aes256-gcm96",
"chacha20-poly1305",
"ed25519",
"ecdsa-p256",
"ecdsa-p384",
"ecdsa-p521",
"rsa-2048",
"rsa-3072",
"rsa-4096"
],
"type": "string",
"description": "Key type (default: aes256-gcm96)"
},
"derived": {
"type": "boolean",
"description": "Use key derivation"
},
"exportable": {
"type": "boolean",
"description": "Allow key to be exported"
},
"mount_path": {
"type": "string",
"default": "transit",
"description": "Mount path of the Transit engine"
},
"convergent_encryption": {
"type": "boolean",
"description": "Enable convergent encryption (requires derived)"
},
"allow_plaintext_backup": {
"type": "boolean",
"description": "Allow plaintext backup"
}
}
}vault_transit_read_keyRead information about a Transit encryption key.
{
"type": "object",
"required": [
"name"
],
"properties": {
"name": {
"type": "string",
"description": "Name of the encryption key"
},
"mount_path": {
"type": "string",
"default": "transit",
"description": "Mount path of the Transit engine"
}
}
}vault_transit_list_keysList all keys in the Transit secrets engine.
{
"type": "object",
"properties": {
"mount_path": {
"type": "string",
"default": "transit",
"description": "Mount path of the Transit engine"
}
}
}vault_transit_delete_keyDelete a Transit encryption key. Key must have deletion_allowed=true.
{
"type": "object",
"required": [
"name"
],
"properties": {
"name": {
"type": "string",
"description": "Name of the encryption key to delete"
},
"mount_path": {
"type": "string",
"default": "transit",
"description": "Mount path of the Transit engine"
}
}
}vault_transit_update_key_configUpdate configuration of a Transit encryption key.
{
"type": "object",
"required": [
"name"
],
"properties": {
"name": {
"type": "string",
"description": "Name of the encryption key"
},
"exportable": {
"type": "boolean",
"description": "Allow key export (can only enable, not disable)"
},
"mount_path": {
"type": "string",
"default": "transit",
"description": "Mount path of the Transit engine"
},
"deletion_allowed": {
"type": "boolean",
"description": "Allow key deletion"
},
"auto_rotate_period": {
"type": "string",
"description": "Auto-rotate period (e.g., \"720h"
},
"allow_plaintext_backup": {
"type": "boolean",
"description": "Allow plaintext backup"
},
"min_decryption_version": {
"type": "integer",
"description": "Minimum version for decryption"
},
"min_encryption_version": {
"type": "integer",
"description": "Minimum version for encryption"
}
}
}vault_transit_rotate_keyRotate a Transit encryption key to a new version.
{
"type": "object",
"required": [
"name"
],
"properties": {
"name": {
"type": "string",
"description": "Name of the encryption key to rotate"
},
"mount_path": {
"type": "string",
"default": "transit",
"description": "Mount path of the Transit engine"
}
}
}vault_transit_encryptEncrypt plaintext using a Transit encryption key.
{
"type": "object",
"required": [
"key_name",
"plaintext"
],
"properties": {
"context": {
"type": "string",
"description": "Context for derived keys (base64 encoded)"
},
"key_name": {
"type": "string",
"description": "Name of the encryption key"
},
"plaintext": {
"type": "string",
"description": "Plaintext to encrypt"
},
"mount_path": {
"type": "string",
"default": "transit",
"description": "Mount path of the Transit engine"
},
"key_version": {
"type": "integer",
"description": "Specific key version to use"
}
}
}vault_transit_decryptDecrypt ciphertext using a Transit encryption key.
{
"type": "object",
"required": [
"key_name",
"ciphertext"
],
"properties": {
"context": {
"type": "string",
"description": "Context for derived keys (base64 encoded)"
},
"key_name": {
"type": "string",
"description": "Name of the encryption key"
},
"ciphertext": {
"type": "string",
"description": "Ciphertext to decrypt (vault:v1:... format)"
},
"mount_path": {
"type": "string",
"default": "transit",
"description": "Mount path of the Transit engine"
}
}
}vault_transit_rewrapRewrap ciphertext with the latest key version.
{
"type": "object",
"required": [
"key_name",
"ciphertext"
],
"properties": {
"context": {
"type": "string",
"description": "Context for derived keys"
},
"key_name": {
"type": "string",
"description": "Name of the encryption key"
},
"ciphertext": {
"type": "string",
"description": "Ciphertext to rewrap"
},
"mount_path": {
"type": "string",
"default": "transit",
"description": "Mount path of the Transit engine"
},
"key_version": {
"type": "integer",
"description": "Target key version"
}
}
}vault_transit_generate_data_keyGenerate a data encryption key wrapped by a Transit key.
{
"type": "object",
"required": [
"key_name",
"type"
],
"properties": {
"bits": {
"type": "integer",
"description": "Number of bits (128, 256, 512)"
},
"type": {
"enum": [
"plaintext",
"wrapped"
],
"type": "string",
"description": "Return plaintext key along with wrapped, or only wrapped"
},
"context": {
"type": "string",
"description": "Context for derived keys"
},
"key_name": {
"type": "string",
"description": "Name of the wrapping key"
},
"mount_path": {
"type": "string",
"default": "transit",
"description": "Mount path of the Transit engine"
}
}
}vault_transit_generate_randomGenerate cryptographically secure random bytes.
{
"type": "object",
"properties": {
"bytes": {
"type": "integer",
"default": 32,
"description": "Number of bytes to generate"
},
"format": {
"enum": [
"base64",
"hex"
],
"type": "string",
"default": "base64",
"description": "Output format"
},
"mount_path": {
"type": "string",
"default": "transit",
"description": "Mount path of the Transit engine"
}
}
}vault_transit_hashHash data using a cryptographic hash function.
{
"type": "object",
"required": [
"input"
],
"properties": {
"input": {
"type": "string",
"description": "Data to hash"
},
"format": {
"enum": [
"hex",
"base64"
],
"type": "string",
"default": "hex",
"description": "Output format"
},
"algorithm": {
"enum": [
"sha2-224",
"sha2-256",
"sha2-384",
"sha2-512",
"sha3-224",
"sha3-256",
"sha3-384",
"sha3-512"
],
"type": "string",
"default": "sha2-256",
"description": "Hash algorithm"
},
"mount_path": {
"type": "string",
"default": "transit",
"description": "Mount path of the Transit engine"
}
}
}vault_transit_hmacGenerate HMAC for data using a Transit key.
{
"type": "object",
"required": [
"key_name",
"input"
],
"properties": {
"input": {
"type": "string",
"description": "Data to HMAC"
},
"key_name": {
"type": "string",
"description": "Name of the key for HMAC"
},
"algorithm": {
"enum": [
"sha2-224",
"sha2-256",
"sha2-384",
"sha2-512",
"sha3-224",
"sha3-256",
"sha3-384",
"sha3-512"
],
"type": "string",
"default": "sha2-256",
"description": "Hash algorithm"
},
"mount_path": {
"type": "string",
"default": "transit",
"description": "Mount path of the Transit engine"
}
}
}vault_transit_signSign data using a Transit signing key.
{
"type": "object",
"required": [
"key_name",
"input"
],
"properties": {
"input": {
"type": "string",
"description": "Data to sign"
},
"key_name": {
"type": "string",
"description": "Name of the signing key"
},
"mount_path": {
"type": "string",
"default": "transit",
"description": "Mount path of the Transit engine"
},
"hash_algorithm": {
"enum": [
"sha1",
"sha2-224",
"sha2-256",
"sha2-384",
"sha2-512",
"sha3-224",
"sha3-256",
"sha3-384",
"sha3-512"
],
"type": "string",
"description": "Hash algorithm"
},
"signature_algorithm": {
"enum": [
"pss",
"pkcs1v15"
],
"type": "string",
"description": "Signature algorithm (RSA keys only)"
}
}
}vault_transit_verifyVerify a signature using a Transit signing key.
{
"type": "object",
"required": [
"key_name",
"input",
"signature"
],
"properties": {
"input": {
"type": "string",
"description": "Original data that was signed"
},
"key_name": {
"type": "string",
"description": "Name of the signing key"
},
"signature": {
"type": "string",
"description": "Signature to verify (vault:v1:... format)"
},
"mount_path": {
"type": "string",
"default": "transit",
"description": "Mount path of the Transit engine"
},
"hash_algorithm": {
"enum": [
"sha1",
"sha2-224",
"sha2-256",
"sha2-384",
"sha2-512",
"sha3-224",
"sha3-256",
"sha3-384",
"sha3-512"
],
"type": "string",
"description": "Hash algorithm"
}
}
}vault_userpass_list_usersList all userpass users.
{
"type": "object",
"properties": {
"mount_path": {
"type": "string",
"default": "userpass",
"description": "Mount path of the Userpass auth method"
}
}
}vault_userpass_read_userRead a userpass user configuration.
{
"type": "object",
"required": [
"username"
],
"properties": {
"username": {
"type": "string",
"description": "Username"
},
"mount_path": {
"type": "string",
"default": "userpass",
"description": "Mount path of the Userpass auth method"
}
}
}vault_userpass_create_userCreate or update a userpass user.
{
"type": "object",
"required": [
"username",
"password"
],
"properties": {
"password": {
"type": "string",
"description": "Password"
},
"username": {
"type": "string",
"description": "Username"
},
"token_ttl": {
"type": "string",
"description": "Token TTL"
},
"mount_path": {
"type": "string",
"default": "userpass",
"description": "Mount path of the Userpass auth method"
},
"token_type": {
"type": "string",
"description": "Token type (service, batch, default)"
},
"token_period": {
"type": "string",
"description": "Token period for periodic tokens"
},
"token_max_ttl": {
"type": "string",
"description": "Maximum token TTL"
},
"token_num_uses": {
"type": "integer",
"description": "Number of times token can be used"
},
"token_policies": {
"type": "array",
"items": {
"type": "string"
},
"description": "Policies to attach to token"
},
"token_bound_cidrs": {
"type": "array",
"items": {
"type": "string"
},
"description": "CIDRs that can use the token"
},
"token_no_default_policy": {
"type": "boolean",
"description": "Do not attach default policy"
}
}
}vault_userpass_delete_userDelete a userpass user.
{
"type": "object",
"required": [
"username"
],
"properties": {
"username": {
"type": "string",
"description": "Username to delete"
},
"mount_path": {
"type": "string",
"default": "userpass",
"description": "Mount path of the Userpass auth method"
}
}
}vault_userpass_update_passwordUpdate a user password.
{
"type": "object",
"required": [
"username",
"password"
],
"properties": {
"password": {
"type": "string",
"description": "New password"
},
"username": {
"type": "string",
"description": "Username"
},
"mount_path": {
"type": "string",
"default": "userpass",
"description": "Mount path of the Userpass auth method"
}
}
}vault_userpass_update_policiesUpdate policies for a user.
{
"type": "object",
"required": [
"username",
"policies"
],
"properties": {
"policies": {
"type": "array",
"items": {
"type": "string"
},
"description": "New list of policies"
},
"username": {
"type": "string",
"description": "Username"
},
"mount_path": {
"type": "string",
"default": "userpass",
"description": "Mount path of the Userpass auth method"
}
}
}vault_userpass_loginLogin using userpass credentials to obtain a token.
{
"type": "object",
"required": [
"username",
"password"
],
"properties": {
"password": {
"type": "string",
"description": "Password"
},
"username": {
"type": "string",
"description": "Username"
},
"mount_path": {
"type": "string",
"default": "userpass",
"description": "Mount path of the Userpass auth method"
}
}
}vault_wrapWrap arbitrary data in a single-use wrapping token.
{
"type": "object",
"required": [
"data"
],
"properties": {
"ttl": {
"type": "string",
"description": "Wrapping token TTL (default: 5m)"
},
"data": {
"type": "object",
"description": "Data to wrap"
}
}
}vault_sys_generate_randomGenerate cryptographically secure random bytes.
{
"type": "object",
"properties": {
"bytes": {
"type": "integer",
"default": 32,
"description": "Number of bytes to generate"
},
"format": {
"enum": [
"base64",
"hex"
],
"type": "string",
"default": "base64",
"description": "Output format"
}
}
}vault_sys_hashHash data using a cryptographic hash function.
{
"type": "object",
"required": [
"input"
],
"properties": {
"input": {
"type": "string",
"description": "Data to hash (base64 encoded)"
},
"format": {
"enum": [
"hex",
"base64"
],
"type": "string",
"default": "hex",
"description": "Output format"
},
"algorithm": {
"enum": [
"sha2-224",
"sha2-256",
"sha2-384",
"sha2-512"
],
"type": "string",
"default": "sha2-256",
"description": "Hash algorithm"
}
}
}