Vault
The Vault operations of the Hub REST API (6 operations).
bearerAuthAuthorizationBearer <API key>Pod API key (Bearer) issued via /api/hub/setup/agent or pod admin tooling. Browser/web clients may use the X-Session-Token header instead. See GET /api/hub/auth/status to introspect the calling key.
application/json- body
workspaceId?stringagentUserId?stringchannelId?stringsourceMessageId?stringsecretType*stringSecret class (e.g. api_key, oauth_token).
service*stringService the secret unlocks (e.g. github).
purpose*stringHuman-readable rationale shown to the user.
accessLevel?stringDefaults to 'read'.
ttl?numberMinutes the grant lives. Defaults to 60.
Pending proposal id
application/json- response
status*"pending""pending"proposalId*stringmessage*stringcurl -X POST 'https://pod.example.com/api/hub/vault/request' \ -H 'Content-Type: application/json' \ -d '{ "secretType": "string", "service": "string", "purpose": "string"}'{ "status": "pending", "proposalId": "string", "message": "string"}bearerAuthAuthorizationBearer <API key>Pod API key (Bearer) issued via /api/hub/setup/agent or pod admin tooling. Browser/web clients may use the X-Session-Token header instead. See GET /api/hub/auth/status to introspect the calling key.
proposalId*stringRequest outcome
application/json- response
status*stringvaultRef*string|nullscope*string|nullexpiresAt*string|nullcurl -X GET 'https://pod.example.com/api/hub/vault/request/string'{ "status": "string", "vaultRef": "string", "scope": "string", "expiresAt": "string"}bearerAuthAuthorizationBearer <API key>Pod API key (Bearer) issued via /api/hub/setup/agent or pod admin tooling. Browser/web clients may use the X-Session-Token header instead. See GET /api/hub/auth/status to introspect the calling key.
application/json- body
ref*stringResolved secret value
application/json- response
value*stringcurl -X POST 'https://pod.example.com/api/hub/vault/redeem' \ -H 'Content-Type: application/json' \ -d '{ "ref": "string"}'{ "value": "string"}bearerAuthAuthorizationBearer <API key>Pod API key (Bearer) issued via /api/hub/setup/agent or pod admin tooling. Browser/web clients may use the X-Session-Token header instead. See GET /api/hub/auth/status to introspect the calling key.
workspaceId?stringuuidSecret metadata list
application/json- response
secrets*array<>curl -X GET 'https://pod.example.com/api/hub/vault/secrets'{ "secrets": [ { "id": "string", "name": "string", "type": "string", "service": "string", "url": "string", "category": "string", "createdAt": "string" } ]}bearerAuthAuthorizationBearer <API key>Pod API key (Bearer) issued via /api/hub/setup/agent or pod admin tooling. Browser/web clients may use the X-Session-Token header instead. See GET /api/hub/auth/status to introspect the calling key.
application/json- body
workspaceId?stringuuidname*string1 <= length <= 255type?string"password""api_key""credential""note""card""identity""ssh_key""certificate""env_variable""database""oauth"service?stringvalue*string|description?stringlength <= 1000url?stringagentUserId?stringStored secret metadata
application/json- response
id*stringname*stringtype*stringvaultRef*stringcurl -X POST 'https://pod.example.com/api/hub/vault/secrets' \ -H 'Content-Type: application/json' \ -d '{ "name": "string", "value": "string"}'{ "id": "string", "name": "string", "type": "string", "vaultRef": "string"}bearerAuthAuthorizationBearer <API key>Pod API key (Bearer) issued via /api/hub/setup/agent or pod admin tooling. Browser/web clients may use the X-Session-Token header instead. See GET /api/hub/auth/status to introspect the calling key.
id*stringuuidSoft-deleted
application/json- response
success*booleancurl -X DELETE 'https://pod.example.com/api/hub/vault/secrets/497f6eca-6276-4993-bfeb-53cbbbba6f08'{ "success": true}