Auth
Was this helpful?
Was this helpful?
Returns detailed information about the currently authenticated client token. This endpoint requires the caller to include a valid Vault token.
Lists the token roles configured in the token auth backend. Requires a token with list capability. This is equivalent to Vault's LIST method.
Performs maintenance to clean up invalid entries in the token store. This operation reads all accessors, tokens, and secondary index entries to identify and remove invalid tokens, orphaned children, and unused cubbyholes. Use with caution due to potential memory and I/O load.
Returns a list of token accessor IDs which can then be used to discover their properties or revoke them. Requires both list and sudo capabilities on the auth/token/accessors path.
Must be set to "true"
Creates an orphan token that is not tied to a parent token. Orphan tokens do not expire when the parent token expires and are not revoked when the parent is revoked.
Custom client token ID (root only). Cannot contain "." or start with "s.".
Name of the token role.
Policies to assign to the token.
If true, creates an orphan token. Requires root or sudo.
falseIf true, excludes the default policy.
falseWhether the token can be renewed.
trueDeprecated. Use ttl instead.
TTL (e.g., "1h").
Token type.
Explicit max TTL that cannot be exceeded.
Display name for the token.
tokenMax number of uses. 0 means unlimited.
0Periodic renewal interval. Requires root or sudo.
Entity alias to associate with (must be allowed in role).
Creates a new token using the configuration of the specified role. The role may override parameters passed in the request body.
The name of the token role to use for token creation.
Name to associate with this token
Name of the entity alias to associate with this token
Explicit Max TTL of this token
Value for the token
Use 'ttl' instead
Arbitrary key=value metadata to associate with the token
Do not include default policy for this token
Create the token with no parent
Max number of uses for this token
Renew period
List of policies for the token
Allow token to be renewed past its initial TTL up to system/mount maximum TTL
trueTime to live for this token
Token type
Returns detailed information about the specified client token. This endpoint requires a token with sufficient capabilities to perform lookups.
Returns detailed information about a token using its accessor. This endpoint requires a token with sufficient capabilities to perform lookups.
Renews a lease associated with a token using its accessor. This is used to prevent expiration and automatic revocation of the token. The token must be renewable and have an active lease.
Accessor of the token to renew (request body)
The desired increment in seconds to the token expiration
0Renews a lease associated with the calling token. This prevents the token from expiring and being automatically revoked. Renewal is only possible if the token is renewable and has an active lease.
The desired increment in seconds to the token expiration
0Token to renew (unused, does not need to be set)
Revokes the specified token and all child tokens derived from it. Any dynamic secrets associated with the token are also revoked.
Token to revoke
No content
Revokes the token associated with the specified accessor and all of its child tokens. This operation is useful in scenarios where the token ID is unavailable.
Accessor of the token to revoke
No content
Revokes the specified token and all secrets created with it, but does not revoke child tokens. The child tokens become orphaned and can be revoked later using /auth/token/revoke. This operation requires root-level privileges.
Token to revoke
No content
Revokes the token used to authenticate this request, along with all child tokens. All secrets generated with the token are also revoked.
No content
Creates or replaces the specified token role configuration.
Name of the token role
String or JSON list of allowed entity aliases. If set, specifies the entity aliases which are allowed to be used during token generation. This field supports globbing.
If set, tokens can be created with any subset of the policies in this list, rather than the normal semantics of tokens being a subset of the calling token's policies. The parameter is a comma-delimited string of policy names.
If set, tokens can be created with any subset of glob matched policies in this list, rather than the normal semantics of tokens being a subset of the calling token's policies. The parameter is a comma-delimited string of policy name globs.
Use 'token_bound_cidrs' instead.
If set, successful token creation via this role will require that no policies in the given list are requested. The parameter is a comma-delimited string of policy names.
If set, successful token creation via this role will require that no requested policies glob match any of policies in this list. The parameter is a comma-delimited string of policy name globs.
Use 'token_explicit_max_ttl' instead.
If true, tokens created via this role will be orphan tokens (have no parent)
If set, tokens created via this role will contain the given suffix as a part of their path. This can be used to assist use of the 'revoke-prefix' endpoint later on. The given suffix must match the regular expression.\w[\w-.]+\w
Use 'token_period' instead.
Tokens created via this role will be renewable or not according to this value. Defaults to "true".
trueComma separated string or JSON list of CIDR blocks. If set, specifies the blocks of IP addresses which are allowed to use the generated token.
If set, tokens created via this role carry an explicit maximum TTL. During renewal, the current maximum TTL values of the role and the mount are not checked for changes, and any updates to these values will have no effect on the token being renewed.
If true, the 'default' policy will not automatically be added to generated tokens
The maximum number of times a token may be used, a value of zero means unlimited
If set, tokens created via this role will have no max lifetime; instead, their renewal period will be fixed to this value. This takes an integer number of seconds, or a string duration (e.g. "24h").
The type of token to generate, service or batch
default-service