awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update existing endpoints in API reference to support Identities, update Identities docs

Browse Source
This commit is contained in:
Tuan Dang
2023-12-11 20:01:32 +07:00
parent f3e8ef1537
commit 5f29562fad
40 changed files with 924 additions and 333 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
docs/api-reference/endpoints/organizations/workspaces.mdx
View File

@@ -2,3 +2,9 @@
title: "Get Projects"
openapi: "GET /api/v2/organizations/{organizationId}/workspaces"
---
<Warning>
This endpoint will be deprecated in the near future in Q1/Q2 2024.
We recommend switching to using [identities](/documentation/platform/identities/overview).
</Warning>

6
docs/api-reference/endpoints/service-tokens/get.mdx
View File

@@ -2,3 +2,9 @@
title: "Get"
openapi: "GET /api/v2/service-token/"
---
<Warning>
This endpoint will be deprecated in the near future with the removal of service tokens in Q1/Q2 2024.
We recommend switching to using [identities](/documentation/platform/identities/overview).
</Warning>

6
docs/api-reference/endpoints/users/me.mdx
View File

@@ -2,3 +2,9 @@
title: "Get My User"
openapi: "GET /api/v2/users/me"
---
<Warning>
This endpoint will be deprecated in the near future in Q1/Q2 2024.
We recommend switching to using [identities](/documentation/platform/identities/overview).
</Warning>

6
docs/api-reference/endpoints/users/my-organizations.mdx
View File

@@ -2,3 +2,9 @@
title: "Get My Organizations"
openapi: "GET /api/v2/users/me/organizations"
---
<Warning>
This endpoint will be deprecated in the near future in Q1/Q2 2024.
We recommend switching to using [identities](/documentation/platform/identities/overview).
</Warning>

5
docs/api-reference/endpoints/workspaces/workspace-key.mdx
View File

@@ -2,3 +2,8 @@
title: "Get Key"
openapi: "GET /api/v2/workspace/{workspaceId}/encrypted-key"
---
<Warning>
This endpoint will be deprecated in the near future in Q1/Q2 2024.
We recommend using Infisical in non-E2EE mode going forward.
</Warning>

112
docs/api-reference/overview/authentication.mdx
View File

@@ -3,29 +3,105 @@ title: "Authentication"
description: "How to authenticate with the Infisical Public API"
---
The Public API accepts multiple modes of authentication being via [Infisical Token](/documentation/platform/token) or API Key.
You can authenticate with the Infisical API using [Identities](/documentation/platform/identities/overview) with the [Universal Auth](/documentation/platform/identities/universal-auth) authentication method.
- [Infisical Token](/documentation/platform/token): Provides short-lived, scoped CRUD access to the secrets of a specific project and environment.
- API Key: Provides full access to all endpoints representing the user without ability to encrypt/decrypt secrets for **E2EE** endpoints.
In the following steps, we explore how to create an identity representing a workload or application to access the Infisical API.
<Tabs>
<Tab title="Infisical Token">
The Infisical Token mode uses an Infisical Token to authenticate with the API.
<Steps>
<Step title="Creating an identity">
To create an identity, head to your Organization Settings > Access Control > Machine Identities and press **Create identity**.
To authenticate requests with Infisical using the Infisical Token, you must include your Infisical Token in the `Authorization` header of HTTP requests made to the platform with the value `Bearer <infisical_token>`.
![identities organization](../../images/platform/identities/identities-org.png)
When creating an identity, you specify an organization level [role](/documentation/platform/role-based-access-controls) for it to assume; you can configure roles in Organization Settings > Access Control > Organization Roles.
![identities organization create](../../images/platform/identities/identities-org-create.png)
Once you've created an identity, you'll be prompted to configure the **Universal Auth** authentication method for it.
![identities organization create auth method](../../images/platform/identities/identities-org-create-auth-method.png)
You can obtain an Infisical Token in Project Settings > Service Tokens.
</Step>
<Step title="Creating a Client Secret">
In order to use the identity, you'll need the non-sensitive **Client ID**
of the identity and a **Client Secret** for it; you can think of these credentials akin to a username
and password used to authenticate with the Infisical API. With that, press on the key icon on the identity to generate a **Client Secret**
for it.
![identities client secret create](../../images/platform/identities/identities-org-client-secret.png)
![identities client secret create](../../images/platform/identities/identities-org-client-secret-create-1.png)
![identities client secret create](../../images/platform/identities/identities-org-client-secret-create-2.png)
</Step>
<Step title="Adding an identity to a project">
To enable the identity to access project-level resources such as secrets within a specific project, you should add it to that project.
![token add](../../images/project-token-add.png)
</Tab>
<Tab title="API Key">
The API key mode uses an API key to authenticate with the API.
To do this, head over to the project you want to add the identity to and go to Project Settings > Access Control > Machine Identities and press **Add identity**.
To authenticate requests with Infisical using the API Key, you must include an API key in the `X-API-KEY` header of HTTP requests made to the platform.
Next, select the identity you want to add to the project and the role you want to assign it.
You can obtain an API key in User Settings > API Keys
![identities project](../../images/platform/identities/identities-project.png)
![identities project create](../../images/platform/identities/identities-project-create.png)
</Step>
<Step title="Accessing the Infisical API with the identity">
To access the Infisical API as the identity, you should first perform a login operation
that is to exchange the **Client ID** and **Client Secret** of the identity for an access token
by making a request to the `/api/v1/auth/universal-auth/login` endpoint.
#### Sample request
![API key dashboard](../../images/api-key-dashboard.png)
![API key in personal settings](../../images/api-key-settings.png)
</Tab>
</Tabs>
```
curl --location --request POST 'https://app.infisical.com/api/v1/auth/universal-auth/login' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'clientSecret=...' \
--data-urlencode 'clientId=...'
```
#### Sample response
```
{
"accessToken": "...",
"expiresIn": 7200,
"tokenType": "Bearer"
}
```
Next, you can use the access token to authenticate with the [Infisical API](/api-reference/overview/introduction)
<Note>
Each identity access token has a time-to-live (TLL) which you can infer from the response of the login operation;
the default TTL is `7200` seconds which can be adjusted.
If an identity access token expires, it can no longer authenticate with the Infisical API. In this case,
a new access token should be obtained from the aforementioned login operation.
</Note>
</Step>
</Steps>
**FAQ**
<AccordionGroup>
<Accordion title="What happened to the Service Token and API Key authentication modes?">
The Service Token and API Key authentication modes are being deprecated out in favor of [Identities](/documentation/platform/identity).
We expect to make a deprecation notice in the coming months alongside a larger deprecation initiative planned for Q1/Q2 2024.
With identities, we're improving significantly over the shortcomings of Service Tokens and API Keys. Amongst many differences, identities provide broader access over the Infisical API, utilizes the same role-based
permission system used by users, and comes with ample more configurable security measures.
</Accordion>
<Accordion title="Why can I not create, read, update, or delete an identity?">
There are a few reasons for why this might happen:
- You have insufficient organization permissions to create, read, update, delete identities.
- The identity you are trying to read, update, or delete is more privileged than yourself.
- The role you are trying to create an identity for or update an identity to is more privileged than yours.
</Accordion>
<Accordion title="Why is the Infisical API rejecting my identity credentials?">
There are a few reasons for why this might happen:
- The client secret or access token has expired.
- The identity is insufficently permissioned to interact with the resources you wish to access.
- You are attempting to access a `/raw` secrets endpoint that requires your project to disable E2EE.
- The client secret/access token is being used from an untrusted IP.
</Accordion>
</AccordionGroup>

18
docs/api-reference/overview/blind-indices.mdx
View File

@@ -1,18 +0,0 @@
---
title: "Blind Indices"
---
In April 2023, we added the capability for users to query for secrets by name to improve the user experience of Infisical. Previously, it was only possible to query by id of the secret or fetch all secrets belonging to a project and environment.
Blind indexing must be enabled for projects created prior to April 2023 to take effect. If your project can be blind indexed, then you'll see a section in your project settings appear as shown below:
![project enable blind indices](../../images/project-settings-blind-indices.png)
It works using virtually irreversible blind indices generated by applying `argon2id` to the name of each secret and a random 128-bit salt assigned to each project on the server. We continue to keep the values of secrets E2EE by default.
You can read more about it [here](/security/mechanics).
<Note>
As previously mentioned, all projects made after April 2023 are automatically blind indexed. If you created a project before this date, you have to enable it manually in your project settings.
</Note>

4
docs/api-reference/overview/examples/e2ee-enabled.mdx
View File

@@ -2,6 +2,10 @@
title: "E2EE Enabled"
---
<Note>
E2EE enabled mode only works with Service Tokens and cannot be used with [Identities](/documentation/platform/identities/overview).
</Note>
Using Infisical's API to read/write secrets with E2EE enabled allows you to create, update, and retrieve secrets
but requires you to perform client-side encryption/decryption operations. For this reason, we recommend using one of the available
SDKs instead.

6
docs/api-reference/overview/introduction.mdx
View File

@@ -6,8 +6,4 @@ Infisical's Public (REST) API provides users an alternative way to programmatica
secrets via HTTPS requests. This can be useful for automating tasks, such as
rotating credentials, or for integrating secret management into a larger system.
With the Public API, users can create, read, update, and delete secrets, as well as manage access control, query audit logs, and more.
<Warning>
In April 2023, we added the capability for users to query for secrets by name to improve the user experience of Infisical. If your project was created prior to April 2023, please read and follow the section on [blind indices](./blind-indices) and how to enable them for better usage of Infisical.
</Warning>
With the Public API, you can create, read, update, and delete secrets, as well as manage access control, query audit logs, and more.

54
docs/documentation/platform/identities/overview.mdx Normal file
View File

@@ -0,0 +1,54 @@
---
title: Identities
description: "Programmatically interact with Infisical"
---
<Note>
Currently, identities can only be used to make authenticated requests to the Infisical API and do not work with any clients such as [Node SDK](https://github.com/Infisical/infisical-node)
, [Python SDK](https://github.com/Infisical/infisical-python), CLI, K8s operator, Terraform Provider, etc.
We will be releasing compatibility with it across clients in the coming quarter.
</Note>
## Concept
A (machine) identity is an entity that you can create in an Infisical organization to represent a workload or application that requires access to the Infisical API. This is conceptually similar to an IAM user in AWS or service account in Google Cloud Platform (GCP).
Each identity must authenticate with the API using a supported authentication method like [Universal Auth](/documentation/platform/identities/universal-auth) to get back a short-lived access token to be used in subsequent requests.
Key Features:
- Role Assignment: Identities must be assigned [roles](/documentation/platform/role-based-access-controls). These roles determine the scope of access to resources, either at the organization level or project level.
- Auth/Token Configuration: Identities must be configured with auth methods and access token properties to securely interact with the Infisical API.
## Workflow
A typical workflow for using identities consists of four steps:
1. Creating the identity with a name and [role](/documentation/platform/role-based-access-controls) in Organization Access Control > Machine Identities.
This step also involves configuring an authentication method for it such as [Universal Auth](/documentation/platform/identities/universal-auth).
2. Adding the identity to the project(s) you want it to have access to.
3. Authenticating the identity with the Infisical API based on the configured authentication method on it and receiving a short-lived access token back.
4. Authenticating subsequent requests with the Infisical API using the short-lived access token.
Check out the following authentication method-specific guides for step-by-step instruction on how to use identities to access Infisical:
- [Universal Auth](/documentation/platform/identities/universal-auth)
**FAQ**
<AccordionGroup>
<Accordion title="What is the difference between an identity and service token?">
A service token is a project-level authentication method that is being phased out in favor of identities.
Amongst many differences, identities provide broader access over the Infisical API, utilizes the same role-based
permission system used by users, and comes with ample more configurable authentication and security features.
</Accordion>
<Accordion title="Why can I not create, read, update, or delete an identity?">
There are a few reasons for why this might happen:
- You have insufficient organization permissions to create, read, update, delete identities.
- The identity you are trying to read, update, or delete is more privileged than yourself.
- The role you are trying to create an identity for or update an identity to is more privileged than yours.
</Accordion>
</AccordionGroup>

80
docs/documentation/platform/identity.mdx → docs/documentation/platform/identities/universal-auth.mdx
View File

@@ -1,44 +1,34 @@
---
title: Identity
description: "Programmatically interact with Infisical"
title: Universal Auth
description: "Authenticate with Infisical from any platform/environment"
---
A (machine) identity is an entity that you can create in Infisical.
Each identity represents a workload that wishes to access the Infisical API via an authentication method; this is similar to an IAM user in AWS or service account in GCP.
**Universal Auth** is the most versatile authentication method that can be configured on an identity from any platform/environment to access Infisical.
An identity can be provisioned scoped access to resources at the organization or project-level via [role-based access controls (RBAC)](/documentation/platform/role-based-access-controls). For instance, you may create a identity with scoped access to
fetch secrets back from the `/` path of the `development` environment in some project.
In this method, each identity is given a **Client ID** for which you can generate one or more **Client Secret(s)**. Together, a **Client ID** and **Client Secret** can be exchanged for an access token to authenticate with the Infisical API.
<Note>
The identity feature is in beta.
Currently, an identity can only be used to make authenticated requests to the Infisical API and does not work with any clients such as [Node SDK](https://github.com/Infisical/infisical-node)
, [Python SDK](https://github.com/Infisical/infisical-python), CLI, K8s operator, Terraform Provider, etc.
## Properties
We will be releasing compatibility with it across clients in the coming quarter.
</Note>
Universal Auth supports many settings that can be beneficial for tightening your workflow security configuration:
Each identity can be configured an authentication method. The only supported method at the moment is **Universal Auth (UA)**
which has the following properties:
- Support for restrictions on the number of times that the **Client Secret(s)** and access token(s) can be used.
- Support for expiration, so, if specified, the **Client Secret** of the identity will automatically be defunct after a period of time.
- Support for IP allowlisting; this means you can restrict the usage of **Client Secret(s)** and access token to a specific IP or CIDR range.
- In UA, each identity is assigned a **Client ID** for which you can generate one or more **Client Secret(s)**. Together, a **Client ID** and **Client Secret** can be exchanged for an access token (i.e. login operation) to authenticate with the Infisical API.
- UA supports restrictions on the number of times that the **Client Secret(s)** and access token(s) can be used.
- UA supports token renewal that is the ability to extend the lifetime of a token by its TTL up to its maximum TTL since its creation.
- UA supports IP allowlisting; this means you can restrict the usage of **Client Secret(s)** and access token to a specific IP or CIDR range.
- UA support expiration, so, if specified, the client secret of the identity will automatically be defunct after a period of time.
- UA tracks most recent usage of their client secrets and access tokens; it also keeps track of each token's usage count.
## Workflow
## Using identities
In the following steps, we explore how to create and use identities for your applications to access the Infisical API.
In the following steps, we explore how to create and use identities for your workloads and applications to access the Infisical API
using the Universal Auth authentication method.
<Steps>
<Step title="Creating an identity">
To create an identity, head to your Organization Settings > Access Control > Machine Identities and press **Create identity**.
![machine identities organization](../../images/platform/machine-identity/machine-identity-org.png)
![identities organization](../../images/platform/identities/identities-org.png)
When creating an identity, you specify an organization level [role](/documentation/platform/role-based-access-controls) for it to assume; you can configure roles in Organization Settings > Access Control > Organization Roles.
![machine identities organization create](../../images/platform/machine-identity/machine-identity-org-create.png)
![identities organization create](../../images/platform/identities/identities-org-create.png)
Now input a few details for your new identity. Here's some guidance for each field:
@@ -46,6 +36,10 @@ In the following steps, we explore how to create and use identities for your app
- Role (required): A role from the **Organization Roles** tab to permit the identity to access certain resources.
Once you've created an identity, you'll be prompted to configure the **Universal Auth** authentication method for it.
![identities organization create auth method](../../images/platform/identities/identities-org-create-auth-method.png)
Here's some more guidance on each field:
- Access Token TTL (default is `7200`): The incremental lifetime for an acccess token in seconds; a value of `0` implies an infinite incremental lifetime.
- Access Token Max TTL (default is `7200`): The maximum lifetime for an acccess token in seconds; a value of `0` implies an infinite maximum lifetime.
@@ -66,9 +60,9 @@ In the following steps, we explore how to create and use identities for your app
and password used to authenticate with the Infisical API. With that, press on the key icon on the identity to generate a **Client Secret**
for it.
![machine identities client secret create](../../images/platform/machine-identity/machine-identity-org-client-secret.png)
![machine identities client secret create](../../images/platform/machine-identity/machine-identity-org-client-secret-create-1.png)
![machine identities client secret create](../../images/platform/machine-identity/machine-identity-org-client-secret-create-2.png)
![identities client secret create](../../images/platform/identities/identities-org-client-secret.png)
![identities client secret create](../../images/platform/identities/identities-org-client-secret-create-1.png)
![identities client secret create](../../images/platform/identities/identities-org-client-secret-create-2.png)
Feel free to input any (optional) details for the **Client Secret** configuration:
@@ -83,13 +77,13 @@ In the following steps, we explore how to create and use identities for your app
Next, select the identity you want to add to the project and the role you want to assign it.
![machine identities project](../../images/platform/machine-identity/machine-identity-project.png)
![identities project](../../images/platform/identities/identities-project.png)
![machine identities project create](../../images/platform/machine-identity/machine-identity-project-create.png)
![identities project create](../../images/platform/identities/identities-project-create.png)
</Step>
<Step title="Accessing the Infisical API with the identity">
To access the Infisical API as the identity, you should first perform a login operation
that is to exchange the **Client ID** and **Client Secret** of the MI for an access token
that is to exchange the **Client ID** and **Client Secret** of the identity for an access token
by making a request to the `/api/v1/auth/universal-auth/login` endpoint.
#### Sample request
@@ -126,12 +120,6 @@ In the following steps, we explore how to create and use identities for your app
**FAQ**
<AccordionGroup>
<Accordion title="What is the difference between an identity and service token?">
A service token is a project-level authentication method that is being phased out in favor of identities.
Amongst many differences, identities provide broader access over the Infisical API, utilizes the same role-based
permission system used by users, and comes with ample more configurable security measures.
</Accordion>
<Accordion title="Why is the Infisical API rejecting my identity credentials?">
There are a few reasons for why this might happen:
@@ -149,20 +137,4 @@ In the following steps, we explore how to create and use identities for your app
Note that the max TTL cannot be less than the TTL for an access token.
</Accordion>
<Accordion title="Why can I not create, read, update, or delete an identity?">
There are a few reasons for why this might happen:
- You have insufficient organization permissions to create, read, update, delete identities.
- The identity you are trying to read, update, or delete is more privileged than yourself.
- The role you are trying to create an identity for or update an identity to is more privileged than yours.
</Accordion>
<Accordion title="Can you provide examples for using glob patterns?">
1. `/**`: This pattern matches all folders at any depth in the directory structure. For example, it would match folders like `/folder1/`, `/folder1/subfolder/`, and so on.
2. `/*`: This pattern matches all immediate subfolders in the current directory. It does not match any folders at a deeper level. For example, it would match folders like `/folder1/`, `/folder2/`, but not `/folder1/subfolder/`.
3. `/*/*`: This pattern matches all subfolders at a depth of two levels in the current directory. It does not match any folders at a shallower or deeper level. For example, it would match folders like `/folder1/subfolder/`, `/folder2/subfolder/`, but not `/folder1/` or `/folder1/subfolder/subsubfolder/`.
4. `/folder1/*`: This pattern matches all immediate subfolders within the `/folder1/` directory. It does not match any folders outside of `/folder1/`, nor does it match any subfolders within those immediate subfolders. For example, it would match folders like `/folder1/subfolder1/`, `/folder1/subfolder2/`, but not `/folder2/subfolder/`.
</Accordion>
</AccordionGroup>

BIN
docs/images/platform/identities/identities-org-client-secret-create-1.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 514 KiB

BIN
docs/images/platform/identities/identities-org-client-secret-create-2.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 504 KiB

BIN
docs/images/platform/identities/identities-org-client-secret.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 678 KiB

BIN
docs/images/platform/identities/identities-org-create-auth-method.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 494 KiB

BIN
docs/images/platform/identities/identities-org-create.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 410 KiB

BIN
docs/images/platform/identities/identities-org.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 656 KiB

BIN
docs/images/platform/identities/identities-project-create.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 414 KiB

BIN
docs/images/platform/identities/identities-project.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 645 KiB

BIN
docs/images/platform/machine-identity/machine-identity-org-client-secret-create-1.png
View File

Binary file not shown.
Side by Side

Before

Width:  |  Height:  |  Size: 1.5 MiB

BIN
docs/images/platform/machine-identity/machine-identity-org-client-secret-create-2.png
View File

Binary file not shown.
Side by Side

Before

Width:  |  Height:  |  Size: 1.5 MiB

BIN
docs/images/platform/machine-identity/machine-identity-org-client-secret.png
View File

Binary file not shown.
Side by Side

Before

Width:  |  Height:  |  Size: 1.3 MiB

BIN
docs/images/platform/machine-identity/machine-identity-org-create.png
View File

Binary file not shown.
Side by Side

Before

Width:  |  Height:  |  Size: 1.3 MiB

BIN
docs/images/platform/machine-identity/machine-identity-org.png
View File

Binary file not shown.
Side by Side

Before

Width:  |  Height:  |  Size: 1.2 MiB

BIN
docs/images/platform/machine-identity/machine-identity-project-create.png
View File

Binary file not shown.
Side by Side

Before

Width:  |  Height:  |  Size: 1.3 MiB

BIN
docs/images/platform/machine-identity/machine-identity-project.png
View File

Binary file not shown.
Side by Side

Before

Width:  |  Height:  |  Size: 1.2 MiB

11
docs/mint.json
View File

@@ -117,8 +117,14 @@
"documentation/platform/webhooks",
"documentation/platform/pit-recovery",
"documentation/platform/audit-logs",
{
"group": "Identities",
"pages": [
"documentation/platform/identities/overview",
"documentation/platform/identities/universal-auth"
]
},
"documentation/platform/token",
"documentation/platform/identity",
"documentation/platform/mfa",
"documentation/platform/pr-workflows",
"documentation/platform/role-based-access-controls",
@@ -317,8 +323,7 @@
"api-reference/overview/examples/e2ee-disabled",
"api-reference/overview/examples/e2ee-enabled"
]
},
"api-reference/overview/blind-indices"
}
]
},
{

316
docs/spec.yaml
View File

@@ -9,6 +9,35 @@ servers:
- url: http://localhost:8080
description: Local server
paths:
/api/v1/identities/:
post:
description: ''
responses:
'200':
description: OK
/api/v1/identities/{identityId}:
patch:
description: ''
parameters:
- name: identityId
in: path
required: true
schema:
type: string
responses:
'200':
description: OK
delete:
description: ''
parameters:
- name: identityId
in: path
required: true
schema:
type: string
responses:
'200':
description: OK
/api/v1/secret/{secretId}/secret-versions:
get:
summary: Return secret versions
@@ -110,7 +139,21 @@ paths:
required: true
schema:
type: string
description: ID of project
description: ID of project where to get secret snapshots for
- name: environment
description: Slug of environment where to get secret snapshots for
required: true
in: query
schema:
type: string
- name: directory
description: >-
Path where to get secret snapshots for like / or /foo/bar. Default
is /
required: false
in: query
schema:
type: string
- name: offset
description: Number of secret snapshots to skip
required: false
@@ -138,6 +181,7 @@ paths:
description: Project secret snapshots
security:
- apiKeyAuth: []
bearerAuth: []
/api/v1/workspace/{workspaceId}/secret-snapshots/count:
get:
description: ''
@@ -164,7 +208,7 @@ paths:
required: true
schema:
type: string
description: ID of project
description: ID of project where to roll back
responses:
'200':
description: OK
@@ -180,6 +224,7 @@ paths:
description: Secrets rolled back to
security:
- apiKeyAuth: []
bearerAuth: []
requestBody:
required: true
content:
@@ -187,6 +232,12 @@ paths:
schema:
type: object
properties:
environment:
type: string
description: Slug of environment where to roll back
directory:
type: string
description: Path where to roll back for like / or /foo/bar. Default is /
version:
type: integer
description: Version of secret snapshot to roll back to
@@ -604,51 +655,6 @@ paths:
responses:
'200':
description: OK
/api/v3/service-token/me/key:
get:
description: ''
responses:
'200':
description: OK
/api/v3/service-token/me/token:
post:
description: ''
responses:
'200':
description: OK
/api/v3/service-token/:
post:
description: ''
responses:
'200':
description: OK
'400':
description: Bad Request
/api/v3/service-token/{serviceTokenDataId}:
patch:
description: ''
parameters:
- name: serviceTokenDataId
in: path
required: true
schema:
type: string
responses:
'200':
description: OK
'400':
description: Bad Request
delete:
description: ''
parameters:
- name: serviceTokenDataId
in: path
required: true
schema:
type: string
responses:
'200':
description: OK
/api/v1/secret-rotation-providers/{workspaceId}:
get:
description: ''
@@ -749,6 +755,101 @@ paths:
responses:
'200':
description: OK
/api/v1/auth/token/renew:
post:
description: ''
responses:
'200':
description: OK
/api/v1/auth/universal-auth/login:
post:
description: ''
parameters:
- name: user-agent
in: header
schema:
type: string
responses:
'200':
description: OK
/api/v1/auth/universal-auth/identities/{identityId}:
post:
description: ''
parameters:
- name: identityId
in: path
required: true
schema:
type: string
responses:
'200':
description: OK
'400':
description: Bad Request
patch:
description: ''
parameters:
- name: identityId
in: path
required: true
schema:
type: string
responses:
'200':
description: OK
'400':
description: Bad Request
get:
description: ''
parameters:
- name: identityId
in: path
required: true
schema:
type: string
responses:
'200':
description: OK
/api/v1/auth/universal-auth/identities/{identityId}/client-secrets:
post:
description: ''
parameters:
- name: identityId
in: path
required: true
schema:
type: string
responses:
'200':
description: OK
get:
description: ''
parameters:
- name: identityId
in: path
required: true
schema:
type: string
responses:
'200':
description: OK
/api/v1/auth/universal-auth/identities/{identityId}/client-secrets/{clientSecretId}/revoke:
post:
description: ''
parameters:
- name: identityId
in: path
required: true
schema:
type: string
- name: clientSecretId
in: path
required: true
schema:
type: string
responses:
'200':
description: OK
/api/v1/admin/config:
get:
description: ''
@@ -1106,6 +1207,8 @@ paths:
responses:
'200':
description: OK
'400':
description: Bad Request
/api/v1/key/{workspaceId}:
post:
description: ''
@@ -2560,8 +2663,8 @@ paths:
description: OK
/api/v2/organizations/{organizationId}/memberships:
get:
summary: Return organization memberships
description: Return organization memberships
summary: Return organization user memberships
description: Return organization user memberships
parameters:
- name: organizationId
in: path
@@ -2584,10 +2687,11 @@ paths:
description: Memberships of organization
security:
- apiKeyAuth: []
bearerAuth: []
/api/v2/organizations/{organizationId}/memberships/{membershipId}:
patch:
summary: Update organization membership
description: Update organization membership
summary: Update organization user membership
description: Update organization user membership
parameters:
- name: organizationId
in: path
@@ -2612,8 +2716,11 @@ paths:
membership:
$ref: '#/components/schemas/MembershipOrg'
description: Updated organization membership
'400':
description: Bad Request
security:
- apiKeyAuth: []
bearerAuth: []
requestBody:
required: true
content:
@@ -2627,8 +2734,8 @@ paths:
Role of organization membership - either owner, admin, or
member
delete:
summary: Delete organization membership
description: Delete organization membership
summary: Delete organization user membership
description: Delete organization user membership
parameters:
- name: organizationId
in: path
@@ -2655,6 +2762,7 @@ paths:
description: Deleted organization membership
security:
- apiKeyAuth: []
bearerAuth: []
/api/v2/organizations/{organizationId}/workspaces:
get:
summary: Return projects in organization that user is part of
@@ -2699,6 +2807,18 @@ paths:
responses:
'200':
description: OK
/api/v2/organizations/{organizationId}/identity-memberships:
get:
description: ''
parameters:
- name: organizationId
in: path
required: true
schema:
type: string
responses:
'200':
description: OK
/api/v2/workspace/{workspaceId}/memberships:
post:
description: ''
@@ -2712,8 +2832,8 @@ paths:
'200':
description: OK
get:
summary: Return project memberships
description: Return project memberships
summary: Return project user memberships
description: Return project user memberships
parameters:
- name: workspaceId
in: path
@@ -2736,6 +2856,7 @@ paths:
description: Memberships of project
security:
- apiKeyAuth: []
bearerAuth: []
/api/v2/workspace/{workspaceId}/environments:
post:
summary: Create environment
@@ -3031,8 +3152,8 @@ paths:
description: OK
/api/v2/workspace/{workspaceId}/memberships/{membershipId}:
patch:
summary: Update project membership
description: Update project membership
summary: Update project user membership
description: Update project user membership
parameters:
- name: workspaceId
in: path
@@ -3059,6 +3180,7 @@ paths:
description: Updated membership
security:
- apiKeyAuth: []
bearerAuth: []
requestBody:
required: true
content:
@@ -3070,8 +3192,8 @@ paths:
type: string
description: Role of membership - either admin or member
delete:
summary: Delete project membership
description: Delete project membership
summary: Delete project user membership
description: Delete project user membership
parameters:
- name: workspaceId
in: path
@@ -3098,6 +3220,7 @@ paths:
description: Deleted membership
security:
- apiKeyAuth: []
bearerAuth: []
/api/v2/workspace/{workspaceId}/auto-capitalization:
patch:
description: ''
@@ -3110,6 +3233,67 @@ paths:
responses:
'200':
description: OK
/api/v2/workspace/{workspaceId}/identity-memberships/{identityId}:
post:
description: ''
parameters:
- name: workspaceId
in: path
required: true
schema:
type: string
- name: identityId
in: path
required: true
schema:
type: string
responses:
'200':
description: OK
patch:
description: ''
parameters:
- name: workspaceId
in: path
required: true
schema:
type: string
- name: identityId
in: path
required: true
schema:
type: string
responses:
'200':
description: OK
delete:
description: ''
parameters:
- name: workspaceId
in: path
required: true
schema:
type: string
- name: identityId
in: path
required: true
schema:
type: string
responses:
'200':
description: OK
/api/v2/workspace/{workspaceId}/identity-memberships:
get:
description: ''
parameters:
- name: workspaceId
in: path
required: true
schema:
type: string
responses:
'200':
description: OK
/api/v2/secret/batch-create/workspace/{workspaceId}/environment/{environment}:
post:
description: ''
@@ -3842,18 +4026,6 @@ paths:
responses:
'200':
description: OK
/api/v3/workspaces/{workspaceId}/service-token:
get:
description: ''
parameters:
- name: workspaceId
in: path
required: true
schema:
type: string
responses:
'200':
description: OK
/api/v3/signup/complete-account/signup:
post:
description: ''
@@ -4424,7 +4596,7 @@ components:
type: http
scheme: bearer
bearerFormat: JWT
description: A service token in Infisical
description: An access token in Infisical
apiKeyAuth:
type: apiKey
in: header