Amazon Secrets Manager Secrets Manager Operations API

openapi: 3.2.0
info:
  title: AWS Secrets Manager Operations API
  version: '2017-10-17'
  description: Generated from AWS's published Smithy model for AWS Secrets Manager. 5 operation(s).
  contact:
    name: Amazon Web Services
    url: https://aws.amazon.com/contact-us/
  license:
    name: Apache 2.0
    identifier: Apache-2.0
    url: https://github.com/aws/api-models-aws/blob/main/LICENSE
servers:
- url: https://secretsmanager.{region}.amazonaws.com
  variables:
    region:
      default: us-east-1
security:
- sigv4: []
tags:
- name: Operations
paths:
  /#CancelRotateSecret:
    post:
      operationId: CancelRotateSecret
      summary: Cancel Rotate Secret
      description: 'Turns off automatic rotation, and if a rotation is currently in progress, cancels the rotation. If you cancel a rotation in progress, it can leave the VersionStage labels in an unexpected state. You might need to remove the staging label AWSPENDING from the partially created version. You also need to determine whether to roll back to the previous version of the secret by moving the staging label AWSCURRENT to the version that has AWSPENDING. To determine which version has a specific staging label, call ListSecretVersionIds. Then use UpdateSecretVersionStage to change staging labels. For more information, see How rotation works. To turn on automatic rotation again, call RotateSecret. Secrets Manager generates a CloudTrail log entry when you call this action. Do not include sensitive information in request parameters because it might be logged. For more information, see Logging Secrets Manager events with CloudTrail. Required permissions: secretsmanager:CancelRotateSecret. For more information, see IAM policy actions for Secrets Manager and Authentication and access control in Secrets Manager.'
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/CancelRotateSecretResponse'
              example:
                ARN: arn:aws:secretsmanager:us-west-2:123456789012:secret:MyTestDatabaseSecret-a1b2c3
                Name: Name
        '500':
          description: InternalServiceError
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/InternalServiceError'
        '400':
          description: InvalidParameterException; InvalidRequestException; ResourceNotFoundException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/InvalidParameterException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - secretsmanager.CancelRotateSecret
      requestBody:
        required: true
        content:
          application/x-amz-json-1.1:
            schema:
              $ref: '#/components/schemas/CancelRotateSecretRequest'
            example:
              SecretId: MyTestDatabaseSecret
      tags:
      - Operations
  /#ListSecretVersionIds:
    post:
      operationId: ListSecretVersionIds
      summary: List Secret Version Ids
      description: 'Lists the versions of a secret. Secrets Manager uses staging labels to indicate the different versions of a secret. For more information, see Secrets Manager concepts: Versions. To list the secrets in the account, use ListSecrets. Secrets Manager generates a CloudTrail log entry when you call this action. Do not include sensitive information in request parameters because it might be logged. For more information, see Logging Secrets Manager events with CloudTrail. Required permissions: secretsmanager:ListSecretVersionIds. For more information, see IAM policy actions for Secrets Manager and Authentication and access control in Secrets Manager.'
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ListSecretVersionIdsResponse'
              example:
                Versions:
                - VersionId: EXAMPLE1-90ab-cdef-fedc-ba987EXAMPLE
                  VersionStages:
                  - AWSPREVIOUS
                  CreatedDate: 1523477145.713
                - VersionId: EXAMPLE2-90ab-cdef-fedc-ba987EXAMPLE
                  VersionStages:
                  - AWSCURRENT
                  CreatedDate: 1523486221.391
                - CreatedDate: 1511974462.36
                  VersionId: EXAMPLE3-90ab-cdef-fedc-ba987EXAMPLE;
                ARN: arn:aws:secretsmanager:us-west-2:123456789012:secret:MyTestDatabaseSecret-a1b2c3
                Name: MyTestDatabaseSecret
        '500':
          description: InternalServiceError
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/InternalServiceError'
        '400':
          description: InvalidNextTokenException; InvalidParameterException; ResourceNotFoundException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/InvalidNextTokenException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - secretsmanager.ListSecretVersionIds
      requestBody:
        required: true
        content:
          application/x-amz-json-1.1:
            schema:
              $ref: '#/components/schemas/ListSecretVersionIdsRequest'
            example:
              SecretId: MyTestDatabaseSecret
              IncludeDeprecated: true
      tags:
      - Operations
  /#RemoveRegionsFromReplication:
    post:
      operationId: RemoveRegionsFromReplication
      summary: Remove Regions From Replication
      description: 'For a secret that is replicated to other Regions, deletes the secret replicas from the Regions you specify. Secrets Manager generates a CloudTrail log entry when you call this action. Do not include sensitive information in request parameters because it might be logged. For more information, see Logging Secrets Manager events with CloudTrail. Required permissions: secretsmanager:RemoveRegionsFromReplication. For more information, see IAM policy actions for Secrets Manager and Authentication and access control in Secrets Manager.'
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/RemoveRegionsFromReplicationResponse'
        '500':
          description: InternalServiceError
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/InternalServiceError'
        '400':
          description: InvalidParameterException; InvalidRequestException; ResourceNotFoundException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/InvalidParameterException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - secretsmanager.RemoveRegionsFromReplication
      requestBody:
        required: true
        content:
          application/x-amz-json-1.1:
            schema:
              $ref: '#/components/schemas/RemoveRegionsFromReplicationRequest'
      tags:
      - Operations
  /#StopReplicationToReplica:
    post:
      operationId: StopReplicationToReplica
      summary: Stop Replication To Replica
      description: 'Removes the link between the replica secret and the primary secret and promotes the replica to a primary secret in the replica Region. You must call this operation from the Region in which you want to promote the replica to a primary secret. Secrets Manager generates a CloudTrail log entry when you call this action. Do not include sensitive information in request parameters because it might be logged. For more information, see Logging Secrets Manager events with CloudTrail. Required permissions: secretsmanager:StopReplicationToReplica. For more information, see IAM policy actions for Secrets Manager and Authentication and access control in Secrets Manager.'
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/StopReplicationToReplicaResponse'
        '500':
          description: InternalServiceError
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/InternalServiceError'
        '400':
          description: InvalidParameterException; InvalidRequestException; ResourceNotFoundException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/InvalidParameterException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - secretsmanager.StopReplicationToReplica
      requestBody:
        required: true
        content:
          application/x-amz-json-1.1:
            schema:
              $ref: '#/components/schemas/StopReplicationToReplicaRequest'
      tags:
      - Operations
  /#UpdateSecretVersionStage:
    post:
      operationId: UpdateSecretVersionStage
      summary: Update Secret Version Stage
      description: 'Modifies the staging labels attached to a version of a secret. Secrets Manager uses staging labels to track a version as it progresses through the secret rotation process. Each staging label can be attached to only one version at a time. To add a staging label to a version when it is already attached to another version, Secrets Manager first removes it from the other version first and then attaches it to this one. For more information about versions and staging labels, see Concepts: Version. The staging labels that you specify in the VersionStage parameter are added to the existing list of staging labels for the version. You can move the AWSCURRENT staging label to this version by including it in this call. Whenever you move AWSCURRENT, Secrets Manager automatically moves the label AWSPREVIOUS to the version that AWSCURRENT was removed from. If this action results in the last label being removed from a version, then the version is considered to be ''deprecated'' and can be deleted by Secrets Manager. Secrets Manager generates a CloudTrail log entry when you call this action. Do not include sensitive information in request parameters because it might be logged. For more information, s'
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/UpdateSecretVersionStageResponse'
              example:
                ARN: arn:aws:secretsmanager:us-west-2:123456789012:secret:MyTestDatabaseSecret-a1b2c3
                Name: MyTestDatabaseSecret
        '500':
          description: InternalServiceError
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/InternalServiceError'
        '400':
          description: InvalidParameterException; InvalidRequestException; LimitExceededException; ResourceNotFoundException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/InvalidParameterException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - secretsmanager.UpdateSecretVersionStage
      requestBody:
        required: true
        content:
          application/x-amz-json-1.1:
            schema:
              $ref: '#/components/schemas/UpdateSecretVersionStageRequest'
            example:
              SecretId: MyTestDatabaseSecret
              VersionStage: STAGINGLABEL1
              MoveToVersionId: EXAMPLE1-90ab-cdef-fedc-ba987SECRET1
      tags:
      - Operations
components:
  schemas:
    InvalidNextTokenException:
      type: object
      properties:
        Message:
          type: string
    ReplicationStatusType:
      type: object
      properties:
        Region:
          type: string
          description: The Region where replication occurs.
        KmsKeyId:
          type: string
          description: Can be an ARN, Key ID, or Alias.
        Status:
          type: string
          enum:
          - InSync
          - Failed
          - InProgress
          description: The status can be InProgress, Failed, or InSync.
        StatusMessage:
          type: string
          description: Status message such as "Secret with this name already exists in this region".
        LastAccessedDate:
          type: string
          format: date-time
          description: The date that the secret was last accessed in the Region. This field is omitted if the secret has never been retrieved in the Region.
    StopReplicationToReplicaResponse:
      type: object
      properties:
        ARN:
          type: string
          description: The ARN of the promoted secret. The ARN is the same as the original primary secret except the Region is changed.
    CancelRotateSecretResponse:
      type: object
      properties:
        ARN:
          type: string
          description: The ARN of the secret.
        Name:
          type: string
          description: The name of the secret.
        VersionId:
          type: string
          description: The unique identifier of the version of the secret created during the rotation. This version might not be complete, and should be evaluated for possible deletion. We recommend that you remove the VersionStage value AWSPENDING from this version so that Secrets Manager can delete it. Failing to clean up a cancelled rotation can block you from starting future rotations.
    ListSecretVersionIdsResponse:
      type: object
      properties:
        Versions:
          type: array
          items:
            $ref: '#/components/schemas/SecretVersionsListEntry'
          description: A list of the versions of the secret.
        NextToken:
          type: string
          description: Secrets Manager includes this value if there's more output available than what is included in the current response. This can occur even when the response includes no values at all, such as when you ask for a filtered view of a long list. To get the next results, call ListSecretVersionIds again with this value.
        ARN:
          type: string
          description: The ARN of the secret.
        Name:
          type: string
          description: The name of the secret.
    CancelRotateSecretRequest:
      type: object
      properties:
        SecretId:
          type: string
          description: The ARN or name of the secret. For an ARN, we recommend that you specify a complete ARN rather than a partial ARN. See Finding a secret from a partial ARN.
      required:
      - SecretId
    SecretVersionsListEntry:
      type: object
      properties:
        VersionId:
          type: string
          description: The unique version identifier of this version of the secret.
        VersionStages:
          type: array
          items:
            type: string
          description: An array of staging labels that are currently associated with this version of the secret.
        LastAccessedDate:
          type: string
          format: date-time
          description: The date that this version of the secret was last accessed. Note that the resolution of this field is at the date level and does not include the time.
        CreatedDate:
          type: string
          format: date-time
          description: The date and time this version of the secret was created.
        KmsKeyIds:
          type: array
          items:
            type: string
          description: The KMS keys used to encrypt the secret version.
    UpdateSecretVersionStageRequest:
      type: object
      properties:
        SecretId:
          type: string
          description: The ARN or the name of the secret with the version and staging labelsto modify. For an ARN, we recommend that you specify a complete ARN rather than a partial ARN. See Finding a secret from a partial ARN.
        VersionStage:
          type: string
          description: The staging label to add to this version.
        RemoveFromVersionId:
          type: string
          description: The ID of the version that the staging label is to be removed from. If the staging label you are trying to attach to one version is already attached to a different version, then you must include this parameter and specify the version that the label is to be removed from. If the label is attached and you either do not specify this parameter, or the version ID does not match, then the operation fails.
        MoveToVersionId:
          type: string
          description: The ID of the version to add the staging label to. To remove a label from a version, then do not specify this parameter. If the staging label is already attached to a different version of the secret, then you must also specify the RemoveFromVersionId parameter.
      required:
      - SecretId
      - VersionStage
    StopReplicationToReplicaRequest:
      type: object
      properties:
        SecretId:
          type: string
          description: The name of the secret or the replica ARN. The replica ARN is the same as the original primary secret ARN expect the Region is changed to the replica Region.
      required:
      - SecretId
    InternalServiceError:
      type: object
      properties:
        Message:
          type: string
    RemoveRegionsFromReplicationRequest:
      type: object
      properties:
        SecretId:
          type: string
          description: The ARN or name of the secret.
        RemoveReplicaRegions:
          type: array
          items:
            type: string
          description: The Regions of the replicas to remove.
      required:
      - SecretId
      - RemoveReplicaRegions
    UpdateSecretVersionStageResponse:
      type: object
      properties:
        ARN:
          type: string
          description: The ARN of the secret that was updated.
        Name:
          type: string
          description: The name of the secret that was updated.
    RemoveRegionsFromReplicationResponse:
      type: object
      properties:
        ARN:
          type: string
          description: The ARN of the primary secret.
        ReplicationStatus:
          type: array
          items:
            $ref: '#/components/schemas/ReplicationStatusType'
          description: The status of replicas for this secret after you remove Regions.
    ListSecretVersionIdsRequest:
      type: object
      properties:
        SecretId:
          type: string
          description: The ARN or name of the secret whose versions you want to list. For an ARN, we recommend that you specify a complete ARN rather than a partial ARN. See Finding a secret from a partial ARN.
        MaxResults:
          type: integer
          description: The number of results to include in the response. If there are more results available, in the response, Secrets Manager includes NextToken. To get the next results, call ListSecretVersionIds again with the value from NextToken.
        NextToken:
          type: string
          description: A token that indicates where the output should continue from, if a previous call did not show all results. To get the next results, call ListSecretVersionIds again with this value.
        IncludeDeprecated:
          type: boolean
          description: Specifies whether to include versions of secrets that don't have any staging labels attached to them. Versions without staging labels are considered deprecated and are subject to deletion by Secrets Manager. By default, versions without staging labels aren't included.
      required:
      - SecretId
    InvalidParameterException:
      type: object
      properties:
        Message:
          type: string
  securitySchemes:
    sigv4:
      type: apiKey
      in: header
      name: Authorization
      description: AWS Signature Version 4. The Authorization header carries an AWS4-HMAC-SHA256 signature over the canonical request, with X-Amz-Date (and X-Amz-Security-Token for temporary credentials). Not a bearer token.
      x-aws-sigv4:
        signingName: secretsmanager
x-provenance:
  method: harvested
  publisher: Amazon Web Services
  source: https://raw.githubusercontent.com/aws/api-models-aws/582e55931c45b944739742a2c1620b6026dd2d13/models/secrets-manager/service/2017-10-17/secrets-manager-2017-10-17.json
  note: converted by smithy-to-openapi.py from AWS's Smithy model (roadmap#1001)