> For the complete documentation index, see [llms.txt](https://docs.enclaive.cloud/virtual-hsm/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enclaive.cloud/virtual-hsm/api/system.md).
# System
## GET /sys/audit
> List the enabled audit devices
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/audit":{"get":{"operationId":"auditing-list-enabled-devices","summary":"List the enabled audit devices","tags":["system"],"parameters":[],"requestBody":{"description":"No request body is required for this endpoint.","content":{"application/json":{"schema":{"type":"object"}}},"required":false},"responses":{"200":{"description":"Successfully retrieved enabled audit devices.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AuditDevicesResponse"}}}},"400":{"description":"Bad request due to client error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"401":{"description":"Unauthorized. Vault token is invalid or missing.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"403":{"description":"Forbidden. Caller lacks sufficient permission.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## POST /sys/audit-hash/{path}
> Calculate hash via audit backend.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/audit-hash/{path}":{"post":{"operationId":"auditing-calculate-hash","summary":"Calculate hash via audit backend.","tags":["system"],"requestBody":{"required":true,"description":"Input string to hash using the given audit backend.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AuditingCalculateHashRequest"}}}},"responses":{"200":{"description":"Successfully calculated the hash of the input.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AuditingCalculateHashResponse"}}}},"400":{"description":"Bad request due to malformed or missing data.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"401":{"description":"Unauthorized. Vault token is invalid or missing.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"403":{"description":"Forbidden. Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}},"components":{"schemas":{"AuditingCalculateHashRequest":{"properties":{"input":{"type":"string"}},"type":"object"},"AuditingCalculateHashResponse":{"properties":{"hash":{"type":"string"}},"type":"object"},"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## POST /sys/audit/{path}
> Enable a new audit device at the supplied path.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/audit/{path}":{"post":{"summary":"Enable a new audit device at the supplied path.","operationId":"auditing-enable-device","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AuditingEnableDeviceRequest"}}}},"responses":{"204":{"description":"Audit device successfully enabled. No content is returned.","content":{"application/json":{}}},"400":{"description":"Bad Request - The provided request body is invalid.","content":"application"}},"tags":["system"]}}},"components":{"schemas":{"AuditingEnableDeviceRequest":{"properties":{"description":{"description":"User-friendly description for this audit backend.","type":"string"},"local":{"default":false,"description":"Mark the mount as a local mount, which is not replicated and is unaffected by replication.","type":"boolean"},"options":{"description":"Configuration options for the audit backend.","format":"kvpairs","type":"object"},"type":{"description":"The type of the backend. Example: \"mysql\"","type":"string"}},"type":"object"}}}}
```
## DELETE /sys/audit/{path}
> Disable the audit device at the given path.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/audit/{path}":{"delete":{"summary":"Disable the audit device at the given path.","operationId":"auditing-disable-device","responses":{"204":{"description":"Audit device successfully disabled. No content is returned.","content":{"application/json":{}}},"400":{"description":"Bad Request - The provided path is invalid or the device cannot be disabled.","content":{"application/json":{}}},"401":{"description":"Unauthorized - Authentication failed or no access rights.","content":{"application/json":{"e rror":"Unauthorized access."}}},"404":{"description":"Not Found - The specified audit device path was not found.","content":{"application/json":{}}}},"tags":["system"]}}}}
```
## GET /sys/auth/{path}
> Read the configuration of the auth engine at the given path.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/auth/{path}":{"get":{"summary":"Read the configuration of the auth engine at the given path.","operationId":"auth-read-configuration","responses":{"200":{"description":"Successfully read the auth configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AuthReadConfigurationResponse"}}}},"400":{"description":"Bad Request - Invalid path or request format.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"401":{"description":"Unauthorized - Authentication failure.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"404":{"description":"Not Found - No auth engine found at this path.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"AuthReadConfigurationResponse":{"properties":{"accessor":{"type":"string"},"config":{"format":"map","type":"object"},"deprecation_status":{"type":"string"},"description":{"type":"string"},"external_entropy_access":{"type":"boolean"},"local":{"type":"boolean"},"options":{"format":"map","type":"object"},"plugin_version":{"type":"string"},"running_plugin_version":{"type":"string"},"running_sha256":{"type":"string"},"seal_wrap":{"type":"boolean"},"type":{"type":"string"},"uuid":{"type":"string"}},"type":"object"},"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## Enables a new auth method.
> After enabling, the auth method can be accessed and configured via the auth path specified as part of the URL. For example, enabling the "userpass" auth method at "user" will make it accessible at \`/auth/user\`.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/auth/{path}":{"post":{"summary":"Enables a new auth method.","description":"After enabling, the auth method can be accessed and configured via the auth path specified as part of the URL. For example, enabling the \"userpass\" auth method at \"user\" will make it accessible at `/auth/user`.\n","operationId":"auth-enable-method","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AuthEnableMethodRequest"}}}},"responses":{"204":{"description":"Auth method successfully enabled. No content is returned.","content":{"application/json":{}}},"400":{"description":"Bad Request - Validation error or malformed input.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"401":{"description":"Unauthorized - Permission denied or token missing.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"AuthEnableMethodRequest":{"properties":{"config":{"description":"Configuration for this mount, such as plugin_name.","format":"map","type":"object"},"description":{"description":"User-friendly description for this credential backend.","type":"string"},"external_entropy_access":{"default":false,"description":"Whether to give the mount access to Vault's external entropy.","type":"boolean"},"local":{"default":false,"description":"Mark the mount as a local mount, which is not replicated and is unaffected by replication.","type":"boolean"},"options":{"description":"The options to pass into the backend. Should be a json object with string keys and values.","format":"kvpairs","type":"object"},"plugin_name":{"description":"Name of the auth plugin to use based from the name in the plugin catalog.","type":"string"},"plugin_version":{"description":"The semantic version of the plugin to use.","type":"string"},"seal_wrap":{"default":false,"description":"Whether to turn on seal wrapping for the mount.","type":"boolean"},"type":{"description":"The type of the backend. Example: \"userpass\"","type":"string"}},"type":"object"},"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## DELETE /sys/auth/{path}
> Disable the auth method at the given auth path.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/auth/{path}":{"delete":{"summary":"Disable the auth method at the given auth path.","operationId":"auth-disable-method","responses":{"204":{"description":"Auth method successfully disabled. No content is returned.","content":{"application/json":{}}},"400":{"description":"Bad Request - Invalid path or request format.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"401":{"description":"Unauthorized - Authentication or permission failure.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"404":{"description":"Not Found - The specified auth method path was not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## Reads the given auth path's configuration.
> This endpoint requires sudo capability on the final path, but the same functionality can be achieved without sudo via \`sys/mounts/auth/\[auth-path]/tune\`.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/auth/{path}/tune":{"get":{"summary":"Reads the given auth path's configuration.","description":"This endpoint requires sudo capability on the final path, but the same functionality can be achieved without sudo via `sys/mounts/auth/[auth-path]/tune`.\n","operationId":"auth-read-tuning-information","responses":{"200":{"description":"Successfully read tuning information.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AuthReadTuningInformationResponse"}}}},"400":{"description":"Bad Request - Invalid request or path.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"401":{"description":"Unauthorized - Token missing or access denied.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"AuthReadTuningInformationResponse":{"properties":{"allowed_managed_keys":{"items":{"type":"string"},"type":"array"},"allowed_response_headers":{"items":{"type":"string"},"type":"array"},"audit_non_hmac_request_keys":{"items":{"type":"string"},"type":"array"},"audit_non_hmac_response_keys":{"items":{"type":"string"},"type":"array"},"default_lease_ttl":{"type":"integer"},"description":{"type":"string"},"external_entropy_access":{"type":"boolean"},"force_no_cache":{"type":"boolean"},"listing_visibility":{"type":"string"},"max_lease_ttl":{"type":"integer"},"options":{"format":"map","type":"object"},"passthrough_request_headers":{"items":{"type":"string"},"type":"array"},"plugin_version":{"type":"string"},"token_type":{"type":"string"},"user_lockout_counter_reset_duration":{"format":"int64","type":"integer"},"user_lockout_disable":{"type":"boolean"},"user_lockout_duration":{"format":"int64","type":"integer"},"user_lockout_threshold":{"format":"int64","type":"integer"}},"type":"object"},"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## Tune configuration parameters for a given auth path.
> This endpoint requires sudo capability on the final path, but the same functionality can be achieved without sudo via \`sys/mounts/auth/\[auth-path]/tune\`.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/auth/{path}/tune":{"post":{"summary":"Tune configuration parameters for a given auth path.","description":"This endpoint requires sudo capability on the final path, but the same functionality can be achieved without sudo via `sys/mounts/auth/[auth-path]/tune`.\n","operationId":"auth-tune-configuration-parameters","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AuthTuneConfigurationParametersRequest"}}}},"responses":{"204":{"description":"Successfully updated tuning parameters. No content is returned.","content":{"application/json":{}}},"400":{"description":"Bad Request - Validation error in request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"401":{"description":"Unauthorized - Missing or invalid token.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"AuthTuneConfigurationParametersRequest":{"properties":{"allowed_response_headers":{"description":"A list of headers to whitelist and allow a plugin to set on responses.","items":{"type":"string"},"type":"array"},"audit_non_hmac_request_keys":{"description":"The list of keys in the request data object that will not be HMAC'ed by audit devices.","items":{"type":"string"},"type":"array"},"audit_non_hmac_response_keys":{"description":"The list of keys in the response data object that will not be HMAC'ed by audit devices.","items":{"type":"string"},"type":"array"},"default_lease_ttl":{"description":"The default lease TTL for this mount.","type":"string"},"description":{"description":"User-friendly description for this credential backend.","type":"string"},"listing_visibility":{"description":"Determines the visibility of the mount in the UI-specific listing endpoint. Accepted value are 'unauth' and 'hidden', with the empty default ('') behaving like 'hidden'.","type":"string"},"max_lease_ttl":{"description":"The max lease TTL for this mount.","type":"string"},"options":{"description":"The options to pass into the backend. Should be a json object with string keys and values.","format":"kvpairs","type":"object"},"passthrough_request_headers":{"description":"A list of headers to whitelist and pass from the request to the plugin.","items":{"type":"string"},"type":"array"},"plugin_version":{"description":"The semantic version of the plugin to use.","type":"string"},"token_type":{"description":"The type of token to issue (service or batch).","type":"string"},"user_lockout_config":{"description":"The user lockout configuration to pass into the backend. Should be a json object with string keys and values.","format":"map","type":"object"}},"type":"object"},"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## POST /sys/capabilities
> Returns the capabilities of the calling token on the specified paths.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/capabilities":{"post":{"operationId":"query-token-capabilities","summary":"Returns the capabilities of the calling token on the specified paths.","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/QueryTokenCapabilitiesRequest"}}}},"responses":{"200":{"description":"Successfully retrieved capabilities for the given paths.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/QueryTokenCapabilitiesResponse"}}}},"400":{"description":"Bad Request - Invalid request or missing fields.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"401":{"description":"Unauthorized - The token is invalid or expired.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"QueryTokenCapabilitiesRequest":{"properties":{"path":{"deprecated":true,"description":"Use 'paths' instead.","items":{"type":"string"},"type":"array"},"paths":{"description":"Paths on which capabilities are being queried.","items":{"type":"string"},"type":"array"},"token":{"description":"Token for which capabilities are being queried.","type":"string"}},"type":"object"},"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## POST /sys/capabilities-accessor
> Returns the capabilities of the token identified by the accessor on the specified paths.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/capabilities-accessor":{"post":{"operationId":"query-token-accessor-capabilities","summary":"Returns the capabilities of the token identified by the accessor on the specified paths.","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/QueryTokenAccessorCapabilitiesRequest"}}}},"responses":{"200":{"description":"Successfully retrieved capabilities for the given paths.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/QueryTokenCapabilitiesResponse"}}}},"400":{"description":"Bad Request - Missing or invalid accessor or paths.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"401":{"description":"Unauthorized - Invalid credentials or insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"QueryTokenAccessorCapabilitiesRequest":{"properties":{"accessor":{"description":"Accessor of the token for which capabilities are being queried.","type":"string"},"path":{"deprecated":true,"description":"Use 'paths' instead.","items":{"type":"string"},"type":"array"},"paths":{"description":"Paths on which capabilities are being queried.","items":{"type":"string"},"type":"array"}},"type":"object"},"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## POST /sys/capabilities-self
> Returns the capabilities of the calling token on the given paths.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/capabilities-self":{"post":{"operationId":"query-token-self-capabilities","summary":"Returns the capabilities of the calling token on the given paths.","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/QueryTokenSelfCapabilitiesRequest"}}}},"responses":{"200":{"description":"Successfully retrieved capabilities for the specified paths.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/QueryTokenCapabilitiesResponse"}}}},"400":{"description":"Bad Request - Missing or invalid paths field.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"401":{"description":"Unauthorized - Token is missing, invalid, or lacks necessary permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"QueryTokenSelfCapabilitiesRequest":{"properties":{"path":{"deprecated":true,"description":"Use 'paths' instead.","items":{"type":"string"},"type":"array"},"paths":{"description":"Paths on which capabilities are being queried.","items":{"type":"string"},"type":"array"},"token":{"description":"Token for which capabilities are being queried.","type":"string"}},"type":"object"},"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## GET /sys/config/auditing/request-headers
> List the request headers that are configured to be audited.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/config/auditing/request-headers":{"get":{"operationId":"auditing-list-request-headers","summary":"List the request headers that are configured to be audited.","tags":["system"],"responses":{"200":{"description":"Successfully listed the configured audited request headers.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AuditingListRequestHeadersResponse"}}}},"400":{"description":"Bad Request - Server failed to process the request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"401":{"description":"Unauthorized - Token is missing or does not have sufficient privileges.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}},"components":{"schemas":{"AuditingListRequestHeadersResponse":{"properties":{"headers":{"format":"map","type":"object"}},"type":"object"},"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## GET /sys/config/auditing/request-headers/{header}
> List the information for the given request header.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/config/auditing/request-headers/{header}":{"get":{"operationId":"auditing-read-request-header-information","summary":"List the information for the given request header.","tags":["system"],"responses":{"200":{"description":"Successfully retrieved the request header auditing information.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AuditingReadRequestHeaderResponse"}}}},"400":{"description":"Bad Request - Invalid header format.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"401":{"description":"Unauthorized - Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## POST /sys/config/auditing/request-headers/{header}
> Enable auditing of a header.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/config/auditing/request-headers/{header}":{"post":{"operationId":"auditing-enable-request-header","summary":"Enable auditing of a header.","tags":["system"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AuditingEnableRequestHeaderRequest"}}}},"responses":{"204":{"description":"Auditing for the header enabled successfully."},"400":{"description":"Bad Request - Could not enable auditing for header.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"401":{"description":"Unauthorized - Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}},"components":{"schemas":{"AuditingEnableRequestHeaderRequest":{"properties":{"hmac":{"type":"boolean"}},"type":"object"},"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## DELETE /sys/config/auditing/request-headers/{header}
> Disable auditing of the given request header.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/config/auditing/request-headers/{header}":{"delete":{"operationId":"auditing-disable-request-header","summary":"Disable auditing of the given request header.","tags":["system"],"responses":{"204":{"description":"Auditing for the header disabled successfully."},"400":{"description":"Bad Request - Header not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"401":{"description":"Unauthorized - Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## GET /sys/config/control-group
> Read the current control group configuration.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/config/control-group":{"get":{"operationId":"system-read-config-control-group","summary":"Read the current control group configuration.","tags":["system"],"responses":{"200":{"description":"Successfully retrieved the control group configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ControlGroupConfigurationResponse"}}}},"400":{"description":"Bad Request - Invalid request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"401":{"description":"Unauthorized - Missing or invalid credentials.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## POST /sys/config/control-group
> Configure control group parameters.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/config/control-group":{"post":{"operationId":"system-write-config-control-group","summary":"Configure control group parameters.","tags":["system"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ControlGroupConfigurationRequest"}}}},"responses":{"200":{"description":"Control group configuration updated successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ControlGroupConfigurationResponse"}}}},"400":{"description":"Bad Request - Invalid config.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"401":{"description":"Unauthorized - Access denied.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## DELETE /sys/config/control-group
> Delete the control group configuration.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/config/control-group":{"delete":{"operationId":"system-delete-config-control-group","summary":"Delete the control group configuration.","tags":["system"],"responses":{"204":{"description":"Control group configuration deleted successfully."},"400":{"description":"Bad Request - Cannot delete configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"401":{"description":"Unauthorized - Access denied.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## GET /sys/config/cors
> Return the current CORS settings.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/config/cors":{"get":{"operationId":"cors-read-configuration","summary":"Return the current CORS settings.","tags":["system"],"responses":{"200":{"description":"Current CORS settings returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CorsReadConfigurationResponse"}}}},"400":{"description":"Invalid request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"403":{"description":"Forbidden. Not authorized.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}},"components":{"schemas":{"CorsReadConfigurationResponse":{"properties":{"allowed_headers":{"items":{"type":"string"},"type":"array"},"allowed_origins":{"items":{"type":"string"},"type":"array"},"enabled":{"type":"boolean"}},"type":"object"},"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## POST /sys/config/cors
> Configure the CORS settings.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/config/cors":{"post":{"operationId":"cors-configure","summary":"Configure the CORS settings.","tags":["system"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CorsConfigureRequest"}}}},"responses":{"204":{"description":"CORS settings successfully updated."},"400":{"description":"Invalid CORS configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"403":{"description":"Not authorized.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}},"components":{"schemas":{"CorsConfigureRequest":{"properties":{"allowed_headers":{"description":"A comma-separated string or array of strings indicating headers that are allowed on cross-origin requests.","items":{"type":"string"},"type":"array"},"allowed_origins":{"description":"A comma-separated string or array of strings indicating origins that may make cross-origin requests.","items":{"type":"string"},"type":"array"},"enable":{"description":"Enables or disables CORS headers on requests.","type":"boolean"}},"type":"object"},"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## DELETE /sys/config/cors
> Remove any CORS settings.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/config/cors":{"delete":{"operationId":"cors-delete-configuration","summary":"Remove any CORS settings.","tags":["system"],"responses":{"204":{"description":"CORS settings removed successfully."},"403":{"description":"Not authorized.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## GET /sys/config/group-policy-application
> Read the group policy application configuration.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/config/group-policy-application":{"get":{"operationId":"system-read-config-group-policy-application","summary":"Read the group policy application configuration.","tags":["system"],"responses":{"200":{"description":"Group policy application configuration retrieved successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GroupPolicyApplicationResponse"}}}},"400":{"description":"Invalid request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"403":{"description":"Forbidden. The client does not have permission.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## POST /sys/config/group-policy-application
> Configure the group policy application settings.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/config/group-policy-application":{"post":{"operationId":"system-write-config-group-policy-application","summary":"Configure the group policy application settings.","tags":["system"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GroupPolicyApplicationRequest"}}}},"responses":{"200":{"description":"Group policy application configuration updated successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GroupPolicyApplicationResponse"}}}}}}}},"components":{"schemas":{}}}
```
## POST /sys/config/reload/{subsystem}
> Reload the given subsystem
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/config/reload/{subsystem}":{"post":{"operationId":"reload-subsystem","summary":"Reload the given subsystem","tags":["system"],"requestBody":{"description":"Example reload request for a given subsystem.","content":{"application/json":{}},"required":false},"responses":{"204":{"description":"Subsystem reloaded successfully."},"400":{"description":"Invalid request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"403":{"description":"Forbidden. The client does not have permission to reload the subsystem.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"404":{"description":"Subsystem not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error while reloading subsystem.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## Return a sanitized version of the Vault server configuration.
> The sanitized output strips configuration values in the storage, HA storage, and seals stanzas, which may contain sensitive values such as API tokens. It also removes any token or secret fields in other stanzas, such as the \`circonus\_api\_token\` from telemetry.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/config/state/sanitized":{"get":{"summary":"Return a sanitized version of the Vault server configuration.","description":"The sanitized output strips configuration values in the storage, HA storage, and seals stanzas, which may contain sensitive values such as API tokens. It also removes any token or secret fields in other stanzas, such as the `circonus_api_token` from telemetry.\n","operationId":"read-sanitized-configuration-state","tags":["system"],"responses":{"200":{"description":"Sanitized configuration retrieved successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SanitizedConfigResponse"}}}},"403":{"description":"Forbidden. The client does not have sufficient privileges.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## GET /sys/config/ui/headers
> Return a list of configured UI headers.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/config/ui/headers":{"get":{"operationId":"ui-headers-list","parameters":[{"description":"Must be set to `true`","in":"query","name":"list","required":true,"schema":{"enum":["true"],"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UiHeadersListResponse"}}},"description":"Returns a list of configured UI headers."},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}},"description":"Bad request. The request is malformed or missing required parameters."},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}},"description":"Unauthorized. The request lacks valid authentication credentials."},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}},"description":"Forbidden. The client does not have permission to access the requested resource."},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}},"description":"Not Found. The requested resource does not exist."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}},"description":"Internal Server Error. A server-side error occurred."}},"summary":"Return a list of configured UI headers.","tags":["system"],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"list":{"type":"string","enum":["true"],"description":"Must be set to `true`"}},"required":["list"]}}}}}}},"components":{"schemas":{"UiHeadersListResponse":{"properties":{"keys":{"description":"Lists of configured UI headers. Omitted if list is empty","items":{"type":"string"},"type":"array"}},"type":"object"},"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## GET /sys/config/ui/headers/{header}
> Return the given UI header's configuration.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/config/ui/headers/{header}":{"get":{"operationId":"ui-headers-read-configuration","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UiHeadersReadConfigurationResponse"}}},"description":"Returns the configuration of the specified UI header."},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}},"description":"Not Found. The requested header does not exist."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}},"description":"Internal Server Error. A server-side error occurred."}},"summary":"Return the given UI header's configuration.","tags":["system"]}}},"components":{"schemas":{"UiHeadersReadConfigurationResponse":{"properties":{"value":{"description":"returns the first header value when `multivalue` request parameter is false","type":"string"},"values":{"description":"returns all header values when `multivalue` request parameter is true","items":{"type":"string"},"type":"array"}},"type":"object"},"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## POST /sys/config/ui/headers/{header}
> Configure the values to be returned for the UI header.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/config/ui/headers/{header}":{"post":{"operationId":"ui-headers-configure","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UiHeadersConfigureRequest"}},"required":true}},"responses":{"200":{"description":"Header value successfully configured."},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}},"description":"Bad request. The request is malformed or missing required parameters."},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}},"description":"Not Found. The requested header does not exist."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}},"description":"Internal Server Error. A server-side error occurred."}},"summary":"Configure the values to be returned for the UI header.","tags":["system"]}}},"components":{"schemas":{"UiHeadersConfigureRequest":{"properties":{"multivalue":{"description":"Returns multiple values if true","type":"boolean"},"values":{"description":"The values to set the header.","items":{"type":"string"},"type":"array"}},"type":"object"},"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## DELETE /sys/config/ui/headers/{header}
> Remove a UI header.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/config/ui/headers/{header}":{"delete":{"operationId":"ui-headers-delete-configuration","responses":{"204":{"description":"Header successfully removed."},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}},"description":"Bad request. The request is malformed or missing required parameters."},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}},"description":"Not Found. The requested header does not exist."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}},"description":"Internal Server Error. A server-side error occurred."}},"summary":"Remove a UI header.","tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## POST /sys/control-group/authorize
> Authorizes a control group by assigning permissions
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/control-group/authorize":{"post":{"operationId":"system-write-control-group-authorize","responses":{"200":{"description":"Authorization successful."},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}},"description":"Bad request. The request is malformed or missing required parameters."},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}},"description":"Unauthorized. The request lacks valid authentication credentials."},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}},"description":"Forbidden. The client does not have permission to perform this action."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}},"description":"Internal Server Error. A server-side error occurred."}},"tags":["system"],"summary":"Authorizes a control group by assigning permissions","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"group_id":{"type":"string","description":"The control group ID to authorize."},"permissions":{"type":"array","items":{"type":"string","enum":["read","write","execute"]},"description":"List of permissions to grant to the control group."}},"required":["group_id","permissions"]}}}}}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## POST /sys/control-group/request
> Submit a request for control group authorization
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/control-group/request":{"post":{"operationId":"system-write-control-group-request","summary":"Submit a request for control group authorization","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"request_id":{"type":"string","description":"Unique identifier for the control group request."},"data":{"type":"object","additionalProperties":true,"description":"Arbitrary data associated with the control group request."}},"required":["request_id"]}}}},"responses":{"200":{"description":"Request processed successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"status":{"type":"string","description":"Status of the processed request."},"message":{"type":"string","description":"A descriptive message about the result."}}}}}},"400":{"description":"Bad Request - The request is malformed or missing required parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"401":{"description":"Unauthorized - Authentication credentials were missing or invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"403":{"description":"Forbidden - You do not have permission to perform this action.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"404":{"description":"Not Found - The control group or requested resource does not exist.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal Server Error - An unexpected error occurred on the server.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## Decode an encoded token using a one-time password (OTP)
> This endpoint decodes an encoded token using the provided one-time password (OTP). It can be used in unauthenticated contexts.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/decode-token":{"post":{"operationId":"decode","summary":"Decode an encoded token using a one-time password (OTP)","description":"This endpoint decodes an encoded token using the provided one-time password (OTP). It can be used in unauthenticated contexts.\n","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DecodeRequest"}}}},"responses":{"200":{"description":"Successfully decoded the token.","content":{"application/json":{"schema":{"type":"object","properties":{"decoded_token":{"type":"string","description":"The decoded token value."}}}}}},"400":{"description":"Bad Request - The request is malformed or missing required parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"401":{"description":"Unauthorized - Authentication credentials are missing or invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"403":{"description":"Forbidden - The provided credentials are valid but insufficient.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"404":{"description":"Not Found - The token or associated resources could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal Server Error - An unexpected server-side error occurred.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"DecodeRequest":{"properties":{"encoded_token":{"description":"Specifies the encoded token (result from generate-root).","type":"string"},"otp":{"description":"Specifies the otp code for decode.","type":"string"}},"type":"object"},"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## GET /sys/experiments
> List available and enabled experimental features in Vault.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/experiments":{"get":{"operationId":"list-experimental-features","summary":"List available and enabled experimental features in Vault.","requestBody":{"content":{"application/json":{"schema":{"type":"object"}}},"required":false},"responses":{"200":{"description":"Successfully returned the list of experimental features.","content":{"application/json":{"schema":{"type":"object","properties":{"features":{"type":"array","description":"A list of experimental features.","items":{"type":"object","properties":{"name":{"type":"string","description":"Name of the experimental feature."},"enabled":{"type":"boolean","description":"Whether the feature is enabled."}}}}}}}}},"400":{"description":"Bad Request - The request is malformed or missing required parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"401":{"description":"Unauthorized - Authentication credentials are missing or invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"403":{"description":"Forbidden - You do not have permission to access experimental features.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"404":{"description":"Not Found - The resource for experimental features could not be located.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal Server Error - An unexpected error occurred on the server.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## Read the current root token generation progress.
> Returns the configuration and progress details of the ongoing root token generation process.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/generate-root":{"get":{"operationId":"root-token-generation-read-progress2","summary":"Read the current root token generation progress.","description":"Returns the configuration and progress details of the ongoing root token generation process.\n","responses":{"200":{"description":"Successfully retrieved the root generation progress.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RootTokenGenerationReadProgress2Response"}}}},"400":{"description":"Bad Request - The request is malformed or invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"401":{"description":"Unauthorized - Authentication credentials are missing or invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"403":{"description":"Forbidden - Insufficient permissions to read root generation progress.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"404":{"description":"Not Found - No active root generation attempt found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal Server Error - Unexpected server-side error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"RootTokenGenerationReadProgress2Response":{"properties":{"complete":{"type":"boolean"},"encoded_root_token":{"type":"string"},"encoded_token":{"type":"string"},"nonce":{"type":"string"},"otp":{"type":"string"},"otp_length":{"type":"integer"},"pgp_fingerprint":{"type":"string"},"progress":{"type":"integer"},"required":{"type":"integer"},"started":{"type":"boolean"}},"type":"object"},"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## Initialize a new root token generation attempt.
> Starts a new root generation attempt. Only one attempt can be active at a time. Either \`otp\` or \`pgp\_key\` must be provided.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/generate-root":{"post":{"operationId":"root-token-generation-initialize-2","summary":"Initialize a new root token generation attempt.","description":"Starts a new root generation attempt. Only one attempt can be active at a time. Either `otp` or `pgp_key` must be provided.\n","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RootTokenGenerationInitialize2Request"}}}},"responses":{"200":{"description":"Successfully initialized the root generation attempt.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RootTokenGenerationInitialize2Response"}}}},"400":{"description":"Bad Request - Missing required parameters or invalid input.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"401":{"description":"Unauthorized - Authentication credentials are missing or invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"403":{"description":"Forbidden - Insufficient permissions to initialize root generation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"409":{"description":"Conflict - A root generation attempt is already in progress.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal Server Error - Unexpected server-side error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"RootTokenGenerationInitialize2Request":{"properties":{"pgp_key":{"description":"Specifies a base64-encoded PGP public key.","type":"string"}},"type":"object"},"RootTokenGenerationInitialize2Response":{"properties":{"complete":{"type":"boolean"},"encoded_root_token":{"type":"string"},"encoded_token":{"type":"string"},"nonce":{"type":"string"},"otp":{"type":"string"},"otp_length":{"type":"integer"},"pgp_fingerprint":{"type":"string"},"progress":{"type":"integer"},"required":{"type":"integer"},"started":{"type":"boolean"}},"type":"object"},"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## Cancel an ongoing root token generation attempt.
> Cancels any in-progress root token generation attempt, allowing a new attempt to be started.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/generate-root":{"delete":{"operationId":"root-token-generation-cancel-2","summary":"Cancel an ongoing root token generation attempt.","description":"Cancels any in-progress root token generation attempt, allowing a new attempt to be started.\n","responses":{"204":{"description":"Successfully canceled the root generation attempt."},"400":{"description":"Bad Request - The request is malformed or invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"401":{"description":"Unauthorized - Authentication credentials are missing or invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"403":{"description":"Forbidden - Insufficient permissions to cancel the root generation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal Server Error - Unexpected server-side error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## Read the progress of the current root generation attempt.
> Returns configuration and current progress details for an active root token generation attempt.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/generate-root/attempt":{"get":{"operationId":"root-token-generation-read-progress","summary":"Read the progress of the current root generation attempt.","description":"Returns configuration and current progress details for an active root token generation attempt.\n","responses":{"200":{"description":"Successfully retrieved root generation progress.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RootTokenGenerationReadProgressResponse"}}}},"400":{"description":"Bad Request - The request is malformed or invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"401":{"description":"Unauthorized - Missing or invalid authentication credentials.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"403":{"description":"Forbidden - You do not have permission to read the root generation progress.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"404":{"description":"Not Found - No active root generation attempt found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal Server Error - An unexpected server-side error occurred.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"RootTokenGenerationReadProgressResponse":{"properties":{"complete":{"type":"boolean"},"encoded_root_token":{"type":"string"},"encoded_token":{"type":"string"},"nonce":{"type":"string"},"otp":{"type":"string"},"otp_length":{"type":"integer"},"pgp_fingerprint":{"type":"string"},"progress":{"type":"integer"},"required":{"type":"integer"},"started":{"type":"boolean"}},"type":"object"},"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## Initialize a new root token generation attempt.
> Starts a new root generation attempt. Only one attempt can be active at a time. Either \`otp\` or \`pgp\_key\` must be provided.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/generate-root/attempt":{"post":{"operationId":"root-token-generation-initialize","summary":"Initialize a new root token generation attempt.","description":"Starts a new root generation attempt. Only one attempt can be active at a time. Either `otp` or `pgp_key` must be provided.\n","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RootTokenGenerationInitializeRequest"}}}},"responses":{"200":{"description":"Successfully initialized the root generation attempt.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RootTokenGenerationInitializeResponse"}}}},"400":{"description":"Bad Request - Missing required parameters or invalid input.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"401":{"description":"Unauthorized - Missing or invalid authentication credentials.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"403":{"description":"Forbidden - You do not have permission to initiate root generation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"409":{"description":"Conflict - A root generation attempt is already in progress.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal Server Error - An unexpected server-side error occurred.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"RootTokenGenerationInitializeRequest":{"properties":{"pgp_key":{"description":"Specifies a base64-encoded PGP public key.","type":"string"}},"type":"object"},"RootTokenGenerationInitializeResponse":{"properties":{"complete":{"type":"boolean"},"encoded_root_token":{"type":"string"},"encoded_token":{"type":"string"},"nonce":{"type":"string"},"otp":{"type":"string"},"otp_length":{"type":"integer"},"pgp_fingerprint":{"type":"string"},"progress":{"type":"integer"},"required":{"type":"integer"},"started":{"type":"boolean"}},"type":"object"},"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## Cancel an ongoing root token generation attempt.
> Cancels any in-progress root token generation attempt to allow a new one to begin.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/generate-root/attempt":{"delete":{"operationId":"root-token-generation-cancel","summary":"Cancel an ongoing root token generation attempt.","description":"Cancels any in-progress root token generation attempt to allow a new one to begin.\n","responses":{"204":{"description":"Successfully canceled the root generation attempt."},"400":{"description":"Bad Request - The request is malformed or invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"401":{"description":"Unauthorized - Missing or invalid authentication credentials.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"403":{"description":"Forbidden - You do not have permission to cancel the root generation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal Server Error - An unexpected server-side error occurred.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## Submit a key share to progress the root token generation attempt.
> Submits a single unseal key share for the active root generation attempt. If the required threshold of key shares is reached, Vault completes the root token generation and issues the new token. The attempt nonce must be provided with each call.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/generate-root/update":{"post":{"operationId":"root-token-generation-update","summary":"Submit a key share to progress the root token generation attempt.","description":"Submits a single unseal key share for the active root generation attempt. If the required threshold of key shares is reached, Vault completes the root token generation and issues the new token. The attempt nonce must be provided with each call.\n","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RootTokenGenerationUpdateRequest"}}}},"responses":{"200":{"description":"Successfully submitted the key share. Progress updated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RootTokenGenerationUpdateResponse"}}}},"400":{"description":"Bad Request - The request is malformed or missing required parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"401":{"description":"Unauthorized - Missing or invalid authentication credentials.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"403":{"description":"Forbidden - You do not have permission to submit key shares.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"404":{"description":"Not Found - No active root generation attempt was found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"409":{"description":"Conflict - The root generation attempt is already completed or invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal Server Error - A server-side error occurred.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"RootTokenGenerationUpdateRequest":{"properties":{"key":{"description":"Specifies a single unseal key share.","type":"string"},"nonce":{"description":"Specifies the nonce of the attempt.","type":"string"}},"type":"object"},"RootTokenGenerationUpdateResponse":{"properties":{"complete":{"type":"boolean"},"encoded_root_token":{"type":"string"},"encoded_token":{"type":"string"},"nonce":{"type":"string"},"otp":{"type":"string"},"otp_length":{"type":"integer"},"pgp_fingerprint":{"type":"string"},"progress":{"type":"integer"},"required":{"type":"integer"},"started":{"type":"boolean"}},"type":"object"},"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## Retrieve the HA status of a Vault cluster.
> Retrieves detailed information regarding the HA cluster setup, including whether the node is active, standby, and information about the leader.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/ha-status":{"get":{"operationId":"ha-status","summary":"Retrieve the HA status of a Vault cluster.","description":"Retrieves detailed information regarding the HA cluster setup, including whether the node is active, standby, and information about the leader.\n","parameters":[],"responses":{"200":{"description":"Successfully retrieved the HA status.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HaStatusResponse"}}}},"500":{"description":"Internal Server Error - Failed to retrieve HA status due to server-side issues.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"HaStatusResponse":{"properties":{"nodes":{"items":{"type":"object"},"type":"array"}},"type":"object"},"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## Retrieve the health status of the Vault server.
> Returns different HTTP status codes depending on Vault's current state: - 200: Vault is initialized, unsealed, and active. - 429: Vault is unsealed and in standby mode. - 472: Vault is in data recovery mode, acting as replication secondary and active. - 501: Vault is not initialized. - 503: Vault is sealed and unavailable.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/health":{"get":{"operationId":"read-health-status","summary":"Retrieve the health status of the Vault server.","description":"Returns different HTTP status codes depending on Vault's current state: - 200: Vault is initialized, unsealed, and active. - 429: Vault is unsealed and in standby mode. - 472: Vault is in data recovery mode, acting as replication secondary and active. - 501: Vault is not initialized. - 503: Vault is sealed and unavailable.\n","parameters":[],"responses":{"200":{"description":"Initialized, unsealed, and active."},"400":{"description":"Bad Request - Invalid request parameters or format.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"401":{"description":"Unauthorized - Missing or invalid authentication credentials.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"429":{"description":"Unsealed and standby."},"472":{"description":"Data recovery mode replication secondary and active."},"500":{"description":"Internal Server Error - An unexpected error occurred.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"501":{"description":"Not initialized."},"503":{"description":"Sealed."}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## Retrieve host instance information for the Vault server.
> Collects and returns host-level system information including hardware details, CPU utilization, disk usage, and memory statistics. Useful for monitoring the resource consumption of the Vault instance.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/host-info":{"get":{"operationId":"collect-host-information","summary":"Retrieve host instance information for the Vault server.","description":"Collects and returns host-level system information including hardware details, CPU utilization, disk usage, and memory statistics. Useful for monitoring the resource consumption of the Vault instance.\n","responses":{"200":{"description":"Successfully retrieved host information.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CollectHostInformationResponse"}}}},"400":{"description":"Bad Request - Malformed request or invalid parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"401":{"description":"Unauthorized - Authentication credentials missing or invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal Server Error - Failed to retrieve host information.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"CollectHostInformationResponse":{"properties":{"cpu":{"items":{"type":"object"},"type":"array"},"cpu_times":{"items":{"type":"object"},"type":"array"},"disk":{"items":{"type":"object"},"type":"array"},"host":{"format":"map","type":"object"},"memory":{"format":"map","type":"object"},"timestamp":{"format":"date-time","type":"string"}},"type":"object"},"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## List in-flight requests being processed by Vault.
> Returns a map of ongoing API requests ("in-flight requests") to assist with debugging and load monitoring. Each entry provides information such as client details, request path, and duration.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/in-flight-req":{"get":{"operationId":"collect-in-flight-request-information","summary":"List in-flight requests being processed by Vault.","description":"Returns a map of ongoing API requests (\"in-flight requests\") to assist with debugging and load monitoring. Each entry provides information such as client details, request path, and duration.\n","responses":{"200":{"description":"Successfully retrieved in-flight request information.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InFlightRequestInformationResponse"}}}},"400":{"description":"Bad Request - Malformed request or invalid parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"401":{"description":"Unauthorized - Authentication credentials missing or invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal Server Error - Failed to retrieve in-flight request information.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## Returns the initialization status of Vault.
> Checks whether Vault has already been initialized. This endpoint returns the initialization status without making any modifications to the Vault state.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/init":{"get":{"operationId":"read-initialization-status","summary":"Returns the initialization status of Vault.","description":"Checks whether Vault has already been initialized. This endpoint returns the initialization status without making any modifications to the Vault state.\n","responses":{"200":{"description":"Successfully retrieved initialization status.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InitializationStatusResponse"}}}},"400":{"description":"Bad Request - Malformed request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal Server Error - Failed to retrieve initialization status.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## Initialize a new Vault.
> Initializes the Vault server. Initialization is a one-time operation. After successful initialization, Vault will generate a set of unseal keys and an initial root token. If using HSM, recovery and stored shares options can be configured during this process.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/init":{"post":{"operationId":"initialize","summary":"Initialize a new Vault.","description":"Initializes the Vault server. Initialization is a one-time operation. After successful initialization, Vault will generate a set of unseal keys and an initial root token. If using HSM, recovery and stored shares options can be configured during this process.\n","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/InitializeRequest"}}}},"required":true,"responses":{"200":{"description":"Successfully initialized Vault.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InitializeResponse"}}}},"400":{"description":"Bad Request - Vault is already initialized or request parameters are invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"409":{"description":"Conflict - Vault is already initialized.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal Server Error - Failed to initialize Vault.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"InitializeRequest":{"properties":{"pgp_keys":{"description":"Specifies an array of PGP public keys used to encrypt the output unseal keys. Ordering is preserved. The keys must be base64-encoded from their original binary representation. The size of this array must be the same as `secret_shares`.","items":{"type":"string"},"type":"array"},"recovery_pgp_keys":{"description":"Specifies an array of PGP public keys used to encrypt the output recovery keys. Ordering is preserved. The keys must be base64-encoded from their original binary representation. The size of this array must be the same as `recovery_shares`.","items":{"type":"string"},"type":"array"},"recovery_shares":{"description":"Specifies the number of shares to split the recovery key into.","type":"integer"},"recovery_threshold":{"description":"Specifies the number of shares required to reconstruct the recovery key. This must be less than or equal to `recovery_shares`.","type":"integer"},"root_token_pgp_key":{"description":"Specifies a PGP public key used to encrypt the initial root token. The key must be base64-encoded from its original binary representation.","type":"string"},"secret_shares":{"description":"Specifies the number of shares to split the unseal key into.","type":"integer"},"secret_threshold":{"description":"Specifies the number of shares required to reconstruct the unseal key. This must be less than or equal secret_shares. If using Vault HSM with auto-unsealing, this value must be the same as `secret_shares`.","type":"integer"},"stored_shares":{"description":"Specifies the number of shares that should be encrypted by the HSM and stored for auto-unsealing. Currently must be the same as `secret_shares`.","type":"integer"}},"type":"object"},"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## Report the historical client count metrics.
> Retrieves historical counts of unique clients that interacted with Vault, covering the current namespace and all child namespaces.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/internal/counters/activity":{"get":{"operationId":"internal-client-activity-report-counts","summary":"Report the historical client count metrics.","description":"Retrieves historical counts of unique clients that interacted with Vault, covering the current namespace and all child namespaces.\n","responses":{"200":{"description":"Successfully retrieved client activity counts.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ClientActivityCountsResponse"}}}},"400":{"description":"Bad Request - Malformed request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal Server Error - Failed to retrieve counts.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## Export the historical client count data.
> Exports detailed raw historical client activity data for analysis and reporting outside of Vault.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/internal/counters/activity/export":{"get":{"operationId":"internal-client-activity-export","summary":"Export the historical client count data.","description":"Exports detailed raw historical client activity data for analysis and reporting outside of Vault.\n","responses":{"200":{"description":"Successfully exported client activity data.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ClientActivityExportResponse"}}}},"400":{"description":"Bad Request - Malformed request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal Server Error - Failed to export activity data.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## Report the client count for the current month.
> Returns the number of unique clients that have interacted with Vault during the current month for this namespace and all child namespaces.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/internal/counters/activity/monthly":{"get":{"operationId":"internal-client-activity-report-counts-this-month","summary":"Report the client count for the current month.","description":"Returns the number of unique clients that have interacted with Vault during the current month for this namespace and all child namespaces.\n","responses":{"200":{"description":"Successfully retrieved monthly client counts.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ClientActivityMonthlyResponse"}}}},"400":{"description":"Bad Request - Malformed request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal Server Error - Failed to retrieve monthly counts.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## Read the client count tracking configuration.
> Returns the current configuration settings for client count collection, including status, retention period, and default reporting period.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/internal/counters/config":{"get":{"operationId":"internal-client-activity-read-configuration","summary":"Read the client count tracking configuration.","description":"Returns the current configuration settings for client count collection, including status, retention period, and default reporting period.\n","responses":{"200":{"description":"Successfully retrieved client count configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InternalClientActivityConfigResponse"}}}},"400":{"description":"Bad Request - Malformed request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal Server Error - Failed to retrieve configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## Configure the client count collection settings.
> Enables or disables the collection of client counts and configures the retention period and default reporting period for client activity data.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/internal/counters/config":{"post":{"operationId":"internal-client-activity-configure","summary":"Configure the client count collection settings.","description":"Enables or disables the collection of client counts and configures the retention period and default reporting period for client activity data.\n","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/InternalClientActivityConfigureRequest"}}}},"responses":{"200":{"description":"Successfully updated client count tracking configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InternalClientActivityConfigUpdateResponse"}}}},"400":{"description":"Bad Request - Invalid configuration settings provided.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal Server Error - Failed to update configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"InternalClientActivityConfigureRequest":{"properties":{"default_report_months":{"default":12,"description":"Number of months to report if no start date specified.","type":"integer"},"enabled":{"default":"default","description":"Enable or disable collection of client count: enable, disable, or default.","type":"string"},"retention_months":{"default":24,"description":"Number of months of client data to retain. Setting to 0 will clear all existing data.","type":"integer"}},"type":"object"},"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## Report the number of active identity entities in the Vault cluster.
> Retrieves the current number of active identity entities managed by the Vault server. \*\*Note:\*\* Backward compatibility is not guaranteed for this endpoint.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/internal/counters/entities":{"get":{"operationId":"internal-count-entities","summary":"Report the number of active identity entities in the Vault cluster.","description":"Retrieves the current number of active identity entities managed by the Vault server. **Note:** Backward compatibility is not guaranteed for this endpoint.\n","responses":{"200":{"description":"Successfully retrieved entity count.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InternalCountEntitiesResponse"}}}},"400":{"description":"Bad Request - Malformed or invalid request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal Server Error - Failed to retrieve entity count.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"InternalCountEntitiesResponse":{"properties":{"counters":{"format":"map","type":"object"}},"type":"object"},"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## Deprecated - Count of requests seen by the Vault cluster.
> This endpoint is currently unsupported and deprecated. Previously, it provided a count of requests handled by the Vault cluster. \*\*Note:\*\* Backward compatibility is not guaranteed.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/internal/counters/requests":{"get":{"operationId":"internal-count-requests","summary":"Deprecated - Count of requests seen by the Vault cluster.","description":"This endpoint is currently unsupported and deprecated. Previously, it provided a count of requests handled by the Vault cluster. **Note:** Backward compatibility is not guaranteed.\n","deprecated":true,"responses":{"200":{"description":"Deprecated API call successful (no useful output)."},"400":{"description":"Bad Request - Invalid call to deprecated API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal Server Error - Deprecated API failure.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## Report the number of active tokens in the Vault cluster.
> Retrieves the current number of active authentication tokens managed by Vault. \*\*Note:\*\* Backward compatibility is not guaranteed for this endpoint.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/internal/counters/tokens":{"get":{"operationId":"internal-count-tokens","summary":"Report the number of active tokens in the Vault cluster.","description":"Retrieves the current number of active authentication tokens managed by Vault. **Note:** Backward compatibility is not guaranteed for this endpoint.\n","responses":{"200":{"description":"Successfully retrieved token count.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InternalCountTokensResponse"}}}},"400":{"description":"Bad Request - Malformed or invalid request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal Server Error - Failed to retrieve token count.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"InternalCountTokensResponse":{"properties":{"counters":{"format":"map","type":"object"}},"type":"object"},"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## Exposes the route entry and mount entry tables present in the router.
> Retrieves the entries in the router for the specified subtree (uuid, accessor, storage, root). The \`tag\` path parameter must be one of the inspectable subtrees. This endpoint provides information about the structure and entries in the router trees.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/internal/inspect/router/{tag}":{"get":{"operationId":"internal-inspect-router","summary":"Exposes the route entry and mount entry tables present in the router.","description":"Retrieves the entries in the router for the specified subtree (uuid, accessor, storage, root). The `tag` path parameter must be one of the inspectable subtrees. This endpoint provides information about the structure and entries in the router trees.\n","parameters":[{"name":"tag","in":"path","description":"Name of the subtree being observed (e.g., uuid, accessor, storage, root).","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Successfully retrieved the entries in the router for the specified tag.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InternalInspectRouterResponse"}}}},"400":{"description":"Bad Request - Invalid or malformed tag or missing required parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"404":{"description":"Not Found - The specified tag does not exist in the router.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal Server Error - Failed to retrieve router entries.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## GET /sys/internal/specs/openapi
> Generate OpenAPI document for mounted paths
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/internal/specs/openapi":{"get":{"summary":"Generate OpenAPI document for mounted paths","operationId":"internal-generate-open-api-document","parameters":[{"name":"generic_mount_paths","in":"query","description":"Use generic mount paths","schema":{"type":"boolean","default":false}}],"responses":{"200":{"description":"Successfully generated OpenAPI document","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OpenAPIDocument"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## POST /sys/internal/specs/openapi
> Generate OpenAPI document with request parameters
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/internal/specs/openapi":{"post":{"summary":"Generate OpenAPI document with request parameters","operationId":"internal-generate-open-api-document-with-parameters","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/InternalGenerateOpenApiDocumentWithParametersRequest"}}}},"responses":{"200":{"description":"Successfully generated OpenAPI document","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OpenAPIDocument"}}}},"400":{"description":"Invalid request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"InternalGenerateOpenApiDocumentWithParametersRequest":{"properties":{"context":{"description":"Context string appended to every operationId","type":"string"}},"type":"object"},"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## GET /sys/internal/ui/feature-flags
> Lists enabled feature flags
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/internal/ui/feature-flags":{"get":{"summary":"Lists enabled feature flags","operationId":"internal-ui-list-enabled-feature-flags","responses":{"200":{"description":"Successfully listed enabled feature flags","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InternalUiListEnabledFeatureFlagsResponse"}}}},"400":{"description":"Invalid request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"InternalUiListEnabledFeatureFlagsResponse":{"properties":{"feature_flags":{"items":{"type":"string"},"type":"array"}},"type":"object"},"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## GET /sys/internal/ui/mounts
> Lists all enabled and visible auth and secrets mounts
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/internal/ui/mounts":{"get":{"summary":"Lists all enabled and visible auth and secrets mounts","operationId":"internal-ui-list-enabled-visible-mounts","responses":{"200":{"description":"Successfully listed visible mounts","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InternalUiListEnabledVisibleMountsResponse"}}}},"400":{"description":"Invalid request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"InternalUiListEnabledVisibleMountsResponse":{"properties":{"auth":{"description":"auth mounts","format":"map","type":"object"},"secret":{"description":"secret mounts","format":"map","type":"object"}},"type":"object"},"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## GET /sys/internal/ui/namespaces
> Lists visible child namespaces
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/internal/ui/namespaces":{"get":{"summary":"Lists visible child namespaces","operationId":"internal-ui-list-namespaces","responses":{"200":{"description":"Successfully listed namespaces","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InternalUiListNamespacesResponse"}}}},"400":{"description":"Invalid request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"InternalUiListNamespacesResponse":{"properties":{"keys":{"description":"field is only returned if there are one or more namespaces","items":{"type":"string"},"type":"array"}},"type":"object"},"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## GET /sys/internal/ui/resultant-acl
> Returns the resultant ACL for a client token
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/internal/ui/resultant-acl":{"get":{"summary":"Returns the resultant ACL for a client token","operationId":"internal-ui-read-resultant-acl","responses":{"200":{"description":"Successfully returned ACL policy","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InternalUiReadResultantAclResponse"}}}},"204":{"description":"No client token present; empty response"},"400":{"description":"Invalid request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"InternalUiReadResultantAclResponse":{"properties":{"exact_paths":{"format":"map","type":"object"},"glob_paths":{"format":"map","type":"object"},"root":{"type":"boolean"}},"type":"object"},"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## GET /sys/key-status
> Reports backend encryption key status
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/key-status":{"get":{"summary":"Reports backend encryption key status","operationId":"encryption-key-status","responses":{"200":{"description":"Successfully retrieved key status","content":{"application/json":{"schema":{"$ref":"#/components/schemas/KeyStatusResponse"}}}},"400":{"description":"Invalid request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## GET /sys/leader
> Returns HA status and the current leader of Vault
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/leader":{"get":{"summary":"Returns HA status and the current leader of Vault","operationId":"leader-status","responses":{"200":{"description":"Successfully returned leader status","content":{"application/json":{"schema":{"$ref":"#/components/schemas/LeaderStatusResponse"}}}},"400":{"description":"Invalid request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"LeaderStatusResponse":{"properties":{"active_time":{"format":"date-time","type":"string"},"ha_enabled":{"type":"boolean"},"is_self":{"type":"boolean"},"last_wal":{"format":"int64","type":"integer"},"leader_address":{"type":"string"},"leader_cluster_address":{"type":"string"},"performance_standby":{"type":"boolean"},"performance_standby_last_remote_wal":{"format":"int64","type":"integer"},"raft_applied_index":{"format":"int64","type":"integer"},"raft_committed_index":{"format":"int64","type":"integer"}},"type":"object"},"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## GET /sys/leases
> Lists active leases
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/leases":{"get":{"summary":"Lists active leases","operationId":"leases-list","responses":{"200":{"description":"Successfully listed leases","content":{"application/json":{"schema":{"$ref":"#/components/schemas/LeasesListResponse"}}}},"400":{"description":"Invalid request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"LeasesListResponse":{"properties":{"counts":{"description":"Number of matching leases per mount","type":"integer"},"lease_count":{"description":"Number of matching leases","type":"integer"}},"type":"object"},"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## GET /sys/leases/count
> Returns the count of active leases
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/leases/count":{"get":{"summary":"Returns the count of active leases","operationId":"leases-count","responses":{"200":{"description":"Successfully retrieved lease count","content":{"application/json":{"schema":{"$ref":"#/components/schemas/LeasesCountResponse"}}}},"400":{"description":"Invalid request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"LeasesCountResponse":{"properties":{"counts":{"description":"Number of matching leases per mount","type":"integer"},"lease_count":{"description":"Number of matching leases","type":"integer"}},"type":"object"},"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## POST /sys/leases/lookup
> Retrieves metadata for a specific lease
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/leases/lookup":{"post":{"summary":"Retrieves metadata for a specific lease","operationId":"leases-read-lease","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/LeasesReadLeaseRequest"}}}},"responses":{"200":{"description":"Successfully retrieved lease metadata","content":{"application/json":{"schema":{"$ref":"#/components/schemas/LeasesReadLeaseResponse"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"404":{"description":"Lease not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"LeasesReadLeaseRequest":{"properties":{"lease_id":{"description":"The lease identifier to renew. This is included with a lease.","type":"string"}},"type":"object"},"LeasesReadLeaseResponse":{"properties":{"expire_time":{"description":"Optional lease expiry time","format":"date-time","type":"string"},"id":{"description":"Lease id","type":"string"},"issue_time":{"description":"Timestamp for the lease's issue time","format":"date-time","type":"string"},"last_renewal":{"description":"Optional Timestamp of the last time the lease was renewed","format":"date-time","type":"string"},"renewable":{"description":"True if the lease is able to be renewed","type":"boolean"},"ttl":{"description":"Time to Live set for the lease, returns 0 if unset","type":"integer"}},"type":"object"},"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## GET /sys/leases/lookup/
> Lists all lease paths
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/leases/lookup/":{"get":{"summary":"Lists all lease paths","operationId":"leases-look-up","parameters":[{"name":"list","in":"query","required":true,"schema":{"type":"string","enum":["true"]},"description":"Must be set to `'true'` to trigger a list response."}],"responses":{"200":{"description":"Successfully listed lease paths","content":{"application/json":{"schema":{"$ref":"#/components/schemas/LeasesLookUpResponse"}}}},"400":{"description":"Invalid query parameter","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"LeasesLookUpResponse":{"properties":{"keys":{"description":"A list of lease ids","items":{"type":"string"},"type":"array"}},"type":"object"},"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## GET /sys/leases/lookup/{prefix}
> Lists leases under the specified prefix
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/leases/lookup/{prefix}":{"get":{"summary":"Lists leases under the specified prefix","operationId":"leases-look-up-with-prefix","parameters":[{"name":"prefix","in":"path","required":true,"schema":{"type":"string"},"description":"The path to list leases under. Example: \"aws/creds/deploy\""},{"name":"list","in":"query","required":true,"schema":{"type":"string","enum":["true"]},"description":"Must be set to `'true'`"}],"responses":{"200":{"description":"Successfully listed leases for the prefix","content":{"application/json":{"schema":{"$ref":"#/components/schemas/LeasesLookUpWithPrefixResponse"}}}},"400":{"description":"Invalid input","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"404":{"description":"Prefix not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"LeasesLookUpWithPrefixResponse":{"properties":{"keys":{"description":"A list of lease ids","items":{"type":"string"},"type":"array"}},"type":"object"},"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## POST /sys/leases/renew
> Renews a lease by extending its TTL.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/leases/renew":{"post":{"summary":"Renews a lease by extending its TTL.","operationId":"leases-renew-lease","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/LeasesRenewLeaseRequest"}}}},"responses":{"204":{"description":"Lease renewed successfully (no content)"},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"404":{"description":"Lease not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"LeasesRenewLeaseRequest":{"properties":{"increment":{"description":"The desired increment in seconds to the lease","format":"seconds","type":"integer"},"lease_id":{"description":"The lease identifier to renew. This is included with a lease.","type":"string"},"url_lease_id":{"description":"The lease identifier to renew. This is included with a lease.","type":"string"}},"type":"object"},"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## POST /sys/leases/renew/{url\_lease\_id}
> Renews a lease using a lease ID in the path.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/leases/renew/{url_lease_id}":{"post":{"summary":"Renews a lease using a lease ID in the path.","operationId":"leases-renew-lease-with-id","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/LeasesRenewLeaseWithIdRequest"}}}},"responses":{"204":{"description":"Lease renewed successfully (no content)"},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"404":{"description":"Lease not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"LeasesRenewLeaseWithIdRequest":{"properties":{"increment":{"description":"The desired increment in seconds to the lease","format":"seconds","type":"integer"},"lease_id":{"description":"The lease identifier to renew. This is included with a lease.","type":"string"}},"type":"object"},"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## POST /sys/leases/revoke
> Immediately revokes a lease.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/leases/revoke":{"post":{"summary":"Immediately revokes a lease.","operationId":"leases-revoke-lease","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/LeasesRevokeLeaseRequest"}}}},"responses":{"204":{"description":"Lease revoked successfully (no content)"},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"404":{"description":"Lease not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"LeasesRevokeLeaseRequest":{"properties":{"lease_id":{"description":"The lease identifier to renew. This is included with a lease.","type":"string"},"sync":{"default":true,"description":"Whether or not to perform the revocation synchronously","type":"boolean"},"url_lease_id":{"description":"The lease identifier to renew. This is included with a lease.","type":"string"}},"type":"object"},"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## Revokes all secrets or tokens generated under a given prefix immediately
> Unlike \`/sys/leases/revoke-prefix\`, this path ignores backend errors encountered during revocation. This is potentially very dangerous and should only be used in specific emergency situations where errors in the backend or the connected backend service prevent normal revocation.\
> \
> By ignoring these errors, Vault abdicates responsibility for ensuring that the issued credentials or secrets are properly revoked and/or cleaned up. Access to this endpoint should be tightly controlled.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/leases/revoke-force/{prefix}":{"post":{"description":"Unlike `/sys/leases/revoke-prefix`, this path ignores backend errors encountered during revocation. This is potentially very dangerous and should only be used in specific emergency situations where errors in the backend or the connected backend service prevent normal revocation.\n\nBy ignoring these errors, Vault abdicates responsibility for ensuring that the issued credentials or secrets are properly revoked and/or cleaned up. Access to this endpoint should be tightly controlled.","operationId":"leases-force-revoke-lease-with-prefix","responses":{"204":{"description":"OK"}},"summary":"Revokes all secrets or tokens generated under a given prefix immediately","tags":["system"]}}}}
```
## POST /sys/leases/revoke-prefix/{prefix}
> Revokes all secrets (via a lease ID prefix) or tokens (via the tokens' path property) generated under a given prefix immediately.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/leases/revoke-prefix/{prefix}":{"post":{"operationId":"leases-revoke-lease-with-prefix","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/LeasesRevokeLeaseWithPrefixRequest"}}},"required":true},"responses":{"204":{"description":"OK"}},"summary":"Revokes all secrets (via a lease ID prefix) or tokens (via the tokens' path property) generated under a given prefix immediately.","tags":["system"]}}},"components":{"schemas":{"LeasesRevokeLeaseWithPrefixRequest":{"properties":{"sync":{"default":true,"description":"Whether or not to perform the revocation synchronously","type":"boolean"}},"type":"object"}}}}
```
## POST /sys/leases/revoke/{url\_lease\_id}
> Revokes a lease immediately.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/leases/revoke/{url_lease_id}":{"post":{"operationId":"leases-revoke-lease-with-id","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/LeasesRevokeLeaseWithIdRequest"}}},"required":true},"responses":{"204":{"description":"OK"}},"summary":"Revokes a lease immediately.","tags":["system"]}}},"components":{"schemas":{"LeasesRevokeLeaseWithIdRequest":{"properties":{"lease_id":{"description":"The lease identifier to renew. This is included with a lease.","type":"string"},"sync":{"default":true,"description":"Whether or not to perform the revocation synchronously","type":"boolean"}},"type":"object"}}}}
```
## POST /sys/leases/tidy
> Trigger a background lease tidy operation.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/leases/tidy":{"post":{"summary":"Trigger a background lease tidy operation.","operationId":"leases-tidy","requestBody":{"description":"Optional parameters to influence lease tidy behavior.","required":false,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/LeaseTidyRequest"}}}},"responses":{"204":{"description":"Lease tidy completed successfully; no content returned."},"400":{"description":"Invalid input or parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error during lease tidy.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## GET /sys/license/status
> Retrieve the status of the currently installed license.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/license/status":{"get":{"summary":"Retrieve the status of the currently installed license.","operationId":"system-read-license-status","responses":{"200":{"description":"Successfully retrieved license status.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/LicenseStatus"}}}},"500":{"description":"Error retrieving license status.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## GET /sys/locked-users
> List the locked user count metrics for the current namespace and all child namespaces.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/locked-users":{"get":{"summary":"List the locked user count metrics for the current namespace and all child namespaces.","operationId":"locked-users-list","responses":{"200":{"description":"Successfully retrieved locked user metrics.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/LockedUsersMetrics"}}}},"500":{"description":"Failed to retrieve locked user metrics.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## POST /sys/locked-users/{mount\_accessor}/unlock/{alias\_identifier}
> Unlock a locked user by mount accessor and alias identifier.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/locked-users/{mount_accessor}/unlock/{alias_identifier}":{"post":{"summary":"Unlock a locked user by mount accessor and alias identifier.","operationId":"locked-users-unlock","parameters":[{"in":"path","name":"alias_identifier","required":true,"description":"Identifier of the alias (e.g., username or RoleID).","schema":{"type":"string"}},{"in":"path","name":"mount_accessor","required":true,"description":"Identifier of the mount entry associated with the user.","schema":{"type":"string"}}],"responses":{"200":{"description":"User successfully unlocked.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnlockUserResponse"}}}},"404":{"description":"User or mount not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## GET /sys/loggers
> Read the verbosity level for all existing loggers.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/loggers":{"get":{"operationId":"loggers-read-verbosity-level","summary":"Read the verbosity level for all existing loggers.","responses":{"200":{"description":"Current verbosity levels retrieved.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/LoggersVerbosityLevel"}}}},"500":{"description":"Internal error while reading logger settings.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## POST /sys/loggers
> Modify verbosity levels for all loggers.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/loggers":{"post":{"operationId":"loggers-update-verbosity-level","summary":"Modify verbosity levels for all loggers.","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/LoggersUpdateVerbosityLevelRequest"}}}},"responses":{"204":{"description":"Logger levels updated."},"400":{"description":"Invalid log level provided.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"LoggersUpdateVerbosityLevelRequest":{"properties":{"level":{"description":"Log verbosity level. Supported values (in order of detail) are \"trace\", \"debug\", \"info\", \"warn\", and \"error\".","type":"string"}},"type":"object"},"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## DELETE /sys/loggers
> Revert all loggers to the configured log level.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/loggers":{"delete":{"operationId":"loggers-revert-verbosity-level","summary":"Revert all loggers to the configured log level.","responses":{"204":{"description":"Log levels reverted."},"500":{"description":"Failed to revert logger settings.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## GET /sys/loggers/{name}
> Read verbosity level of a specific logger.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/loggers/{name}":{"get":{"operationId":"loggers-read-verbosity-level-for","summary":"Read verbosity level of a specific logger.","responses":{"200":{"description":"Logger verbosity level retrieved.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/LoggerVerbosityLevel"}}}},"404":{"description":"Logger not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## POST /sys/loggers/{name}
> Modify the log level of a specific logger.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/loggers/{name}":{"post":{"operationId":"loggers-update-verbosity-level-for","summary":"Modify the log level of a specific logger.","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/LoggersUpdateVerbosityLevelForRequest"}}}},"responses":{"204":{"description":"Logger level updated."},"400":{"description":"Invalid log level.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"LoggersUpdateVerbosityLevelForRequest":{"properties":{"level":{"description":"Log verbosity level. Supported values (in order of detail) are \"trace\", \"debug\", \"info\", \"warn\", and \"error\".","type":"string"}},"type":"object"},"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## DELETE /sys/loggers/{name}
> Revert a specific logger to the configured log level.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/loggers/{name}":{"delete":{"operationId":"loggers-revert-verbosity-level-for","summary":"Revert a specific logger to the configured log level.","responses":{"204":{"description":"Logger reverted."},"404":{"description":"Logger not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## GET /sys/managed-keys/{type}
> Manage lists of managed keys by type.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/managed-keys/{type}":{"get":{"summary":"Manage lists of managed keys by type.","operationId":"system-list-managed-keys-type","responses":{"200":{"description":"Managed keys listed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ManagedKeyList"}}}},"400":{"description":"Missing or incorrect query parameter.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## GET /sys/managed-keys/{type}/{name}
> Get a specific managed key by type and name.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/managed-keys/{type}/{name}":{"get":{"summary":"Get a specific managed key by type and name.","operationId":"system-read-managed-keys-type-name","responses":{"200":{"description":"Managed key details.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ManagedKey"}}}},"404":{"description":"Managed key not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## POST /sys/managed-keys/{type}/{name}
> Update a specific managed key by type and name.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/managed-keys/{type}/{name}":{"post":{"summary":"Update a specific managed key by type and name.","operationId":"system-write-managed-keys-type-name","responses":{"200":{"description":"Managed key written.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ManagedKey"}}}},"400":{"description":"Invalid input.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## DELETE /sys/managed-keys/{type}/{name}
> Delete a specific managed key by type and name.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/managed-keys/{type}/{name}":{"delete":{"summary":"Delete a specific managed key by type and name.","operationId":"system-delete-managed-keys-type-name","responses":{"204":{"description":"Managed key deleted."},"404":{"description":"Managed key not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## POST /sys/managed-keys/{type}/{name}/test/sign
> Test signing functionality for a managed key.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/managed-keys/{type}/{name}/test/sign":{"post":{"summary":"Test signing functionality for a managed key.","operationId":"system-write-managed-keys-type-name-test-sign","parameters":[{"in":"path","name":"type","required":true,"schema":{"type":"string"},"description":"The type of the managed key (e.g., \"transit\", \"pkcs11\")."},{"in":"path","name":"name","required":true,"schema":{"type":"string"},"description":"The name of the managed key to use for the test signing operation."}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/TestSignRequest"}}}},"responses":{"200":{"description":"Test signing successful.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TestSignResponse"}}}},"400":{"description":"Invalid input data for signing.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"404":{"description":"Managed key not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error during test sign.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## GET /sys/metrics
> Export system metrics in Prometheus format.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/metrics":{"get":{"summary":"Export system metrics in Prometheus format.","operationId":"metrics","parameters":[{"name":"format","in":"query","description":"The output format for the metrics. Currently, only `prometheus` is supported.\n","required":false,"schema":{"type":"string","enum":["prometheus"]}}],"requestBody":{"required":false,"content":{"application/json":{}}},"responses":{"200":{"description":"Metrics exported successfully.","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/PrometheusMetricsResponse"}}}},"400":{"description":"Bad request. The `format` parameter is invalid or missing.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error while exporting metrics.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## GET /sys/mfa/method
> List configured Multi-Factor Authentication (MFA) methods.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/mfa/method":{"get":{"summary":"List configured Multi-Factor Authentication (MFA) methods.","operationId":"system-list-mfa-method","parameters":[{"name":"list","in":"query","description":"A required parameter that must be set to `true` to retrieve the list of MFA methods.\n","required":true,"schema":{"type":"string","enum":["true"]}}],"requestBody":{"required":false,"content":{"application/json":{}}},"responses":{"200":{"description":"Successfully retrieved the list of configured MFA methods.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MfaMethodsListResponse"}}}},"400":{"description":"Bad request. The `list` parameter was missing or invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error while retrieving MFA methods.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## GET /sys/mfa/method/okta/{name}
> Read the configuration of a specific Okta MFA method.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/mfa/method/okta/{name}":{"get":{"operationId":"system-read-mfa-method-okta-name","summary":"Read the configuration of a specific Okta MFA method.","responses":{"200":{"description":"Successfully retrieved the Okta MFA configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MfaMethodOktaReadResponse"}}}},"400":{"description":"Invalid request syntax or parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"403":{"description":"Forbidden – insufficient access rights.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"404":{"description":"The specified MFA method was not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Unexpected internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## POST /sys/mfa/method/okta/{name}
> Create or update an Okta MFA method configuration.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/mfa/method/okta/{name}":{"post":{"operationId":"system-write-mfa-method-okta-name","summary":"Create or update an Okta MFA method configuration.","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MfaMethodOktaWriteRequest"}}}},"responses":{"200":{"description":"Successfully created or updated the Okta MFA method.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MfaMethodOktaWriteResponse"}}}},"400":{"description":"Bad request – invalid payload or missing fields.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"403":{"description":"Forbidden – access denied.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## DELETE /sys/mfa/method/okta/{name}
> Delete the specified Okta MFA method configuration.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/mfa/method/okta/{name}":{"delete":{"operationId":"system-delete-mfa-method-okta-name","summary":"Delete the specified Okta MFA method configuration.","responses":{"204":{"description":"The method was successfully deleted; no content returned."},"400":{"description":"Invalid request syntax or missing required fields.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"403":{"description":"Forbidden – client lacks necessary permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"404":{"description":"The requested MFA method was not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## GET /sys/mfa/method/pingid/{name}
> Retrieve a PingID MFA method configuration.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/mfa/method/pingid/{name}":{"get":{"operationId":"system-read-mfa-method-pingid-name","summary":"Retrieve a PingID MFA method configuration.","responses":{"200":{"description":"Successfully retrieved the PingID configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MfaMethodPingIDReadResponse"}}}},"400":{"description":"Invalid input.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"404":{"description":"Method not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## POST /sys/mfa/method/pingid/{name}
> Create or update a PingID MFA method configuration.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/mfa/method/pingid/{name}":{"post":{"operationId":"system-write-mfa-method-pingid-name","summary":"Create or update a PingID MFA method configuration.","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MfaMethodPingIDWriteRequest"}}}},"responses":{"200":{"description":"PingID method created or updated successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MfaMethodPingIDWriteResponse"}}}},"400":{"description":"Bad request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## DELETE /sys/mfa/method/pingid/{name}
> Delete a PingID MFA method configuration by name.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/mfa/method/pingid/{name}":{"delete":{"operationId":"system-delete-mfa-method-pingid-name","summary":"Delete a PingID MFA method configuration by name.","responses":{"204":{"description":"PingID method configuration deleted successfully. No content returned."},"400":{"description":"Invalid request or parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"403":{"description":"Forbidden. Client lacks necessary permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"404":{"description":"PingID method configuration not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## GET /sys/mfa/method/totp/{name}
> Read a TOTP MFA method configuration.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/mfa/method/totp/{name}":{"get":{"operationId":"system-read-mfa-method-totp-name","summary":"Read a TOTP MFA method configuration.","responses":{"200":{"description":"Successfully retrieved the TOTP method configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MfaMethodTOTPReadResponse"}}}},"400":{"description":"Invalid input or missing parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"404":{"description":"Method not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## POST /sys/mfa/method/totp/{name}
> Create or update a TOTP MFA method configuration.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/mfa/method/totp/{name}":{"post":{"operationId":"system-write-mfa-method-totp-name","summary":"Create or update a TOTP MFA method configuration.","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MfaMethodTOTPWriteRequest"}}}},"responses":{"200":{"description":"TOTP method created or updated successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MfaMethodTOTPWriteResponse"}}}},"400":{"description":"Bad request or validation error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## DELETE /sys/mfa/method/totp/{name}
> Delete a TOTP MFA method configuration by name.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/mfa/method/totp/{name}":{"delete":{"operationId":"system-delete-mfa-method-totp-name","summary":"Delete a TOTP MFA method configuration by name.","responses":{"204":{"description":"TOTP method deleted successfully. No content returned."},"400":{"description":"Bad request or invalid input.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"403":{"description":"Forbidden. Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"404":{"description":"The specified TOTP method configuration was not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## POST /sys/mfa/method/totp/{name}/admin-destroy
> Admin-level destroy operation for a TOTP MFA method configuration.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/mfa/method/totp/{name}/admin-destroy":{"post":{"operationId":"system-write-mfa-method-totp-name-admin-destroy","summary":"Admin-level destroy operation for a TOTP MFA method configuration.","responses":{"200":{"description":"The TOTP method was successfully destroyed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GenericSuccessResponse"}}}},"400":{"description":"Invalid request format or parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"403":{"description":"Forbidden. The user does not have the required permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"404":{"description":"The specified TOTP method configuration was not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## POST /sys/mfa/method/totp/{name}/admin-generate
> Admin-level operation to generate a new TOTP key for a user.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/mfa/method/totp/{name}/admin-generate":{"post":{"operationId":"system-write-mfa-method-totp-name-admin-generate","summary":"Admin-level operation to generate a new TOTP key for a user.","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AdminGenerateTotpRequest"}}}},"responses":{"200":{"description":"TOTP key successfully generated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AdminGenerateTotpResponse"}}}},"400":{"description":"Bad request. Invalid input data.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"403":{"description":"Forbidden. Insufficient permissions to perform this operation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"404":{"description":"The specified TOTP configuration was not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## GET /sys/mfa/method/totp/{name}/generate
> Generate a TOTP key and OTP URL for a specific TOTP MFA method configuration.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/mfa/method/totp/{name}/generate":{"get":{"operationId":"system-read-mfa-method-totp-name-generate","summary":"Generate a TOTP key and OTP URL for a specific TOTP MFA method configuration.","tags":["system"],"responses":{"200":{"description":"Successfully retrieved the TOTP key and OTP URL.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GenerateTotpResponse"}}}},"400":{"description":"Bad request — invalid request parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"403":{"description":"Forbidden — insufficient permissions to generate TOTP key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"404":{"description":"Not found — specified TOTP method does not exist.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error — unexpected error occurred.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## Validates the login for the given MFA methods.
> Validates MFA credentials submitted by the user. Upon successful validation, it returns an authentication response that includes a client token. This endpoint is typically called after initial credentials are provided and MFA is required.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/mfa/validate":{"post":{"operationId":"mfa-validate","summary":"Validates the login for the given MFA methods.","description":"Validates MFA credentials submitted by the user. Upon successful validation, it returns an authentication response that includes a client token. This endpoint is typically called after initial credentials are provided and MFA is required.\n","tags":["system"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MfaValidateRequest"}}}},"responses":{"200":{"description":"Successful MFA validation and authentication.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AuthResponse"}}}},"400":{"description":"Bad request — missing or invalid fields in the request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"403":{"description":"Forbidden — MFA validation failed or unauthorized access.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"404":{"description":"Not found — specified MFA method or user not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error — unexpected failure during validation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}},"components":{"schemas":{"MfaValidateRequest":{"properties":{"mfa_payload":{"description":"A map from MFA method ID to a slice of passcodes or an empty slice if the method does not use passcodes","format":"map","type":"object"},"mfa_request_id":{"description":"ID for this MFA request","type":"string"}},"required":["mfa_payload","mfa_request_id"],"type":"object"},"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## Retrieve system logs with specified log format and log level.
> Fetch system logs based on the selected output format and log level.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/monitor":{"get":{"operationId":"monitor","summary":"Retrieve system logs with specified log format and log level.","description":"Fetch system logs based on the selected output format and log level.","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"log_format":{"type":"string","enum":["standard","json"]},"log_level":{"type":"string","enum":["trace","debug","info","warn","error"]},"logs":{"type":"array","items":{"type":"string"}}}}}}}},"tags":["system"],"parameters":[{"description":"Output format of logs. Supported values are \"standard\" and \"json\". The default is \"standard\".","in":"query","name":"log_format","schema":{"type":"string","default":"standard","enum":["standard","json"]}},{"description":"Log level to view system logs at. Currently supported values are \"trace\", \"debug\", \"info\", \"warn\", \"error\".","in":"query","name":"log_level","schema":{"type":"string","enum":["trace","debug","info","warn","error"]}}]}}}}
```
## GET /sys/mounts
> Retrieve a list of currently mounted backends.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/mounts":{"get":{"operationId":"mounts-list-secrets-engines","summary":"Retrieve a list of currently mounted backends.","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"mounts":{"type":"array","items":{"type":"object","properties":{"path":{"type":"string"},"type":{"type":"string"},"description":{"type":"string"}}}}}}}}},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}},"tags":["system"]}}}}
```
## GET /sys/mounts/{path}
> Read the configuration of the secret engine at the given path.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/mounts/{path}":{"get":{"operationId":"mounts-read-configuration","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MountsReadConfigurationResponse"}}},"description":"OK"}},"summary":"Read the configuration of the secret engine at the given path.","tags":["system"]}}},"components":{"schemas":{"MountsReadConfigurationResponse":{"properties":{"accessor":{"type":"string"},"config":{"description":"Configuration for this mount, such as default_lease_ttl and max_lease_ttl.","format":"map","type":"object"},"deprecation_status":{"type":"string"},"description":{"description":"User-friendly description for this mount.","type":"string"},"external_entropy_access":{"type":"boolean"},"local":{"default":false,"description":"Mark the mount as a local mount, which is not replicated and is unaffected by replication.","type":"boolean"},"options":{"description":"The options to pass into the backend. Should be a json object with string keys and values.","format":"kvpairs","type":"object"},"plugin_version":{"description":"The semantic version of the plugin to use.","type":"string"},"running_plugin_version":{"type":"string"},"running_sha256":{"type":"string"},"seal_wrap":{"default":false,"description":"Whether to turn on seal wrapping for the mount.","type":"boolean"},"type":{"description":"The type of the backend. Example: \"passthrough\"","type":"string"},"uuid":{"type":"string"}},"type":"object"}}}}
```
## POST /sys/mounts/{path}
> Enable a new secrets engine at the given path.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/mounts/{path}":{"post":{"operationId":"mounts-enable-secrets-engine","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MountsEnableSecretsEngineRequest"}}},"required":true},"responses":{"204":{"description":"OK"}},"summary":"Enable a new secrets engine at the given path.","tags":["system"]}}},"components":{"schemas":{"MountsEnableSecretsEngineRequest":{"properties":{"config":{"description":"Configuration for this mount, such as default_lease_ttl and max_lease_ttl.","format":"map","type":"object"},"description":{"description":"User-friendly description for this mount.","type":"string"},"external_entropy_access":{"default":false,"description":"Whether to give the mount access to Vault's external entropy.","type":"boolean"},"local":{"default":false,"description":"Mark the mount as a local mount, which is not replicated and is unaffected by replication.","type":"boolean"},"options":{"description":"The options to pass into the backend. Should be a json object with string keys and values.","format":"kvpairs","type":"object"},"plugin_name":{"description":"Name of the plugin to mount based from the name registered in the plugin catalog.","type":"string"},"plugin_version":{"description":"The semantic version of the plugin to use.","type":"string"},"seal_wrap":{"default":false,"description":"Whether to turn on seal wrapping for the mount.","type":"boolean"},"type":{"description":"The type of the backend. Example: \"passthrough\"","type":"string"}},"type":"object"}}}}
```
## DELETE /sys/mounts/{path}
> Disable the mount point specified at the given path.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/mounts/{path}":{"delete":{"operationId":"mounts-disable-secrets-engine","responses":{"200":{"description":"OK"}},"summary":"Disable the mount point specified at the given path.","tags":["system"]}}}}
```
## GET /sys/mounts/{path}/tune
> Read the tuning configuration of a mounted backend.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/mounts/{path}/tune":{"get":{"operationId":"mounts-read-tuning-information","summary":"Read the tuning configuration of a mounted backend.","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"default_lease_ttl":{"type":"string"},"max_lease_ttl":{"type":"string"},"description":{"type":"string"},"audit_non_hmac_request_keys":{"type":"array","items":{"type":"string"}}}}}}},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}},"tags":["system"]}}}}
```
## POST /sys/mounts/{path}/tune
> Update the tuning configuration parameters for a mounted backend.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/mounts/{path}/tune":{"post":{"operationId":"mounts-tune-configuration-parameters","summary":"Update the tuning configuration parameters for a mounted backend.","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"default_lease_ttl":{"type":"string"},"max_lease_ttl":{"type":"string"},"description":{"type":"string"},"audit_non_hmac_request_keys":{"type":"array","items":{"type":"string"}}}}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"}}}}}},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}},"tags":["system"]}}}}
```
## GET /sys/namespaces/
> List namespaces
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/namespaces/":{"get":{"operationId":"system-list-namespaces","parameters":[{"description":"Must be set to `true`","in":"query","name":"list","required":true,"schema":{"enum":["true"],"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SystemListNamespacesResponse"}}},"description":"OK"}},"summary":"List namespaces","tags":["system"]}}},"components":{"schemas":{"SystemListNamespacesResponse":{"properties":{"keys":{"items":{"type":"string"},"type":"array"}},"type":"object"}}}}
```
## POST /sys/namespaces/api-lock/lock
> Lock the API for all namespaces to prevent changes.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/namespaces/api-lock/lock":{"post":{"operationId":"system-write-namespaces-api-lock-lock","summary":"Lock the API for all namespaces to prevent changes.","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"reason":{"type":"string"}}}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"}}}}}},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}},"tags":["system"]}}}}
```
## POST /sys/namespaces/api-lock/unlock
> Unlock the API for all namespaces.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/namespaces/api-lock/unlock":{"post":{"operationId":"system-write-namespaces-api-lock-unlock","summary":"Unlock the API for all namespaces.","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"reason":{"type":"string"}}}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"}}}}}},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}},"tags":["system"]}}}}
```
## POST /sys/namespaces/api-lock/unlock/{path}
> Unlock the API at a specific namespace path.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/namespaces/api-lock/unlock/{path}":{"post":{"operationId":"system-write-namespaces-api-lock-unlock-path","summary":"Unlock the API at a specific namespace path.","requestBody":{"required":false},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"}}}}}},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}},"tags":["system"]}}}}
```
## GET /sys/namespaces/{path}
> Read namespace information
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/namespaces/{path}":{"get":{"operationId":"system-read-namespaces-path","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SystemReadNamespacesPathResponse"}}},"description":"OK"}},"summary":"Read namespace information","tags":["system"]}}},"components":{"schemas":{"SystemReadNamespacesPathResponse":{"properties":{"custom_metadata":{"format":"map","type":"object"},"id":{"type":"string"},"path":{"type":"string"}},"type":"object"}}}}
```
## POST /sys/namespaces/{path}
> Create a new namespace
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/namespaces/{path}":{"post":{"operationId":"system-write-namespaces-path","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SystemWriteNamespacesPathRequest"}}},"required":true},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SystemWriteNamespacesPathResponse"}}},"description":"OK"}},"summary":"Create a new namespace","tags":["system"]}}},"components":{"schemas":{"SystemWriteNamespacesPathRequest":{"properties":{"custom_metadata":{"description":"A map of arbitrary string to string valued user-provided metadata meant to describe the namespace","format":"map","type":"object"}},"type":"object"},"SystemWriteNamespacesPathResponse":{"properties":{"custom_metadata":{"format":"map","type":"object"},"id":{"type":"string"},"path":{"type":"string"}},"type":"object"}}}}
```
## DELETE /sys/namespaces/{path}
> Delete a namespace
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/namespaces/{path}":{"delete":{"operationId":"system-delete-namespaces-path","responses":{"200":{"description":"OK"}},"summary":"Delete a namespace","tags":["system"]}}}}
```
## GET /sys/plugins/catalog
> List all the plugins registered with Vault.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/plugins/catalog":{"get":{"operationId":"plugins-catalog-list-plugins","summary":"List all the plugins registered with Vault.","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"data":{"type":"object","additionalProperties":{"type":"object","properties":{"type":{"type":"string"},"sha256":{"type":"string"},"command":{"type":"string"},"args":{"type":"array","items":{"type":"string"}}}}}}}}}},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}},"tags":["system"]}}}}
```
## GET /sys/plugins/catalog/{name}
> Return the configuration data for the plugin with the given name.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/plugins/catalog/{name}":{"get":{"operationId":"plugins-catalog-read-plugin-configuration","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginsCatalogReadPluginConfigurationResponse"}}},"description":"OK"}},"summary":"Return the configuration data for the plugin with the given name.","tags":["system"]}}},"components":{"schemas":{"PluginsCatalogReadPluginConfigurationResponse":{"properties":{"args":{"description":"The args passed to plugin command.","items":{"type":"string"},"type":"array"},"builtin":{"type":"boolean"},"command":{"description":"The command used to start the plugin. The executable defined in this command must exist in vault's plugin directory.","type":"string"},"deprecation_status":{"type":"string"},"name":{"description":"The name of the plugin","type":"string"},"sha256":{"description":"The SHA256 sum of the executable used in the command field. This should be HEX encoded.","type":"string"},"version":{"description":"The semantic version of the plugin to use.","type":"string"}},"type":"object"}}}}
```
## POST /sys/plugins/catalog/{name}
> Register a new plugin, or updates an existing one with the supplied name.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/plugins/catalog/{name}":{"post":{"operationId":"plugins-catalog-register-plugin","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginsCatalogRegisterPluginRequest"}}},"required":true},"responses":{"200":{"description":"OK"}},"summary":"Register a new plugin, or updates an existing one with the supplied name.","tags":["system"]}}},"components":{"schemas":{"PluginsCatalogRegisterPluginRequest":{"properties":{"args":{"description":"The args passed to plugin command.","items":{"type":"string"},"type":"array"},"command":{"description":"The command used to start the plugin. The executable defined in this command must exist in vault's plugin directory.","type":"string"},"env":{"description":"The environment variables passed to plugin command. Each entry is of the form \"key=value\".","items":{"type":"string"},"type":"array"},"sha256":{"description":"The SHA256 sum of the executable used in the command field. This should be HEX encoded.","type":"string"},"type":{"description":"The type of the plugin, may be auth, secret, or database","type":"string"},"version":{"description":"The semantic version of the plugin to use.","type":"string"}},"type":"object"}}}}
```
## DELETE /sys/plugins/catalog/{name}
> Remove the plugin with the given name.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/plugins/catalog/{name}":{"delete":{"operationId":"plugins-catalog-remove-plugin","responses":{"200":{"description":"OK"}},"summary":"Remove the plugin with the given name.","tags":["system"]}}}}
```
## GET /sys/plugins/catalog/{type}
> List the plugins in the catalog.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/plugins/catalog/{type}":{"get":{"operationId":"plugins-catalog-list-plugins-with-type","parameters":[{"description":"Must be set to `true`","in":"query","name":"list","required":true,"schema":{"enum":["true"],"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginsCatalogListPluginsWithTypeResponse"}}},"description":"OK"}},"summary":"List the plugins in the catalog.","tags":["system"]}}},"components":{"schemas":{"PluginsCatalogListPluginsWithTypeResponse":{"properties":{"keys":{"description":"List of plugin names in the catalog","items":{"type":"string"},"type":"array"}},"type":"object"}}}}
```
## GET /sys/plugins/catalog/{type}/{name}
> Return the configuration data for the plugin with the given name.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/plugins/catalog/{type}/{name}":{"get":{"operationId":"plugins-catalog-read-plugin-configuration-with-type","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginsCatalogReadPluginConfigurationWithTypeResponse"}}},"description":"OK"}},"summary":"Return the configuration data for the plugin with the given name.","tags":["system"]}}},"components":{"schemas":{"PluginsCatalogReadPluginConfigurationWithTypeResponse":{"properties":{"args":{"description":"The args passed to plugin command.","items":{"type":"string"},"type":"array"},"builtin":{"type":"boolean"},"command":{"description":"The command used to start the plugin. The executable defined in this command must exist in vault's plugin directory.","type":"string"},"deprecation_status":{"type":"string"},"name":{"description":"The name of the plugin","type":"string"},"sha256":{"description":"The SHA256 sum of the executable used in the command field. This should be HEX encoded.","type":"string"},"version":{"description":"The semantic version of the plugin to use.","type":"string"}},"type":"object"}}}}
```
## POST /sys/plugins/catalog/{type}/{name}
> Register a new plugin, or updates an existing one with the supplied name.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/plugins/catalog/{type}/{name}":{"post":{"operationId":"plugins-catalog-register-plugin-with-type","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginsCatalogRegisterPluginWithTypeRequest"}}},"required":true},"responses":{"200":{"description":"OK"}},"summary":"Register a new plugin, or updates an existing one with the supplied name.","tags":["system"]}}},"components":{"schemas":{"PluginsCatalogRegisterPluginWithTypeRequest":{"properties":{"args":{"description":"The args passed to plugin command.","items":{"type":"string"},"type":"array"},"command":{"description":"The command used to start the plugin. The executable defined in this command must exist in vault's plugin directory.","type":"string"},"env":{"description":"The environment variables passed to plugin command. Each entry is of the form \"key=value\".","items":{"type":"string"},"type":"array"},"sha256":{"description":"The SHA256 sum of the executable used in the command field. This should be HEX encoded.","type":"string"},"version":{"description":"The semantic version of the plugin to use.","type":"string"}},"type":"object"}}}}
```
## DELETE /sys/plugins/catalog/{type}/{name}
> Remove the plugin with the given name.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/plugins/catalog/{type}/{name}":{"delete":{"operationId":"plugins-catalog-remove-plugin-with-type","responses":{"200":{"description":"OK"}},"summary":"Remove the plugin with the given name.","tags":["system"]}}}}
```
## Reload mounted plugin backends.
> Either the plugin name (\`plugin\`) or the desired plugin backend mounts (\`mounts\`) must be provided, but not both. In the case that the plugin name is provided, all mounted paths that use that plugin backend will be reloaded. If (\`scope\`) is provided and is (\`global\`), the plugin(s) are reloaded globally.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/plugins/reload/backend":{"post":{"description":"Either the plugin name (`plugin`) or the desired plugin backend mounts (`mounts`) must be provided, but not both. In the case that the plugin name is provided, all mounted paths that use that plugin backend will be reloaded. If (`scope`) is provided and is (`global`), the plugin(s) are reloaded globally.","operationId":"plugins-reload-backends","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginsReloadBackendsRequest"}}},"required":true},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginsReloadBackendsResponse"}}},"description":"OK"},"202":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginsReloadBackendsResponse"}}},"description":"OK"}},"summary":"Reload mounted plugin backends.","tags":["system"]}}},"components":{"schemas":{"PluginsReloadBackendsRequest":{"properties":{"mounts":{"description":"The mount paths of the plugin backends to reload.","items":{"type":"string"},"type":"array"},"plugin":{"description":"The name of the plugin to reload, as registered in the plugin catalog.","type":"string"},"scope":{"type":"string"}},"type":"object"},"PluginsReloadBackendsResponse":{"properties":{"reload_id":{"type":"string"}},"type":"object"}}}}
```
## GET /sys/plugins/reload/backend/status
> Check the status of any pending plugin reloads for secret backends.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/plugins/reload/backend/status":{"get":{"operationId":"system-read-plugins-reload-backend-status","summary":"Check the status of any pending plugin reloads for secret backends.","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"reload_required":{"type":"boolean"},"plugins":{"type":"array","items":{"type":"string"}}}}}}},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}},"tags":["system"]}}}}
```
## GET /sys/policies/acl
> Retrieve a list of all configured ACL policies.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/policies/acl":{"get":{"operationId":"policies-list-acl-policies","summary":"Retrieve a list of all configured ACL policies.","parameters":[{"name":"list","in":"query","required":true,"description":"Must be set to `true` to list ACL policies.","schema":{"type":"string","enum":["true"]}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"data":{"type":"object","properties":{"keys":{"type":"array","items":{"type":"string"}}}}},"required":["data"]}}}},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}},"tags":["system"]}}}}
```
## GET /sys/policies/acl/{name}
> Retrieve information about the named ACL policy.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/policies/acl/{name}":{"get":{"operationId":"policies-read-acl-policy","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PoliciesReadAclPolicyResponse"}}},"description":"OK"}},"summary":"Retrieve information about the named ACL policy.","tags":["system"]}}},"components":{"schemas":{"PoliciesReadAclPolicyResponse":{"properties":{"name":{"type":"string"},"policy":{"type":"string"},"rules":{"type":"string"}},"type":"object"}}}}
```
## POST /sys/policies/acl/{name}
> Add a new or update an existing ACL policy.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/policies/acl/{name}":{"post":{"operationId":"policies-write-acl-policy","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PoliciesWriteAclPolicyRequest"}}},"required":true},"responses":{"204":{"description":"OK"}},"summary":"Add a new or update an existing ACL policy.","tags":["system"]}}},"components":{"schemas":{"PoliciesWriteAclPolicyRequest":{"properties":{"policy":{"description":"The rules of the policy.","type":"string"}},"type":"object"}}}}
```
## DELETE /sys/policies/acl/{name}
> Delete the ACL policy with the given name.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/policies/acl/{name}":{"delete":{"operationId":"policies-delete-acl-policy","responses":{"204":{"description":"OK"}},"summary":"Delete the ACL policy with the given name.","tags":["system"]}}}}
```
## GET /sys/policies/egp
> List all externally managed group policies (EGPs).
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/policies/egp":{"get":{"operationId":"system-list-policies-egp","summary":"List all externally managed group policies (EGPs).","parameters":[{"name":"list","in":"query","required":true,"description":"Must be set to `true` to retrieve EGPs.","schema":{"type":"string","enum":["true"]}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"data":{"type":"object","properties":{"keys":{"type":"array","items":{"type":"string"}}}}}}}}},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}},"tags":["system"]}}}}
```
## GET /sys/policies/egp/{name}
> Read an EGP policy by name.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/policies/egp/{name}":{"get":{"operationId":"system-read-policies-egp-name","summary":"Read an EGP policy by name.","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"data":{"type":"object","properties":{"name":{"type":"string"},"policy":{"type":"string"}}}},"required":["data"]}}}},"404":{"description":"EGP policy not found","content":{"application/json":{"schema":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}},"tags":["system"]}}}}
```
## POST /sys/policies/egp/{name}
> Create or update an EGP policy by name.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/policies/egp/{name}":{"post":{"operationId":"system-write-policies-egp-name","summary":"Create or update an EGP policy by name.","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"policy":{"type":"string"}},"required":["policy"]}}}},"responses":{"200":{"description":"Policy created or updated successfully"},"400":{"description":"Invalid policy definition","content":{"application/json":{"schema":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}},"tags":["system"]}}}}
```
## DELETE /sys/policies/egp/{name}
> Delete an EGP policy by name.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/policies/egp/{name}":{"delete":{"operationId":"system-delete-policies-egp-name","summary":"Delete an EGP policy by name.","responses":{"204":{"description":"Policy deleted successfully (empty body)"},"404":{"description":"EGP policy not found","content":{"application/json":{"schema":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}},"tags":["system"]}}}}
```
## GET /sys/policies/password
> List the existing password policies.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/policies/password":{"get":{"operationId":"policies-list-password-policies","parameters":[{"description":"Must be set to `true`","in":"query","name":"list","required":true,"schema":{"enum":["true"],"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PoliciesListPasswordPoliciesResponse"}}},"description":"OK"}},"summary":"List the existing password policies.","tags":["system"]}}},"components":{"schemas":{"PoliciesListPasswordPoliciesResponse":{"properties":{"keys":{"items":{"type":"string"},"type":"array"}},"type":"object"}}}}
```
## GET /sys/policies/password/{name}
> Retrieve an existing password policy.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/policies/password/{name}":{"get":{"operationId":"policies-read-password-policy","responses":{"204":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PoliciesReadPasswordPolicyResponse"}}},"description":"OK"}},"summary":"Retrieve an existing password policy.","tags":["system"]}}},"components":{"schemas":{"PoliciesReadPasswordPolicyResponse":{"properties":{"policy":{"type":"string"}},"type":"object"}}}}
```
## POST /sys/policies/password/{name}
> Add a new or update an existing password policy.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/policies/password/{name}":{"post":{"operationId":"policies-write-password-policy","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PoliciesWritePasswordPolicyRequest"}}},"required":true},"responses":{"204":{"description":"OK"}},"summary":"Add a new or update an existing password policy.","tags":["system"]}}},"components":{"schemas":{"PoliciesWritePasswordPolicyRequest":{"properties":{"policy":{"description":"The password policy","type":"string"}},"type":"object"}}}}
```
## DELETE /sys/policies/password/{name}
> Delete a password policy.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/policies/password/{name}":{"delete":{"operationId":"policies-delete-password-policy","responses":{"204":{"description":"OK"}},"summary":"Delete a password policy.","tags":["system"]}}}}
```
## GET /sys/policies/password/{name}/generate
> Generate a password from an existing password policy.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/policies/password/{name}/generate":{"get":{"operationId":"policies-generate-password-from-password-policy","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PoliciesGeneratePasswordFromPasswordPolicyResponse"}}},"description":"OK"}},"summary":"Generate a password from an existing password policy.","tags":["system"]}}},"components":{"schemas":{"PoliciesGeneratePasswordFromPasswordPolicyResponse":{"properties":{"password":{"type":"string"}},"type":"object"}}}}
```
## GET /sys/policies/rgp
> List all role-based group policies (RGPs).
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/policies/rgp":{"get":{"summary":"List all role-based group policies (RGPs).","operationId":"system-list-policies-rgp","parameters":[{"name":"list","in":"query","required":true,"description":"Must be set to `true` to list RGPs.","schema":{"type":"string","enum":["true"]}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PoliciesListRgpResponse"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## GET /sys/policies/rgp/{name}
> Read a specific RGP policy by name.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/policies/rgp/{name}":{"get":{"summary":"Read a specific RGP policy by name.","operationId":"system-read-policies-rgp-name","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RgpPolicyResponse"}}}},"404":{"description":"RGP policy not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## POST /sys/policies/rgp/{name}
> Create or update an RGP policy by name.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/policies/rgp/{name}":{"post":{"summary":"Create or update an RGP policy by name.","operationId":"system-write-policies-rgp-name","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RgpPolicyRequest"}}}},"responses":{"200":{"description":"Policy written successfully"},"400":{"description":"Invalid policy definition","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## DELETE /sys/policies/rgp/{name}
> Delete a specific RGP policy by name.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/policies/rgp/{name}":{"delete":{"summary":"Delete a specific RGP policy by name.","operationId":"system-delete-policies-rgp-name","responses":{"204":{"description":"Policy deleted successfully (empty body)"},"404":{"description":"RGP policy not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## GET /sys/policy
> List all access control policies.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/policy":{"get":{"summary":"List all access control policies.","operationId":"policies-list","parameters":[{"name":"list","in":"query","description":"Return a list if `true`","schema":{"type":"string"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PoliciesListResponse"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"PoliciesListResponse":{"properties":{"keys":{"items":{"type":"string"},"type":"array"},"policies":{"items":{"type":"string"},"type":"array"}},"type":"object"},"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## GET /sys/policy/{name}
> Retrieve the policy body for the named policy.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/policy/{name}":{"get":{"operationId":"policies-read-acl-policy2","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PoliciesReadAclPolicy2Response"}}},"description":"OK"}},"summary":"Retrieve the policy body for the named policy.","tags":["system"]}}},"components":{"schemas":{"PoliciesReadAclPolicy2Response":{"properties":{"name":{"type":"string"},"policy":{"type":"string"},"rules":{"type":"string"}},"type":"object"}}}}
```
## POST /sys/policy/{name}
> Add a new or update an existing policy.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/policy/{name}":{"post":{"operationId":"policies-write-acl-policy2","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PoliciesWriteAclPolicy2Request"}}},"required":true},"responses":{"204":{"description":"OK"}},"summary":"Add a new or update an existing policy.","tags":["system"]}}},"components":{"schemas":{"PoliciesWriteAclPolicy2Request":{"properties":{"policy":{"description":"The rules of the policy.","type":"string"},"rules":{"deprecated":true,"description":"The rules of the policy.","type":"string"}},"type":"object"}}}}
```
## DELETE /sys/policy/{name}
> Delete the policy with the given name.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/policy/{name}":{"delete":{"operationId":"policies-delete-acl-policy2","responses":{"204":{"description":"OK"}},"summary":"Delete the policy with the given name.","tags":["system"]}}}}
```
## Returns an HTML page listing the available profiles.
> Returns an HTML page listing the available \
> profiles. This should be mainly accessed via browsers or applications that can \
> render pages.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/pprof":{"get":{"description":"Returns an HTML page listing the available \nprofiles. This should be mainly accessed via browsers or applications that can \nrender pages.","operationId":"pprof-index","responses":{"200":{"description":"OK"}},"summary":"Returns an HTML page listing the available profiles.","tags":["system"]}}}}
```
## Returns a sampling of all past memory allocations.
> Returns a sampling of all past memory allocations.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/pprof/allocs":{"get":{"description":"Returns a sampling of all past memory allocations.","operationId":"pprof-memory-allocations","responses":{"200":{"description":"OK"}},"summary":"Returns a sampling of all past memory allocations.","tags":["system"]}}}}
```
## Returns stack traces that led to blocking on synchronization primitives
> Returns stack traces that led to blocking on synchronization primitives
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/pprof/block":{"get":{"description":"Returns stack traces that led to blocking on synchronization primitives","operationId":"pprof-blocking","responses":{"200":{"description":"OK"}},"summary":"Returns stack traces that led to blocking on synchronization primitives","tags":["system"]}}}}
```
## Returns the running program's command line.
> Returns the running program's command line, with arguments separated by NUL bytes.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/pprof/cmdline":{"get":{"description":"Returns the running program's command line, with arguments separated by NUL bytes.","operationId":"pprof-command-line","responses":{"200":{"description":"OK"}},"summary":"Returns the running program's command line.","tags":["system"]}}}}
```
## Returns stack traces of all current goroutines.
> Returns stack traces of all current goroutines.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/pprof/goroutine":{"get":{"description":"Returns stack traces of all current goroutines.","operationId":"pprof-goroutines","responses":{"200":{"description":"OK"}},"summary":"Returns stack traces of all current goroutines.","tags":["system"]}}}}
```
## Returns a sampling of memory allocations of live object.
> Returns a sampling of memory allocations of live object.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/pprof/heap":{"get":{"description":"Returns a sampling of memory allocations of live object.","operationId":"pprof-memory-allocations-live","responses":{"200":{"description":"OK"}},"summary":"Returns a sampling of memory allocations of live object.","tags":["system"]}}}}
```
## Returns stack traces of holders of contended mutexes
> Returns stack traces of holders of contended mutexes
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/pprof/mutex":{"get":{"description":"Returns stack traces of holders of contended mutexes","operationId":"pprof-mutexes","responses":{"200":{"description":"OK"}},"summary":"Returns stack traces of holders of contended mutexes","tags":["system"]}}}}
```
## Returns a pprof-formatted cpu profile payload.
> Returns a pprof-formatted cpu profile payload. Profiling lasts for duration specified in seconds GET parameter, or for 30 seconds if not specified.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/pprof/profile":{"get":{"description":"Returns a pprof-formatted cpu profile payload. Profiling lasts for duration specified in seconds GET parameter, or for 30 seconds if not specified.","operationId":"pprof-cpu-profile","responses":{"200":{"description":"OK"}},"summary":"Returns a pprof-formatted cpu profile payload.","tags":["system"]}}}}
```
## Returns the program counters listed in the request.
> Returns the program counters listed in the request.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/pprof/symbol":{"get":{"description":"Returns the program counters listed in the request.","operationId":"pprof-symbols","responses":{"200":{"description":"OK"}},"summary":"Returns the program counters listed in the request.","tags":["system"]}}}}
```
## Returns stack traces that led to the creation of new OS threads
> Returns stack traces that led to the creation of new OS threads
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/pprof/threadcreate":{"get":{"description":"Returns stack traces that led to the creation of new OS threads","operationId":"pprof-thread-creations","responses":{"200":{"description":"OK"}},"summary":"Returns stack traces that led to the creation of new OS threads","tags":["system"]}}}}
```
## Returns the execution trace in binary form.
> Returns the execution trace in binary form. Tracing lasts for duration specified in seconds GET parameter, or for 1 second if not specified.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/pprof/trace":{"get":{"description":"Returns the execution trace in binary form. Tracing lasts for duration specified in seconds GET parameter, or for 1 second if not specified.","operationId":"pprof-execution-trace","responses":{"200":{"description":"OK"}},"summary":"Returns the execution trace in binary form.","tags":["system"]}}}}
```
## GET /sys/quotas/config
> Read the current quota configuration.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/quotas/config":{"get":{"summary":"Read the current quota configuration.","operationId":"rate-limit-quotas-read-configuration","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RateLimitQuotasReadConfigurationResponse"}}}},"404":{"description":"Quota configuration not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"RateLimitQuotasReadConfigurationResponse":{"properties":{"enable_rate_limit_audit_logging":{"type":"boolean"},"enable_rate_limit_response_headers":{"type":"boolean"},"rate_limit_exempt_paths":{"items":{"type":"string"},"type":"array"}},"type":"object"},"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## POST /sys/quotas/config
> Create or update the quota configuration.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/quotas/config":{"post":{"summary":"Create or update the quota configuration.","operationId":"rate-limit-quotas-configure","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RateLimitQuotasConfigureRequest"}}}},"responses":{"204":{"description":"Quota configuration updated successfully (empty body)"},"400":{"description":"Invalid configuration request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"RateLimitQuotasConfigureRequest":{"properties":{"enable_rate_limit_audit_logging":{"description":"If set, starts audit logging of requests that get rejected due to rate limit quota rule violations.","type":"boolean"},"enable_rate_limit_response_headers":{"description":"If set, additional rate limit quota HTTP headers will be added to responses.","type":"boolean"},"rate_limit_exempt_paths":{"description":"Specifies the list of exempt paths from all rate limit quotas. If empty no paths will be exempt.","items":{"type":"string"},"type":"array"}},"type":"object"},"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## GET /sys/quotas/lease-count
> List all configured lease count quotas.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/quotas/lease-count":{"get":{"summary":"List all configured lease count quotas.","operationId":"system-list-quotas-lease-count","parameters":[{"description":"Must be set to `true`","in":"query","name":"list","required":true,"schema":{"enum":["true"],"type":"string"}}],"responses":{"200":{"description":"A list of lease count quotas","content":{"application/json":{"schema":{"$ref":"#/components/schemas/QuotasLeaseCountListResponse"}}}},"400":{"description":"Invalid request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## GET /sys/quotas/lease-count/{name}
> Read the specified lease count quota configuration.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/quotas/lease-count/{name}":{"get":{"summary":"Read the specified lease count quota configuration.","operationId":"system-read-quotas-lease-count-name","responses":{"200":{"description":"Lease count quota configuration","content":{"application/json":{"schema":{"$ref":"#/components/schemas/QuotasLeaseCountReadResponse"}}}},"404":{"description":"Quota not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## POST /sys/quotas/lease-count/{name}
> Create or update a lease count quota.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/quotas/lease-count/{name}":{"post":{"400":{"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"description":"Invalid request body","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"summary":"Create or update a lease count quota.","operationId":"system-write-quotas-lease-count-name","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/QuotasLeaseCountRequest"}}}},"responses":{"200":{"description":"Quota created or updated successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/QuotasLeaseCountWriteResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## DELETE /sys/quotas/lease-count/{name}
> Delete a lease count quota.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/quotas/lease-count/{name}":{"delete":{"summary":"Delete a lease count quota.","operationId":"system-delete-quotas-lease-count-name","responses":{"204":{"description":"Quota deleted successfully (no content)"},"404":{"description":"Quota not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## GET /sys/quotas/rate-limit
> List rate limit quota names
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/quotas/rate-limit":{"get":{"summary":"List rate limit quota names","operationId":"rate-limit-quotas-list","parameters":[{"description":"Must be set to `true`","in":"query","name":"list","required":true,"schema":{"enum":["true"],"type":"string"}}],"responses":{"200":{"description":"A list of rate limit quota names","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RateLimitQuotasListResponse"}}}},"400":{"description":"Invalid request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"RateLimitQuotasListResponse":{"properties":{"keys":{"items":{"type":"string"},"type":"array"}},"type":"object"},"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## GET /sys/quotas/rate-limit/{name}
> Read a specific rate limit quota configuration
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/quotas/rate-limit/{name}":{"get":{"summary":"Read a specific rate limit quota configuration","operationId":"rate-limit-quotas-read","responses":{"200":{"description":"Rate limit quota configuration","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RateLimitQuotasReadResponse"}}}},"404":{"description":"Quota not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"RateLimitQuotasReadResponse":{"properties":{"block_interval":{"type":"integer"},"interval":{"type":"integer"},"name":{"type":"string"},"path":{"type":"string"},"rate":{"format":"float","type":"number"},"role":{"type":"string"},"type":{"type":"string"}},"type":"object"},"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## POST /sys/quotas/rate-limit/{name}
> Create or update a rate limit quota
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/quotas/rate-limit/{name}":{"post":{"summary":"Create or update a rate limit quota","operationId":"rate-limit-quotas-write","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RateLimitQuotasWriteRequest"}}}},"responses":{"204":{"description":"Quota created or updated successfully (no content)"},"400":{"description":"Invalid quota configuration","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"RateLimitQuotasWriteRequest":{"properties":{"block_interval":{"description":"If set, when a client reaches a rate limit threshold, the client will be prohibited from any further requests until after the 'block_interval' has elapsed.","format":"seconds","type":"integer"},"interval":{"description":"The duration to enforce rate limiting for (default '1s').","format":"seconds","type":"integer"},"path":{"description":"Path of the mount or namespace to apply the quota. A blank path configures a global quota. For example namespace1/ adds a quota to a full namespace, namespace1/auth/userpass adds a quota to userpass in namespace1.","type":"string"},"rate":{"description":"The maximum number of requests in a given interval to be allowed by the quota rule. The 'rate' must be positive.","format":"float","type":"number"},"role":{"description":"Login role to apply this quota to. Note that when set, path must be configured to a valid auth method with a concept of roles.","type":"string"},"type":{"description":"Type of the quota rule.","type":"string"}},"type":"object"},"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## DELETE /sys/quotas/rate-limit/{name}
> Delete a rate limit quota
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/quotas/rate-limit/{name}":{"delete":{"summary":"Delete a rate limit quota","operationId":"rate-limit-quotas-delete","responses":{"204":{"description":"Quota deleted successfully (no content)"},"404":{"description":"Quota not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## GET /sys/rekey/backup
> Return the backup copy of PGP-encrypted unseal keys.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/rekey/backup":{"get":{"operationId":"rekey-read-backup-key","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RekeyReadBackupKeyResponse"}}},"description":"OK"}},"summary":"Return the backup copy of PGP-encrypted unseal keys.","tags":["system"]}}},"components":{"schemas":{"RekeyReadBackupKeyResponse":{"properties":{"keys":{"format":"map","type":"object"},"keys_base64":{"format":"map","type":"object"},"nonce":{"type":"string"}},"type":"object"}}}}
```
## DELETE /sys/rekey/backup
> Delete the backup copy of PGP-encrypted unseal keys.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/rekey/backup":{"delete":{"operationId":"rekey-delete-backup-key","responses":{"204":{"description":"OK"}},"summary":"Delete the backup copy of PGP-encrypted unseal keys.","tags":["system"]}}}}
```
## GET /sys/rekey/init
> Reads the configuration and progress of the current rekey attempt.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/rekey/init":{"get":{"operationId":"rekey-attempt-read-progress","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RekeyAttemptReadProgressResponse"}}},"description":"OK"}},"summary":"Reads the configuration and progress of the current rekey attempt.","tags":["system"]}}},"components":{"schemas":{"RekeyAttemptReadProgressResponse":{"properties":{"backup":{"type":"boolean"},"n":{"type":"integer"},"nounce":{"type":"string"},"pgp_fingerprints":{"items":{"type":"string"},"type":"array"},"progress":{"type":"integer"},"required":{"type":"integer"},"started":{"type":"string"},"t":{"type":"integer"},"verification_nonce":{"type":"string"},"verification_required":{"type":"boolean"}},"type":"object"}}}}
```
## Initializes a new rekey attempt.
> Only a single rekey attempt can take place at a time, and changing the parameters of a rekey requires canceling and starting a new rekey, which will also provide a new nonce.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/rekey/init":{"post":{"description":"Only a single rekey attempt can take place at a time, and changing the parameters of a rekey requires canceling and starting a new rekey, which will also provide a new nonce.","operationId":"rekey-attempt-initialize","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RekeyAttemptInitializeRequest"}}},"required":true},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RekeyAttemptInitializeResponse"}}},"description":"OK"}},"summary":"Initializes a new rekey attempt.","tags":["system"]}}},"components":{"schemas":{"RekeyAttemptInitializeRequest":{"properties":{"backup":{"description":"Specifies if using PGP-encrypted keys, whether Vault should also store a plaintext backup of the PGP-encrypted keys.","type":"boolean"},"pgp_keys":{"description":"Specifies an array of PGP public keys used to encrypt the output unseal keys. Ordering is preserved. The keys must be base64-encoded from their original binary representation. The size of this array must be the same as secret_shares.","items":{"type":"string"},"type":"array"},"require_verification":{"description":"Turns on verification functionality","type":"boolean"},"secret_shares":{"description":"Specifies the number of shares to split the unseal key into.","type":"integer"},"secret_threshold":{"description":"Specifies the number of shares required to reconstruct the unseal key. This must be less than or equal secret_shares. If using Vault HSM with auto-unsealing, this value must be the same as secret_shares.","type":"integer"}},"type":"object"},"RekeyAttemptInitializeResponse":{"properties":{"backup":{"type":"boolean"},"n":{"type":"integer"},"nounce":{"type":"string"},"pgp_fingerprints":{"items":{"type":"string"},"type":"array"},"progress":{"type":"integer"},"required":{"type":"integer"},"started":{"type":"string"},"t":{"type":"integer"},"verification_nonce":{"type":"string"},"verification_required":{"type":"boolean"}},"type":"object"}}}}
```
## Cancels any in-progress rekey.
> This clears the rekey settings as well as any progress made. This must be called to change the parameters of the rekey. Note: verification is still a part of a rekey. If rekeying is canceled during the verification flow, the current unseal keys remain valid.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/rekey/init":{"delete":{"description":"This clears the rekey settings as well as any progress made. This must be called to change the parameters of the rekey. Note: verification is still a part of a rekey. If rekeying is canceled during the verification flow, the current unseal keys remain valid.","operationId":"rekey-attempt-cancel","responses":{"200":{"description":"OK"}},"summary":"Cancels any in-progress rekey.","tags":["system"]}}}}
```
## GET /sys/rekey/recovery-key-backup
> Read the backup of the recovery keys
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/rekey/recovery-key-backup":{"get":{"summary":"Read the backup of the recovery keys","operationId":"rekey-read-backup-recovery-key","responses":{"200":{"description":"Successfully retrieved the recovery key backup","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RekeyReadBackupRecoveryKeyResponse"}}}},"404":{"description":"No recovery key backup found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"RekeyReadBackupRecoveryKeyResponse":{"properties":{"keys":{"format":"map","type":"object"},"keys_base64":{"format":"map","type":"object"},"nonce":{"type":"string"}},"type":"object"},"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## DELETE /sys/rekey/recovery-key-backup
> Delete the recovery key backup
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/rekey/recovery-key-backup":{"delete":{"summary":"Delete the recovery key backup","operationId":"rekey-delete-backup-recovery-key","responses":{"204":{"description":"Successfully deleted the recovery key backup"},"404":{"description":"No recovery key backup to delete","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## POST /sys/rekey/update
> Enter a single unseal key share to progress the rekey of the Vault.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/rekey/update":{"post":{"operationId":"rekey-attempt-update","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RekeyAttemptUpdateRequest"}}},"required":true},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RekeyAttemptUpdateResponse"}}},"description":"OK"}},"summary":"Enter a single unseal key share to progress the rekey of the Vault.","tags":["system"]}}},"components":{"schemas":{"RekeyAttemptUpdateRequest":{"properties":{"key":{"description":"Specifies a single unseal key share.","type":"string"},"nonce":{"description":"Specifies the nonce of the rekey attempt.","type":"string"}},"type":"object"},"RekeyAttemptUpdateResponse":{"properties":{"backup":{"type":"boolean"},"complete":{"type":"boolean"},"keys":{"items":{"type":"string"},"type":"array"},"keys_base64":{"items":{"type":"string"},"type":"array"},"n":{"type":"integer"},"nounce":{"type":"string"},"pgp_fingerprints":{"items":{"type":"string"},"type":"array"},"progress":{"type":"integer"},"required":{"type":"integer"},"started":{"type":"string"},"t":{"type":"integer"},"verification_nonce":{"type":"string"},"verification_required":{"type":"boolean"}},"type":"object"}}}}
```
## GET /sys/rekey/verify
> Read the configuration and progress of the current rekey verification attempt.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/rekey/verify":{"get":{"operationId":"rekey-verification-read-progress","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RekeyVerificationReadProgressResponse"}}},"description":"OK"}},"summary":"Read the configuration and progress of the current rekey verification attempt.","tags":["system"]}}},"components":{"schemas":{"RekeyVerificationReadProgressResponse":{"properties":{"n":{"type":"integer"},"nounce":{"type":"string"},"progress":{"type":"integer"},"started":{"type":"string"},"t":{"type":"integer"}},"type":"object"}}}}
```
## POST /sys/rekey/verify
> Enter a single new key share to progress the rekey verification operation.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/rekey/verify":{"post":{"operationId":"rekey-verification-update","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RekeyVerificationUpdateRequest"}}},"required":true},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RekeyVerificationUpdateResponse"}}},"description":"OK"}},"summary":"Enter a single new key share to progress the rekey verification operation.","tags":["system"]}}},"components":{"schemas":{"RekeyVerificationUpdateRequest":{"properties":{"key":{"description":"Specifies a single unseal share key from the new set of shares.","type":"string"},"nonce":{"description":"Specifies the nonce of the rekey verification operation.","type":"string"}},"type":"object"},"RekeyVerificationUpdateResponse":{"properties":{"complete":{"type":"boolean"},"nounce":{"type":"string"}},"type":"object"}}}}
```
## Cancel any in-progress rekey verification operation.
> This clears any progress made and resets the nonce. Unlike a \`DELETE\` against \`sys/rekey/init\`, this only resets the current verification operation, not the entire rekey atttempt.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/rekey/verify":{"delete":{"description":"This clears any progress made and resets the nonce. Unlike a `DELETE` against `sys/rekey/init`, this only resets the current verification operation, not the entire rekey atttempt.","operationId":"rekey-verification-cancel","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RekeyVerificationCancelResponse"}}},"description":"OK"}},"summary":"Cancel any in-progress rekey verification operation.","tags":["system"]}}},"components":{"schemas":{"RekeyVerificationCancelResponse":{"properties":{"n":{"type":"integer"},"nounce":{"type":"string"},"progress":{"type":"integer"},"started":{"type":"string"},"t":{"type":"integer"}},"type":"object"}}}}
```
## POST /sys/remount
> Initiate a mount migration
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/remount":{"post":{"operationId":"remount","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RemountRequest"}}},"required":true},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RemountResponse"}}},"description":"OK"}},"summary":"Initiate a mount migration","tags":["system"]}}},"components":{"schemas":{"RemountRequest":{"properties":{"from":{"description":"The previous mount point.","type":"string"},"to":{"description":"The new mount point.","type":"string"}},"type":"object"},"RemountResponse":{"properties":{"migration_id":{"type":"string"}},"type":"object"}}}}
```
## GET /sys/remount/status/{migration\_id}
> Check status of a mount migration
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/remount/status/{migration_id}":{"get":{"operationId":"remount-status","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RemountStatusResponse"}}},"description":"OK"}},"summary":"Check status of a mount migration","tags":["system"]}}},"components":{"schemas":{"RemountStatusResponse":{"properties":{"migration_id":{"type":"string"},"migration_info":{"format":"map","type":"object"}},"type":"object"}}}}
```
## POST /sys/renew
> Renews a lease, requesting to extend the lease.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/renew":{"post":{"operationId":"leases-renew-lease2","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/LeasesRenewLease2Request"}}},"required":true},"responses":{"204":{"description":"OK"}},"summary":"Renews a lease, requesting to extend the lease.","tags":["system"]}}},"components":{"schemas":{"LeasesRenewLease2Request":{"properties":{"increment":{"description":"The desired increment in seconds to the lease","format":"seconds","type":"integer"},"lease_id":{"description":"The lease identifier to renew. This is included with a lease.","type":"string"},"url_lease_id":{"description":"The lease identifier to renew. This is included with a lease.","type":"string"}},"type":"object"}}}}
```
## POST /sys/renew/{url\_lease\_id}
> Renews a lease, requesting to extend the lease.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/renew/{url_lease_id}":{"post":{"operationId":"leases-renew-lease-with-id2","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/LeasesRenewLeaseWithId2Request"}}},"required":true},"responses":{"204":{"description":"OK"}},"summary":"Renews a lease, requesting to extend the lease.","tags":["system"]}}},"components":{"schemas":{"LeasesRenewLeaseWithId2Request":{"properties":{"increment":{"description":"The desired increment in seconds to the lease","format":"seconds","type":"integer"},"lease_id":{"description":"The lease identifier to renew. This is included with a lease.","type":"string"}},"type":"object"}}}}
```
## POST /sys/replication/dr/primary/demote
> Demotes the DR primary node
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/replication/dr/primary/demote":{"post":{"operationId":"system-write-replication-dr-primary-demote","summary":"Demotes the DR primary node","responses":{"200":{"description":"DR primary successfully demoted","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DRPrimaryDemoteResponse"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## POST /sys/replication/dr/primary/disable
> Disables the DR primary replication
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/replication/dr/primary/disable":{"post":{"operationId":"system-write-replication-dr-primary-disable","summary":"Disables the DR primary replication","responses":{"200":{"description":"DR replication successfully disabled","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DRPrimaryDisableResponse"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## POST /sys/replication/dr/primary/enable
> Enables the DR primary replication
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/replication/dr/primary/enable":{"post":{"operationId":"system-write-replication-dr-primary-enable","summary":"Enables the DR primary replication","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DRPrimaryEnableRequest"}}}},"responses":{"200":{"description":"DR replication successfully enabled","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DRPrimaryEnableResponse"}}}},"400":{"description":"Invalid request payload","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## POST /sys/replication/dr/primary/revoke-secondary
> Revokes a DR secondary cluster
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/replication/dr/primary/revoke-secondary":{"post":{"operationId":"system-write-replication-dr-primary-revoke-secondary","summary":"Revokes a DR secondary cluster","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DRRevokeSecondaryRequest"}}}},"responses":{"200":{"description":"DR secondary successfully revoked","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DRRevokeSecondaryResponse"}}}},"404":{"description":"Secondary not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## POST /sys/replication/dr/primary/secondary-token
> Creates a token for a DR secondary to join the primary
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/replication/dr/primary/secondary-token":{"post":{"operationId":"system-write-replication-dr-primary-secondary-token","summary":"Creates a token for a DR secondary to join the primary","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DRSecondaryTokenRequest"}}}},"responses":{"200":{"description":"Token successfully created","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DRSecondaryTokenResponse"}}}},"400":{"description":"Invalid input","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## POST /sys/replication/dr/secondary/config/reload/{subsystem}
> Reload a specific DR secondary subsystem configuration.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/replication/dr/secondary/config/reload/{subsystem}":{"post":{"operationId":"system-write-replication-dr-secondary-config-reload-subsystem","summary":"Reload a specific DR secondary subsystem configuration.","responses":{"200":{"description":"Configuration reloaded successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ReloadSubsystemResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{}}}
```
## POST /sys/replication/dr/secondary/disable
> Disable DR secondary replication.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/replication/dr/secondary/disable":{"post":{"operationId":"system-write-replication-dr-secondary-disable","summary":"Disable DR secondary replication.","responses":{"200":{"description":"DR secondary replication disabled.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DisableSecondaryResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{}}}
```
## POST /sys/replication/dr/secondary/enable
> Enable DR secondary replication.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/replication/dr/secondary/enable":{"post":{"operationId":"system-write-replication-dr-secondary-enable","summary":"Enable DR secondary replication.","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EnableSecondaryRequest"}}}},"responses":{"200":{"description":"DR secondary enabled.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/EnableSecondaryResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{}}}
```
## POST /sys/replication/dr/secondary/generate-public-key
> Generate a new DR secondary public key.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/replication/dr/secondary/generate-public-key":{"post":{"operationId":"system-write-replication-dr-secondary-generate-public-key","summary":"Generate a new DR secondary public key.","responses":{"200":{"description":"Public key generated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GeneratePublicKeyResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{}}}
```
## GET /sys/replication/dr/secondary/license/status
> Check license status on the DR secondary.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/replication/dr/secondary/license/status":{"get":{"operationId":"system-read-replication-dr-secondary-license-status","summary":"Check license status on the DR secondary.","responses":{"200":{"description":"License status retrieved.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/LicenseStatusResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{}}}
```
## POST /sys/replication/dr/secondary/operation-token/delete
> Delete the DR secondary operation token.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/replication/dr/secondary/operation-token/delete":{"post":{"operationId":"system-write-replication-dr-secondary-operation-token-delete","summary":"Delete the DR secondary operation token.","responses":{"200":{"description":"Operation token deleted.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperationTokenDeleteResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{}}}
```
## POST /sys/replication/dr/secondary/promote
> Promote the DR secondary to primary.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/replication/dr/secondary/promote":{"post":{"operationId":"system-write-replication-dr-secondary-promote","summary":"Promote the DR secondary to primary.","responses":{"200":{"description":"Secondary promoted to primary.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PromoteSecondaryResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{}}}
```
## POST /sys/replication/dr/secondary/recover
> Recover a DR secondary.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/replication/dr/secondary/recover":{"post":{"operationId":"system-write-replication-dr-secondary-recover","summary":"Recover a DR secondary.","responses":{"200":{"description":"Secondary recovery started.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RecoverSecondaryResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{}}}
```
## POST /sys/replication/dr/secondary/reindex
> Trigger reindexing on the DR secondary.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/replication/dr/secondary/reindex":{"post":{"operationId":"system-write-replication-dr-secondary-reindex","summary":"Trigger reindexing on the DR secondary.","responses":{"200":{"description":"Reindexing triggered.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ReindexSecondaryResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{}}}
```
## POST /sys/replication/dr/secondary/update-primary
> Update the DR primary cluster configuration.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/replication/dr/secondary/update-primary":{"post":{"operationId":"system-write-replication-dr-secondary-update-primary","summary":"Update the DR primary cluster configuration.","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdatePrimaryRequest"}}}},"responses":{"200":{"description":"Primary configuration updated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdatePrimaryResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{}}}
```
## GET /sys/replication/dr/status
> Read DR replication status.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/replication/dr/status":{"get":{"operationId":"system-read-replication-dr-status","summary":"Read DR replication status.","responses":{"200":{"description":"DR status retrieved.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DRStatusResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{}}}
```
## POST /sys/replication/performance/primary/demote
> Demote the performance primary cluster.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/replication/performance/primary/demote":{"post":{"operationId":"system-write-replication-performance-primary-demote","summary":"Demote the performance primary cluster.","responses":{"200":{"description":"Demotion successful.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DemotePrimaryResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{}}}
```
## POST /sys/replication/performance/primary/disable
> Disable performance primary replication.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/replication/performance/primary/disable":{"post":{"operationId":"system-write-replication-performance-primary-disable","summary":"Disable performance primary replication.","responses":{"200":{"description":"Replication disabled.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DisablePrimaryReplicationResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{}}}
```
## GET /sys/replication/performance/primary/dynamic-filter/{id}
> Read a dynamic filter by ID.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/replication/performance/primary/dynamic-filter/{id}":{"get":{"operationId":"system-read-replication-performance-primary-dynamic-filter-id","summary":"Read a dynamic filter by ID.","responses":{"200":{"description":"Filter details retrieved.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DynamicFilterResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{}}}
```
## POST /sys/replication/performance/primary/enable
> Enable performance primary replication.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/replication/performance/primary/enable":{"post":{"operationId":"system-write-replication-performance-primary-enable","summary":"Enable performance primary replication.","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EnablePrimaryRequest"}}}},"responses":{"200":{"description":"Replication enabled.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/EnablePrimaryResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{}}}
```
## GET /sys/replication/performance/primary/paths-filter/{id}
> Get a paths filter by ID.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/replication/performance/primary/paths-filter/{id}":{"get":{"operationId":"system-read-replication-performance-primary-paths-filter-id","summary":"Get a paths filter by ID.","responses":{"200":{"description":"Filter details.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PathsFilterResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{}}}
```
## POST /sys/replication/performance/primary/paths-filter/{id}
> Create or update a paths filter.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/replication/performance/primary/paths-filter/{id}":{"post":{"operationId":"system-write-replication-performance-primary-paths-filter-id","summary":"Create or update a paths filter.","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PathsFilterRequest"}}}},"responses":{"200":{"description":"Filter updated successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PathsFilterWriteResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{}}}
```
## DELETE /sys/replication/performance/primary/paths-filter/{id}
> Delete a paths filter by ID.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/replication/performance/primary/paths-filter/{id}":{"delete":{"operationId":"system-delete-replication-performance-primary-paths-filter-id","summary":"Delete a paths filter by ID.","responses":{"204":{"description":"Filter deleted successfully."}},"tags":["system"]}}}}
```
## POST /sys/replication/performance/primary/revoke-secondary
> Revoke a secondary from the performance primary.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/replication/performance/primary/revoke-secondary":{"post":{"operationId":"system-write-replication-performance-primary-revoke-secondary","summary":"Revoke a secondary from the performance primary.","responses":{"200":{"description":"Secondary revoked successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RevokeSecondaryResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{}}}
```
## POST /sys/replication/performance/primary/secondary-token
> Generate a secondary token.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/replication/performance/primary/secondary-token":{"post":{"operationId":"system-write-replication-performance-primary-secondary-token","summary":"Generate a secondary token.","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SecondaryTokenRequest"}}}},"responses":{"200":{"description":"Token generated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SecondaryTokenResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{}}}
```
## POST /sys/replication/performance/secondary/disable
> Disable a performance secondary.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/replication/performance/secondary/disable":{"post":{"operationId":"system-write-replication-performance-secondary-disable","summary":"Disable a performance secondary.","responses":{"200":{"description":"Secondary disabled.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DisableSecondaryResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{}}}
```
## GET /sys/replication/performance/secondary/dynamic-filter/{id}
> Get a secondary dynamic filter by ID.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/replication/performance/secondary/dynamic-filter/{id}":{"get":{"operationId":"system-read-replication-performance-secondary-dynamic-filter-id","summary":"Get a secondary dynamic filter by ID.","responses":{"200":{"description":"Filter information retrieved.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DynamicFilterResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{}}}
```
## POST /sys/replication/performance/secondary/enable
> Enable performance secondary replication.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/replication/performance/secondary/enable":{"post":{"operationId":"system-write-replication-performance-secondary-enable","summary":"Enable performance secondary replication.","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EnableSecondaryRequest"}}}},"responses":{"200":{"description":"Secondary enabled.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/EnableSecondaryResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{}}}
```
## POST /sys/replication/performance/secondary/generate-public-key
> Generate public key for performance secondary.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/replication/performance/secondary/generate-public-key":{"post":{"operationId":"system-write-replication-performance-secondary-generate-public-key","summary":"Generate public key for performance secondary.","responses":{"200":{"description":"Public key generated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GeneratePublicKeyResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{}}}
```
## POST /sys/replication/performance/secondary/promote
> Promote performance secondary to primary.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/replication/performance/secondary/promote":{"post":{"operationId":"system-write-replication-performance-secondary-promote","summary":"Promote performance secondary to primary.","responses":{"200":{"description":"Secondary promoted to primary.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PromoteSecondaryResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{}}}
```
## POST /sys/replication/performance/secondary/update-primary
> Update primary information for the secondary.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/replication/performance/secondary/update-primary":{"post":{"operationId":"system-write-replication-performance-secondary-update-primary","summary":"Update primary information for the secondary.","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdatePrimaryRequest"}}}},"responses":{"200":{"description":"Primary updated successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdatePrimaryResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{}}}
```
## GET /sys/replication/performance/status
> Get the status of performance replication.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/replication/performance/status":{"get":{"operationId":"system-read-replication-performance-status","summary":"Get the status of performance replication.","responses":{"200":{"description":"Replication status returned.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PerformanceReplicationStatusResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{}}}
```
## POST /sys/replication/primary/demote
> Demote the current primary cluster.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/replication/primary/demote":{"post":{"operationId":"system-write-replication-primary-demote","summary":"Demote the current primary cluster.","responses":{"200":{"description":"Primary successfully demoted.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GenericResponse"}}}},"403":{"description":"Forbidden - insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## POST /sys/replication/primary/disable
> Disable the replication feature on the primary.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/replication/primary/disable":{"post":{"operationId":"system-write-replication-primary-disable","summary":"Disable the replication feature on the primary.","responses":{"200":{"description":"Replication disabled on primary.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GenericResponse"}}}},"403":{"description":"Forbidden - operation not permitted.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## POST /sys/replication/primary/enable
> Enable the primary cluster for replication.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/replication/primary/enable":{"post":{"operationId":"system-write-replication-primary-enable","summary":"Enable the primary cluster for replication.","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EnablePrimaryRequest"}}}},"responses":{"200":{"description":"Primary replication enabled.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GenericResponse"}}}},"400":{"description":"Invalid request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"403":{"description":"Unauthorized to enable primary.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## POST /sys/replication/primary/revoke-secondary
> Revoke the replication relationship with a secondary.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/replication/primary/revoke-secondary":{"post":{"operationId":"system-write-replication-primary-revoke-secondary","summary":"Revoke the replication relationship with a secondary.","responses":{"200":{"description":"Secondary successfully revoked.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GenericResponse"}}}},"403":{"description":"Forbidden","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## POST /sys/replication/primary/secondary-token
> Generate a token to be used by a secondary to join the primary.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/replication/primary/secondary-token":{"post":{"operationId":"system-write-replication-primary-secondary-token","summary":"Generate a token to be used by a secondary to join the primary.","requestBody":{"required":false,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SecondaryTokenRequest"}}}},"responses":{"200":{"description":"Token successfully generated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SecondaryTokenResponse"}}}},"403":{"description":"Forbidden","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## POST /sys/replication/recover
> Trigger internal recovery of the replication state.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/replication/recover":{"post":{"operationId":"system-write-replication-recover","summary":"Trigger internal recovery of the replication state.","responses":{"200":{"description":"Recovery initiated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GenericResponse"}}}},"500":{"description":"Server error during recovery.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## POST /sys/replication/reindex
> Trigger a reindex of all replication state data.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/replication/reindex":{"post":{"operationId":"system-write-replication-reindex","summary":"Trigger a reindex of all replication state data.","responses":{"200":{"description":"Reindexing triggered.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GenericResponse"}}}},"403":{"description":"Sudo required","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## POST /sys/replication/secondary/disable
> Disable replication on a secondary cluster.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/replication/secondary/disable":{"post":{"operationId":"system-write-replication-secondary-disable","summary":"Disable replication on a secondary cluster.","responses":{"200":{"description":"Secondary replication disabled.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GenericResponse"}}}},"403":{"description":"Not allowed","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## POST /sys/replication/secondary/enable
> Enable replication on a secondary cluster.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/replication/secondary/enable":{"post":{"operationId":"system-write-replication-secondary-enable","summary":"Enable replication on a secondary cluster.","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EnableSecondaryRequest"}}}},"responses":{"200":{"description":"Secondary replication enabled.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GenericResponse"}}}},"400":{"description":"Invalid token.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## POST /sys/replication/secondary/promote
> Promote a performance or DR secondary to become the primary.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/replication/secondary/promote":{"post":{"operationId":"system-write-replication-secondary-promote","summary":"Promote a performance or DR secondary to become the primary.","responses":{"200":{"description":"Secondary successfully promoted.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GenericResponse"}}}},"409":{"description":"Conflict - replication state prevents promotion.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## POST /sys/replication/secondary/update-primary
> Provide a new connection configuration to a primary from a secondary.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/replication/secondary/update-primary":{"post":{"operationId":"system-write-replication-secondary-update-primary","summary":"Provide a new connection configuration to a primary from a secondary.","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdatePrimaryRequest"}}}},"responses":{"200":{"description":"Primary address updated successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GenericResponse"}}}},"400":{"description":"Invalid or missing primary configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## GET /sys/replication/status
> Get the current status of replication for this Vault node.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/replication/status":{"get":{"operationId":"system-read-replication-status","summary":"Get the current status of replication for this Vault node.","responses":{"200":{"description":"Current replication status returned.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ReplicationStatusResponse"}}}},"500":{"description":"Error retrieving replication status.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## POST /sys/revoke
> Revokes a lease immediately.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/revoke":{"post":{"operationId":"leases-revoke-lease2","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/LeasesRevokeLease2Request"}}},"required":true},"responses":{"204":{"description":"OK"}},"summary":"Revokes a lease immediately.","tags":["system"]}}},"components":{"schemas":{"LeasesRevokeLease2Request":{"properties":{"lease_id":{"description":"The lease identifier to renew. This is included with a lease.","type":"string"},"sync":{"default":true,"description":"Whether or not to perform the revocation synchronously","type":"boolean"},"url_lease_id":{"description":"The lease identifier to renew. This is included with a lease.","type":"string"}},"type":"object"}}}}
```
## Revokes all secrets or tokens generated under a given prefix immediately
> Unlike \`/sys/leases/revoke-prefix\`, this path ignores backend errors encountered during revocation. This is potentially very dangerous and should only be used in specific emergency situations where errors in the backend or the connected backend service prevent normal revocation.\
> \
> By ignoring these errors, Vault abdicates responsibility for ensuring that the issued credentials or secrets are properly revoked and/or cleaned up. Access to this endpoint should be tightly controlled.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/revoke-force/{prefix}":{"post":{"description":"Unlike `/sys/leases/revoke-prefix`, this path ignores backend errors encountered during revocation. This is potentially very dangerous and should only be used in specific emergency situations where errors in the backend or the connected backend service prevent normal revocation.\n\nBy ignoring these errors, Vault abdicates responsibility for ensuring that the issued credentials or secrets are properly revoked and/or cleaned up. Access to this endpoint should be tightly controlled.","operationId":"leases-force-revoke-lease-with-prefix2","responses":{"204":{"description":"OK"}},"summary":"Revokes all secrets or tokens generated under a given prefix immediately","tags":["system"]}}}}
```
## POST /sys/revoke-prefix/{prefix}
> Revokes all secrets (via a lease ID prefix) or tokens (via the tokens' path property) generated under a given prefix immediately.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/revoke-prefix/{prefix}":{"post":{"operationId":"leases-revoke-lease-with-prefix2","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/LeasesRevokeLeaseWithPrefix2Request"}}},"required":true},"responses":{"204":{"description":"OK"}},"summary":"Revokes all secrets (via a lease ID prefix) or tokens (via the tokens' path property) generated under a given prefix immediately.","tags":["system"]}}},"components":{"schemas":{"LeasesRevokeLeaseWithPrefix2Request":{"properties":{"sync":{"default":true,"description":"Whether or not to perform the revocation synchronously","type":"boolean"}},"type":"object"}}}}
```
## POST /sys/revoke/{url\_lease\_id}
> Revokes a lease immediately.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/revoke/{url_lease_id}":{"post":{"operationId":"leases-revoke-lease-with-id2","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/LeasesRevokeLeaseWithId2Request"}}},"required":true},"responses":{"204":{"description":"OK"}},"summary":"Revokes a lease immediately.","tags":["system"]}}},"components":{"schemas":{"LeasesRevokeLeaseWithId2Request":{"properties":{"lease_id":{"description":"The lease identifier to renew. This is included with a lease.","type":"string"},"sync":{"default":true,"description":"Whether or not to perform the revocation synchronously","type":"boolean"}},"type":"object"}}}}
```
## Rotate the backend encryption key.
> Rotates the backend encryption key used to persist Vault data. This operation is a no-op if key rotation is disabled.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/rotate":{"post":{"operationId":"encryption-key-rotate","summary":"Rotate the backend encryption key.","description":"Rotates the backend encryption key used to persist Vault data. This operation is a no-op if key rotation is disabled.","responses":{"204":{"description":"Key rotation successful. No content returned."},"403":{"description":"Forbidden. Sudo permissions required.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error during key rotation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## GET /sys/rotate/config
> Read encryption key rotation configuration.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/rotate/config":{"get":{"operationId":"encryption-key-read-rotation-configuration","summary":"Read encryption key rotation configuration.","responses":{"200":{"description":"Current encryption key rotation configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/EncryptionKeyReadRotationConfigurationResponse"}}}},"500":{"description":"Internal error fetching configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"EncryptionKeyReadRotationConfigurationResponse":{"properties":{"enabled":{"type":"boolean"},"interval":{"format":"seconds","type":"integer"},"max_operations":{"format":"int64","type":"integer"}},"type":"object"},"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## POST /sys/rotate/config
> Configure encryption key rotation settings.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/rotate/config":{"post":{"operationId":"encryption-key-configure-rotation","summary":"Configure encryption key rotation settings.","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EncryptionKeyConfigureRotationRequest"}}}},"responses":{"204":{"description":"Configuration updated successfully."},"400":{"description":"Invalid input configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"403":{"description":"Forbidden. Sudo permissions required.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"EncryptionKeyConfigureRotationRequest":{"properties":{"enabled":{"description":"Whether automatic rotation is enabled.","type":"boolean"},"interval":{"description":"How long after installation of an active key term that the key will be automatically rotated.","format":"seconds","type":"integer"},"max_operations":{"description":"The number of encryption operations performed before the barrier key is automatically rotated.","format":"int64","type":"integer"}},"type":"object"},"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## POST /sys/seal
> Seal the Vault.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/seal":{"post":{"operationId":"seal","responses":{"204":{"description":"OK"}},"summary":"Seal the Vault.","tags":["system"]}}}}
```
## GET /sys/seal-status
> Check the seal status of a Vault.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/seal-status":{"get":{"operationId":"seal-status","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SealStatusResponse"}}},"description":""}},"summary":"Check the seal status of a Vault.","tags":["system"]}}},"components":{"schemas":{"SealStatusResponse":{"properties":{"build_date":{"type":"string"},"cluster_id":{"type":"string"},"cluster_name":{"type":"string"},"hcp_link_resource_ID":{"type":"string"},"hcp_link_status":{"type":"string"},"initialized":{"type":"boolean"},"migration":{"type":"boolean"},"n":{"type":"integer"},"nonce":{"type":"string"},"progress":{"type":"integer"},"recovery_seal":{"type":"boolean"},"sealed":{"type":"boolean"},"storage_type":{"type":"string"},"t":{"type":"integer"},"type":{"type":"string"},"version":{"type":"string"}},"type":"object"}}}}
```
## Check sealwrap rewrap status
> Returns information about keys or values that require rewrap due to changes in the underlying seal configuration.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/sealwrap/rewrap":{"get":{"operationId":"system-read-sealwrap-rewrap","summary":"Check sealwrap rewrap status","description":"Returns information about keys or values that require rewrap due to changes in the underlying seal configuration.","responses":{"200":{"description":"Sealwrap rewrap status retrieved successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SealwrapRewrapStatusResponse"}}}},"500":{"description":"Internal error while fetching rewrap status.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## Perform sealwrap rewrap
> Triggers rewrap for keys encrypted with an old seal configuration. This may take time depending on the size of the data.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/sealwrap/rewrap":{"post":{"operationId":"system-write-sealwrap-rewrap","summary":"Perform sealwrap rewrap","description":"Triggers rewrap for keys encrypted with an old seal configuration. This may take time depending on the size of the data.","requestBody":{"required":false,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SealwrapRewrapRequest"}}}},"responses":{"200":{"description":"Rewrap operation completed successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SealwrapRewrapResponse"}}}},"400":{"description":"Invalid request parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal error during rewrap operation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## Cause the node to give up active status.
> This endpoint forces the node to give up active status. If the node does not have active status, this endpoint does nothing. Note that the node will sleep for ten seconds before attempting to grab the active lock again, but if no standby nodes grab the active lock in the interim, the same node may become the active node again.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/step-down":{"post":{"description":"This endpoint forces the node to give up active status. If the node does not have active status, this endpoint does nothing. Note that the node will sleep for ten seconds before attempting to grab the active lock again, but if no standby nodes grab the active lock in the interim, the same node may become the active node again.","operationId":"step-down-leader","responses":{"204":{"description":"empty body"}},"summary":"Cause the node to give up active status.","tags":["system"]}}}}
```
## GET /sys/storage/raft/snapshot-auto/config/
> List all configured automatic snapshot jobs
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/storage/raft/snapshot-auto/config/":{"get":{"operationId":"system-list-storage-raft-snapshot-auto-config","summary":"List all configured automatic snapshot jobs","parameters":[{"name":"list","in":"query","required":true,"description":"Must be set to `true`","schema":{"type":"string","enum":["true"]}}],"responses":{"200":{"description":"Successfully listed configured snapshot jobs.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SnapshotAutoConfigListResponse"}}}},"400":{"description":"Missing or incorrect `list=true` query parameter.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## GET /sys/storage/raft/snapshot-auto/config/{name}
> Read configuration for a specific snapshot job
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/storage/raft/snapshot-auto/config/{name}":{"get":{"operationId":"system-read-storage-raft-snapshot-auto-config-name","summary":"Read configuration for a specific snapshot job","responses":{"200":{"description":"Snapshot job configuration retrieved.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SnapshotAutoConfigResponse"}}}},"404":{"description":"Snapshot configuration not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## POST /sys/storage/raft/snapshot-auto/config/{name}
> Create or update a snapshot job configuration
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/storage/raft/snapshot-auto/config/{name}":{"post":{"operationId":"system-write-storage-raft-snapshot-auto-config-name","summary":"Create or update a snapshot job configuration","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SnapshotAutoConfigRequest"}}}},"responses":{"200":{"description":"Snapshot configuration saved successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SnapshotAutoConfigResponse"}}}},"400":{"description":"Invalid configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## DELETE /sys/storage/raft/snapshot-auto/config/{name}
> Delete the specified snapshot job configuration
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/storage/raft/snapshot-auto/config/{name}":{"delete":{"operationId":"system-delete-storage-raft-snapshot-auto-config-name","summary":"Delete the specified snapshot job configuration","responses":{"204":{"description":"Snapshot configuration deleted. Empty response body."},"404":{"description":"Configuration not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## GET /sys/storage/raft/snapshot-auto/status/{name}
> Read status of a named snapshot job
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/storage/raft/snapshot-auto/status/{name}":{"get":{"operationId":"system-read-storage-raft-snapshot-auto-status-name","summary":"Read status of a named snapshot job","parameters":[{"in":"path","name":"name","required":true,"schema":{"type":"string"},"description":"The name of the snapshot job"}],"responses":{"200":{"description":"Status of the snapshot job retrieved successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SnapshotAutoStatusResponse"}}}},"404":{"description":"No such snapshot job exists.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## Generate a hash sum for input data using a configured default algorithm
> Accepts raw input data and returns its hash digest using Vault's configured default hash algorithm.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/tools/hash":{"post":{"operationId":"generate-hash","summary":"Generate a hash sum for input data using a configured default algorithm","description":"Accepts raw input data and returns its hash digest using Vault's configured default hash algorithm.\n","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GenerateHashRequest"}}}},"responses":{"200":{"description":"Hash generated successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GenerateHashResponse"}}}},"400":{"description":"Invalid input provided.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"GenerateHashRequest":{"properties":{"algorithm":{"default":"sha2-256","description":"Algorithm to use (POST body parameter). Valid values are: * sha2-224 * sha2-256 * sha2-384 * sha2-512 Defaults to \"sha2-256\".","type":"string"},"format":{"default":"hex","description":"Encoding format to use. Can be \"hex\" or \"base64\". Defaults to \"hex\".","type":"string"},"input":{"description":"The base64-encoded input data","type":"string"},"urlalgorithm":{"description":"Algorithm to use (POST URL parameter)","type":"string"}},"type":"object"},"GenerateHashResponse":{"properties":{"sum":{"type":"string"}},"type":"object"},"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## Generate a hash sum for input data using a specific algorithm
> Accepts raw input data and returns its hash digest using the algorithm specified in the URL.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/tools/hash/{urlalgorithm}":{"post":{"operationId":"generate-hash-with-algorithm","summary":"Generate a hash sum for input data using a specific algorithm","description":"Accepts raw input data and returns its hash digest using the algorithm specified in the URL.\n","parameters":[{"name":"urlalgorithm","in":"path","required":true,"schema":{"type":"string"},"description":"The hash algorithm to use (e.g., sha2-256, sha2-512)"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GenerateHashWithAlgorithmRequest"}}}},"responses":{"200":{"description":"Hash generated successfully using the specified algorithm.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GenerateHashWithAlgorithmResponse"}}}},"400":{"description":"Invalid algorithm or input provided.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"GenerateHashWithAlgorithmRequest":{"properties":{"algorithm":{"default":"sha2-256","description":"Algorithm to use (POST body parameter). Valid values are: * sha2-224 * sha2-256 * sha2-384 * sha2-512 Defaults to \"sha2-256\".","type":"string"},"format":{"default":"hex","description":"Encoding format to use. Can be \"hex\" or \"base64\". Defaults to \"hex\".","type":"string"},"input":{"description":"The base64-encoded input data","type":"string"}},"type":"object"},"GenerateHashWithAlgorithmResponse":{"properties":{"sum":{"type":"string"}},"type":"object"},"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## POST /sys/tools/random
> Generate random bytes using the default platform source
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/tools/random":{"post":{"operationId":"generate-random","summary":"Generate random bytes using the default platform source","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GenerateRandomRequest"}}}},"responses":{"200":{"description":"Random bytes generated successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GenerateRandomResponse"}}}},"400":{"description":"Invalid request parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"GenerateRandomRequest":{"properties":{"bytes":{"default":32,"description":"The number of bytes to generate (POST body parameter). Defaults to 32 (256 bits).","type":"integer"},"format":{"default":"base64","description":"Encoding format to use. Can be \"hex\" or \"base64\". Defaults to \"base64\".","type":"string"},"source":{"default":"platform","description":"Which system to source random data from, ether \"platform\", \"seal\", or \"all\".","type":"string"},"urlbytes":{"description":"The number of bytes to generate (POST URL parameter)","type":"string"}},"type":"object"},"GenerateRandomResponse":{"properties":{"random_bytes":{"type":"string"}},"type":"object"},"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## POST /sys/tools/random/{source}
> Generate random bytes using a specified source
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/tools/random/{source}":{"post":{"operationId":"generate-random-with-source","summary":"Generate random bytes using a specified source","parameters":[{"name":"source","in":"path","required":true,"schema":{"type":"string","default":"platform","enum":["platform","seal","all"]},"description":"Source to generate randomness from"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GenerateRandomWithSourceRequest"}}}},"responses":{"200":{"description":"Random bytes generated successfully from specified source.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GenerateRandomWithSourceResponse"}}}},"400":{"description":"Invalid request or unknown source.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"GenerateRandomWithSourceRequest":{"properties":{"bytes":{"default":32,"description":"The number of bytes to generate (POST body parameter). Defaults to 32 (256 bits).","type":"integer"},"format":{"default":"base64","description":"Encoding format to use. Can be \"hex\" or \"base64\". Defaults to \"base64\".","type":"string"},"urlbytes":{"description":"The number of bytes to generate (POST URL parameter)","type":"string"}},"type":"object"},"GenerateRandomWithSourceResponse":{"properties":{"random_bytes":{"type":"string"}},"type":"object"},"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## POST /sys/tools/random/{urlbytes}
> Generate a specific number of random bytes
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/tools/random/{urlbytes}":{"post":{"operationId":"generate-random-with-bytes","summary":"Generate a specific number of random bytes","parameters":[{"name":"urlbytes","in":"path","required":true,"schema":{"type":"string"},"description":"Number of bytes to generate"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GenerateRandomWithBytesRequest"}}}},"responses":{"200":{"description":"Random bytes generated successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GenerateRandomWithBytesResponse"}}}},"400":{"description":"Invalid byte count or input.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"GenerateRandomWithBytesRequest":{"properties":{"bytes":{"default":32,"description":"The number of bytes to generate (POST body parameter). Defaults to 32 (256 bits).","type":"integer"},"format":{"default":"base64","description":"Encoding format to use. Can be \"hex\" or \"base64\". Defaults to \"base64\".","type":"string"},"source":{"default":"platform","description":"Which system to source random data from, ether \"platform\", \"seal\", or \"all\".","type":"string"}},"type":"object"},"GenerateRandomWithBytesResponse":{"properties":{"random_bytes":{"type":"string"}},"type":"object"},"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## POST /sys/tools/random/{source}/{urlbytes}
> Generate a specific number of random bytes from a given source
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/tools/random/{source}/{urlbytes}":{"post":{"operationId":"generate-random-with-source-and-bytes","summary":"Generate a specific number of random bytes from a given source","parameters":[{"name":"source","in":"path","required":true,"schema":{"type":"string","enum":["platform","seal","all"]},"description":"Source to generate randomness from"},{"name":"urlbytes","in":"path","required":true,"schema":{"type":"string"},"description":"Number of bytes to generate"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GenerateRandomWithSourceAndBytesRequest"}}}},"responses":{"200":{"description":"Random bytes generated successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GenerateRandomWithSourceAndBytesResponse"}}}},"400":{"description":"Invalid input or unsupported source.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}},"components":{"schemas":{"GenerateRandomWithSourceAndBytesRequest":{"properties":{"bytes":{"default":32,"description":"The number of bytes to generate (POST body parameter). Defaults to 32 (256 bits).","type":"integer"},"format":{"default":"base64","description":"Encoding format to use. Can be \"hex\" or \"base64\". Defaults to \"base64\".","type":"string"}},"type":"object"},"GenerateRandomWithSourceAndBytesResponse":{"properties":{"random_bytes":{"type":"string"}},"type":"object"},"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}}}
```
## POST /sys/unseal
> Unseal the Vault.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/unseal":{"post":{"operationId":"unseal","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnsealRequest"}}},"required":true},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnsealResponse"}}},"description":""}},"summary":"Unseal the Vault.","tags":["system"]}}},"components":{"schemas":{"UnsealRequest":{"properties":{"key":{"description":"Specifies a single unseal key share. This is required unless reset is true.","type":"string"},"reset":{"description":"Specifies if previously-provided unseal keys are discarded and the unseal process is reset.","type":"boolean"}},"type":"object"},"UnsealResponse":{"properties":{"build_date":{"type":"string"},"cluster_id":{"type":"string"},"cluster_name":{"type":"string"},"hcp_link_resource_ID":{"type":"string"},"hcp_link_status":{"type":"string"},"initialized":{"type":"boolean"},"migration":{"type":"boolean"},"n":{"type":"integer"},"nonce":{"type":"string"},"progress":{"type":"integer"},"recovery_seal":{"type":"boolean"},"sealed":{"type":"boolean"},"storage_type":{"type":"string"},"t":{"type":"integer"},"type":{"type":"string"},"version":{"type":"string"}},"type":"object"}}}}
```
## GET /sys/version-history
> Returns map of historical version change entries
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/version-history":{"get":{"operationId":"version-history","parameters":[{"description":"Must be set to `true`","in":"query","name":"list","required":true,"schema":{"enum":["true"],"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/VersionHistoryResponse"}}},"description":"OK"}},"summary":"Returns map of historical version change entries","tags":["system"]}}},"components":{"schemas":{"VersionHistoryResponse":{"properties":{"key_info":{"format":"kvpairs","type":"object"},"keys":{"items":{"type":"string"},"type":"array"}},"type":"object"}}}}
```
## GET /sys/wrapping/lookup
> Look up wrapping properties for the requester's token.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/wrapping/lookup":{"get":{"operationId":"read-wrapping-properties2","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ReadWrappingProperties2Response"}}},"description":"OK"}},"summary":"Look up wrapping properties for the requester's token.","tags":["system"]}}},"components":{"schemas":{"ReadWrappingProperties2Response":{"properties":{"creation_path":{"type":"string"},"creation_time":{"format":"date-time","type":"string"},"creation_ttl":{"format":"seconds","type":"integer"}},"type":"object"}}}}
```
## POST /sys/wrapping/lookup
> Look up wrapping properties for the given token.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"paths":{"/sys/wrapping/lookup":{"post":{"operationId":"read-wrapping-properties","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ReadWrappingPropertiesRequest"}}},"required":true},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ReadWrappingPropertiesResponse"}}},"description":"OK"}},"summary":"Look up wrapping properties for the given token.","tags":["system"]}}},"components":{"schemas":{"ReadWrappingPropertiesRequest":{"properties":{"token":{"type":"string"}},"type":"object"},"ReadWrappingPropertiesResponse":{"properties":{"creation_path":{"type":"string"},"creation_time":{"format":"date-time","type":"string"},"creation_ttl":{"format":"seconds","type":"integer"}},"type":"object"}}}}
```
## Rotates a response-wrapped token
> Accepts a response-wrapped token and returns a new wrapped token.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"security":[{"VaultToken":[]}],"components":{"securitySchemes":{},"schemas":{"RewrapRequest":{"properties":{"token":{"type":"string"}},"type":"object"},"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}},"paths":{"/sys/wrapping/rewrap":{"post":{"summary":"Rotates a response-wrapped token","description":"Accepts a response-wrapped token and returns a new wrapped token.","operationId":"rewrap","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RewrapRequest"}}}},"responses":{"200":{"description":"Successfully rewrapped token","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RewrapResponse"}}}},"400":{"description":"Invalid input or missing token","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"403":{"description":"Forbidden - invalid or expired wrapping token","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}}}
```
## Unwraps a response-wrapped token
> Unwraps a token and returns the original payload.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"security":[{"VaultToken":[]}],"components":{"securitySchemes":{},"schemas":{"UnwrapRequest":{"properties":{"token":{"type":"string"}},"type":"object"},"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}},"paths":{"/sys/wrapping/unwrap":{"post":{"summary":"Unwraps a response-wrapped token","description":"Unwraps a token and returns the original payload.","operationId":"unwrap","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnwrapRequest"}}}},"responses":{"200":{"description":"Token unwrapped successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnwrapResponse"}}}},"204":{"description":"Token unwrapped successfully but had no payload"},"400":{"description":"Invalid request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"403":{"description":"Forbidden or token expired","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}}}
```
## Response-wraps an arbitrary JSON object
> Accepts a JSON object and returns it wrapped in a token.
```json
{"openapi":"3.0.2","info":{"title":"Enclaive Vault API","version":"1.3.2"},"servers":[{"url":"http://localhost:8200/v1","description":"Local Vault Server"}],"security":[{"VaultToken":[]}],"components":{"securitySchemes":{},"schemas":{"ErrorResponse":{"type":"object","properties":{"errors":{"type":"array","items":{"type":"string"}}}}}},"paths":{"/sys/wrapping/wrap":{"post":{"summary":"Response-wraps an arbitrary JSON object","description":"Accepts a JSON object and returns it wrapped in a token.","operationId":"wrap","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/WrapRequest"}}}},"responses":{"200":{"description":"Object wrapped successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WrapResponse"}}}},"400":{"description":"Missing payload to wrap","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"tags":["system"]}}}}
```