XPipe LogoXPipe Documentation

Encrypts a secret

For stores, the secrets are encrypted in json form. When creating stores in an automated fashion, secrets have to be first converted into the proper representation. To obtain the representation of a secret of an existing store, use the /secret/decrypt endpoint. The secret encryption method depends on your vault setup. Without any vault user and passphrase, the secret will be encrypted with a generic vault key. If you have a vault user with custom passphrase or a team set up, the secret can be encrypted with that key. You can also control the access scope of a secret by passing a custom principal. A principal is a vault user or role that has access to the secret. You can pass this principal to this endpoint to control who has access to this secret.

POST
/secret/encrypt

Authorization

bearerAuth
AuthorizationBearer <token>

The bearer token used is the session token that you receive from the handshake exchange.

In: header

Request Body

application/json

value*string

The raw string value to encrypt

principals?array<string>

The optional principals to restrict access to. Can be principal names or their UUIDs

Response Body

application/json

application/json

application/json

curl -X POST "http://localhost:21721/secret/encrypt" \  -H "Content-Type: application/json" \  -d '{    "value": "123"  }'
{
  "encrypted": {
    "secrets": [
      {
        "name": "vault",
        "principal": "be815152-05d2-4094-84d3-f0eea9200d5f",
        "iteration": 1,
        "secret": "0M5kljBv_jtlJgg2a6USgWRUhuuaYFsGciLGQh1N-A==",
        "token": "3GhDK7KbgKaOd5OhIRHjhL4c-DfiohKB-XSzLX6oU6bBtivBd137G0q6hCpMOxFJUFPywm_YSg161Xw51gwkig=="
      }
    ]
  }
}
{
  "message": "string"
}
Empty
Empty
{
  "error": {
    "cause": {},
    "stackTrace": [
      "string"
    ],
    "suppressed": [
      {}
    ],
    "localizedMessage": "string",
    "message": "string"
  }
}