Docker Secret API

openapi: 3.2.0
info:
  title: Docker Engine Config Secret API
  version: '1.54'
  x-logo:
    url: https://docs.docker.com/assets/images/logo-docker-main.png
  description: "The Engine API is an HTTP API served by Docker Engine. It is the API the\nDocker client uses to communicate with the Engine, so everything the Docker\nclient can do can be done with the API.\n\nMost of the client's commands map directly to API endpoints (e.g. `docker ps`\nis `GET /containers/json`). The notable exception is running containers,\nwhich consists of several API calls.\n\n# Errors\n\nThe API uses standard HTTP status codes to indicate the success or failure\nof the API call. The body of the response will be JSON in the following\nformat:\n\n```\n{\n  \"message\": \"page not found\"\n}\n```\n\n# Versioning\n\nThe API is usually changed in each release, so API calls are versioned to\nensure that clients don't break. To lock to a specific version of the API,\nyou prefix the URL with its version, for example, call `/v1.30/info` to use\nthe v1.30 version of the `/info` endpoint. If the API version specified in\nthe URL is not supported by the daemon, a HTTP `400 Bad Request` error message\nis returned.\n\nIf you omit the version-prefix, the current version of the API (v1.50) is used.\nFor example, calling `/info` is the same as calling `/v1.52/info`. Using the\nAPI without a version-prefix is deprecated and will be removed in a future release.\n\nEngine releases in the near future should support this version of the API,\nso your client will continue to work even if it is talking to a newer Engine.\n\nThe API uses an open schema model, which means the server may add extra properties\nto responses. Likewise, the server will ignore any extra query parameters and\nrequest body properties. When you write clients, you need to ignore additional\nproperties in responses to ensure they do not break when talking to newer\ndaemons.\n\n\n# Authentication\n\nAuthentication for registries is handled client side. The client has to send\nauthentication details to various endpoints that need to communicate with\nregistries, such as `POST /images/(name)/push`. These are sent as\n`X-Registry-Auth` header as a [base64url encoded](https://tools.ietf.org/html/rfc4648#section-5)\n(JSON) string with the following structure:\n\n```\n{\n  \"username\": \"string\",\n  \"password\": \"string\",\n  \"serveraddress\": \"string\"\n}\n```\n\nThe `serveraddress` is a domain/IP without a protocol. Throughout this\nstructure, double quotes are required.\n\nIf you have already got an identity token from the [`/auth` endpoint](#operation/SystemAuth),\nyou can just pass this instead of credentials:\n\n```\n{\n  \"identitytoken\": \"9cbaf023786cd7...\"\n}\n```\n"
servers:
- url: /v1.54
tags:
- name: Secret
  x-displayName: Secrets
  description: 'Secrets are sensitive data that can be used by services. Swarm mode must

    be enabled for these endpoints to work.

    '
paths:
  /secrets:
    get:
      summary: List secrets
      operationId: SecretList
      responses:
        200:
          description: no error
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Secret'
                example:
                - ID: blt1owaxmitz71s9v5zh81zun
                  Version:
                    Index: 85
                  CreatedAt: '2017-07-20T13:55:28.678958722Z'
                  UpdatedAt: '2017-07-20T13:55:28.678958722Z'
                  Spec:
                    Name: mysql-passwd
                    Labels:
                      some.label: some.value
                    Driver:
                      Name: secret-bucket
                      Options:
                        OptionA: value for driver option A
                        OptionB: value for driver option B
                - ID: ktnbjxoalbkvbvedmg1urrz8h
                  Version:
                    Index: 11
                  CreatedAt: '2016-11-05T01:20:17.327670065Z'
                  UpdatedAt: '2016-11-05T01:20:17.327670065Z'
                  Spec:
                    Name: app-dev.crt
                    Labels:
                      foo: bar
        500:
          description: server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        503:
          description: node is not part of a swarm
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      parameters:
      - name: filters
        in: query
        description: 'A JSON encoded value of the filters (a `map[string][]string`) to

          process on the secrets list.


          Available filters:


          - `id=<secret id>`

          - `label=<key> or label=<key>=value`

          - `name=<secret name>`

          - `names=<secret name>`

          '
        schema:
          type: string
      tags:
      - Secret
  /secrets/create:
    post:
      summary: Create a secret
      operationId: SecretCreate
      responses:
        201:
          description: no error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IDResponse'
        409:
          description: name conflicts with an existing object
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        500:
          description: server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        503:
          description: node is not part of a swarm
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      tags:
      - Secret
      requestBody:
        content:
          application/json:
            schema:
              allOf:
              - $ref: '#/components/schemas/SecretSpec'
              - type: object
                example:
                  Name: app-key.crt
                  Labels:
                    foo: bar
                  Data: VEhJUyBJUyBOT1QgQSBSRUFMIENFUlRJRklDQVRFCg==
                  Driver:
                    Name: secret-bucket
                    Options:
                      OptionA: value for driver option A
                      OptionB: value for driver option B
  /secrets/{id}:
    get:
      summary: Inspect a secret
      operationId: SecretInspect
      responses:
        200:
          description: no error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Secret'
              example:
                ID: ktnbjxoalbkvbvedmg1urrz8h
                Version:
                  Index: 11
                CreatedAt: '2016-11-05T01:20:17.327670065Z'
                UpdatedAt: '2016-11-05T01:20:17.327670065Z'
                Spec:
                  Name: app-dev.crt
                  Labels:
                    foo: bar
                  Driver:
                    Name: secret-bucket
                    Options:
                      OptionA: value for driver option A
                      OptionB: value for driver option B
        404:
          description: secret not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        500:
          description: server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        503:
          description: node is not part of a swarm
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      parameters:
      - name: id
        in: path
        required: true
        description: ID of the secret
        schema:
          type: string
      tags:
      - Secret
    delete:
      summary: Delete a secret
      operationId: SecretDelete
      responses:
        204:
          description: no error
        404:
          description: secret not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        500:
          description: server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        503:
          description: node is not part of a swarm
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      parameters:
      - name: id
        in: path
        required: true
        description: ID of the secret
        schema:
          type: string
      tags:
      - Secret
  /secrets/{id}/update:
    post:
      summary: Update a Secret
      operationId: SecretUpdate
      responses:
        200:
          description: no error
        400:
          description: bad parameter
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
            text/plain:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        404:
          description: no such secret
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
            text/plain:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        500:
          description: server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
            text/plain:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        503:
          description: node is not part of a swarm
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
            text/plain:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      parameters:
      - name: id
        in: path
        description: The ID or name of the secret
        required: true
        schema:
          type: string
      - name: version
        in: query
        description: 'The version number of the secret object being updated. This is

          required to avoid conflicting writes.

          '
        required: true
        schema:
          type: integer
          format: int64
      tags:
      - Secret
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SecretSpec'
          text/plain:
            schema:
              $ref: '#/components/schemas/SecretSpec'
        description: 'The spec of the secret to update. Currently, only the Labels field

          can be updated. All other fields must remain unchanged from the

          [SecretInspect endpoint](#operation/SecretInspect) response values.

          '
components:
  schemas:
    ErrorResponse:
      description: Represents an error.
      type: object
      required:
      - message
      properties:
        message:
          description: The error message.
          type: string
      example:
        message: Something went wrong.
    Driver:
      description: Driver represents a driver (network, logging, secrets).
      type: object
      required:
      - Name
      properties:
        Name:
          description: Name of the driver.
          type: string
          example: some-driver
        Options:
          description: Key/value map of driver-specific options.
          type: object
          additionalProperties:
            type: string
          example:
            OptionA: value for driver-specific option A
            OptionB: value for driver-specific option B
    IDResponse:
      description: Response to an API call that returns just an Id
      type: object
      x-go-name: IDResponse
      required:
      - Id
      properties:
        Id:
          description: The id of the newly created object.
          type: string
    ObjectVersion:
      description: 'The version number of the object such as node, service, etc. This is needed

        to avoid conflicting writes. The client must send the version number along

        with the modified specification when updating these objects.


        This approach ensures safe concurrency and determinism in that the change

        on the object may not be applied if the version number has changed from the

        last read. In other words, if two update requests specify the same base

        version, only one of the requests can succeed. As a result, two separate

        update requests that happen at the same time will not unintentionally

        overwrite each other.

        '
      type: object
      properties:
        Index:
          type: integer
          format: uint64
          example: 373531
    Secret:
      type: object
      properties:
        ID:
          type: string
          example: blt1owaxmitz71s9v5zh81zun
        Version:
          $ref: '#/components/schemas/ObjectVersion'
        CreatedAt:
          type: string
          format: dateTime
          example: '2017-07-20T13:55:28.678958722Z'
        UpdatedAt:
          type: string
          format: dateTime
          example: '2017-07-20T13:55:28.678958722Z'
        Spec:
          $ref: '#/components/schemas/SecretSpec'
    SecretSpec:
      type: object
      properties:
        Name:
          description: User-defined name of the secret.
          type: string
        Labels:
          description: User-defined key/value metadata.
          type: object
          additionalProperties:
            type: string
          example:
            com.example.some-label: some-value
            com.example.some-other-label: some-other-value
        Data:
          description: 'Data is the data to store as a secret, formatted as a standard base64-encoded

            ([RFC 4648](https://tools.ietf.org/html/rfc4648#section-4)) string.

            It must be empty if the Driver field is set, in which case the data is

            loaded from an external secret store. The maximum allowed size is 500KB,

            as defined in [MaxSecretSize](https://pkg.go.dev/github.com/moby/swarmkit/v2@v2.0.0/api/validation#MaxSecretSize).


            This field is only used to _create_ a secret, and is not returned by

            other endpoints.

            '
          type: string
          example: ''
        Driver:
          description: 'Name of the secrets driver used to fetch the secret''s value from an

            external secret store.

            '
          $ref: '#/components/schemas/Driver'
        Templating:
          description: 'Templating driver, if applicable


            Templating controls whether and how to evaluate the config payload as

            a template. If no driver is set, no templating is used.

            '
          $ref: '#/components/schemas/Driver'