IronCore Labs Tenant Secret API

openapi: 3.1.0
info:
  title: Vendor API Bridge Configuration Assignment Tenant Secret API
  version: 3.1.0
  description: API used to manage tenants and KMS configurations by communicating with the IronCore Configuration Broker on your behalf.
  contact:
    name: IronCore Labs
    url: www.ironcorelabs.com
    email: info@ironcorelabs.com
  summary: IronCore Vendor API Bridge
servers:
- url: http://localhost:3000/api
  description: Local
security:
- Authorization: []
tags:
- name: Tenant Secret
  description: Tenant secrets created by the TSP and stored in the Config Broker
paths:
  /1/tenants/secrets:
    parameters: []
    get:
      summary: Tenant Secret List
      operationId: post-1-tenants-secrets
      responses:
        '200':
          $ref: '#/components/responses/TenantSecretListResponse'
        '401':
          description: Unauthorized
      tags:
      - Tenant Secret
      requestBody:
        $ref: '#/components/requestBodies/TenantSecretListRequest'
      parameters:
      - schema:
          type: string
          format: date-time
        in: query
        name: updatedSince
        description: RFC3339 timestamp
      - schema:
          type: string
          format: date-time
        in: query
        name: createdSince
        description: RFC3339 timestamp
      - $ref: '#/components/parameters/secretType'
      - $ref: '#/components/parameters/migrationStatus'
      - $ref: '#/components/parameters/rotationStatus'
      - $ref: '#/components/parameters/page'
      - $ref: '#/components/parameters/pageSize'
      - $ref: '#/components/parameters/sortDirection'
      - schema:
          type: string
          enum:
          - created
          - updated
        in: query
        name: sortColumn
        description: Column to use for sorting
      - schema:
          type: string
        in: query
        name: query
        description: Tenant provided ID, secret path, secret fingerprint, or KMS config ID to search for
      - $ref: '#/components/parameters/iclRequestorId'
      description: List secrets associated with the vendor's tenants
  /1/tenants/{tenantId}/secrets/rotate/begin:
    parameters:
    - $ref: '#/components/parameters/tenantId'
    post:
      summary: Tenant Secret Rotation Begin
      operationId: post-1-tenants-tenantId-secrets-rotate-begin
      responses:
        '200':
          $ref: '#/components/responses/TenantSecretRotationResponse'
      tags:
      - Tenant Secret
      requestBody:
        $ref: '#/components/requestBodies/TenantSecretRotationRequest'
      description: 'Begin rotation for a tenant secret. If `id` is specified, the assignment with that ID will be marked InRotation. If `secretType` and `secretPath` are specified, the tenant''s Current secret matching those will be marked InRotation.

        InRotation secrets can still be used for decryption.'
      parameters:
      - $ref: '#/components/parameters/iclRequestorId'
  /1/tenants/{tenantId}/secrets/rotate/commit:
    parameters:
    - $ref: '#/components/parameters/tenantId'
    post:
      summary: Tenant Secret Rotation Commit
      operationId: post-1-tenants-tenantId-secrets-rotate-commit
      responses:
        '200':
          $ref: '#/components/responses/TenantSecretRotationResponse'
      tags:
      - Tenant Secret
      description: 'Finish rotation for a tenant secret. If `id` is specified, the assignment with that ID will be marked Archived. If `secretType` and `secretPath` are specified, the tenant''s InRotation secret matching those will be marked Archived.

        Archived secrets can still be used for decryption.'
      requestBody:
        $ref: '#/components/requestBodies/TenantSecretRotationRequest'
      parameters:
      - $ref: '#/components/parameters/iclRequestorId'
components:
  schemas:
    TenantSecretListResponseItem:
      type: object
      x-stoplight:
        id: 433171505ae25
      description: Tenant secret and associated tenant
      examples: []
      required:
      - id
      - encryptedSecret
      - secretFingerprint
      - secretPath
      - kmsConfigId
      - tenantId
      - tenantTags
      - secretType
      - migrationStatus
      - rotationStatus
      - created
      - updated
      properties:
        id:
          $ref: '#/components/schemas/TenantSecretId'
          description: null
        encryptedSecret:
          $ref: '#/components/schemas/Base64'
          x-stoplight:
            id: kwhiyztjtw6t7
          description: Encrypted secret
        secretFingerprint:
          type: string
          x-stoplight:
            id: i91bv8ma228fk
          description: Secret fingerprint
        secretPath:
          type: string
          x-stoplight:
            id: qbs3m5gywaz87
          description: Secret path
        kmsConfigId:
          $ref: '#/components/schemas/KmsConfigId'
          x-stoplight:
            id: adnnt8f7p1l6a
          description: KMS config ID associated with the secret
        tenantId:
          $ref: '#/components/schemas/TenantId'
          x-stoplight:
            id: smwov9dluskqn
          description: Tenant ID
        tenantTags:
          type: array
          x-stoplight:
            id: s9sra6ap663qr
          description: Tags for the associated tenant
          items:
            $ref: '#/components/schemas/TagId'
            x-stoplight:
              id: 5dcq14yuo54ui
        secretType:
          $ref: '#/components/schemas/TenantSecretType'
          x-stoplight:
            id: svl67tbe89a42
          description: Tenant secret type
        migrationStatus:
          $ref: '#/components/schemas/TenantSecretMigrationStatus'
          x-stoplight:
            id: vchcr5pjtfwmh
          description: Tenant secret migration status
        rotationStatus:
          $ref: '#/components/schemas/TenantSecretRotationStatus'
          x-stoplight:
            id: wwyy4ebz98pzb
          description: Tenant secret rotation status
        created:
          $ref: '#/components/schemas/Timestamp'
          x-stoplight:
            id: jglsmymnb64xb
          description: When the secret was created
        updated:
          $ref: '#/components/schemas/Timestamp'
          x-stoplight:
            id: s4cdbls33bqxv
          description: When the secret was last updated
    Base64:
      type: string
      title: Base64
      examples:
      - AgA4eyJfZGlkXyI6IjVkMW
      pattern: ^[A-Za-z0-9+/=]+
      description: Base 64 string
    KmsConfigId:
      type: integer
      title: KmsConfigId
      description: KMS configuration ID
      minimum: 1
      examples: []
    TenantSecretType:
      title: TenantSecretType
      x-stoplight:
        id: 6tsvm23gtbykk
      type: string
      enum:
      - Search
      - Deterministic
      - Vector
      description: Tenant secret type
    TenantSecret:
      title: TenantSecret
      x-stoplight:
        id: nac6edess8wor
      type: object
      description: Tenant secret
      examples: []
      required:
      - id
      - encryptedSecret
      - secretFingerprint
      - secretPath
      - kmsConfigId
      - migrationStatus
      - rotationStatus
      - secretType
      - created
      - updated
      properties:
        id:
          $ref: '#/components/schemas/TenantSecretId'
          description: null
        encryptedSecret:
          $ref: '#/components/schemas/Base64'
          x-stoplight:
            id: sukmeyogx5sbv
          description: Encrypted secret
        secretFingerprint:
          type: string
          x-stoplight:
            id: pb279d2cktd7m
          description: Secret fingerprint
        secretPath:
          type: string
          x-stoplight:
            id: loog4cu54c1lc
          description: Secret path
        kmsConfigId:
          $ref: '#/components/schemas/KmsConfigId'
          x-stoplight:
            id: gk35ew9a6pyca
          description: KMS config ID associated with the secret
        migrationStatus:
          $ref: '#/components/schemas/TenantSecretMigrationStatus'
          x-stoplight:
            id: 97p44y2qkt68d
          description: Tenant secret migration status
        rotationStatus:
          $ref: '#/components/schemas/TenantSecretRotationStatus'
          x-stoplight:
            id: u5n9owuiocu0l
          description: Tenant secret rotation status
        secretType:
          $ref: '#/components/schemas/TenantSecretType'
          x-stoplight:
            id: z4uhgpfgcptxx
          description: Tenant secret type
        created:
          $ref: '#/components/schemas/Timestamp'
          x-stoplight:
            id: g262o2x4op23k
          description: When the secret was created
        updated:
          $ref: '#/components/schemas/Timestamp'
          x-stoplight:
            id: omqiwjcnjtz6k
          description: When the secret was last updated
    TenantSecretRotationStatus:
      title: TenantSecretRotationStatus
      x-stoplight:
        id: r2mqglmci0t5p
      type: string
      description: Tenant secret rotation status
      enum:
      - Current
      - InRotation
      - Archived
    TenantSecretMigrationStatus:
      title: TenantSecretMigrationStatus
      x-stoplight:
        id: 9c7cb0oukecfv
      type: string
      description: Tenant secret migration status
      enum:
      - Current
      - NeedsMigration
    TenantSecretId:
      title: TenantSecretId
      x-stoplight:
        id: uyvb59g8tky6a
      type: integer
      description: Tenant Secret ID
      minimum: 1
    TagId:
      title: TagId
      x-stoplight:
        id: suvs45x4i6s3z
      type: integer
      description: Tag ID
      minimum: 1
    Timestamp:
      type: string
      title: Timestamp
      description: RFC3339 timestamp
      pattern: ^((?:(\d{4}-\d{2}-\d{2})T(\d{2}:\d{2}:\d{2}(?:\.\d+)?))(Z|[\+-]\d{2}:\d{2})?)$
      examples:
      - '2022-01-13T21:44:43.653Z'
      example: '2022-01-13T21:44:43.653Z'
    TenantId:
      title: TenantId
      type: string
      description: Tenant ID
      examples:
      - tenant-icl
  parameters:
    sortDirection:
      name: sortDirection
      in: query
      required: false
      schema:
        type: string
        default: desc
        enum:
        - asc
        - desc
      description: Direction to sort
    page:
      name: page
      in: query
      required: false
      schema:
        type: integer
        default: 1
        minimum: 1
      description: Page number to return
    secretType:
      name: secretType
      in: query
      required: false
      schema:
        type: string
        enum:
        - search
        - deterministic-encryption
        - vector
      description: Tenant secret type to filter to
    rotationStatus:
      name: rotationStatus
      in: query
      required: false
      schema:
        type: string
        enum:
        - current
        - in-rotation
        - archived
      description: Tenant secret rotation status to filter to
    migrationStatus:
      name: migrationStatus
      in: query
      required: false
      schema:
        type: string
        enum:
        - current
        - needs-migration
      description: Tenant secret migration status to filter to
    iclRequestorId:
      name: icl-requestor-id
      in: header
      required: true
      schema:
        type: string
      description: ID of requesting user/service
    tenantId:
      name: tenantId
      in: path
      required: true
      schema:
        type: string
      description: Tenant ID
    pageSize:
      name: pageSize
      in: query
      required: false
      schema:
        type: integer
        minimum: 1
        default: 10
      description: Number of entries returned per page
  responses:
    TenantSecretRotationResponse:
      description: Response from either a tenant secret rotation begin request or a tenant secret rotation commit request.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/TenantSecret'
    TenantSecretListResponse:
      description: Result of listing tenant secrets
      content:
        application/json:
          schema:
            type: object
            required:
            - result
            - page
            - totalPages
            properties:
              result:
                type: array
                x-stoplight:
                  id: 0nlg4galhu6um
                description: Tenant secrets
                items:
                  $ref: '#/components/schemas/TenantSecretListResponseItem'
                  x-stoplight:
                    id: bdcze7yetefsm
              page:
                type: integer
                x-stoplight:
                  id: 8r26d7is9iujk
                description: Current response page number
              totalPages:
                type: integer
                x-stoplight:
                  id: 6kjzc0mmoy9jl
                description: Total number of response pages
  requestBodies:
    TenantSecretListRequest:
      content:
        application/json:
          schema:
            type: object
            properties:
              ids:
                type: array
                x-stoplight:
                  id: 0t3d64ldpj52d
                description: Tenant secret IDs to filter to
                items:
                  $ref: '#/components/schemas/TenantSecretId'
                  x-stoplight:
                    id: 9b9sqv0leq3pm
              tags:
                type: array
                x-stoplight:
                  id: s48pq66izzg54
                items:
                  $ref: '#/components/schemas/TagId'
                  x-stoplight:
                    id: pwbgrj99r85zp
      description: List tenant secrets, optionally filtered to specific secret IDs
    TenantSecretRotationRequest:
      content:
        application/json:
          schema:
            oneOf:
            - properties:
                id:
                  $ref: '#/components/schemas/TenantSecretId'
                  x-stoplight:
                    id: t6pcrolm8iuq8
                  description: Tenant secret ID to operate on
              required:
              - id
            - x-stoplight:
                id: 0025qo9kg0u5u
              properties:
                secretType:
                  $ref: '#/components/schemas/TenantSecretType'
                  x-stoplight:
                    id: y0v05uijhgk7l
                  description: Tenant secret type to operate on
                secretPath:
                  type: string
                  x-stoplight:
                    id: e8fc09y0tli5x
                  description: Tenant secret path to operate on
              required:
              - secretType
              - secretPath
            type: object
      description: 'Request to begin or commit a tenant secret rotation.

        If `id` is specified, the tenant secret with that ID will be operated on.

        If `secretType` and `secretPath` are specified, beginning rotation mark the Current tenant secret as InRotation, while committing rotation will mark the InRotation tenant secret as Archived (archived tenant secrets are still used for decryption).'
  securitySchemes:
    Authorization:
      name: Authorization
      type: apiKey
      in: header
      description: 'VAB authorization header. Form: `vab:1:<API_KEY>`'
x-stoplight:
  id: jiu0tsbmtfigo