Tower Secrets API

openapi: 3.1.0
info:
  contact:
    email: hello@tower.dev
    name: Tower Computing GmbH
    url: https://tower.dev
  description: REST API to interact with Tower Services.
  termsOfService: https://tower.dev/terms
  title: Tower Accounts Secrets API
  version: v0.11.16
servers:
- url: https://api.tower.dev/v1
tags:
- name: Secrets
paths:
  /secrets:
    get:
      description: Lists all the secrets associated with your current account.
      operationId: list-secrets
      parameters:
      - description: The page number to fetch.
        explode: false
        in: query
        name: page
        schema:
          default: 1
          description: The page number to fetch.
          format: int64
          type: integer
      - description: The number of records to fetch on each page.
        explode: false
        in: query
        name: page_size
        schema:
          default: 20
          description: The number of records to fetch on each page.
          format: int64
          type: integer
      - description: The environment to filter by.
        explode: false
        in: query
        name: environment
        schema:
          description: The environment to filter by.
          type: string
      - description: Whether to fetch all secrets or only the ones that are not marked as deleted.
        explode: false
        in: query
        name: all
        schema:
          description: Whether to fetch all secrets or only the ones that are not marked as deleted.
          type: boolean
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListSecretsResponse'
          description: OK
        default:
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ErrorModel'
          description: Error
      security:
      - AccessTokenAuth:
        - secrets:read
      - APIKeyAuth:
        - secrets:read
      summary: List secrets
      tags:
      - Secrets
    post:
      description: Creates a new secret and associates it with the current account.
      operationId: create-secret
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateSecretParams'
        required: true
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateSecretResponse'
          description: Created
        '401':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorModel'
          description: Unauthorized
        '409':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorModel'
          description: Conflict
        '412':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorModel'
          description: Validation Error (Precondition Failed)
        '500':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorModel'
          description: Internal Server Error
      security:
      - AccessTokenAuth:
        - secrets:create
      - APIKeyAuth:
        - secrets:create
      summary: Create secret
      tags:
      - Secrets
  /secrets/environments:
    get:
      description: Lists all the environments associated with secrets.
      operationId: list-secret-environments
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListSecretEnvironmentsResponse'
          description: OK
        default:
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ErrorModel'
          description: Error
      security:
      - AccessTokenAuth:
        - secrets:read
      - APIKeyAuth:
        - secrets:read
      summary: List secret environments
      tags:
      - Secrets
  /secrets/export:
    post:
      description: Lists all the secrets in your current account and re-encrypt them with the public key you supplied.
      operationId: export-secrets
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ExportSecretsParams'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExportSecretsResponse'
          description: OK
        default:
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ErrorModel'
          description: Error
      security:
      - AccessTokenAuth:
        - secrets:read
      - APIKeyAuth:
        - secrets:read
      summary: Export secrets
      tags:
      - Secrets
  /secrets/key:
    get:
      description: Gets the encryption key used for encrypting secrets that you want to create in Tower.
      operationId: describe-secrets-key
      parameters:
      - description: The format to return the key in. Options are 'pkcs1' and 'spki'.
        explode: false
        in: query
        name: format
        schema:
          description: The format to return the key in. Options are 'pkcs1' and 'spki'.
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DescribeSecretsKeyResponse'
          description: OK
        default:
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ErrorModel'
          description: Error
      security:
      - AccessTokenAuth:
        - secrets:read
      - APIKeyAuth:
        - secrets:read
      summary: Describe encryption key
      tags:
      - Secrets
  /secrets/{name}:
    delete:
      description: Delete a secret by name.
      operationId: delete-secret
      parameters:
      - description: The name of the secret to delete.
        in: path
        name: name
        required: true
        schema:
          description: The name of the secret to delete.
          type: string
      - description: The environment of the secret to delete.
        explode: false
        in: query
        name: environment
        schema:
          description: The environment of the secret to delete.
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DeleteSecretResponse'
          description: OK
        default:
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ErrorModel'
          description: Error
      security:
      - AccessTokenAuth:
        - secrets:delete
      - APIKeyAuth:
        - secrets:delete
      summary: Delete secret
      tags:
      - Secrets
    put:
      description: Updates a secret that has previously been created in your account
      operationId: update-secret
      parameters:
      - in: path
        name: name
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateSecretParams'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UpdateSecretResponse'
          description: OK
        default:
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ErrorModel'
          description: Error
      security:
      - AccessTokenAuth:
        - secrets:update
      - APIKeyAuth:
        - secrets:update
      summary: Update secret
      tags:
      - Secrets
components:
  schemas:
    DescribeSecretsKeyResponse:
      additionalProperties: false
      properties:
        $schema:
          description: A URL to the JSON Schema for this object.
          examples:
          - https://api.tower.dev/v1/schemas/DescribeSecretsKeyResponse.json
          format: uri
          readOnly: true
          type: string
        public_key:
          type: string
      required:
      - public_key
      type: object
    ExportedSecret:
      additionalProperties: false
      properties:
        created_at:
          format: date-time
          type: string
        encrypted_value:
          type: string
        environment:
          type: string
        name:
          type: string
      required:
      - name
      - environment
      - encrypted_value
      - created_at
      type: object
    CreateSecretResponse:
      additionalProperties: false
      properties:
        $schema:
          description: A URL to the JSON Schema for this object.
          examples:
          - https://api.tower.dev/v1/schemas/CreateSecretResponse.json
          format: uri
          readOnly: true
          type: string
        secret:
          $ref: '#/components/schemas/Secret'
      required:
      - secret
      type: object
    Secret:
      additionalProperties: false
      properties:
        created_at:
          format: date-time
          type: string
        environment:
          type: string
        name:
          type: string
        preview:
          type: string
      required:
      - name
      - environment
      - preview
      - created_at
      type: object
    ListSecretsResponse:
      additionalProperties: false
      properties:
        $schema:
          description: A URL to the JSON Schema for this object.
          examples:
          - https://api.tower.dev/v1/schemas/ListSecretsResponse.json
          format: uri
          readOnly: true
          type: string
        pages:
          $ref: '#/components/schemas/Pagination'
        secrets:
          items:
            $ref: '#/components/schemas/Secret'
          type: array
      required:
      - pages
      - secrets
      type: object
    UpdateSecretParams:
      additionalProperties: false
      properties:
        $schema:
          description: A URL to the JSON Schema for this object.
          examples:
          - https://api.tower.dev/v1/schemas/UpdateSecretParams.json
          format: uri
          readOnly: true
          type: string
        encrypted_value:
          type: string
        environment:
          type: string
        preview:
          type: string
      required:
      - environment
      - encrypted_value
      - preview
      type: object
    ExportSecretsParams:
      additionalProperties: false
      properties:
        $schema:
          description: A URL to the JSON Schema for this object.
          examples:
          - https://api.tower.dev/v1/schemas/ExportSecretsParams.json
          format: uri
          readOnly: true
          type: string
        all:
          default: false
          description: Whether to fetch all secrets or only the ones that are not marked as deleted.
          type: boolean
        environment:
          default: default
          description: The environment to filter by.
          type: string
        page:
          default: 1
          description: The page number to fetch.
          format: int64
          type: integer
        page_size:
          default: 20
          description: The number of records to fetch on each page.
          format: int64
          type: integer
        public_key:
          description: The PEM-encoded public key you want to use to encrypt sensitive secret values.
          type: string
      required:
      - public_key
      - environment
      - all
      - page
      - page_size
      type: object
    ExportSecretsResponse:
      additionalProperties: false
      properties:
        $schema:
          description: A URL to the JSON Schema for this object.
          examples:
          - https://api.tower.dev/v1/schemas/ExportSecretsResponse.json
          format: uri
          readOnly: true
          type: string
        pages:
          $ref: '#/components/schemas/Pagination'
        secrets:
          items:
            $ref: '#/components/schemas/ExportedSecret'
          type: array
      required:
      - pages
      - secrets
      type: object
    ErrorModel:
      additionalProperties: false
      properties:
        $schema:
          description: A URL to the JSON Schema for this object.
          examples:
          - https://api.tower.dev/v1/schemas/ErrorModel.json
          format: uri
          readOnly: true
          type: string
        detail:
          description: A human-readable explanation specific to this occurrence of the problem.
          examples:
          - Property foo is required but is missing.
          type: string
        errors:
          description: Optional list of individual error details
          items:
            $ref: '#/components/schemas/ErrorDetail'
          type: array
        instance:
          description: A URI reference that identifies the specific occurrence of the problem.
          examples:
          - https://example.com/error-log/abc123
          format: uri
          type: string
        status:
          description: HTTP status code
          examples:
          - 400
          format: int64
          type: integer
        title:
          description: A short, human-readable summary of the problem type. This value should not change between occurrences of the error.
          examples:
          - Bad Request
          type: string
        type:
          default: about:blank
          description: A URI reference to human-readable documentation for the error.
          examples:
          - https://example.com/errors/example
          format: uri
          type: string
      type: object
    UpdateSecretResponse:
      additionalProperties: false
      properties:
        $schema:
          description: A URL to the JSON Schema for this object.
          examples:
          - https://api.tower.dev/v1/schemas/UpdateSecretResponse.json
          format: uri
          readOnly: true
          type: string
        secret:
          $ref: '#/components/schemas/Secret'
      required:
      - secret
      type: object
    ListSecretEnvironmentsResponse:
      additionalProperties: false
      properties:
        $schema:
          description: A URL to the JSON Schema for this object.
          examples:
          - https://api.tower.dev/v1/schemas/ListSecretEnvironmentsResponse.json
          format: uri
          readOnly: true
          type: string
        environments:
          items:
            type: string
          type: array
      required:
      - environments
      type: object
    DeleteSecretResponse:
      additionalProperties: false
      properties:
        $schema:
          description: A URL to the JSON Schema for this object.
          examples:
          - https://api.tower.dev/v1/schemas/DeleteSecretResponse.json
          format: uri
          readOnly: true
          type: string
        secret:
          $ref: '#/components/schemas/Secret'
      required:
      - secret
      type: object
    ErrorDetail:
      additionalProperties: false
      properties:
        location:
          description: Where the error occurred, e.g. 'body.items[3].tags' or 'path.thing-id'
          type: string
        message:
          description: Error message text
          type: string
        value:
          description: The value at the given location
      type: object
    Pagination:
      additionalProperties: false
      properties:
        num_pages:
          format: int64
          type: integer
        page:
          format: int64
          type: integer
        page_size:
          format: int64
          type: integer
        total:
          format: int64
          type: integer
      required:
      - page
      - total
      - num_pages
      - page_size
      type: object
    CreateSecretParams:
      additionalProperties: false
      properties:
        $schema:
          description: A URL to the JSON Schema for this object.
          examples:
          - https://api.tower.dev/v1/schemas/CreateSecretParams.json
          format: uri
          readOnly: true
          type: string
        encrypted_value:
          type: string
        environment:
          type: string
        name:
          type: string
        preview:
          type: string
      required:
      - name
      - environment
      - encrypted_value
      - preview
      type: object
  securitySchemes:
    APIKeyAuth:
      description: API key created by a Tower user or Tower service account to authenticate an API request.
      in: header
      name: X-API-Key
      type: apiKey
    AccessTokenAuth:
      description: Access token authentication scheme which uses an access token provided by the Tower API as part of a Tower session (see documentation about creating sessions).
      scheme: Bearer
      type: http