Secrets

The Secrets API provides operations to manage Secrets for OPA Teams. Secrets are encrypted key-value pairs used to store sensitive information.

See Secrets.

Resolve Secret or Folder

Resolves the ID or path for a Secret or Secret Folder. Users must be authorized to perform this action by an existing Security Policy.

To resolve the ID, the request must include the named path. To resolve the path, the request must include the ID.

This endpoint requires one of the following roles: authenticated_client, authenticated_service_user, security_admin, delegated_security_admin.

SecuritybearerAuth
Request
path Parameters
team_name
required
string

The name of your Team

Request Body schema: application/json
id
string or null

The ID of the Secret or Secret Folder. Don't use this parameter if the request also includes a parent_folder_path, secret_folder_name, and secret_name.

parent_folder_path
string or null

The path to the parent directory. Don't use this parameter if the request also includes an id.

required
object (SecretResolveParent)
id
string

The UUID of the parent

name
string

The name of the parent

required
object (SecretResolveParent)
id
string

The UUID of the parent

name
string

The name of the parent

secret_folder_name
string

The name of the Secret Folder. Don't use this parameter if the request also includes an id or secret_name.

secret_name
string

The name of the Secret. Don't use this parameter if the request also includes an id or secret_folder_name.

Responses
200

OK

post/v1/teams/{team_name}/resolve_secret
Request samples
application/json
{
  • "id": "string",
  • "parent_folder_path": "string",
  • "project": {
    • "id": "string",
    • "name": "string"
    },
  • "resource_group": {
    • "id": "string",
    • "name": "string"
    },
  • "secret_folder_name": "string",
  • "secret_name": "string"
}
Response samples
application/json
{
  • "description": "string",
  • "id": "string",
  • "name": "string",
  • "path": [
    • {
      }
    ],
  • "project": {
    • "id": "string",
    • "name": "string",
    • "type": "project"
    },
  • "resource_group": {
    • "id": "string",
    • "name": "string",
    • "type": "project"
    },
  • "type": "folder"
}

List top-level Secret Folders for a Project

Lists all top-level Secret Folders for a Project. Users must be authorized to perform this action by an existing Security Policy.

This endpoint requires the following roles: authenticated_client, authenticated_service_user, end_user.

SecuritybearerAuth
Request
path Parameters
team_name
required
string

The name of your Team

resource_group_id
required
string

The UUID of a Resource Group

project_id
required
string

The UUID of a Project

Responses
200

OK

403

Forbidden

get/v1/teams/{team_name}/resource_groups/{resource_group_id}/projects/{project_id}/secret_folders
Request samples
Response samples
application/json
{
  • "list": [
    • {
      }
    ]
}

Create a Secret Folder

Creates a Secret Folder. Users must be authorized to perform this action by an existing Security Policy.

This endpoint requires the following roles: authenticated_client, authenticated_service_user, end_user.

SecuritybearerAuth
Request
path Parameters
team_name
required
string

The name of your Team

resource_group_id
required
string

The UUID of a Resource Group

project_id
required
string

The UUID of a Project

Request Body schema: application/json
description
string or null

A description of the Secret Folder

name
required
string

The name of the Secret Folder

parent_folder_id
string

The UUID of Secret Folder's parent folder

Responses
201

Created

403

Forbidden

post/v1/teams/{team_name}/resource_groups/{resource_group_id}/projects/{project_id}/secret_folders
Request samples
application/json
{
  • "description": "string",
  • "name": "string",
  • "parent_folder_id": "string"
}
Response samples
application/json
{
  • "created_at": "2023-08-25T12:00:00.000000Z",
  • "created_by": "string",
  • "description": "string",
  • "id": "string",
  • "name": "string",
  • "path": [
    • {
      }
    ],
  • "updated_at": "2023-08-25T12:00:00.000000Z",
  • "updated_by": "string"
}

Retrieve a Secret Folder

Retrieves the specified Secret Folder. Users must be authorized to perform this action by an existing Security Policy.

This endpoint requires the following roles: authenticated_client, authenticated_service_user, end_user.

SecuritybearerAuth
Request
path Parameters
team_name
required
string

The name of your Team

resource_group_id
required
string

The UUID of a Resource Group

project_id
required
string

The UUID of a Project

secret_folder_id
required
string

The UUID of a Secret Folder

Responses
200

OK

403

Forbidden

get/v1/teams/{team_name}/resource_groups/{resource_group_id}/projects/{project_id}/secret_folders/{secret_folder_id}
Request samples
Response samples
application/json
{
  • "created_at": "2023-08-25T12:00:00.000000Z",
  • "created_by": "string",
  • "description": "string",
  • "id": "string",
  • "name": "string",
  • "path": [
    • {
      }
    ],
  • "updated_at": "2023-08-25T12:00:00.000000Z",
  • "updated_by": "string"
}

Update a Secret Folder

Updates the specified Secret Folder. Users must be authorized to perform this action by an existing Security Policy.

This endpoint requires the following roles: authenticated_client, authenticated_service_user, end_user.

SecuritybearerAuth
Request
path Parameters
team_name
required
string

The name of your Team

resource_group_id
required
string

The UUID of a Resource Group

project_id
required
string

The UUID of a Project

secret_folder_id
required
string

The UUID of a Secret Folder

Request Body schema: application/json
description
string or null

A description of the Secret Folder

name
required
string

The name of the Secret Folder

Responses
200

OK

403

Forbidden

put/v1/teams/{team_name}/resource_groups/{resource_group_id}/projects/{project_id}/secret_folders/{secret_folder_id}
Request samples
application/json
{
  • "description": "string",
  • "name": "string"
}
Response samples
application/json
{
  • "created_at": "2023-08-25T12:00:00.000000Z",
  • "created_by": "string",
  • "description": "string",
  • "id": "string",
  • "name": "string",
  • "path": [
    • {
      }
    ],
  • "updated_at": "2023-08-25T12:00:00.000000Z",
  • "updated_by": "string"
}

Delete a Secret Folder

Deletes the specified Secret Folder. Users must be authorized to perform this action by an existing Security Policy.

This endpoint requires the following roles: authenticated_client, authenticated_service_user, end_user.

SecuritybearerAuth
Request
path Parameters
team_name
required
string

The name of your Team

resource_group_id
required
string

The UUID of a Resource Group

project_id
required
string

The UUID of a Project

secret_folder_id
required
string

The UUID of a Secret Folder

Responses
204

No Content

403

Forbidden

delete/v1/teams/{team_name}/resource_groups/{resource_group_id}/projects/{project_id}/secret_folders/{secret_folder_id}
Request samples
Response samples
application/json
{
  • "list": [
    • {
      }
    ]
}

List all items in a Secret Folder

Lists all items in a Secret Folder. Users must be authorized to perform this action by an existing Security Policy.

This endpoint requires the following roles: authenticated_client, authenticated_service_user, end_user.

SecuritybearerAuth
Request
path Parameters
team_name
required
string

The name of your Team

resource_group_id
required
string

The UUID of a Resource Group

project_id
required
string

The UUID of a Project

secret_folder_id
required
string

The UUID of a Secret Folder

query Parameters
count
integer <int32>

The number of objects per page

descending
boolean

The object order

offset
string

The offset value for pagination. The rel="next" and rel="prev" Link headers define the offset for subsequent or previous pages.

prev
boolean

The direction of paging

Responses
200

OK

403

Forbidden

get/v1/teams/{team_name}/resource_groups/{resource_group_id}/projects/{project_id}/secret_folders/{secret_folder_id}/items
Request samples
Response samples
application/json
{
  • "list": [
    • {
      }
    ]
}

Create a Secret

Creates a Secret. Users must be authorized to perform this action by an existing Security Policy.

This endpoint requires one of the following roles: authenticated_client, authenticated_service_user, end_user.

SecuritybearerAuth
Request
path Parameters
team_name
required
string

The name of your Team

resource_group_id
required
string

The UUID of a Resource Group

project_id
required
string

The UUID of a Project

Request Body schema: application/json
description
string or null

The description of the Secret

name
required
string

The name of the Secret

parent_folder_id
required
string

The UUID of the Secret's parent folder

secret_jwe
required
string

The encrypted Secret as a fully serialized JWE. The secret is encrypted using a public key provided by Okta Privileged Access at /v1/teams/:team_name/vault/jwks.json. The data is encrypted client-side. Generally, it's intended for the secret encryption to be performed by the sft client or Terraform provider.

Responses
201

Created

403

Forbidden

post/v1/teams/{team_name}/resource_groups/{resource_group_id}/projects/{project_id}/secrets
Request samples
application/json
{
  • "description": "string",
  • "name": "string",
  • "parent_folder_id": "string",
  • "secret_jwe": "string"
}
Response samples
application/json
{
  • "created_at": "2023-08-25T12:00:00.000000Z",
  • "created_by": "string",
  • "description": "string",
  • "id": "string",
  • "name": "string",
  • "path": [
    • {
      }
    ],
  • "updated_at": "2023-08-25T12:00:00.000000Z",
  • "updated_by": "string"
}

Retrieve a Secret

Retrieves the specified Secret. Users must be authorized to perform this action by an existing Security Policy.

This endpoint requires one of the following roles: authenticated_client, authenticated_service_user, end_user.

SecuritybearerAuth
Request
path Parameters
team_name
required
string

The name of your Team

resource_group_id
required
string

The UUID of a Resource Group

project_id
required
string

The UUID of a Project

secret_id
required
string

The UUID of a Secret

Responses
200

OK

403

Forbidden

get/v1/teams/{team_name}/resource_groups/{resource_group_id}/projects/{project_id}/secrets/{secret_id}
Request samples
Response samples
application/json
{
  • "created_at": "2023-08-25T12:00:00.000000Z",
  • "created_by": "string",
  • "description": "string",
  • "id": "string",
  • "name": "string",
  • "path": [
    • {
      }
    ],
  • "updated_at": "2023-08-25T12:00:00.000000Z",
  • "updated_by": "string"
}

Reveal a Secret

Reveals the specified Secret. Users must be authorized to perform this action by an existing Security Policy.

This endpoint requires one of the following roles: authenticated_client, authenticated_service_user, end_user.

SecuritybearerAuth
Request
path Parameters
team_name
required
string

The name of your Team

resource_group_id
required
string

The UUID of a Resource Group

project_id
required
string

The UUID of a Project

secret_id
required
string

The UUID of a Secret

Request Body schema: application/json
required
object (RawJSONWebKey)

A JSON Web Key formatted in accordance with RFC 7517.

alg
string (alg)

The algorithm of the key

Value: "RSA-OAEP-256"
crv
string (curve)

The curve used by the key

Enum: "P-256" "P-384" "P-521"
d
string <byte>

The exponent of the private key

dp
string <byte>

The first factor CRT exponent of the private key

dq
string <byte>

The second factor CRT exponent of the private key

e
string <byte>

The exponent of the public key

k
string <byte>

The key

kid
string <regex> (?i)^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}...

The key ID

kty
string (kty)

The key type

Enum: "EC" "OKP" "RSA" "oct"
n
string <byte>

The modulus of the public key

p
string <byte>

The first prime factor of the private key

q
string <byte>

The second prime factor of the private key

qi
string <byte>

The first CRT coefficient of the private key

use
string

The intended use of the key

x
string <byte>

The x coordinate of the key

x5c
Array of strings

A list of X.509 certificates

x5t
string

The SHA-1 thumbprint of the X.509 certificate

x5t#S256
string

The SHA-256 thumbprint of the X.509 certificate

x5u
string

The URL of the X.509 certificates

y
string <byte>

The y coordinate of the key

Responses
200

OK

403

Forbidden

post/v1/teams/{team_name}/resource_groups/{resource_group_id}/projects/{project_id}/secrets/{secret_id}
Request samples
application/json
{
  • "public_key": {
    • "alg": "RSA-OAEP-256",
    • "crv": "P-256",
    • "d": "string",
    • "dp": "string",
    • "dq": "string",
    • "e": "string",
    • "k": "string",
    • "kid": "/regex/",
    • "kty": "EC",
    • "n": "string",
    • "p": "string",
    • "q": "string",
    • "qi": "string",
    • "use": "string",
    • "x": "string",
    • "x5c": [
      ],
    • "x5t": "string",
    • "x5t#S256": "string",
    • "x5u": "string",
    • "y": "string"
    }
}
Response samples
application/json
{
  • "created_at": "2023-08-25T12:00:00.000000Z",
  • "created_by": "string",
  • "description": "string",
  • "id": "string",
  • "name": "string",
  • "path": [
    • {
      }
    ],
  • "updated_at": "2023-08-25T12:00:00.000000Z",
  • "updated_by": "string",
  • "secret_jwe": "string"
}

Update a Secret

Updates the specified Secret. Users must be authorized to perform this action by an existing Security Policy.

This endpoint requires one of the following roles: authenticated_client, authenticated_service_user, end_user.

SecuritybearerAuth
Request
path Parameters
team_name
required
string

The name of your Team

resource_group_id
required
string

The UUID of a Resource Group

project_id
required
string

The UUID of a Project

secret_id
required
string

The UUID of a Secret

Request Body schema: application/json
description
string or null

The description of the Secret

name
required
string

The name of the Secret

parent_folder_id
required
string

The UUID of the Secret's parent folder

secret_jwe
required
string

The encrypted Secret as a fully serialized JWE. The secret is encrypted using a public key provided by Okta Privileged Access at /v1/teams/:team_name/vault/jwks.json. The data is encrypted client-side. Generally, it's intended for the secret encryption to be performed by the sft client or Terraform provider.

Responses
200

OK

403

Forbidden

put/v1/teams/{team_name}/resource_groups/{resource_group_id}/projects/{project_id}/secrets/{secret_id}
Request samples
application/json
{
  • "description": "string",
  • "name": "string",
  • "parent_folder_id": "string",
  • "secret_jwe": "string"
}
Response samples
application/json
{
  • "created_at": "2023-08-25T12:00:00.000000Z",
  • "created_by": "string",
  • "description": "string",
  • "id": "string",
  • "name": "string",
  • "path": [
    • {
      }
    ],
  • "updated_at": "2023-08-25T12:00:00.000000Z",
  • "updated_by": "string"
}

Delete a Secret

Deletes the specified Secret. Users must be authorized to perform this action by an existing Security Policy.

This endpoint requires one of the following roles: authenticated_client, authenticated_service_user, end_user.

SecuritybearerAuth
Request
path Parameters
team_name
required
string

The name of your Team

resource_group_id
required
string

The UUID of a Resource Group

project_id
required
string

The UUID of a Project

secret_id
required
string

The UUID of a Secret

Responses
204

No Content

403

Forbidden

delete/v1/teams/{team_name}/resource_groups/{resource_group_id}/projects/{project_id}/secrets/{secret_id}
Request samples
Response samples
application/json
{
  • "list": [
    • {
      }
    ]
}

List top-level Secret Folders for Team

Lists all top-level Secret Folders for a Team

This endpoint requires the following roles: security_admin.

SecuritybearerAuth
Request
path Parameters
team_name
required
string

The name of your Team

Responses
200

OK

get/v1/teams/{team_name}/secret_folders
Request samples
Response samples
application/json
{
  • "list": [
    • {
      }
    ]
}

List top-level Secret Folders for User

Lists all top-level Secret Folders for a User. Users must be authorized to perform this action by an existing Security Policy.

This endpoint requires one of the following roles: authenticated_client, authenticated_service_user, end_user.

SecuritybearerAuth
Request
path Parameters
team_name
required
string

The name of your Team

query Parameters
count
integer <int32>

The number of objects per page

descending
boolean

The object order

offset
string

The offset value for pagination. The rel="next" and rel="prev" Link headers define the offset for subsequent or previous pages.

prev
boolean

The direction of paging

Responses
200

OK

get/v1/teams/{team_name}/secrets
Request samples
Response samples
application/json
{
  • "list": [
    • {
      }
    ]
}