HashiCorp Vault Secrets - Transit API
Transit secrets engine (encryption as a service)
OpenAPI Specification
openapi: 3.1.0
info:
title: HashiCorp Vault HTTP Auth - AppRole Secrets - Transit API
description: The Vault HTTP API provides full access to Vault functionality via HTTP. Every aspect of Vault can be controlled via this API including secrets management, authentication, system configuration, identity, and policy management.
version: 1.15.0
contact:
name: HashiCorp
url: https://www.vaultproject.io/
license:
name: Business Source License 1.1
url: https://github.com/hashicorp/vault/blob/main/LICENSE
servers:
- url: https://127.0.0.1:8200/v1
description: Local Vault server
- url: https://{vault_host}:{port}/v1
description: Custom Vault server
variables:
vault_host:
default: 127.0.0.1
port:
default: '8200'
security:
- VaultToken: []
tags:
- name: Secrets - Transit
description: Transit secrets engine (encryption as a service)
paths:
/transit/encrypt/{name}:
post:
operationId: transitEncrypt
summary: Encrypt data
description: Encrypts the provided plaintext using the named key.
tags:
- Secrets - Transit
parameters:
- name: name
in: path
required: true
schema:
type: string
description: Name of the encryption key
requestBody:
required: true
content:
application/json:
schema:
type: object
required:
- plaintext
properties:
plaintext:
type: string
description: Base64-encoded plaintext
context:
type: string
description: Base64-encoded context for key derivation
key_version:
type: integer
nonce:
type: string
type:
type: string
enum:
- aes128-gcm96
- aes256-gcm96
- chacha20-poly1305
- rsa-2048
- rsa-3072
- rsa-4096
responses:
'200':
description: Encrypted data
content:
application/json:
schema:
type: object
properties:
data:
type: object
properties:
ciphertext:
type: string
key_version:
type: integer
/transit/decrypt/{name}:
post:
operationId: transitDecrypt
summary: Decrypt data
description: Decrypts the provided ciphertext using the named key.
tags:
- Secrets - Transit
parameters:
- name: name
in: path
required: true
schema:
type: string
requestBody:
required: true
content:
application/json:
schema:
type: object
required:
- ciphertext
properties:
ciphertext:
type: string
context:
type: string
nonce:
type: string
responses:
'200':
description: Decrypted data
content:
application/json:
schema:
type: object
properties:
data:
type: object
properties:
plaintext:
type: string
description: Base64-encoded plaintext
/transit/keys/{name}:
post:
operationId: createTransitKey
summary: Create an encryption key
tags:
- Secrets - Transit
parameters:
- name: name
in: path
required: true
schema:
type: string
requestBody:
content:
application/json:
schema:
type: object
properties:
type:
type: string
enum:
- aes128-gcm96
- aes256-gcm96
- chacha20-poly1305
- ed25519
- ecdsa-p256
- ecdsa-p384
- ecdsa-p521
- rsa-2048
- rsa-3072
- rsa-4096
derived:
type: boolean
exportable:
type: boolean
allow_plaintext_backup:
type: boolean
convergent_encryption:
type: boolean
responses:
'204':
description: Key created
get:
operationId: getTransitKey
summary: Read an encryption key
tags:
- Secrets - Transit
parameters:
- name: name
in: path
required: true
schema:
type: string
responses:
'200':
description: Key information
content:
application/json:
schema:
type: object
properties:
data:
type: object
properties:
name:
type: string
type:
type: string
deletion_allowed:
type: boolean
derived:
type: boolean
exportable:
type: boolean
latest_version:
type: integer
min_available_version:
type: integer
min_decryption_version:
type: integer
min_encryption_version:
type: integer
supports_encryption:
type: boolean
supports_decryption:
type: boolean
supports_signing:
type: boolean
supports_derivation:
type: boolean
delete:
operationId: deleteTransitKey
summary: Delete an encryption key
tags:
- Secrets - Transit
parameters:
- name: name
in: path
required: true
schema:
type: string
responses:
'204':
description: Key deleted
components:
securitySchemes:
VaultToken:
type: apiKey
name: X-Vault-Token
in: header
description: Vault client token