> For the complete documentation index, see [llms.txt](https://docs.enclaive.cloud/virtual-hsm/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enclaive.cloud/virtual-hsm/api/enclaive-vault-api.md).
# Enclaive Vault API
## Create Token
> Creates a new token. Certain options are only available when called by a root or sudo-capable token. If used with a role name in the path, the token will be created against the specified role name.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"security":[{"vaultToken":[]}],"components":{"securitySchemes":{},"schemas":{"CreateTokenRequest":{"type":"object","properties":{"id":{"type":"string","description":"Custom client token ID (root only). Cannot contain \".\" or start with \"s.\"."},"role_name":{"type":"string","description":"Name of the token role."},"policies":{"type":"array","items":{"type":"string"},"description":"Policies to assign to the token."},"meta":{"type":"object","additionalProperties":{"type":"string"},"description":"Metadata to pass through to audit devices."},"no_parent":{"type":"boolean","default":false,"description":"If true, creates an orphan token. Requires root or sudo."},"no_default_policy":{"type":"boolean","default":false,"description":"If true, excludes the default policy."},"renewable":{"type":"boolean","default":true,"description":"Whether the token can be renewed."},"lease":{"type":"string","deprecated":true,"description":"Deprecated. Use ttl instead."},"ttl":{"type":"string","description":"TTL (e.g., \"1h\")."},"type":{"type":"string","enum":["batch","service"],"description":"Token type."},"explicit_max_ttl":{"type":"string","description":"Explicit max TTL that cannot be exceeded."},"display_name":{"type":"string","default":"token","description":"Display name for the token."},"num_uses":{"type":"integer","default":0,"description":"Max number of uses. 0 means unlimited."},"period":{"type":"string","description":"Periodic renewal interval. Requires root or sudo."},"entity_alias":{"type":"string","description":"Entity alias to associate with (must be allowed in role)."}}}}},"paths":{"/auth/token/create":{"post":{"summary":"Create Token","description":"Creates a new token. Certain options are only available when called by a root or sudo-capable token. If used with a role name in the path, the token will be created against the specified role name.\n","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateTokenRequest"}}}},"responses":{"200":{"description":"Token created successfully","content":{"application/json":{}}},"400":{"description":"Bad Request – The input is malformed or missing required fields.","content":{"application/json":{}}},"403":{"description":"Forbidden – The requester's token lacks sufficient privileges","content":{"application/json":{}}}}}}}}
```
## GET /identity/mfa/method/duo/{method\_id}
> Read the current configuration for the given MFA method
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/identity/mfa/method/duo/{method_id}":{"get":{"operationId":"mfa-read-duo-method-configuration","summary":"Read the current configuration for the given MFA method","responses":{"200":{"description":"Successfully retrieved Duo MFA configuration","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DuoMfaMethodResponse"}}}},"400":{"description":"Bad Request – Invalid method ID format.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"403":{"description":"Forbidden – Access denied to this configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"tags":["identity"]}}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## Retrieve the configuration of the specified Duo MFA method.
> This operation retrieves the configuration details of the Duo MFA method identified by the \`name\` parameter.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/mfa/method/duo/{name}":{"get":{"operationId":"system-read-mfa-method-duo-name","summary":"Retrieve the configuration of the specified Duo MFA method.","description":"This operation retrieves the configuration details of the Duo MFA method identified by the `name` parameter.\n","responses":{"200":{"description":"Successfully retrieved the Duo MFA method configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MfaMethodConfiguration"}}}},"404":{"description":"The specified Duo MFA method configuration was not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error while retrieving the Duo MFA method configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## Modify the specified Duo MFA method configuration.
> This operation modifies the configuration of the Duo MFA method identified by the \`name\` parameter. It requires the user to provide the new configuration details in the request body.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/mfa/method/duo/{name}":{"post":{"operationId":"system-write-mfa-method-duo-name","summary":"Modify the specified Duo MFA method configuration.","description":"This operation modifies the configuration of the Duo MFA method identified by the `name` parameter. It requires the user to provide the new configuration details in the request body.\n","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MfaMethodConfiguration"}}}},"responses":{"200":{"description":"Successfully updated the Duo MFA method configuration."},"400":{"description":"Bad request. The provided configuration is invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"404":{"description":"The specified Duo MFA method configuration was not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error while modifying the Duo MFA method configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## Delete the specified Duo MFA method.
> This operation deletes the Duo MFA method configuration identified by the \`name\` parameter.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/mfa/method/duo/{name}":{"delete":{"operationId":"system-delete-mfa-method-duo-name","summary":"Delete the specified Duo MFA method.","description":"This operation deletes the Duo MFA method configuration identified by the `name` parameter.\n","responses":{"204":{"description":"Successfully deleted the Duo MFA method configuration. The body is empty."},"400":{"description":"Bad request. The `name` parameter is invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"404":{"description":"The specified Duo MFA method configuration was not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error while deleting the Duo MFA method configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## POST /sys/namespaces/api-lock/lock/{path}
> Lock the API at a specific namespace path.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/namespaces/api-lock/lock/{path}":{"post":{"operationId":"system-write-namespaces-api-lock-lock-path","summary":"Lock the API at a specific namespace path.","requestBody":{"required":false},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"}}}}}},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}}}}}}
```