# Google Cloud secrets engine (API)

This is the API documentation for the Vault Google Cloud Platform (GCP) secrets engine. For general information about the usage and operation of the GCP secrets engine, please see these docs.

This documentation assumes the GCP secrets engine is enabled at the `/gcp` path in Vault. Since it is possible to mount secrets engines at any path, please update your API calls accordingly.

### Write config <a href="#write-config" id="write-config"></a>

| Method | Path          |
| ------ | ------------- |
| `POST` | `/gcp/config` |

This endpoint configures shared information for the secrets engine.

#### Parameters <a href="#parameters" id="parameters"></a>

* `credentials` (`string:""`) - JSON credentials (either file contents or '@path/to/file') See docs for alternative ways to pass in to this parameter, as well as the required permissions.
* `ttl` (`int: 0 || string:"0s"`) – Specifies default config TTL for long-lived credentials (i.e. service account keys). Uses duration format strings.
* `max_ttl` (`int: 0 || string:"0s"`)– Specifies the maximum config TTL for long-lived credentials (i.e. service account keys). Uses duration format strings.\*\*

#### Sample payload <a href="#sample-payload" id="sample-payload"></a>

```json
{
  "credentials": "<JSON string>",
  "ttl": 3600,
  "max_ttl": 14400
}
```

#### Sample request <a href="#sample-request" id="sample-request"></a>

```shell-session
$ curl \
    --header "X-Vault-Token: ..." \
    --request POST \
    --data @payload.json \
    https://127.0.0.1:8200/v1/gcp/config
```

### Rotate root credentials <a href="#rotate-root-credentials" id="rotate-root-credentials"></a>

Request to rotate the GCP service account credentials used by Vault for this mount. A new key will be generated for the service account, replacing the internal value, and then a deletion of the old service account key is scheduled. Note that this does not create a new service account, only a new version of the service account key.

This path is only valid if Vault has been configured to use GCP credentials via the `config/` endpoint where "credentials" were specified. Additionally, the provided service account must have permissions to create and delete service account keys.

| Method | Path                      |
| ------ | ------------------------- |
| `POST` | `/gcp/config/rotate-root` |

#### Sample request <a href="#sample-request-1" id="sample-request-1"></a>

```shell-session
$ curl \
    --header "X-Vault-Token: ..." \
    --request POST \
    https://127.0.0.1:8200/v1/gcp/config/rotate-root
```

### Read config <a href="#read-config" id="read-config"></a>

| Method | Path          |
| ------ | ------------- |
| `GET`  | `/gcp/config` |

Credentials will be omitted from returned data.

#### Sample request <a href="#sample-request-2" id="sample-request-2"></a>

```shell-session
$ curl \
    --header "X-Vault-Token: ..." \
    --request GET \
    https://127.0.0.1:8200/v1/gcp/config
```

#### Sample response <a href="#sample-response" id="sample-response"></a>

```json
{
  "data": {
    "ttl": "1h",
    "max_ttl": "4h"
  }
}
```

### Create/Update roleset <a href="#create-update-roleset" id="create-update-roleset"></a>

| Method | Path                 |
| ------ | -------------------- |
| `POST` | `/gcp/roleset/:name` |

This method allows you to create a roleset or update an existing roleset. See docs for the GCP secrets backend to learn more about what happens when you create or update a roleset.

**If you update a roleset's bindings, this will effectively revoke any secrets generated under this roleset.**

#### Parameters <a href="#parameters-1" id="parameters-1"></a>

* `name` (`string: <required>`): Required. Name of the role. Cannot be updated.
* `secret_type` (`string: "access_token"`): Type of secret generated for this role set. Accepted values: `access_token`, `service_account_key`. Cannot be updated.
* `project` (`string: <required>`): Name of the GCP project that this roleset's service account will belong to. Cannot be updated.
* `bindings` (`string: <required>`): Bindings configuration string (expects HCL or JSON format in raw or base64-encoded string)
* `token_scopes` (`array: []`): List of OAuth scopes to assign to `access_token` secrets generated under this role set (`access_token` role sets only)

#### Sample payload <a href="#sample-payload-1" id="sample-payload-1"></a>

```json
{
  "secret_type": "access_token",
  "project": "mygcpproject",
  "bindings": "...",
  "token_scopes": [
    "https://www.googleapis.com/auth/cloud-platform",
    "https://www.googleapis.com/auth/bigquery"
  ]
}
```

**Sample bindings:**

See bindings format docs for more information.

```hcl
resource "//cloudresourcemanager.googleapis.com/projects/mygcpproject" {
  roles = [
    "roles/viewer"
  ],
}

resource "//bigquery.googleapis.com/projects/my-project/datasets/mydataset" {
  roles = [
    "roles/bigquery.dataViewer"
  ],
}

resource "https://selflink/to/my/resource" {
  roles = [
    "project/mygcpproject/roles/projcustomrole",
    "organizations/myorg/roles/orgcustomrole"
  ],
}
```

#### Sample request <a href="#sample-request-3" id="sample-request-3"></a>

```shell-session
$ curl \
    --header "X-Vault-Token: ..." \
    --request POST \
    --data @payload.json \
    https://127.0.0.1:8200/v1/gcp/roleset/my-token-roleset
```

### Rotate roleset account <a href="#rotate-roleset-account" id="rotate-roleset-account"></a>

| Method | Path                        |                    |
| ------ | --------------------------- | ------------------ |
| `POST` | `/gcp/roleset/:name/rotate` | `204 (empty body)` |

This will rotate the service account this roleset uses to generate secrets. (this also replaces the key `access_token` roleset). This can be used to invalidate old secrets generated by the roleset or fix issues if a roleset's service account (and/or keys) was changed outside of Vault (i.e. through GCP APIs/cloud console).

#### Sample request <a href="#sample-request-4" id="sample-request-4"></a>

```shell-session
$ curl \
    --header "X-Vault-Token: ..." \
    --request POST \
    https://127.0.0.1:8200/v1/gcp/roleset/my-token-roleset/rotate
```

### Rotate roleset account key (`access_token` roleset only) <a href="#rotate-roleset-account-key-access_token-roleset-only" id="rotate-roleset-account-key-access_token-roleset-only"></a>

| Method | Path                            |                    |
| ------ | ------------------------------- | ------------------ |
| `POST` | `/gcp/roleset/:name/rotate-key` | `204 (empty body)` |

This will rotate the service account key this roleset uses to generate access tokens. This does not recreate the roleset service account.

#### Sample request <a href="#sample-request-5" id="sample-request-5"></a>

```shell-session
$ curl \
    --header "X-Vault-Token: ..." \
    --request POST \
    https://127.0.0.1:8200/v1/gcp/roleset/my-token-roleset/rotate-key
```

### Read roleset <a href="#read-roleset" id="read-roleset"></a>

| Method | Path                 |
| ------ | -------------------- |
| `GET`  | `/gcp/roleset/:name` |

#### Parameters <a href="#parameters-2" id="parameters-2"></a>

* `name` (`string:<required>`): Name of the roleset to read.

#### Sample request <a href="#sample-request-6" id="sample-request-6"></a>

```shell-session
$ curl \
    --header "X-Vault-Token: ..." \
    --request GET \
    https://127.0.0.1:8200/v1/gcp/roleset/my-token-roleset
```

#### Sample response <a href="#sample-response-1" id="sample-response-1"></a>

```json
{
  "data": {
    "secret_type": "access_token",
    "service_account_email": "vault-myroleset-XXXXXXXXXX@myproject.gserviceaccounts.com",
    "service_account_project": "service-account-project",
    "bindings": {
      "project/mygcpproject": ["roles/viewer"],
      "https://selflink/to/my/resource": [
        "project/mygcpproject/roles/projcustomrole",
        "organizations/myorg/roles/orgcustomrole"
      ]
    },
    "token_scopes": ["https://www.googleapis.com/auth/cloud-platform"]
  }
}
```

### List rolesets <a href="#list-rolesets" id="list-rolesets"></a>

| Method | Path            |
| ------ | --------------- |
| `LIST` | `/gcp/rolesets` |

#### Sample request <a href="#sample-request-7" id="sample-request-7"></a>

```shell-session
$ curl \
    --header "X-Vault-Token: ..." \
    --request LIST \
    https://127.0.0.1:8200/v1/gcp/rolesets
```

#### Sample response <a href="#sample-response-2" id="sample-response-2"></a>

```json
{
  "data": {
    "keys": ["my-token-roleset", "my-sakey-roleset"]
  }
}
```

### Delete roleset <a href="#delete-roleset" id="delete-roleset"></a>

This endpoint deletes an existing roleset by the given name.

| Method   | Path                 |
| -------- | -------------------- |
| `DELETE` | `/gcp/roleset/:name` |

#### Parameters <a href="#parameters-3" id="parameters-3"></a>

* `name` (`string:<required>`): Name of the roleset to delete.

#### Sample request <a href="#sample-request-8" id="sample-request-8"></a>

```shell-session
$ curl \
    --header "X-Vault-Token: ..." \
    --request DELETE \
    https://127.0.0.1:8200/v1/gcp/roleset/my-token-roleset
```

### Create/Update static account <a href="#create-update-static-account" id="create-update-static-account"></a>

| Method | Path                        |
| ------ | --------------------------- |
| `POST` | `/gcp/static-account/:name` |

This method allows you to create a static account or update an existing static account. See docs for the GCP secrets backend to learn more about what happens when you create or update a static account.

**If you update a static account's bindings, this will effectively revoke any secrets generated under this static account.**

#### Parameters <a href="#parameters-4" id="parameters-4"></a>

* `name` (`string: <required>`): Name of the static account. Cannot be updated.
* `secret_type` (`string: "access_token"`): Type of secret generated for this static account. Accepted values: `access_token`, `service_account_key`. Cannot be updated.
* `service_account_email` (`string: <required>`): Email of the GCP service account to manage. Cannot be updated.
* `bindings` (`string`): Bindings configuration string (expects HCL or JSON format in raw or base64-encoded string). Optional.
* `token_scopes` (`array: []`): List of OAuth scopes to assign to `access_token` secrets generated under this static account (`access_token` static accounts only)

#### Sample payload <a href="#sample-payload-2" id="sample-payload-2"></a>

```json
{
  "secret_type": "access_token",
  "service_account_email": "example@mygcpproject.iam.gserviceaccount.com",
  "bindings": "...",
  "token_scopes": [
    "https://www.googleapis.com/auth/cloud-platform",
    "https://www.googleapis.com/auth/bigquery"
  ]
}
```

**Sample bindings:**

See bindings format docs for more information.

```hcl
resource "//cloudresourcemanager.googleapis.com/projects/mygcpproject" {
  roles = [
    "roles/viewer"
  ],
}

resource "//bigquery.googleapis.com/projects/my-project/datasets/mydataset" {
  roles = [
    "roles/bigquery.dataViewer"
  ],
}

resource "https://selflink/to/my/resource" {
  roles = [
    "project/mygcpproject/roles/projcustomrole",
    "organizations/myorg/roles/orgcustomrole"
  ],
}
```

#### Sample request <a href="#sample-request-9" id="sample-request-9"></a>

```shell-session
$ curl \
    --header "X-Vault-Token: ..." \
    --request POST \
    --data @payload.json \
    https://127.0.0.1:8200/v1/gcp/static-account/my-token-account
```

### Rotate static account key (`access_token` static account only) <a href="#rotate-static-account-key-access_token-static-account-only" id="rotate-static-account-key-access_token-static-account-only"></a>

| Method | Path                                   |                    |
| ------ | -------------------------------------- | ------------------ |
| `POST` | `/gcp/static-account/:name/rotate-key` | `204 (empty body)` |

This will rotate the service account key this static account uses to generate access tokens. This does not recreate the service account.

#### Sample request <a href="#sample-request-10" id="sample-request-10"></a>

```shell-session
$ curl \
    --header "X-Vault-Token: ..." \
    --request POST \
    https://127.0.0.1:8200/v1/gcp/static-account/my-token-account/rotate-key
```

### Read static account <a href="#read-static-account" id="read-static-account"></a>

| Method | Path                        |
| ------ | --------------------------- |
| `GET`  | `/gcp/static-account/:name` |

#### Parameters <a href="#parameters-5" id="parameters-5"></a>

* `name` (`string:<required>`): Name of the static account to read.

This endpoint will only return bindings that are managed through the secrets engine. Bindings manually managed outside of Vault will not be returned.

#### Sample request <a href="#sample-request-11" id="sample-request-11"></a>

```shell-session
$ curl \
    --header "X-Vault-Token: ..." \
    --request GET \
    https://127.0.0.1:8200/v1/gcp/static-account/my-token-account
```

#### Sample response <a href="#sample-response-3" id="sample-response-3"></a>

```json
{
  "data": {
    "secret_type": "access_token",
    "service_account_email": "example@mygcpproject.iam.gserviceaccount.com",
    "service_account_project": "mygcpproject",
    "bindings": {
      "project/mygcpproject": ["roles/viewer"],
      "https://selflink/to/my/resource": [
        "project/mygcpproject/roles/projcustomrole",
        "organizations/myorg/roles/orgcustomrole"
      ]
    },
    "token_scopes": ["https://www.googleapis.com/auth/cloud-platform"]
  }
}
```

### List static accounts <a href="#list-static-accounts" id="list-static-accounts"></a>

| Method | Path                   |
| ------ | ---------------------- |
| `LIST` | `/gcp/static-accounts` |

#### Sample request <a href="#sample-request-12" id="sample-request-12"></a>

```shell-session
$ curl \
    --header "X-Vault-Token: ..." \
    --request LIST \
    https://127.0.0.1:8200/v1/gcp/static-accounts
```

#### Sample response <a href="#sample-response-4" id="sample-response-4"></a>

```json
{
  "data": {
    "keys": ["my-token-account", "my-sakey-account"]
  }
}
```

### Delete static account <a href="#delete-static-account" id="delete-static-account"></a>

This endpoint deletes an existing static account by the given name.

| Method   | Path                        |
| -------- | --------------------------- |
| `DELETE` | `/gcp/static-account/:name` |

#### Parameters <a href="#parameters-6" id="parameters-6"></a>

* `name` (`string:<required>`): Name of the static account to delete.

#### Sample request <a href="#sample-request-13" id="sample-request-13"></a>

```shell-session
$ curl \
    --header "X-Vault-Token: ..." \
    --request DELETE \
    https://127.0.0.1:8200/v1/gcp/static-account/my-token-account
```

### Create/Update impersonated account <a href="#create-update-impersonated-account" id="create-update-impersonated-account"></a>

| Method | Path                              |
| ------ | --------------------------------- |
| `POST` | `/gcp/impersonated-account/:name` |

This method allows you to create an impersonated account or update an existing impersonated account.

#### Parameters <a href="#parameters-7" id="parameters-7"></a>

* `name` (`string: <required>`): Name of the impersonated account. Cannot be updated.
* `service_account_email` (`string: <required>`): Email of the GCP service account to manage. Cannot be updated.
* `token_scopes` (`array: []`): List of OAuth scopes to assign to access tokens generated under this impersonation account.
* `ttl` (`duration: ""`): Lifetime of the token generated. Defaults to 1 hour and is limited to a maximum of 12 hours. Uses duration format strings.

#### Sample payload <a href="#sample-payload-3" id="sample-payload-3"></a>

```json
{
  "service_account_email": "projectOwner@my-project.iam.gserviceaccount.com",
  "token_scopes": [
    "https://www.googleapis.com/auth/cloud-platform",
    "https://www.googleapis.com/auth/bigquery"
  ],
  "ttl": "2h"
}
```

#### Sample request <a href="#sample-request-14" id="sample-request-14"></a>

```shell-session
$ curl \
    --header "X-Vault-Token: ..." \
    --request POST \
    --data @payload.json \
    https://127.0.0.1:8200/v1/gcp/impersonated-account/my-token-impersonate
```

### Read impersonated account <a href="#read-impersonated-account" id="read-impersonated-account"></a>

| Method | Path                              |
| ------ | --------------------------------- |
| `GET`  | `/gcp/impersonated-account/:name` |

#### Parameters <a href="#parameters-8" id="parameters-8"></a>

* `name` (`string:<required>`): Name of the impersonated account to read.

#### Sample request <a href="#sample-request-15" id="sample-request-15"></a>

```shell-session
$ curl \
    --header "X-Vault-Token: ..." \
    --request GET \
    https://127.0.0.1:8200/v1/gcp/impersonated-account/my-token-impersonate
```

#### Sample response <a href="#sample-response-5" id="sample-response-5"></a>

```json
{
  "data": {
    "service_account_email": "projectOwner@my-project.iam.gserviceaccount.com",
    "service_account_project": "my-project",
    "token_scopes": [
      "https://www.googleapis.com/auth/cloud-platform",
      "https://www.googleapis.com/auth/bigquery"
    ],
    "ttl": 7200
  },
}
```

### List impersonated accounts <a href="#list-impersonated-accounts" id="list-impersonated-accounts"></a>

This endpoint lists the configured Vault roles for impersonated accounts.

| Method | Path                         |
| ------ | ---------------------------- |
| `LIST` | `/gcp/impersonated-accounts` |

#### Sample request <a href="#sample-request-16" id="sample-request-16"></a>

```shell-session
$ curl \
    --header "X-Vault-Token: ..." \
    --request LIST \
    https://127.0.0.1:8200/v1/gcp/impersonated-accounts
```

#### Sample response <a href="#sample-response-6" id="sample-response-6"></a>

```json
{
  "data": {
    "keys": [
      "my-token-impersonate",
      "secondary-role"
    ]
  }
}
```

### Delete impersonated account <a href="#delete-impersonated-account" id="delete-impersonated-account"></a>

This endpoint deletes an existing impersonated account by the given name.

| Method   | Path                              |
| -------- | --------------------------------- |
| `DELETE` | `/gcp/impersonated-account/:name` |

#### Parameters <a href="#parameters-9" id="parameters-9"></a>

* `name` (`string:<required>`): Name of the impersonated account to delete.

#### Sample request <a href="#sample-request-17" id="sample-request-17"></a>

```shell-session
$ curl \
    --header "X-Vault-Token: ..." \
    --request DELETE \
    https://127.0.0.1:8200/v1/gcp/impersonated-account/my-token-impersonate
```

### Generate secret (IAM service account creds): OAuth2 access token <a href="#generate-secret-iam-service-account-creds-oauth2-access-token" id="generate-secret-iam-service-account-creds-oauth2-access-token"></a>

| Method         | Path                                                    |
| -------------- | ------------------------------------------------------- |
| `GET` / `POST` | `/gcp/roleset/:roleset/token`                           |
| `GET` / `POST` | `/gcp/static-account/:static-account/token`             |
| `GET` / `POST` | `/gcp/impersonated-account/:impersonated-account/token` |
| `GET` / `POST` | `/gcp/token/:roleset` (deprecated)                      |

Generates an OAuth2 token with the scopes defined on the roleset, static account, or impersonated account. This OAuth access token can be used in GCP API calls, e.g. `curl -H "Authorization: Bearer $TOKEN" ...`

Tokens are non-revocable and non-renewable and have a static TTL of an hour. The TTL configured for the backend (either through the default system TTLs or through the `config/` endpoint) do not apply.

#### Parameters <a href="#parameters-10" id="parameters-10"></a>

* `roleset` (`string:<required>`): Name of an roleset with secret type `access_token` to generate access\_token under.
* `static-account` (`string:<required>`): Name of the static account with secret type `access_token` to generate access\_token under.
* `impersonated-account` (`string:<required>`): Name of the impersonated account to generate access\_token\_under.

#### Sample request <a href="#sample-request-18" id="sample-request-18"></a>

**Roleset:**

```shell-session
$ curl \
    --header "X-Vault-Token: ..." \
    --request GET \
    https://127.0.0.1:8200/v1/gcp/roleset/my-token-roleset/token
```

**Static account:**

```shell-session
$ curl \
    --header "X-Vault-Token: ..." \
    --request GET \
    https://127.0.0.1:8200/v1/gcp/static-account/my-token-account/token
```

**Impersonated account:**

```shell-session
$ curl \
    --header "X-Vault-Token: ..." \
    --request GET \
    https://127.0.0.1:8200/v1/gcp/impersonated-account/my-token-impersonate/token
```

#### Sample response <a href="#sample-response-7" id="sample-response-7"></a>

```json
{
  "request_id": "<uuid>",
  "data": {
    "token": "ya29.c.Elp5Be3ga87...",
    "expires_at_seconds": 1537400046,
    "token_ttl": 3599
  },
  "wrap_info": null,
  "warnings": null,
  "auth": null
}
```

### Generate secret (IAM service account creds): service account key <a href="#generate-secret-iam-service-account-creds-service-account-key" id="generate-secret-iam-service-account-creds-service-account-key"></a>

| Method         | Path                                      |
| -------------- | ----------------------------------------- |
| `GET` / `POST` | `/gcp/roleset/:roleset/key`               |
| `GET` / `POST` | `/gcp/static-account/:static-account/key` |
| `GET` / `POST` | `/gcp/key/:roleset` (deprecated)          |

If using `GET` ('read'), the optional parameters will be set to their defaults. Use `POST` if you want to specify different values for these params.

These keys are renewable and have TTL/max TTL as defined by either the backend config or the system default if config was not defined.

#### Parameters <a href="#parameters-11" id="parameters-11"></a>

* `roleset` (`string:<required>`): Name of an roleset with secret type `service_account_key` to generate key under.
* `static-account` (`string:<required>`): Name of an static account with secret type `service_account_key` to generate key under.
* `key_algorithm` (`string:"KEY_ALG_RSA_2048"`): Key algorithm used to generate key. Defaults to 2k RSA key You probably should not choose other values (i.e. 1k), but accepted values are `enum(ServiceAccountKeyAlgorithm)`
* `key_type` (`string:"TYPE_GOOGLE_CREDENTIALS_FILE`): Private key type to generate. Defaults to JSON credentials file. Accepted values are `enum(ServiceAccountPrivateKeyType)`
* `ttl` (`string: ""`): Specifies the Time To Live value provided using a duration format string. If not set, uses the system default value.

#### Sample payload <a href="#sample-payload-4" id="sample-payload-4"></a>

```json
{
  "key_algorithm": "KEY_ALG_RSA_2048",
  "key_type": "TYPE_GOOGLE_CREDENTIALS_FILE"
}
```

#### Sample request <a href="#sample-request-19" id="sample-request-19"></a>

```shell-session
$ curl \
    --header "X-Vault-Token: ..." \
    --request GET \
    https://127.0.0.1:8200/v1/gcp/roleset/my-key-roleset/key
```

```shell-session
$ curl \
    --header "X-Vault-Token: ..." \
    --request POST \
    --data @payload.json \
    https://127.0.0.1:8200/v1/gcp/roleset/my-key-roleset/key
```

#### Sample response <a href="#sample-response-8" id="sample-response-8"></a>

```json
{
  "request_id": "<uuid>",
  "lease_id": "gcp/roleset/my-key-roleset/key/<uuid>",
  "renewable": true,
  "lease_duration": 3600,
  "data": {
    "private_key_data": "<base64-encoded private key data>",
    "key_algorithm": "TYPE_GOOGLE_CREDENTIALS_FILE",
    "key_type": "KEY_ALG_RSA_2048"
  },
  "wrap_info": null,
  "warnings": null,
  "auth": null
}
```

### Revoking/Renewing secrets <a href="#revoking-renewing-secrets" id="revoking-renewing-secrets"></a>

See docs on how to renew and revoke leases. Note this only applies to service account keys.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.enclaive.cloud/vault/api/secrets-engines/google-cloud-secrets-engine-api.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.