/sys/quotas/lease-count
Last updated
Last updated
The /sys/quotas/lease-count
endpoint is used to create, edit and delete lease count quotas.
This endpoint is used to create a lease count quota with an identifier, name
. A lease count quota must include a max_leases
value with an optional path
that can either be a namespace or mount, and can optionally include a path suffix following the mount to restrict more specific API paths.
Upon creating a lease count quota, it will be populated with the current count of leases from this path. If there are more leases present than the specified max_leases
, this will cause the lease count to go over the specified max_leases
.
The initial population process can cause a lot of work for Vault - and while creating one lease count quota is always fine, if you're planning to create — for example — thousands of lease count quotas for paths with millions of leases in an automated way, it is recommended to space out the creation requests.
Method | Path |
---|---|
name
(string: "")
- The name of the quota.
path
(string: "")
- Path of the mount or namespace to apply the quota. A blank path configures a global lease count quota. For example namespace1/
adds a quota to a full namespace, namespace1/auth/userpass
adds a quota to userpass
in namespace1
, and namespace1/kv-v2/data/foo/bar
adds a quota to a specific secret on a K/V v2 mount in namespace1
. A trailing glob (*
) can also be added as part of the path after the mount to match paths that share the same prefix prior to the glob. namespace1/kv-v2/data/foo/*
would match both namespace1/kv-v2/data/foo/bar
and namespace1/kv-v2/data/foo/baz
. Updating this field on an existing quota can have "moving" effects. For example, updating namespace1
to namespace1/auth/userpass
moves this quota from being a namespace quota to a namespace-specific mount quota. Non-global quotas are not inherited by child namespaces.
max_leases
(int: 0)
- Maximum number of leases allowed by the quota rule.
role
(string: "")
- If set on a quota where path
is set to an auth mount with a concept of roles (such as /auth/approle/
), this will make the quota restrict login requests to that mount that are made with the specified role. The request will fail if the auth mount does not have a concept of roles, or path
is not an auth mount.
inheritable
(bool: false)
- If set to true
on a quota where path
is set to a namespace, the same quota will be cumulatively applied to all child namespace. The inheritable
parameter cannot be set to true
if the path
does not specify a namespace. Only the quotas associated with the root namespace are inheritable by default.
A lease count quota can be deleted by name
.
A lease count quota can be retrieved by name
.
This endpoint returns a list of all the lease count quotas. A 404 response will be returned if no lease count quota has been created.
Method | Path |
---|---|
Method | Path |
---|---|
Method | Path |
---|---|
POST
/sys/quotas/lease-count/:name
DELETE
/sys/quotas/lease-count/:name
GET
/sys/quotas/lease-count/:name
LIST
/sys/quotas/lease-count