



hvac 0.11.2 documentation

 [hvac](#) 

 v0.11.2

 

* [Overview](index.html#document-overview)

	+ [Installation](index.html#installation)

	+ [Getting Started](index.html#getting-started)

		- [Initialize the Client](index.html#initialize-the-client)

		- [Vault Cluster - Initialize and Seal/Unseal](index.html#vault-cluster-initialize-and-seal-unseal)

		- [Read and write to secrets engines](index.html#read-and-write-to-secrets-engines)

		- [Authentication](index.html#authentication)

* [Usage](index.html#document-usage/index)

	+ [Secrets Engines](index.html#document-usage/secrets_engines/index)

		- [Active Directory](index.html#document-usage/secrets_engines/activedirectory)

		- [AWS](index.html#document-usage/secrets_engines/aws)

		- [Azure](index.html#document-usage/secrets_engines/azure)

		- [GCP](index.html#document-usage/secrets_engines/gcp)

		- [Identity](index.html#document-usage/secrets_engines/identity)

		- [PKI](index.html#document-usage/secrets_engines/pki)

		- [KV Secrets Engines](index.html#document-usage/secrets_engines/kv)

		- [KV - Version 1](index.html#document-usage/secrets_engines/kv_v1)

		- [KV - Version 2](index.html#document-usage/secrets_engines/kv_v2)

		- [Transform](index.html#document-usage/secrets_engines/transform)

		- [Transit](index.html#document-usage/secrets_engines/transit)

	+ [Auth Methods](index.html#document-usage/auth_methods/index)

		- [Approle](index.html#document-usage/auth_methods/approle)

		- [AWS](index.html#document-usage/auth_methods/aws)

		- [Azure](index.html#document-usage/auth_methods/azure)

		- [GCP](index.html#document-usage/auth_methods/gcp)

		- [GitHub](index.html#document-usage/auth_methods/github)

		- [JWT/OIDC](index.html#document-usage/auth_methods/jwt-oidc)

		- [Kubernetes](index.html#document-usage/auth_methods/kubernetes)

		- [LDAP](index.html#document-usage/auth_methods/ldap)

		- [MFA](index.html#document-usage/auth_methods/mfa)

		- [Okta](index.html#document-usage/auth_methods/okta)

		- [Token](index.html#document-usage/auth_methods/token)

		- [Authenticate to different auth backends](index.html#authenticate-to-different-auth-backends)

	+ [System Backend](index.html#document-usage/system_backend/index)

		- [Audit](index.html#document-usage/system_backend/audit)

		- [Auth](index.html#document-usage/system_backend/auth)

		- [Health](index.html#document-usage/system_backend/health)

		- [Init](index.html#document-usage/system_backend/init)

		- [Key](index.html#document-usage/system_backend/key)

		- [Leader](index.html#document-usage/system_backend/leader)

		- [Lease](index.html#document-usage/system_backend/lease)

		- [Mount](index.html#document-usage/system_backend/mount)

		- [Namespace](index.html#document-usage/system_backend/namespace)

		- [Policy](index.html#document-usage/system_backend/policy)

		- [Raft](index.html#document-usage/system_backend/raft)

		- [Seal](index.html#document-usage/system_backend/seal)

		- [Wrapping](index.html#document-usage/system_backend/wrapping)

	+ [Initialize and seal/unseal](index.html#initialize-and-seal-unseal)

* [Advanced Usage](index.html#document-advanced_usage)

	+ [Making Use of Private CA](index.html#making-use-of-private-ca)

	+ [Custom Requests / HTTP Adapter](index.html#custom-requests-http-adapter)

	+ [Vault Agent Unix Socket Listener](index.html#vault-agent-unix-socket-listener)

* [Source Reference](index.html#document-source/index)

	+ [hvac.v1](index.html#document-source/hvac_v1)

	+ [hvac.api](index.html#document-source/hvac_api)

	+ [hvac.api.auth\_methods](index.html#document-source/hvac_api_auth_methods)

	+ [hvac.api.secrets\_engines](index.html#document-source/hvac_api_secrets_engines)

	+ [hvac.api.system\_backend](index.html#document-source/hvac_api_system_backend)

	+ [hvac.utils](index.html#document-source/hvac_utils)

	+ [hvac.aws\_utils](index.html#document-source/hvac_aws_utils)

	+ [hvac.adapters](index.html#document-source/hvac_adapters)

	+ [hvac.exceptions](index.html#document-source/hvac_exceptions)

* [Contributing](index.html#document-contributing)

	+ [Typical Development Environment Setup](index.html#typical-development-environment-setup)

	+ [Testing](index.html#testing)

	+ [Updating Requirements](index.html#updating-requirements)

	+ [Documentation](index.html#documentation)

		- [Adding New Documentation Files](index.html#adding-new-documentation-files)

		- [Testing Docs](index.html#testing-docs)

		- [Examples](index.html#examples)

	+ [Backwards Compatibility Breaking Changes](index.html#backwards-compatibility-breaking-changes)

	+ [Creating / Publishing Releases](index.html#creating-publishing-releases)

* [Changelog](index.html#document-changelog)

	+ [0.11.2 (September 23rd, 2021)](index.html#september-23rd-2021)

		- [🐛 Bug Fixes](index.html#bug-fixes)

	+ [0.11.1 (September 22nd, 2021)](index.html#september-22nd-2021)

		- [💥 Breaking Changes](index.html#breaking-changes)

		- [🚀 Features](index.html#features)

		- [🐛 Bug Fixes](index.html#id3)

	+ [0.11.0 (July 12th, 2021)](index.html#july-12th-2021)

		- [💥 Breaking Changes](index.html#id4)

		- [🚀 Features](index.html#id7)

		- [🐛 Bug Fixes](index.html#id8)

		- [🧰 Miscellaneous](index.html#miscellaneous)

	+ [0.10.14 (May 21st, 2021)](index.html#may-21st-2021)

		- [🐛 Bug Fixes](index.html#id9)

	+ [0.10.13 (May 20th, 2021)](index.html#may-20th-2021)

		- [🐛 Bug Fixes](index.html#id10)

	+ [0.10.12 (May 19th, 2021)](index.html#may-19th-2021)

		- [🚀 Features](index.html#id11)

	+ [0.10.11 (May 7th, 2021)](index.html#may-7th-2021)

		- [🚀 Features](index.html#id12)

		- [🧰 Miscellaneous](index.html#id15)

	+ [0.10.10 (April 29th, 2021)](index.html#april-29th-2021)

		- [🚀 Features](index.html#id16)

		- [🧰 Miscellaneous](index.html#id17)

	+ [0.10.9 (April 2nd, 2021)](index.html#april-2nd-2021)

		- [🐛 Bug Fixes](index.html#id18)

		- [📚 Documentation](index.html#documentation)

	+ [0.10.8 (February 8th, 2021)](index.html#february-8th-2021)

		- [🚀 Features](index.html#id19)

	+ [0.10.7 (February 1st, 2021)](index.html#february-1st-2021)

		- [🚀 Features](index.html#id20)

		- [🧰 Miscellaneous](index.html#id21)

	+ [0.10.6 (December 14th, 2020)](index.html#december-14th-2020)

		- [🚀 Features](index.html#id22)

		- [🐛 Bug Fixes](index.html#id23)

		- [🧰 Miscellaneous](index.html#id24)

	+ [0.10.5 (July 26th, 2020)](index.html#july-26th-2020)

		- [🚀 Features](index.html#id25)

		- [🐛 Bug Fixes](index.html#id26)

		- [📚 Documentation](index.html#id27)

		- [🧰 Miscellaneous](index.html#id28)

	+ [0.10.4 (June 16th, 2020)](index.html#june-16th-2020)

		- [🚀 Features](index.html#id29)

		- [📚 Documentation](index.html#id30)

	+ [0.10.3 (May 24th, 2020)](index.html#may-24th-2020)

		- [🚀 Features](index.html#id31)

	+ [0.10.2 (May 19th, 2020)](index.html#may-19th-2020)

		- [🚀 Features](index.html#id32)

		- [🐛 Bug Fixes](index.html#id33)

		- [📚 Documentation](index.html#id34)

	+ [0.10.1 (April 7th, 2020)](index.html#april-7th-2020)

		- [💥 Breaking Changes](index.html#id35)

		- [🚀 Features](index.html#id36)

		- [🐛 Bug Fixes](index.html#id37)

	+ [0.10.0 (February 26th, 2020)](index.html#february-26th-2020)

		- [🚀 Features](index.html#id38)

		- [📚 Documentation](index.html#id39)

		- [🧰 Miscellaneous](index.html#id40)

	+ [0.9.6 (November 20th, 2019)](index.html#november-20th-2019)

		- [🚀 Features](index.html#id41)

		- [📚 Documentation](index.html#id42)

		- [🧰 Miscellaneous](index.html#id43)

	+ [0.9.5 (July 19th, 2019)](index.html#july-19th-2019)

		- [🚀 Features](index.html#id44)

		- [📚 Documentation](index.html#id45)

	+ [0.9.4 (July 18th, 2019)](index.html#july-18th-2019)

		- [🚀 Features](index.html#id46)

		- [🐛 Bug Fixes](index.html#id47)

		- [📚 Documentation](index.html#id48)

		- [🧰 Miscellaneous](index.html#id49)

	+ [0.9.3 (July 7th, 2019)](index.html#july-7th-2019)

		- [🚀 Features](index.html#id50)

		- [🐛 Bug Fixes](index.html#id51)

		- [📚 Documentation](index.html#id52)

		- [🧰 Miscellaneous](index.html#id53)

	+ [0.9.2 (June 8th, 2019)](index.html#june-8th-2019)

	+ [0.9.1 (May 25th, 2019)](index.html#may-25th-2019)

	+ [0.9.0 (May 23rd, 2019)](index.html#may-23rd-2019)

	+ [0.8.2 (April 4th, 2019)](index.html#april-4th-2019)

	+ [0.8.1 (March 31st, 2019)](index.html#march-31st-2019)

	+ [0.8.0 (March 29th, 2019)](index.html#march-29th-2019)

	+ [0.7.2 (January 1st, 2019)](index.html#january-1st-2019)

	+ [0.7.1 (December 19th, 2018)](index.html#december-19th-2018)

	+ [0.7.0 (November 1st, 2018)](index.html#november-1st-2018)

	+ [0.6.4 (September 5th, 2018)](index.html#september-5th-2018)

	+ [0.6.3 (August 8th, 2018)](index.html#august-8th-2018)

	+ [0.6.2 (July 19th, 2018)](index.html#july-19th-2018)

	+ [0.6.1 (July 5th, 2018)](index.html#july-5th-2018)

	+ [0.6.0 (June 14, 2018)](index.html#june-14-2018)

	+ [0.5.0 (February 20, 2018)](index.html#february-20-2018)

	+ [0.4.0 (February 1, 2018)](index.html#february-1-2018)

	+ [0.3.0 (November 9, 2017)](index.html#november-9-2017)

	+ [0.2.17 (December 15, 2016)](index.html#december-15-2016)

	+ [0.2.16 (September 12, 2016)](index.html#september-12-2016)

	+ [0.2.15 (June 22nd, 2016)](index.html#june-22nd-2016)

	+ [0.2.14 (June 2nd, 2016)](index.html#june-2nd-2016)

	+ [0.2.13 (May 31st, 2016)](index.html#may-31st-2016)

	+ [0.2.12 (May 12th, 2016)](index.html#may-12th-2016)

	+ [0.2.10 (April 8th, 2016)](index.html#april-8th-2016)

	+ [0.2.9 (March 18th, 2016)](index.html#march-18th-2016)

	+ [0.2.8 (February 2nd, 2016)](index.html#february-2nd-2016)

	+ [0.2.7 (December 16th, 2015)](index.html#december-16th-2015)

	+ [0.2.6 (October 30th, 2015)](index.html#october-30th-2015)

	+ [0.2.5 (September 29th, 2015)](index.html#september-29th-2015)

	+ [0.2.4 (July 23rd, 2015)](index.html#july-23rd-2015)

	+ [0.2.3 (July 18th, 2015)](index.html#july-18th-2015)

	+ [0.2.2 (June 12th, 2015)](index.html#june-12th-2015)

	+ [0.2.1 (June 3rd, 2015)](index.html#june-3rd-2015)

	+ [0.2.0 (May 25th, 2015)](index.html#may-25th-2015)

	+ [0.1.1 (May 20th, 2015)](index.html#may-20th-2015)

	+ [0.1.0 (May 17th, 2015)](index.html#may-17th-2015)

[hvac](#)

* »

* hvac 0.11.2 documentation

* [Edit on GitHub](https://github.com/hvac/hvac/blob/v0.11.2/docs/index.rst)

---

hvac[¶](#hvac "Permalink to this headline")

===========================================

hvac[¶](#hvac "Permalink to this headline")

-------------------------------------------

[![Header image](https://raw.githubusercontent.com/hvac/hvac/main/docs/_static/hvac_logo_800px.png)](https://raw.githubusercontent.com/hvac/hvac/main/docs/_static/hvac_logo_800px.png)

[HashiCorp](https://hashicorp.com/) [Vault](https://www.vaultproject.io) API client for Python 3.x

[![Test](https://github.com/hvac/hvac/workflows/Test/badge.svg)](https://github.com/hvac/hvac/actions?query=workflow%3ATest)

[![codecov](https://codecov.io/gh/hvac/hvac/branch/main/graph/badge.svg)](https://codecov.io/gh/hvac/hvac)

[![Documentation Status](https://readthedocs.org/projects/hvac/badge/)](https://hvac.readthedocs.io/en/latest/?badge=latest)

[![PyPI version](https://badge.fury.io/py/hvac.svg)](https://badge.fury.io/py/hvac)

[![Twitter - @python_hvac](https://img.shields.io/twitter/follow/python_hvac.svg?label=Twitter%20-%20@python_hvac&style=social?style=plastic)](https://twitter.com/python_hvac)

[![Gitter chat](https://badges.gitter.im/hvac/community.png)](https://gitter.im/hvac/community)

Tested against the latest release, HEAD ref, and 3 previous minor versions (counting back from the latest release) of Vault.

Current official support covers Vault v1.4.7 or later.

### Installation[¶](#installation "Permalink to this headline")

```

pip install hvac

```

If you would like to be able to return parsed HCL data as a Python dict for methods that support it:

```

pip install "hvac[parser]"

```

### Getting Started[¶](#getting-started "Permalink to this headline")

#### Initialize the Client[¶](#initialize-the-client "Permalink to this headline")

Using TLS:

```

>>> client = hvac.Client(url='https://localhost:8200')

>>> client.is\_authenticated()

True

```

Using TLS with client-side certificate authentication:

```

>>> client = hvac.Client(

...     url='https://localhost:8200',

...     token=os.environ['VAULT\_TOKEN'],

...     cert=(client\_cert\_path, client\_key\_path),

...     verify=server\_cert\_path,

... )

>>> client.is\_authenticated()

True

```

Using [Vault Enterprise namespace](https://www.vaultproject.io/docs/enterprise/namespaces/index.html):

```

>>> client = hvac.Client(

...     url='https://localhost:8200',

...     namespace=os.getenv('VAULT\_NAMESPACE'),

... )

```

Using plaintext / HTTP (not recommended for anything other than development work):

```

>>> client = hvac.Client(url='http://localhost:8200')

```

#### Vault Cluster - Initialize and Seal/Unseal[¶](#vault-cluster-initialize-and-seal-unseal "Permalink to this headline")

```

>>> client.sys.is\_initialized()

False

>>> shares = 5

>>> threshold = 3

>>> result = client.sys.initialize(shares, threshold)

>>> root\_token = result['root\_token']

>>> keys = result['keys']

>>> client.sys.is\_initialized()

True

>>> client.token = root\_token

>>> client.sys.is\_sealed()

True

>>> # Unseal a Vault cluster with individual keys

>>> unseal\_response1 = client.sys.submit\_unseal\_key(keys[0])

>>> unseal\_response2 = client.sys.submit\_unseal\_key(keys[1])

>>> unseal\_response3 = client.sys.submit\_unseal\_key(keys[2])

>>> client.sys.is\_sealed()

False

>>> # Seal a previously unsealed Vault cluster.

>>> client.sys.seal()

<Response [204]>

>>> client.sys.is\_sealed()

True

>>> # Unseal with multiple keys until threshold met

>>> unseal\_response = client.sys.submit\_unseal\_keys(keys)

>>> client.sys.is\_sealed()

False

```

#### Read and write to secrets engines[¶](#read-and-write-to-secrets-engines "Permalink to this headline")

Note

Vault currently defaults the secret/ path to the KV secrets engine *version 2* automatically when the [Vault server is started in “dev” mode](https://www.vaultproject.io/docs/secrets/kv/kv-v2.html#setup).

Note

Starting with Vault v1.1.0, \_no\_ KV secrets engine is mounted by default. I.e., outside of dev mode, a KV engine mounted under path secret/ must be explicitly enabled before use.

##### KV Secrets Engine - Version 2[¶](#kv-secrets-engine-version-2 "Permalink to this headline")

```

 >>> # Retrieve an authenticated hvac.Client() instance

 >>> client = test\_utils.create\_client()

 >>>

 >>> # Write a k/v pair under path: secret/foo

 >>> create\_response = client.secrets.kv.v2.create\_or\_update\_secret(

 ... path='foo',

 ... secret=dict(baz='bar'),

 ... )

 >>>

 >>> # Read the data written under path: secret/foo

 >>> read\_response = client.secrets.kv.read\_secret\_version(path='foo')

 >>> print('Value under path "secret/foo" / key "baz": {val}'.format(

 ... val=read\_response['data']['data']['baz'],

 ... ))

 Value under path "secret/foo" / key "baz": bar

 >>>

 >>> # Delete all metadata/versions for path: secret/foo

 >>> client.secrets.kv.delete\_metadata\_and\_all\_versions('foo')

 <Response [204]>

```

##### KV Secrets Engine - Version 1[¶](#kv-secrets-engine-version-1 "Permalink to this headline")

Preferred usage:

```

 >>> create\_response = client.secrets.kv.v1.create\_or\_update\_secret('foo', secret=dict(baz='bar'))

 >>> read\_response = client.secrets.kv.v1.read\_secret('foo')

 >>> print('Value under path "secret/foo" / key "baz": {val}'.format(

 ... val=read\_response['data']['baz'],

 ... ))

 Value under path "secret/foo" / key "baz": bar

 >>> delete\_response = client.secrets.kv.v1.delete\_secret('foo')

```

#### Authentication[¶](#authentication "Permalink to this headline")

##### Basic Token Authentication[¶](#basic-token-authentication "Permalink to this headline")

```

# Token

>>> client.token = os.environ['VAULT\_TOKEN']

>>> client.is\_authenticated()

True

```

##### LDAP Authentication Example[¶](#ldap-authentication-example "Permalink to this headline")

```

>>> client = hvac.Client(url='https://localhost:8200')

>>> # LDAP, getpass -> user/password, bring in LDAP3 here for teststup?

>>> login\_response = client.auth.ldap.login(

...     username=os.environ['LDAP\_USERNAME'],

...     password=os.environ['LDAP\_PASSWORD'],

... )

>>> client.is\_authenticated()

True

>>> print('The client token returned from the LDAP auth method is: {token}'.format(

...     token=login\_response['auth']['client\_token']

... ))

The client token returned from the LDAP auth method is: ...

```

Usage[¶](#usage "Permalink to this headline")

---------------------------------------------

### Secrets Engines[¶](#secrets-engines "Permalink to this headline")

#### [Active Directory](#id1)[¶](#active-directory "Permalink to this headline")

Contents

* [Active Directory](#active-directory)

	+ [Configure AD Secrets Secrets Engine](#configure-ad-secrets-secrets-engine)

	+ [Read Config](#read-config)

	+ [Create or Update Role](#create-or-update-role)

	+ [Read Role](#read-role)

	+ [List Roles](#list-roles)

	+ [Delete Role](#delete-role)

	+ [Generate Credentials](#generate-credentials)

##### [Configure AD Secrets Secrets Engine](#id2)[¶](#configure-ad-secrets-secrets-engine "Permalink to this headline")

Configure the AD secrets engine to either manage service accounts or service account libraries.

Source reference: `hvac.api.secrets\_engines.activedirectory.configure()`

```

import hvac

client = hvac.Client()

# Authenticate to Vault using client.auth.x

# Not all these settings may apply to your setup, refer to Vault

# documentation for context of what to use here

config\_response = client.secrets.activedirectory.configure(

    binddn='username@domain.fqdn', # A upn or DN can be used for this value, Vault resolves the user to a dn silently

    bindpass='\*\*\*\*\*\*\*\*\*\*\*',

    url='ldaps://domain.fqdn',

    userdn='CN=Users,DN=domain,DN=fqdn',

    upndomain='domain.fqdn',

    ttl=60,

    max\_ttl=120

)

print(config\_response)

```

##### [Read Config](#id3)[¶](#read-config "Permalink to this headline")

Return the AD Secret Engine configuration.

Source reference: `hvac.api.secrets\_engines.activedirectory.read\_config()`

```

import hvac

client = hvac.Client()

# Authenticate to Vault using client.auth.x

config\_response = client.secrets.activedirectory.read\_config()

```

##### [Create or Update Role](#id4)[¶](#create-or-update-role "Permalink to this headline")

Create or Update a role which allows the retrieval and rotation of an AD account. Retrieve and rotate the actual credential via generate\_credentials().

Source reference: `hvac.api.secrets\_engines.activedirectory.create\_or\_update\_role()`

```

import hvac

client = hvac.Client()

# Authenticate to Vault using client.auth.x

role\_response = client.secrets.activedirectory.create\_or\_update\_role(

    name='sql-service-account',

    service\_account\_name='svc-sqldb-petshop@domain.fqdn',

    ttl=60)

```

##### [Read Role](#id5)[¶](#read-role "Permalink to this headline")

Retrieve the role configuration which allows the retrieval and rotation of an AD account. Retrieve and rotate the actual credential via generate\_credentials().

Source reference: `hvac.api.secrets\_engines.activedirectory.read\_role()`

```

import hvac

client = hvac.Client()

# Authenticate to Vault using client.auth.x

role\_response = client.secrets.activedirectory.read\_role(name='sql-service-account')

```

##### [List Roles](#id6)[¶](#list-roles "Permalink to this headline")

List all configured roles which allows the retrieval and rotation of an AD account. Retrieve and rotate the actual credential via generate\_credentials().

Source reference: `hvac.api.secrets\_engines.activedirectory.list\_roles()`

```

import hvac

client = hvac.Client()

# Authenticate to Vault using client.auth.x

all\_roles = client.secrets.activedirectory.list\_roles()

```

##### [Delete Role](#id7)[¶](#delete-role "Permalink to this headline")

Remove the role configuration which allows the retrieval and rotation of an AD account.

The account is retained in Active Directory, but the password will be whatever Vault had rotated it to last.

To regain control, the password will need to be reset via Active Directory.

Source reference: `hvac.api.secrets\_engines.activedirectory.delete\_role()`

```

import hvac

client = hvac.Client()

# Authenticate to Vault using client.auth.x

deletion\_response = client.secrets.activedirectory.delete\_role(name='sql-service-account')

```

##### [Generate Credentials](#id8)[¶](#generate-credentials "Permalink to this headline")

Retrieve a service account password from AD. Return the previous password (if known). Vault shall rotate

the password before returning it, if it has breached its configured ttl.

Source reference: `hvac.api.secrets\_engines.activedirectory.generate\_credentials()`

```

import hvac

client = hvac.Client()

# Authenticate to Vault using client.auth.x

gen\_creds\_response = client.secrets.activedirectory.generate\_credentials(

    name='hvac-role',

)

print('Retrieved Service Account Password: {access} (Current) / {secret} (Old)'.format(

    access=gen\_creds\_response['data']['current\_password'],

    secret=gen\_creds\_response['data']['old\_password'],

))

```

#### [AWS](#id1)[¶](#aws "Permalink to this headline")

Contents

* [AWS](#aws)

	+ [Configure Root IAM Credentials](#configure-root-iam-credentials)

	+ [Rotate Root IAM Credentials](#rotate-root-iam-credentials)

	+ [Configure Lease](#configure-lease)

	+ [Read Lease](#read-lease)

	+ [Create or Update Role](#create-or-update-role)

	

	

		- [Legacy Parameters](#legacy-parameters)

	+ [Read Role](#read-role)

	+ [List Roles](#list-roles)

	+ [Delete Role](#delete-role)

	+ [Generate Credentials](#generate-credentials)

##### [Configure Root IAM Credentials](#id2)[¶](#configure-root-iam-credentials "Permalink to this headline")

Source reference: [`hvac.api.secrets\_engines.Aws.configure\_root\_iam\_credentials()`](index.html#hvac.api.secrets_engines.Aws.configure_root_iam_credentials "hvac.api.secrets_engines.Aws.configure_root_iam_credentials")

```

import os

import hvac

client = hvac.Client()

client.secrets.aws.configure\_root\_iam\_credentials(

    access\_key=os.getenv('AWS\_ACCESS\_KEY\_ID'),

    secret\_key=os.getenv('AWS\_SECRET\_ACCESS\_KEY'),

)

```

##### [Rotate Root IAM Credentials](#id3)[¶](#rotate-root-iam-credentials "Permalink to this headline")

Source reference: [`hvac.api.secrets\_engines.Aws.rotate\_root\_iam\_credentials()`](index.html#hvac.api.secrets_engines.Aws.rotate_root_iam_credentials "hvac.api.secrets_engines.Aws.rotate_root_iam_credentials")

```

import hvac

client = hvac.Client()

client.secrets.aws.rotate\_root\_iam\_credentials()

```

##### [Configure Lease](#id4)[¶](#configure-lease "Permalink to this headline")

Source reference: [`hvac.api.secrets\_engines.Aws.configure\_lease()`](index.html#hvac.api.secrets_engines.Aws.configure_lease "hvac.api.secrets_engines.Aws.configure_lease")

```

import hvac

client = hvac.Client()

# Set the default least TTL to 300 seconds / 5 minutes

client.secrets.aws.configure\_lease(

    lease='300s',

)

```

##### [Read Lease](#id5)[¶](#read-lease "Permalink to this headline")

Source reference: `hvac.api.secrets\_engines.Aws.read\_lease()`

```

import hvac

client = hvac.Client()

read\_lease\_response = client.secrets.aws.read\_lease()

print('The current "lease\_max" TTL is: {lease\_max}'.format(

    lease\_max=read\_lease\_response['data']['lease\_max'],

))

```

##### [Create or Update Role](#id6)[¶](#create-or-update-role "Permalink to this headline")

Source reference: [`hvac.api.secrets\_engines.Aws.create\_or\_update\_role()`](index.html#hvac.api.secrets_engines.Aws.create_or_update_role "hvac.api.secrets_engines.Aws.create_or_update_role")

```

import hvac

client = hvac.Client()

describe\_ec2\_policy\_doc = {

    'Version': '2012-10-17',

    'Statement': [

        {

            'Resource': '\*'

            'Action': 'ec2:Describe\*',

            'Effect': 'Allow',

        },

    ],

}

client.secrets.aws.create\_or\_update\_role(

    name='hvac-role',

    credential\_type='assumed\_role',

    policy\_document=describe\_ec2\_policy\_doc,

    policy\_arns=['arn:aws:iam::aws:policy/AmazonVPCReadOnlyAccess'],

)

```

###### [Legacy Parameters](#id7)[¶](#legacy-parameters "Permalink to this headline")

Note

In previous versions of Vault (before version 0.11.0), this API route only supports the policy\_document and policy\_arns parameters (which hvac will translate to policy and arn parameters respectively in the request sent to Vault). If running these versions of Vault, the legacy\_params parameter on this method can be set to True.

For older versions of Vault (any version before 0.11.0):

```

import hvac

client = hvac.Client()

describe\_ec2\_policy\_doc = {

    'Version': '2012-10-17',

    'Statement': [

        {

            'Resource': '\*'

            'Action': 'ec2:Describe\*',

            'Effect': 'Allow',

        },

    ],

}

# Note: with the legacy params, the `policy\_arns` parameter is translated to `arn`

# in the request sent to Vault and only one ARN is accepted. If a list is provided,

# hvac will only use the first ARN in the list.

client.secrets.aws.create\_or\_update\_role(

    name='hvac-role',

    credential\_type='assumed\_role',

    policy\_document=describe\_ec2\_policy\_doc,

    policy\_arns='arn:aws:iam::aws:policy/AmazonVPCReadOnlyAccess',

    legacy\_params=True,

)

```

##### [Read Role](#id8)[¶](#read-role "Permalink to this headline")

Source reference: [`hvac.api.secrets\_engines.Aws.read\_role()`](index.html#hvac.api.secrets_engines.Aws.read_role "hvac.api.secrets_engines.Aws.read_role")

```

import hvac

client = hvac.Client()

read\_role\_response = client.secrets.aws.read\_role(

    name='hvac-role',

)

print('The credential type for role "hvac-role" is: {cred\_type}'.format(

    cred\_type=read\_role\_response['data']['credential\_types'],

))

```

##### [List Roles](#id9)[¶](#list-roles "Permalink to this headline")

Source reference: [`hvac.api.secrets\_engines.Aws.list\_roles()`](index.html#hvac.api.secrets_engines.Aws.list_roles "hvac.api.secrets_engines.Aws.list_roles")

```

import hvac

client = hvac.Client()

list\_roles\_response = client.secrets.aws.list\_roles()

print('AWS secrets engine role listing: {roles}'.format(

    roles=', '.join(list\_roles\_response['data']['keys'])

))

```

##### [Delete Role](#id10)[¶](#delete-role "Permalink to this headline")

Source reference: [`hvac.api.secrets\_engines.Aws.delete\_role()`](index.html#hvac.api.secrets_engines.Aws.delete_role "hvac.api.secrets_engines.Aws.delete_role")

```

import hvac

client = hvac.Client()

client.secrets.aws.delete\_role(

    name='hvac-role',

)

```

##### [Generate Credentials](#id11)[¶](#generate-credentials "Permalink to this headline")

Source reference: [`hvac.api.secrets\_engines.Aws.generate\_credentials()`](index.html#hvac.api.secrets_engines.Aws.generate_credentials "hvac.api.secrets_engines.Aws.generate_credentials")

```

import hvac

client = hvac.Client()

gen\_creds\_response = client.secrets.aws.generate\_credentials(

    name='hvac-role',

)

print('Generated access / secret keys: {access} / {secret}'.format(

    access=gen\_creds\_response['data']['access\_key'],

    secret=gen\_creds\_response['data']['secret\_key'],

))

```

#### Azure[¶](#azure "Permalink to this headline")

Note

Every method under the [`Azure class`](index.html#hvac.api.secrets_engines.Azure "hvac.api.secrets_engines.Azure") includes a mount\_point parameter that can be used to address the Azure secret engine under a custom mount path. E.g., If enabling the Azure secret engine using Vault’s CLI commands via vault secrets enable -path=my-azure azure”, the mount\_point parameter in [`hvac.api.secrets\_engines.Azure()`](index.html#hvac.api.secrets_engines.Azure "hvac.api.secrets_engines.Azure") methods would need to be set to “my-azure”.

##### Configure[¶](#configure "Permalink to this headline")

[`hvac.api.secrets\_engines.Azure.configure()`](index.html#hvac.api.secrets_engines.Azure.configure "hvac.api.secrets_engines.Azure.configure")

```

import hvac

client = hvac.Client()

client.secrets.azure.configure(

    subscription\_id='my-subscription-id',

    tenant\_id='my-tenant-id',

)

```

##### Read Config[¶](#read-config "Permalink to this headline")

[`hvac.api.secrets\_engines.Azure.read\_config()`](index.html#hvac.api.secrets_engines.Azure.read_config "hvac.api.secrets_engines.Azure.read_config")

```

import hvac

client = hvac.Client()

azure\_secret\_config = client.secrets.azure.read\_config()

print('The Azure secret engine is configured with a subscription ID of {id}'.format(

    id=azure\_secret\_config['subscription\_id'],

))

```

##### Delete Config[¶](#delete-config "Permalink to this headline")

[`hvac.api.secrets\_engines.Azure.delete\_config()`](index.html#hvac.api.secrets_engines.Azure.delete_config "hvac.api.secrets_engines.Azure.delete_config")

```

import hvac

client = hvac.Client()

client.secrets.azure.delete\_config()

```

##### Create Or Update A Role[¶](#create-or-update-a-role "Permalink to this headline")

[`hvac.api.secrets\_engines.Azure.create\_or\_update\_role()`](index.html#hvac.api.secrets_engines.Azure.create_or_update_role "hvac.api.secrets_engines.Azure.create_or_update_role")

```

import hvac

client = hvac.Client()

azure\_roles = [

    {

        'role\_name': "Contributor",

        'scope': "/subscriptions/95e675fa-307a-455e-8cdf-0a66aeaa35ae",

    },

]

client.secrets.azure.create\_or\_update\_role(

    name='my-azure-secret-role',

    azure\_roles=azure\_roles,

)

```

##### List Roles[¶](#list-roles "Permalink to this headline")

[`hvac.api.secrets\_engines.Azure.list\_roles()`](index.html#hvac.api.secrets_engines.Azure.list_roles "hvac.api.secrets_engines.Azure.list_roles")

```

import hvac

client = hvac.Client()

azure\_secret\_engine\_roles = client.secrets.azure.list\_roles()

print('The following Azure secret roles are configured: {roles}'.format(

    roles=','.join(roles['keys']),

))

```

##### Generate Credentials[¶](#generate-credentials "Permalink to this headline")

[`hvac.api.secrets\_engines.Azure.generate\_credentials()`](index.html#hvac.api.secrets_engines.Azure.generate_credentials "hvac.api.secrets_engines.Azure.generate_credentials")

```

import hvac

from azure.common.credentials import ServicePrincipalCredentials

client = hvac.Client()

azure\_creds = client.secrets.azure.secret.generate\_credentials(

    name='some-azure-role-name',

)

azure\_spc = ServicePrincipalCredentials(

    client\_id=azure\_creds['client\_id'],

    secret=azure\_creds['client\_secret'],

    tenant=TENANT\_ID,

)

```

#### GCP[¶](#gcp "Permalink to this headline")

* [Configure](#configure)

* [Read Config](#read-config)

* [Create Or Update Roleset](#create-or-update-roleset)

* [Rotate Roleset Account](#rotate-roleset-account)

* [Rotate Roleset Account Key](#rotate-roleset-account-key)

* [Read Roleset](#read-roleset)

* [List Rolesets](#list-rolesets)

* [Delete Roleset](#delete-roleset)

* [Generate Oauth2 Access Token](#generate-oauth2-access-token)

* [Generate Service Account Key](#generate-service-account-key)

##### [Configure](#id10)[¶](#configure "Permalink to this headline")

`Gcp.``configure`(*credentials=None*, *ttl=None*, *max\_ttl=None*, *mount\_point='gcp'*)[[source]](_modules/hvac/api/secrets_engines/gcp.html#Gcp.configure)

Configure shared information for the Gcp secrets engine.

Supported methods:POST: /{mount\_point}/config. Produces: 204 (empty body)

Parameters

* **credentials** (*str | unicode*) – JSON credentials (either file contents or [‘@path/to/file](mailto:'%40path/to/file)’) See docs for alternative ways to

pass in to this parameter, as well as the required permissions.

* **ttl** (*int | str*) – – Specifies default config TTL for long-lived credentials (i.e. service account keys). Accepts

integer number of seconds or Go duration format string.

* **max\_ttl** (*int | str*) – Specifies the maximum config TTL for long-lived credentials (i.e. service account keys). Accepts

integer number of seconds or Go duration format string.\*\*

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the request.

Return type

requests.Response

###### Examples[¶](#examples "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

credentials = test\_utils.load\_config\_file('example.jwt.json')

configure\_response = client.secrets.gcp.configure(

    credentials=credentials,

    max\_ttl=3600,

)

print(configure\_response)

```

Example output:

```

<Response [204]>

```

##### [Read Config](#id11)[¶](#read-config "Permalink to this headline")

`Gcp.``read_config`(*mount\_point='gcp'*)[[source]](_modules/hvac/api/secrets_engines/gcp.html#Gcp.read_config)

Read the configured shared information for the Gcp secrets engine.

Credentials will be omitted from returned data.

Supported methods:GET: /{mount\_point}/config. Produces: 200 application/json

Parameters

**mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

###### Examples[¶](#id1 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

read\_config\_response = client.secrets.gcp.read\_config()

print('Max TTL for GCP secrets engine set to: {max\_ttl}'.format(max\_ttl=read\_config\_response['data']['max\_ttl']))

```

Example output:

```

Max TTL for GCP secrets engine set to: 3600

```

##### [Create Or Update Roleset](#id12)[¶](#create-or-update-roleset "Permalink to this headline")

`Gcp.``create_or_update_roleset`(*name*, *project*, *bindings*, *secret\_type=None*, *token\_scopes=None*, *mount\_point='gcp'*)[[source]](_modules/hvac/api/secrets_engines/gcp.html#Gcp.create_or_update_roleset)

Create a roleset or update an existing roleset.

See roleset docs for the GCP secrets backend to learn more about what happens when you create or update aroleset.

Supported methods:POST: /{mount\_point}/roleset/{name}. Produces: 204 (empty body)

Parameters

* **name** (*str | unicode*) – Name of the role. Cannot be updated.

* **project** (*str | unicode*) – Name of the GCP project that this roleset’s service account will belong to. Cannot be updated.

* **bindings** (*str | unicode*) – Bindings configuration string (expects HCL or JSON format in raw or base64-encoded string)

* **secret\_type** (*str | unicode*) – Cannot be updated.

* **token\_scopes** (*list**[**str**]*) – List of OAuth scopes to assign to access\_token secrets generated under this role set

(access\_token role sets only)

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the request.

Return type

requests.Response

###### Examples[¶](#id2 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

bindings = """

 resource "//cloudresourcemanager.googleapis.com/project/some-gcp-project-id" {

 roles = [

 "roles/viewer"

 ],

 }

"""

token\_scopes = [

    'https://www.googleapis.com/auth/cloud-platform',

    'https://www.googleapis.com/auth/bigquery',

]

roleset\_response = client.secrets.gcp.create\_or\_update\_roleset(

    name='hvac-doctest',

    project='some-gcp-project-id',

    bindings=bindings,

    token\_scopes=token\_scopes,

)

```

##### [Rotate Roleset Account](#id13)[¶](#rotate-roleset-account "Permalink to this headline")

`Gcp.``rotate_roleset_account`(*name*, *mount\_point='gcp'*)[[source]](_modules/hvac/api/secrets_engines/gcp.html#Gcp.rotate_roleset_account)

Rotate the service account this roleset uses to generate secrets.

This also replaces the key access\_token roleset. This can be used to invalidate old secrets generated by theroleset or fix issues if a roleset’s service account (and/or keys) was changed outside of Vault (i.e.

through GCP APIs/cloud console).

Supported methods:POST: /{mount\_point}/roleset/{name}/rotate. Produces: 204 (empty body)

Parameters

* **name** (*str | unicode*) – Name of the role.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the request.

Return type

requests.Response

###### Examples[¶](#id3 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

rotate\_response = client.secrets.gcp.rotate\_roleset\_account(name='hvac-doctest')

```

##### [Rotate Roleset Account Key](#id14)[¶](#rotate-roleset-account-key "Permalink to this headline")

`Gcp.``rotate_roleset_account_key`(*name*, *mount\_point='gcp'*)[[source]](_modules/hvac/api/secrets_engines/gcp.html#Gcp.rotate_roleset_account_key)

Rotate the service account key this roleset uses to generate access tokens.

This does not recreate the roleset service account.

Supported methods:POST: /{mount\_point}/roleset/{name}/rotate-key. Produces: 204 (empty body)

Parameters

* **name** (*str | unicode*) – Name of the role.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the request.

Return type

requests.Response

###### Examples[¶](#id4 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

rotate\_response = client.secrets.gcp.rotate\_roleset\_account\_key(name='hvac-doctest')

```

##### [Read Roleset](#id15)[¶](#read-roleset "Permalink to this headline")

`Gcp.``read_roleset`(*name*, *mount\_point='gcp'*)[[source]](_modules/hvac/api/secrets_engines/gcp.html#Gcp.read_roleset)

Read a roleset.

Supported methods:GET: /{mount\_point}/roleset/{name}. Produces: 200 application/json

Parameters

* **name** (*str | unicode*) – Name of the role.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

###### Examples[¶](#id5 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

read\_response = client.secrets.gcp.read\_roleset(name='hvac-doctest')

```

##### [List Rolesets](#id16)[¶](#list-rolesets "Permalink to this headline")

`Gcp.``list_rolesets`(*mount\_point='gcp'*)[[source]](_modules/hvac/api/secrets_engines/gcp.html#Gcp.list_rolesets)

List configured rolesets.

Supported methods:LIST: /{mount\_point}/rolesets. Produces: 200 application/json

Parameters

**mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

###### Examples[¶](#id6 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

list\_response = client.secrets.gcp.list\_rolesets()

```

##### [Delete Roleset](#id17)[¶](#delete-roleset "Permalink to this headline")

`Gcp.``delete_roleset`(*name*, *mount\_point='gcp'*)[[source]](_modules/hvac/api/secrets_engines/gcp.html#Gcp.delete_roleset)

Delete an existing roleset by the given name.

Supported methods:DELETE: /{mount\_point}/roleset/{name} Produces: 200 application/json

Parameters

* **name** (*str | unicode*) – Name of the role.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the request.

Return type

requests.Response

###### Examples[¶](#id7 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

delete\_response = client.secrets.gcp.delete\_roleset(name='hvac-doctest')

```

##### [Generate Oauth2 Access Token](#id18)[¶](#generate-oauth2-access-token "Permalink to this headline")

`Gcp.``generate_oauth2_access_token`(*roleset*, *mount\_point='gcp'*)[[source]](_modules/hvac/api/secrets_engines/gcp.html#Gcp.generate_oauth2_access_token)

Generate an OAuth2 token with the scopes defined on the roleset.

This OAuth access token can be used in GCP API calls, e.g. curl -H “Authorization: Bearer $TOKEN” …

Supported methods:GET: /{mount\_point}/token/{roleset}. Produces: 200 application/json

Parameters

* **roleset** (*str | unicode*) – Name of an roleset with secret type access\_token to generate access\_token under.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

###### Examples[¶](#id8 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

token\_response = client.secrets.gcp.generate\_oauth2\_access\_token(roleset='hvac-doctest')

```

##### [Generate Service Account Key](#id19)[¶](#generate-service-account-key "Permalink to this headline")

`Gcp.``generate_service_account_key`(*roleset*, *key\_algorithm='KEY\_ALG\_RSA\_2048'*, *key\_type='TYPE\_GOOGLE\_CREDENTIALS\_FILE'*, *method='POST'*, *mount\_point='gcp'*)[[source]](_modules/hvac/api/secrets_engines/gcp.html#Gcp.generate_service_account_key)

Generate Secret (IAM Service Account Creds): Service Account Key

If using GET (‘read’), the optional parameters will be set to their defaults. Use POST if you want to specifydifferent values for these params.

Parameters

* **roleset** (*str | unicode*) – Name of an roleset with secret type service\_account\_key to generate key under.

* **key\_algorithm** (*str | unicode*) – Key algorithm used to generate key. Defaults to 2k RSA key You probably should not choose

other values (i.e. 1k),

* **key\_type** (*str | unicode*) – Private key type to generate. Defaults to JSON credentials file.

* **method** (*str | unicode*) – Supported methods:

POST: /{mount\_point}/key/{roleset}. Produces: 200 application/json

GET: /{mount\_point}/key/{roleset}. Produces: 200 application/json

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

###### Examples[¶](#id9 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

key\_response = client.secrets.gcp.generate\_service\_account\_key(roleset='hvac-doctest')

```

#### [Identity](#id1)[¶](#identity "Permalink to this headline")

New in version Vault: 0.9.0

Contents

* [Identity](#identity)

	+ [Entity](#entity)

	

	

		- [Create Or Update Entity](#create-or-update-entity)

		- [Create Or Update Entity By Name](#create-or-update-entity-by-name)

		- [Read Entity](#read-entity)

		- [Read Entity By Name](#read-entity-by-name)

		- [Update Entity](#update-entity)

		- [Delete Entity](#delete-entity)

		- [Delete Entity By Name](#delete-entity-by-name)

		- [List Entities](#list-entities)

		- [List Entities By Name](#list-entities-by-name)

		- [Merge Entities](#merge-entities)

	+ [Entity Alias](#entity-alias)

	

	

		- [Create Or Update Entity Alias](#create-or-update-entity-alias)

		- [Read Entity Alias](#read-entity-alias)

		- [Update Entity Alias](#update-entity-alias)

		- [List Entity Aliases](#list-entity-aliases)

		- [Delete Entity Alias](#delete-entity-alias)

	+ [Group](#group)

	

	

		- [Create Or Update Group](#create-or-update-group)

		- [Read Group](#read-group)

		- [Update Group](#update-group)

		- [Delete Group](#delete-group)

		- [List Groups](#list-groups)

		- [List Groups By Name](#list-groups-by-name)

		- [Create Or Update Group By Name](#create-or-update-group-by-name)

		- [Read Group By Name](#read-group-by-name)

		- [Delete Group By Name](#delete-group-by-name)

	+ [Group Alias](#group-alias)

	

	

		- [Create Or Update Group Alias](#create-or-update-group-alias)

		- [Update Group Alias](#update-group-alias)

		- [Read Group Alias](#read-group-alias)

		- [Delete Group Alias](#delete-group-alias)

		- [List Group Aliases](#list-group-aliases)

	+ [Lookup](#lookup)

	

	

		- [Lookup Entity](#lookup-entity)

		- [Lookup Group](#lookup-group)

	+ [Tokens](#tokens)

	

	

		- [Configure Tokens Backend](#configure-tokens-backend)

		- [Read Tokens Backend Configuration](#read-tokens-backend-configuration)

		- [Create Named Key](#create-named-key)

		- [Read Named Key](#read-named-key)

		- [Delete Named Key](#delete-named-key)

		- [List Named Keys](#list-named-keys)

		- [Rotate Named Key](#rotate-named-key)

		- [Create or Update Role](#create-or-update-role)

		- [Read Role](#read-role)

		- [Delete Role](#delete-role)

		- [List Roles](#list-roles)

		- [Generate Signed ID Token](#generate-signed-id-token)

		- [Introspect Signed ID Token](#introspect-signed-id-token)

		- [Read .well-known Configurations](#read-well-known-configurations)

		- [Read Active Public Keys](#read-active-public-keys)

##### [Entity](#id2)[¶](#entity "Permalink to this headline")

###### [Create Or Update Entity](#id3)[¶](#create-or-update-entity "Permalink to this headline")

[`hvac.api.secrets\_engines.Identity.create\_or\_update\_entity()`](index.html#hvac.api.secrets_engines.Identity.create_or_update_entity "hvac.api.secrets_engines.Identity.create_or_update_entity")

```

import hvac

client = hvac.Client()

create\_response = client.secrets.identity.create\_or\_update\_entity(

                name='hvac-entity',

                metadata=dict(extra\_datas='yup'),

        )

entity\_id = create\_response['data']['id']

print('Entity ID for "hvac-entity" is: {id}'.format(id=entity\_id))

```

###### [Create Or Update Entity By Name](#id4)[¶](#create-or-update-entity-by-name "Permalink to this headline")

[`hvac.api.secrets\_engines.Identity.create\_or\_update\_entity\_by\_name()`](index.html#hvac.api.secrets_engines.Identity.create_or_update_entity_by_name "hvac.api.secrets_engines.Identity.create_or_update_entity_by_name")

```

import hvac

client = hvac.Client()

client.secrets.identity.create\_or\_update\_entity\_by\_name(

        name='hvac-entity',

        metadata=dict(new\_datas='uhuh'),

)

```

###### [Read Entity](#id5)[¶](#read-entity "Permalink to this headline")

[`hvac.api.secrets\_engines.Identity.read\_entity()`](index.html#hvac.api.secrets_engines.Identity.read_entity "hvac.api.secrets_engines.Identity.read_entity")

```

import hvac

client = hvac.Client()

read\_response = client.secrets.identity.read\_entity(

        entity\_id=entity\_id,

)

name = read\_response['data']['name']

print('Name for entity ID {id} is: {name}'.format(id=entity\_id, name=name))

```

###### [Read Entity By Name](#id6)[¶](#read-entity-by-name "Permalink to this headline")

New in version Vault: 0.11.2

[`hvac.api.secrets\_engines.Identity.read\_entity\_by\_name()`](index.html#hvac.api.secrets_engines.Identity.read_entity_by_name "hvac.api.secrets_engines.Identity.read_entity_by_name")

```

import hvac

client = hvac.Client()

read\_response = client.secrets.identity.read\_entity\_by\_name(

        name='hvac-entity',

)

entity\_id = read\_response['data']['id']

print('Entity ID for "hvac-entity" is: {id}'.format(id=entity\_id))

```

###### [Update Entity](#id7)[¶](#update-entity "Permalink to this headline")

[`hvac.api.secrets\_engines.Identity.update\_entity()`](index.html#hvac.api.secrets_engines.Identity.update_entity "hvac.api.secrets_engines.Identity.update_entity")

```

import hvac

client = hvac.Client()

client.secrets.identity.update\_entity(

        entity\_id=entity\_id,

        metadata=dict(new\_metadata='yup'),

)

```

###### [Delete Entity](#id8)[¶](#delete-entity "Permalink to this headline")

[`hvac.api.secrets\_engines.Identity.delete\_entity()`](index.html#hvac.api.secrets_engines.Identity.delete_entity "hvac.api.secrets_engines.Identity.delete_entity")

```

import hvac

client = hvac.Client()

client.secrets.identity.delete\_entity(

        entity\_id=entity\_id,

)

```

###### [Delete Entity By Name](#id9)[¶](#delete-entity-by-name "Permalink to this headline")

New in version Vault: 0.11.2

[`hvac.api.secrets\_engines.Identity.delete\_entity\_by\_name()`](index.html#hvac.api.secrets_engines.Identity.delete_entity_by_name "hvac.api.secrets_engines.Identity.delete_entity_by_name")

```

import hvac

client = hvac.Client()

client.secrets.identity.delete\_entity\_by\_name(

        name='hvac-entity',

)

```

###### [List Entities](#id10)[¶](#list-entities "Permalink to this headline")

[`hvac.api.secrets\_engines.Identity.list\_entities()`](index.html#hvac.api.secrets_engines.Identity.list_entities "hvac.api.secrets_engines.Identity.list_entities")

```

import hvac

client = hvac.Client()

list\_response = client.secrets.identity.list\_entities()

entity\_keys = list\_response['data']['keys']

print('The following entity IDs are currently configured: {keys}'.format(keys=entity\_keys))

```

###### [List Entities By Name](#id11)[¶](#list-entities-by-name "Permalink to this headline")

New in version Vault: 0.11.2

[`hvac.api.secrets\_engines.Identity.list\_entities\_by\_name()`](index.html#hvac.api.secrets_engines.Identity.list_entities_by_name "hvac.api.secrets_engines.Identity.list_entities_by_name")

```

import hvac

client = hvac.Client()

list\_response = client.secrets.identity.list\_entities\_by\_name()

entity\_keys = list\_response['data']['keys']

print('The following entity names are currently configured: {keys}'.format(keys=entity\_keys))

```

###### [Merge Entities](#id12)[¶](#merge-entities "Permalink to this headline")

[`hvac.api.secrets\_engines.Identity.merge\_entities()`](index.html#hvac.api.secrets_engines.Identity.merge_entities "hvac.api.secrets_engines.Identity.merge_entities")

```

import hvac

client = hvac.Client()

client.secrets.identity.merge\_entities(

        from\_entity\_ids=from\_entity\_ids,

        to\_entity\_id=to\_entity\_id,

)

```

##### [Entity Alias](#id13)[¶](#entity-alias "Permalink to this headline")

###### [Create Or Update Entity Alias](#id14)[¶](#create-or-update-entity-alias "Permalink to this headline")

[`hvac.api.secrets\_engines.Identity.create\_or\_update\_entity\_alias()`](index.html#hvac.api.secrets_engines.Identity.create_or_update_entity_alias "hvac.api.secrets_engines.Identity.create_or_update_entity_alias")

```

import hvac

client = hvac.Client()

create\_response = client.secrets.identity.create\_or\_update\_entity\_alias(

        name='hvac-entity-alias',

        canonical\_id=entity\_id,

        mount\_accessor='auth\_approle\_73c16de3',

)

alias\_id = create\_response['data']['id']

print('Alias ID for "hvac-entity-alias" is: {id}'.format(id=alias\_id))

```

###### [Read Entity Alias](#id15)[¶](#read-entity-alias "Permalink to this headline")

[`hvac.api.secrets\_engines.Identity.read\_entity\_alias()`](index.html#hvac.api.secrets_engines.Identity.read_entity_alias "hvac.api.secrets_engines.Identity.read_entity_alias")

```

import hvac

client = hvac.Client()

read\_response = client.secrets.identity.read\_entity\_alias(

        alias\_id=alias\_id,

)

name = read\_response['data']['name']

print('Name for entity alias {id} is: {name}'.format(id=alias\_id, name=name))

```

###### [Update Entity Alias](#id16)[¶](#update-entity-alias "Permalink to this headline")

[`hvac.api.secrets\_engines.Identity.update\_entity\_alias()`](index.html#hvac.api.secrets_engines.Identity.update_entity_alias "hvac.api.secrets_engines.Identity.update_entity_alias")

```

import hvac

client = hvac.Client()

client.secrets.identity.update\_entity\_alias(

        alias\_id=alias\_id,

        name='new-alias-name',

        canonical\_id=entity\_id,

        mount\_accessor='auth\_approle\_73c16de3',

)

```

###### [List Entity Aliases](#id17)[¶](#list-entity-aliases "Permalink to this headline")

[`hvac.api.secrets\_engines.Identity.list\_entity\_aliases()`](index.html#hvac.api.secrets_engines.Identity.list_entity_aliases "hvac.api.secrets_engines.Identity.list_entity_aliases")

```

import hvac

client = hvac.Client()

list\_response = client.secrets.identity.list\_entity\_aliases()

alias\_keys = list\_response['data']['keys']

print('The following entity alias IDs are currently configured: {keys}'.format(keys=alias\_keys))

```

###### [Delete Entity Alias](#id18)[¶](#delete-entity-alias "Permalink to this headline")

[`hvac.api.secrets\_engines.Identity.delete\_entity\_alias()`](index.html#hvac.api.secrets_engines.Identity.delete_entity_alias "hvac.api.secrets_engines.Identity.delete_entity_alias")

```

import hvac

client = hvac.Client()

client.secrets.identity.delete\_entity\_alias(

        alias\_id=alias\_id,

)

```

##### [Group](#id19)[¶](#group "Permalink to this headline")

###### [Create Or Update Group](#id20)[¶](#create-or-update-group "Permalink to this headline")

[`hvac.api.secrets\_engines.Identity.create\_or\_update\_group()`](index.html#hvac.api.secrets_engines.Identity.create_or_update_group "hvac.api.secrets_engines.Identity.create_or_update_group")

```

import hvac

client = hvac.Client()

create\_response = client.secrets.identity.create\_or\_update\_group(

        name='hvac-group',

        metadata=dict(extra\_datas='we gots em'),

)

group\_id = create\_response['data']['id']

print('Group ID for "hvac-group" is: {id}'.format(id=group\_id))

```

###### [Read Group](#id21)[¶](#read-group "Permalink to this headline")

[`hvac.api.secrets\_engines.Identity.read\_group()`](index.html#hvac.api.secrets_engines.Identity.read_group "hvac.api.secrets_engines.Identity.read_group")

```

import hvac

client = hvac.Client()

read\_response = client.secrets.identity.read\_group(

        group\_id=group\_id,

)

name = read\_response['data']['name']

print('Name for group ID {id} is: {name}'.format(id=group\_id, name=name))

```

###### [Update Group](#id22)[¶](#update-group "Permalink to this headline")

[`hvac.api.secrets\_engines.Identity.update\_group()`](index.html#hvac.api.secrets_engines.Identity.update_group "hvac.api.secrets_engines.Identity.update_group")

```

import hvac

client = hvac.Client()

client.secrets.identity.update\_group(

        group\_id=group\_id,

        metadata=dict(new\_metadata='yup'),

)

```

###### [Delete Group](#id23)[¶](#delete-group "Permalink to this headline")

[`hvac.api.secrets\_engines.Identity.delete\_group()`](index.html#hvac.api.secrets_engines.Identity.delete_group "hvac.api.secrets_engines.Identity.delete_group")

```

import hvac

client = hvac.Client()

client.secrets.identity.delete\_group(

        group\_id=group\_id,

)

```

###### [List Groups](#id24)[¶](#list-groups "Permalink to this headline")

[`hvac.api.secrets\_engines.Identity.list\_groups()`](index.html#hvac.api.secrets_engines.Identity.list_groups "hvac.api.secrets_engines.Identity.list_groups")

```

import hvac

client = hvac.Client()

list\_response = client.secrets.identity.list\_groups()

group\_keys = list\_entities\_response['data']['keys']

print('The following group IDs are currently configured: {keys}'.format(keys=group\_keys))

```

###### [List Groups By Name](#id25)[¶](#list-groups-by-name "Permalink to this headline")

New in version Vault: 0.11.2

[`hvac.api.secrets\_engines.Identity.list\_groups\_by\_name()`](index.html#hvac.api.secrets_engines.Identity.list_groups_by_name "hvac.api.secrets_engines.Identity.list_groups_by_name")

```

import hvac

client = hvac.Client()

list\_response = client.secrets.identity.list\_groups\_by\_name()

group\_keys = list\_response['data']['keys']

print('The following group names are currently configured: {keys}'.format(keys=group\_keys))

```

###### [Create Or Update Group By Name](#id26)[¶](#create-or-update-group-by-name "Permalink to this headline")

New in version Vault: 0.11.2

[`hvac.api.secrets\_engines.Identity.create\_or\_update\_group\_by\_name()`](index.html#hvac.api.secrets_engines.Identity.create_or_update_group_by_name "hvac.api.secrets_engines.Identity.create_or_update_group_by_name")

```

import hvac

client = hvac.Client()

client.secrets.identity.create\_or\_update\_group\_by\_name(

        name='hvac-group',

        metadata=dict(new\_datas='uhuh'),

)

```

###### [Read Group By Name](#id27)[¶](#read-group-by-name "Permalink to this headline")

New in version Vault: 0.11.2

[`hvac.api.secrets\_engines.Identity.read\_group\_by\_name()`](index.html#hvac.api.secrets_engines.Identity.read_group_by_name "hvac.api.secrets_engines.Identity.read_group_by_name")

```

import hvac

client = hvac.Client()

read\_response = client.secrets.identity.read\_group\_by\_name(

        name='hvac-group',

)

group\_id = read\_response['data']['id']

print('Group ID for "hvac-group" is: {id}'.format(id=group\_id))

```

###### [Delete Group By Name](#id28)[¶](#delete-group-by-name "Permalink to this headline")

New in version Vault: 0.11.2

[`hvac.api.secrets\_engines.Identity.delete\_group\_by\_name()`](index.html#hvac.api.secrets_engines.Identity.delete_group_by_name "hvac.api.secrets_engines.Identity.delete_group_by_name")

```

import hvac

client = hvac.Client()

client.secrets.identity.delete\_group\_by\_name(

        name='hvac-group',

)

```

##### [Group Alias](#id29)[¶](#group-alias "Permalink to this headline")

###### [Create Or Update Group Alias](#id30)[¶](#create-or-update-group-alias "Permalink to this headline")

[`hvac.api.secrets\_engines.Identity.create\_or\_update\_group\_alias()`](index.html#hvac.api.secrets_engines.Identity.create_or_update_group_alias "hvac.api.secrets_engines.Identity.create_or_update_group_alias")

```

import hvac

client = hvac.Client()

create\_response = client.secrets.identity.create\_or\_update\_group\_alias(

                name='hvac-group-alias',

                canonical\_id=group\_id,

                mount\_accessor='auth\_approle\_73c16de3',

        )

alias\_id = create\_response['data']['id']

print('Group alias ID for "hvac-group\_alias" is: {id}'.format(id=alias\_id))

```

###### [Update Group Alias](#id31)[¶](#update-group-alias "Permalink to this headline")

[`hvac.api.secrets\_engines.Identity.update\_group\_alias()`](index.html#hvac.api.secrets_engines.Identity.update_group_alias "hvac.api.secrets_engines.Identity.update_group_alias")

```

import hvac

client = hvac.Client()

client.secrets.identity.update\_group\_alias(

        alias\_id=alias\_id,

        name='new-alias-name',

        canonical\_id=group\_id,

        mount\_accessor='auth\_approle\_73c16de3',

)

```

###### [Read Group Alias](#id32)[¶](#read-group-alias "Permalink to this headline")

[`hvac.api.secrets\_engines.Identity.read\_group\_alias()`](index.html#hvac.api.secrets_engines.Identity.read_group_alias "hvac.api.secrets_engines.Identity.read_group_alias")

```

import hvac

client = hvac.Client()

read\_response = client.secrets.identity.read\_group\_alias(

        alias\_id=alias\_id,

)

name = read\_response['data']['name']

print('Name for group alias {id} is: {name}'.format(id=alias\_id, name=name))

```

###### [Delete Group Alias](#id33)[¶](#delete-group-alias "Permalink to this headline")

[`hvac.api.secrets\_engines.Identity.delete\_group\_alias()`](index.html#hvac.api.secrets_engines.Identity.delete_group_alias "hvac.api.secrets_engines.Identity.delete_group_alias")

```

import hvac

client = hvac.Client()

client.secrets.identity.delete\_group\_alias(

        alias\_id=alias\_id,

)

```

###### [List Group Aliases](#id34)[¶](#list-group-aliases "Permalink to this headline")

[`hvac.api.secrets\_engines.Identity.list\_group\_aliases()`](index.html#hvac.api.secrets_engines.Identity.list_group_aliases "hvac.api.secrets_engines.Identity.list_group_aliases")

```

import hvac

client = hvac.Client()

list\_response = client.secrets.identity.list\_group\_aliases()

alias\_keys = list\_response['data']['keys']

print('The following group alias IDs are currently configured: {keys}'.format(keys=alias\_keys))

```

##### [Lookup](#id35)[¶](#lookup "Permalink to this headline")

###### [Lookup Entity](#id36)[¶](#lookup-entity "Permalink to this headline")

[`hvac.api.secrets\_engines.Identity.lookup\_entity()`](index.html#hvac.api.secrets_engines.Identity.lookup_entity "hvac.api.secrets_engines.Identity.lookup_entity")

```

import hvac

client = hvac.Client()

lookup\_response = client.secrets.identity.lookup\_entity(

        name='hvac-entity',

)

entity\_id = lookup\_response['data']['id']

print('Entity ID for "hvac-entity" is: {id}'.format(id=entity\_id))

```

###### [Lookup Group](#id37)[¶](#lookup-group "Permalink to this headline")

[`hvac.api.secrets\_engines.Identity.lookup\_group()`](index.html#hvac.api.secrets_engines.Identity.lookup_group "hvac.api.secrets_engines.Identity.lookup_group")

```

import hvac

client = hvac.Client()

lookup\_response = client.secrets.identity.lookup\_group(

        name='hvac-group',

)

group\_id = lookup\_response['data']['id']

print('Group ID for "hvac-entity" is: {id}'.format(id=group\_id))

```

##### [Tokens](#id38)[¶](#tokens "Permalink to this headline")

###### [Configure Tokens Backend](#id39)[¶](#configure-tokens-backend "Permalink to this headline")

[`hvac.api.secrets\_engines.Identity.configure\_tokens\_backend()`](index.html#hvac.api.secrets_engines.Identity.configure_tokens_backend "hvac.api.secrets_engines.Identity.configure_tokens_backend")

```

import hvac

client = hvac.Client()

client.secrets.identity.configure\_tokens\_backend(

        issuer='https://python-hvac.org:1234',

)

```

###### [Read Tokens Backend Configuration](#id40)[¶](#read-tokens-backend-configuration "Permalink to this headline")

[`hvac.api.secrets\_engines.Identity.read\_tokens\_backend\_configuration()`](index.html#hvac.api.secrets_engines.Identity.read_tokens_backend_configuration "hvac.api.secrets_engines.Identity.read_tokens_backend_configuration")

```

import hvac

client = hvac.Client()

config = client.secrets.identity.read\_tokens\_backend\_configuration()

print('Tokens backend issuer: {issuer}'.format(issuer=config['data']['issuer']))

```

###### [Create Named Key](#id41)[¶](#create-named-key "Permalink to this headline")

[`hvac.api.secrets\_engines.Identity.create\_named\_key()`](index.html#hvac.api.secrets_engines.Identity.create_named_key "hvac.api.secrets_engines.Identity.create_named_key")

```

import hvac

client = hvac.Client()

client.secrets.identity.create\_named\_key(

        name='hvac',

)

```

###### [Read Named Key](#id42)[¶](#read-named-key "Permalink to this headline")

[`hvac.api.secrets\_engines.Identity.read\_named\_key()`](index.html#hvac.api.secrets_engines.Identity.read_named_key "hvac.api.secrets_engines.Identity.read_named_key")

```

import hvac

client = hvac.Client()

key\_response = client.secrets.identity.read\_named\_key(

        name='hvac',

)

print('Identity key "hvac" algorithm is: {algorithm}'.format(

        algorithm=response['data']['algorithm'],

))

```

###### [Delete Named Key](#id43)[¶](#delete-named-key "Permalink to this headline")

[`hvac.api.secrets\_engines.Identity.delete\_named\_key()`](index.html#hvac.api.secrets_engines.Identity.delete_named_key "hvac.api.secrets_engines.Identity.delete_named_key")

```

import hvac

client = hvac.Client()

client.secrets.identity.delete\_named\_key(

        name='hvac',

)

```

###### [List Named Keys](#id44)[¶](#list-named-keys "Permalink to this headline")

[`hvac.api.secrets\_engines.Identity.delete\_named\_key()`](index.html#hvac.api.secrets_engines.Identity.delete_named_key "hvac.api.secrets_engines.Identity.delete_named_key")

```

import hvac

client = hvac.Client()

list\_keys\_resp = client.secrets.identity.list\_named\_keys()

print('Current token key names: {names}'.format(

        names=', '.join(response['data']['keys']),

))

```

###### [Rotate Named Key](#id45)[¶](#rotate-named-key "Permalink to this headline")

[`hvac.api.secrets\_engines.Identity.rotate\_named\_key()`](index.html#hvac.api.secrets_engines.Identity.rotate_named_key "hvac.api.secrets_engines.Identity.rotate_named_key")

```

import hvac

client = hvac.Client()

client.secrets.identity.rotate\_named\_key(

        name='hvac',

        verification\_ttl='24h',

)

```

###### [Create or Update Role](#id46)[¶](#create-or-update-role "Permalink to this headline")

[`hvac.api.secrets\_engines.Identity.create\_or\_update\_role()`](index.html#hvac.api.secrets_engines.Identity.create_or_update_role "hvac.api.secrets_engines.Identity.create_or_update_role")

```

import hvac

client = hvac.Client()

key\_name = 'hvac-key'

token\_client\_id = 'some-client-id'

client.secrets.identity.create\_named\_key(

        name=key\_name,

        allowed\_client\_ids=[token\_client\_id],

)

client.secrets.identity.create\_or\_update\_role(

        name='hvac-person',

        key\_name=key\_name,

        client\_id=token\_client\_id,

)

```

###### [Read Role](#id47)[¶](#read-role "Permalink to this headline")

[`hvac.api.secrets\_engines.Identity.create\_or\_update\_role()`](index.html#hvac.api.secrets_engines.Identity.create_or_update_role "hvac.api.secrets_engines.Identity.create_or_update_role")

```

import hvac

client = hvac.Client()

read\_resp = client.secrets.identity.read\_role(

        name='hvac-person',

)

print('Identity role "hvac-person" is set to use key: {key\_name}'.format(

        key\_name=read\_resp['data']['key'],

))

```

###### [Delete Role](#id48)[¶](#delete-role "Permalink to this headline")

[`hvac.api.secrets\_engines.Identity.delete\_role()`](index.html#hvac.api.secrets_engines.Identity.delete_role "hvac.api.secrets_engines.Identity.delete_role")

```

import hvac

client = hvac.Client()

client.secrets.identity.delete\_role(

        name='hvac-person',

)

```

###### [List Roles](#id49)[¶](#list-roles "Permalink to this headline")

[`hvac.api.secrets\_engines.Identity.list\_roles()`](index.html#hvac.api.secrets_engines.Identity.list_roles "hvac.api.secrets_engines.Identity.list_roles")

```

import hvac

client = hvac.Client()

response = client.secrets.identity.list\_roles()

print('Current token role names: {names}'.format(

        names=', '.join(response['data']['keys']),

))

```

###### [Generate Signed ID Token](#id50)[¶](#generate-signed-id-token "Permalink to this headline")

[`hvac.api.secrets\_engines.Identity.generate\_signed\_id\_token()`](index.html#hvac.api.secrets_engines.Identity.generate_signed_id_token "hvac.api.secrets_engines.Identity.generate_signed_id_token")

```

import hvac

client = hvac.Client()

# Note: the token attribute on the following Client instance must have an

# identity associated with it. Otherwise the request will be reject by vault due to:

# "no entity associated with the request's token"

response = client.secrets.identity.generate\_signed\_id\_token(

        name='hvac-person',

)

print('Generated signed id token: {token}'.format(

        token=response['data']['token'],

))

```

###### [Introspect Signed ID Token](#id51)[¶](#introspect-signed-id-token "Permalink to this headline")

[`hvac.api.secrets\_engines.Identity.introspect\_signed\_id\_token()`](index.html#hvac.api.secrets_engines.Identity.introspect_signed_id_token "hvac.api.secrets_engines.Identity.introspect_signed_id_token")

```

import hvac

client = hvac.Client()

response = client.secrets.identity.introspect\_signed\_id\_token(

        token='some-generated-signed-id-token',

)

print('Specified token is active?: {active}'.format(

        active=response['active'],

))

```

###### [Read .well-known Configurations](#id52)[¶](#read-well-known-configurations "Permalink to this headline")

[`hvac.api.secrets\_engines.Identity.read\_well\_known\_configurations()`](index.html#hvac.api.secrets_engines.Identity.read_well_known_configurations "hvac.api.secrets_engines.Identity.read_well_known_configurations")

```

import hvac

client = hvac.Client()

response = client.secrets.identity.read\_well\_known\_configurations()

print('JWKS URI is: {jwks\_uri}'.format(

        active=response['jwks\_uri'],

))

```

###### [Read Active Public Keys](#id53)[¶](#read-active-public-keys "Permalink to this headline")

[`hvac.api.secrets\_engines.Identity.read\_active\_public\_keys()`](index.html#hvac.api.secrets_engines.Identity.read_active_public_keys "hvac.api.secrets_engines.Identity.read_active_public_keys")

```

import hvac

client = hvac.Client()

response = client.secrets.identity.read\_active\_public\_keys()

print('Active public keys: {keys}'.format(

        keys=response['keys'],

))

```

#### PKI[¶](#pki "Permalink to this headline")

##### Read CA Certificate[¶](#read-ca-certificate "Permalink to this headline")

`hvac.api.secrets\_engines.pki.read\_ca\_certificate()`

```

import hvac

client = hvac.Client()

read\_ca\_certificate\_response = client.secrets.pki.read\_ca\_certificate()

print('Current PKI CA Certificate: {}'.format(read\_ca\_certificate\_response))

```

##### Read CA Certificate Chain[¶](#read-ca-certificate-chain "Permalink to this headline")

`hvac.api.secrets\_engines.pki.read\_ca\_certificate\_chain()`

```

import hvac

client = hvac.Client()

read\_ca\_certificate\_chain\_response = client.secrets.pki.read\_ca\_certificate\_chain()

print('Current PKI CA Certificate Chain: {}'.format(read\_ca\_certificate\_chain\_response))

```

##### Read Certificate[¶](#read-certificate "Permalink to this headline")

`hvac.api.secrets\_engines.pki.read\_certificate()`

```

import hvac

client = hvac.Client()

read\_certificate\_response = client.secrets.pki.read\_certificate(serial='crl')

print('Current PKI CRL: {}'.format(read\_certificate\_response))

```

##### List Certificates[¶](#list-certificates "Permalink to this headline")

`hvac.api.secrets\_engines.pki.list\_certificates()`

```

import hvac

client = hvac.Client()

list\_certificate\_response = client.secrets.pki.list\_certificates()

print('Current certificates (serial numbers): {}'.format(list\_certificate\_response))

```

##### Submit CA Information[¶](#submit-ca-information "Permalink to this headline")

`hvac.api.secrets\_engines.pki.submit\_ca\_information()`

```

import hvac

client = hvac.Client()

submit\_ca\_information\_response = client.secrets.pki.submit\_ca\_information(

'-----BEGIN RSA PRIVATE KEY-----\n...\n-----END CERTIFICATE-----'

)

```

##### Read CRL Configuration[¶](#read-crl-configuration "Permalink to this headline")

`hvac.api.secrets\_engines.pki.read\_crl\_configuration()`

```

import hvac

client = hvac.Client()

read\_crl\_configuration\_response = client.secrets.pki.read\_crl\_configuration()

print('CRL configuration: {}'.format(read\_crl\_configuration\_response))

```

##### Set CRL Configuration[¶](#set-crl-configuration "Permalink to this headline")

`hvac.api.secrets\_engines.pki.set\_crl\_configuration()`

```

import hvac

client = hvac.Client()

set\_crl\_configuration\_response = client.secrets.pki.set\_crl\_configuration(

   expiry='72h',

   disable=False

)

```

##### Read URLs[¶](#read-urls "Permalink to this headline")

`hvac.api.secrets\_engines.pki.read\_urls()`

```

import hvac

client = hvac.Client()

read\_urls\_response = client.secrets.pki.read\_urls()

print('Get PKI urls: {}'.format(read\_urls\_response))

```

##### Set URLs[¶](#set-urls "Permalink to this headline")

`hvac.api.secrets\_engines.pki.set\_urls()`

```

import hvac

client = hvac.Client()

set\_urls\_response = client.secrets.pki.set\_urls(

{

  'issuing\_certificates': ['http://127.0.0.1:8200/v1/pki/ca'],

  'crl\_distribution\_points': ['http://127.0.0.1:8200/v1/pki/crl']

}

)

```

##### Read CRL[¶](#read-crl "Permalink to this headline")

`hvac.api.secrets\_engines.pki.read\_crl()`

```

import hvac

client = hvac.Client()

read\_crl\_response = client.secrets.pki.read\_crl()

print('Current CRL: {}'.format(read\_crl\_response))

```

##### Rotate CRLs[¶](#rotate-crls "Permalink to this headline")

`hvac.api.secrets\_engines.pki.rotate\_crl()`

```

import hvac

client = hvac.Client()

rotate\_crl\_response = client.secrets.pki.rotate\_crl()

print('Rotate CRL: {}'.format(rotate\_crl\_response))

```

##### Generate Intermediate[¶](#generate-intermediate "Permalink to this headline")

`hvac.api.secrets\_engines.pki.generate\_intermediate()`

```

import hvac

client = hvac.Client()

generate\_intermediate\_response = client.secrets.pki.generate\_intermediate(

    type='exported',

    common\_name='Vault integration tests'

)

print('Intermediate certificate: {}'.format(generate\_intermediate\_response))

```

##### Set Signed Intermediate[¶](#set-signed-intermediate "Permalink to this headline")

`hvac.api.secrets\_engines.pki.set\_signed\_intermediate()`

```

import hvac

client = hvac.Client()

set\_signed\_intermediate\_response = client.secrets.pki.set\_signed\_intermediate(

    '-----BEGIN CERTIFICATE...'

)

```

##### Generate Certificate[¶](#generate-certificate "Permalink to this headline")

`hvac.api.secrets\_engines.pki.generate\_certificate()`

```

import hvac

client = hvac.Client()

generate\_certificate\_response = client.secrets.pki.generate\_certificate(

   name='myrole',

   common\_name='test.example.com'

)

print('Certificate: {}'.format(generate\_certificate\_response))

```

##### Revoke Certificate[¶](#revoke-certificate "Permalink to this headline")

`hvac.api.secrets\_engines.pki.revoke\_certificate()`

```

import hvac

client = hvac.Client()

revoke\_certificate\_response = client.secrets.pki.revoke\_certificate(

   serial\_number='39:dd:2e...'

)

print('Certificate: {}'.format(revoke\_certificate\_response))

```

##### Create/Update Role[¶](#create-update-role "Permalink to this headline")

`hvac.api.secrets\_engines.pki.create\_or\_update\_role()`

```

import hvac

client = hvac.Client()

create\_or\_update\_role\_response = client.secrets.pki.create\_or\_update\_role(

   'mynewrole',

   {

      'ttl': '72h',

      'allow\_localhost': 'false'

   }

)

print('New role: {}'.format(create\_or\_update\_role\_response))

```

##### Read Role[¶](#read-role "Permalink to this headline")

`hvac.api.secrets\_engines.pki.read\_role()`

```

import hvac

client = hvac.Client()

read\_role\_response = client.secrets.pki.read\_role('myrole')

print('Role definition: {}'.format(read\_role\_response))

```

##### List Roles[¶](#list-roles "Permalink to this headline")

`hvac.api.secrets\_engines.pki.list\_roles()`

```

import hvac

client = hvac.Client()

list\_roles\_response = client.secrets.pki.list\_roles()

print('List of available roles: {}'.format(list\_roles\_response))

```

##### Delete Role[¶](#delete-role "Permalink to this headline")

`hvac.api.secrets\_engines.pki.delete\_role()`

```

import hvac

client = hvac.Client()

delete\_role\_response = client.secrets.pki.delete\_role('role2delete')

```

##### Generate Root[¶](#generate-root "Permalink to this headline")

`hvac.api.secrets\_engines.pki.generate\_root()`

```

import hvac

client = hvac.Client()

generate\_root\_response = client.secrets.pki.generate\_root(

   type='exported',

   common\_name='New root CA'

)

print('New root CA: {}'.format(generate\_root\_response))

```

##### Delete Root[¶](#delete-root "Permalink to this headline")

`hvac.api.secrets\_engines.pki.delete\_root()`

```

import hvac

client = hvac.Client()

delete\_root\_response = client.secrets.pki.delete\_root()

```

##### Sign Intermediate[¶](#sign-intermediate "Permalink to this headline")

`hvac.api.secrets\_engines.pki.sign\_intermediate()`

```

import hvac

client = hvac.Client()

sign\_intermediate\_response = client.secrets.pki.sign\_intermediate(

    csr='....',

    common\_name='example.com',

)

print('Signed certificate: {}'.format(sign\_intermediate\_response))

```

##### Sign Self-Issued[¶](#sign-self-issued "Permalink to this headline")

`hvac.api.secrets\_engines.pki.sign\_self\_issued()`

```

import hvac

client = hvac.Client()

sign\_self\_issued\_response = client.secrets.pki.sign\_self\_issued(

   certificate='...'

)

print('Signed certificate: {}'.format(sign\_self\_issued\_response))

```

##### Sign Certificate[¶](#sign-certificate "Permalink to this headline")

`hvac.api.secrets\_engines.pki.sign\_certificate()`

```

import hvac

client = hvac.Client()

sign\_certificate\_response = client.secrets.pki.sign\_certificate(

   name='myrole',

   csr='...',

   common\_name='example.com'

)

print('Signed certificate: {}'.format(sign\_certificate\_response))

```

##### Sign Verbatim[¶](#sign-verbatim "Permalink to this headline")

`hvac.api.secrets\_engines.pki.sign\_verbatim()`

```

import hvac

client = hvac.Client()

sign\_verbatim\_response = client.secrets.pki.sign\_verbatim(

   name='myrole',

   csr='...'

)

print('Signed certificate: {}'.format(sign\_verbatim\_response))

```

##### Tidy[¶](#tidy "Permalink to this headline")

`hvac.api.secrets\_engines.pki.tidy()`

```

import hvac

client = hvac.Client()

tidy\_response = client.secrets.pki.tidy()

```

#### KV Secrets Engines[¶](#kv-secrets-engines "Permalink to this headline")

The [`hvac.api.secrets\_engines.Kv`](index.html#hvac.api.secrets_engines.Kv "hvac.api.secrets_engines.Kv") instance under the `Client class's kv attribute` is a wrapper to expose either version 1 ([`KvV1`](index.html#hvac.api.secrets_engines.KvV1 "hvac.api.secrets_engines.KvV1")) or version 2 of the key/value secrets engines’ API methods ([`KvV2`](index.html#hvac.api.secrets_engines.KvV2 "hvac.api.secrets_engines.KvV2")). At present, this class defaults to version 2 when accessing methods on the instance.

##### Setting the Default KV Version[¶](#setting-the-default-kv-version "Permalink to this headline")

[`hvac.api.secrets\_engines.KvV1.read\_secret()`](index.html#hvac.api.secrets_engines.KvV1.read_secret "hvac.api.secrets_engines.KvV1.read_secret")

```

import hvac

client = hvac.Client()

client.kv.default\_kv\_version = 1

client.kv.read\_secret(path='hvac')  # => calls hvac.api.secrets\_engines.KvV1.read\_secret

```

##### Explicitly Calling a KV Version Method[¶](#explicitly-calling-a-kv-version-method "Permalink to this headline")

[`hvac.api.secrets\_engines.KvV1.list\_secrets()`](index.html#hvac.api.secrets_engines.KvV1.list_secrets "hvac.api.secrets_engines.KvV1.list_secrets")

```

import hvac

client = hvac.Client()

client.kv.v1.read\_secret(path='hvac')

client.kv.v2.read\_secret\_version(path='hvac')

```

##### Specific KV Version Usage[¶](#specific-kv-version-usage "Permalink to this headline")

###### KV - Version 1[¶](#kv-version-1 "Permalink to this headline")

Note

Every method under the [`Kv class's v1 attribute`](index.html#hvac.api.secrets_engines.Kv "hvac.api.secrets_engines.Kv") includes a mount\_point parameter that can be used to address the KvV1 secret engine under a custom mount path. E.g., If enabling the KvV1 secret engine using Vault’s CLI commands via vault secrets enable -path=my-kvv1 -version=1 kv”, the mount\_point parameter in [`hvac.api.secrets\_engines.KvV1()`](index.html#hvac.api.secrets_engines.KvV1 "hvac.api.secrets_engines.KvV1") methods would be set to “my-kvv1”.

####### Read a Secret[¶](#read-a-secret "Permalink to this headline")

[`hvac.api.secrets\_engines.KvV1.read\_secret()`](index.html#hvac.api.secrets_engines.KvV1.read_secret "hvac.api.secrets_engines.KvV1.read_secret")

```

import hvac

client = hvac.Client()

# The following path corresponds, when combined with the mount point, to a full Vault API route of "v1/secretz/hvac"

mount\_point = 'secretz'

secret\_path = 'hvac'

read\_secret\_result = client.secrets.kv.v1.read\_secret(

    path=secret\_path,

    mount\_point=mount\_point,

)

print('The "psst" key under the secret path ("/v1/secret/hvac") is: {psst}'.format(

    psst=read\_secret\_result['data']['psst'],

))

```

####### List Secrets[¶](#list-secrets "Permalink to this headline")

[`hvac.api.secrets\_engines.KvV1.list\_secrets()`](index.html#hvac.api.secrets_engines.KvV1.list_secrets "hvac.api.secrets_engines.KvV1.list_secrets")

```

import hvac

client = hvac.Client()

list\_secrets\_result = client.secrets.kv.v1.list\_secrets(path='hvac')

print('The following keys found under the selected path ("/v1/secret/hvac"): {keys}'.format(

    keys=','.join(list\_secrets\_result['data']['keys']),

))

```

####### Create or Update a Secret[¶](#create-or-update-a-secret "Permalink to this headline")

[`hvac.api.secrets\_engines.KvV1.create\_or\_update\_secret()`](index.html#hvac.api.secrets_engines.KvV1.create_or_update_secret "hvac.api.secrets_engines.KvV1.create_or_update_secret")

```

import hvac

client = hvac.Client()

hvac\_secret = {

    'psst': 'this is so secret yall',

}

client.secrets.kv.v1.create\_or\_update\_secret(

    path='hvac',

    secret=hvac\_secret,

)

read\_secret\_result = client.secrets.kv.v1.read\_secret(

    path='hvac',

)

print('The "psst" key under the secret path ("/v1/secret/hvac") is: {psst}'.format(

    psst=read\_secret\_result['data']['psst'],

))

```

####### Delete a Secret[¶](#delete-a-secret "Permalink to this headline")

[`hvac.api.secrets\_engines.KvV1.delete\_secret()`](index.html#hvac.api.secrets_engines.KvV1.delete_secret "hvac.api.secrets_engines.KvV1.delete_secret")

```

import hvac

client = hvac.Client()

client.secrets.kv.v1.delete\_secret(

    path='hvac',

)

# The following will raise a :py:class:`hvac.exceptions.InvalidPath` exception.

read\_secret\_result = client.secrets.kv.v1.read\_secret(

    path='hvac',

)

```

###### KV - Version 2[¶](#kv-version-2 "Permalink to this headline")

Note

Every method under the [`Kv class's v2 attribute`](index.html#hvac.api.secrets_engines.Kv "hvac.api.secrets_engines.Kv") includes a mount\_point parameter that can be used to address the KvV2 secret engine under a custom mount path. E.g., If enabling the KvV2 secret engine using Vault’s CLI commands via vault secrets enable -path=my-kvv2 -version=2 kv”, the mount\_point parameter in [`hvac.api.secrets\_engines.KvV2()`](index.html#hvac.api.secrets_engines.KvV2 "hvac.api.secrets_engines.KvV2") methods would be set to “my-kvv2”.

####### Configuration[¶](#configuration "Permalink to this headline")

[`hvac.api.secrets\_engines.KvV2.configure()`](index.html#hvac.api.secrets_engines.KvV2.configure "hvac.api.secrets_engines.KvV2.configure")

Setting the default max\_versions for a key/value engine version 2 under a path of kv:

```

import hvac

client = hvac.Client()

client.secrets.kv.v2.configure(

    max\_versions=20,

    mount\_point='kv',

)

```

Setting the default cas\_required (check-and-set required) flag under the implicit default path of secret:

```

import hvac

client = hvac.Client()

client.secrets.kv.v2.configure(

    cas\_required=True,

)

```

####### Read Configuration[¶](#read-configuration "Permalink to this headline")

[`hvac.api.secrets\_engines.KvV2.configure()`](index.html#hvac.api.secrets_engines.KvV2.configure "hvac.api.secrets_engines.KvV2.configure")

Reading the configuration of a KV version 2 engine mounted under a path of kv:

```

import hvac

client = hvac.Client()

kv\_configuration = client.secrets.kv.v2.read\_configuration(

    mount\_point='kv',

)

print('Config under path "kv": max\_versions set to "{max\_ver}"'.format(

    max\_ver=kv\_configuration['data']['max\_versions'],

))

print('Config under path "kv": check-and-set require flag set to {cas}'.format(

    cas=kv\_configuration['data']['cas\_required'],

))

```

####### Read Secret Versions[¶](#read-secret-versions "Permalink to this headline")

[`hvac.api.secrets\_engines.KvV2.read\_secret\_version()`](index.html#hvac.api.secrets_engines.KvV2.read_secret_version "hvac.api.secrets_engines.KvV2.read_secret_version")

Read the latest version of a given secret/path (“hvac”):

```

import hvac

client = hvac.Client()

secret\_version\_response = client.secrets.kv.v2.read\_secret\_version(

    path='hvac',

)

print('Latest version of secret under path "hvac" contains the following keys: {data}'.format(

    data=secret\_version\_response['data']['data'].keys(),

))

print('Latest version of secret under path "hvac" created at: {date}'.format(

    date=secret\_version\_response['data']['metadata']['created\_time'],

))

print('Latest version of secret under path "hvac" is version #{ver}'.format(

    ver=secret\_version\_response['data']['metadata']['version'],

))

```

Read specific version (1) of a given secret/path (“hvac”):

```

import hvac

client = hvac.Client()

secret\_version\_response = client.secrets.kv.v2.read\_secret\_version(

    path='hvac',

    version=1,

)

print('Version 1 of secret under path "hvac" contains the following keys: {data}'.format(

    data=secret\_version\_response['data']['data'].keys(),

))

print('Version 1 of secret under path "hvac" created at: {date}'.format(

    date=secret\_version\_response['data']['metadata']['created\_time'],

))

```

####### Create/Update Secret[¶](#create-update-secret "Permalink to this headline")

[`hvac.api.secrets\_engines.KvV2.create\_or\_update\_secret()`](index.html#hvac.api.secrets_engines.KvV2.create_or_update_secret "hvac.api.secrets_engines.KvV2.create_or_update_secret")

```

import hvac

client = hvac.Client()

client.secrets.kv.v2.create\_or\_update\_secret(

    path='hvac',

    secret=dict(pssst='this is secret'),

)

```

cas parameter with an argument that doesn’t match the current version:

```

import hvac

client = hvac.Client()

# Assuming a current version of "6" for the path "hvac" =>

client.secrets.kv.v2.create\_or\_update\_secret(

    path='hvac',

    secret=dict(pssst='this is secret'),

    cas=5,

)  # Raises hvac.exceptions.InvalidRequest

```

cas parameter set to 0 will only succeed if the path hasn’t already been written.

```

import hvac

client = hvac.Client()

client.secrets.kv.v2.create\_or\_update\_secret(

    path='hvac',

    secret=dict(pssst='this is secret #1'),

    cas=0,

)

client.secrets.kv.v2.create\_or\_update\_secret(

    path='hvac',

    secret=dict(pssst='this is secret #2'),

    cas=0,

)  # => Raises hvac.exceptions.InvalidRequest

```

####### Patch Existing Secret[¶](#patch-existing-secret "Permalink to this headline")

Method (similar to the Vault CLI command vault kv patch) to update an existing path. Either to add a new key/value to the secret and/or update the value for an existing key. Raises an [`hvac.exceptions.InvalidRequest`](index.html#hvac.exceptions.InvalidRequest "hvac.exceptions.InvalidRequest") if the path hasn’t been written to previously.

[`hvac.api.secrets\_engines.KvV2.patch()`](index.html#hvac.api.secrets_engines.KvV2.patch "hvac.api.secrets_engines.KvV2.patch")

```

import hvac

client = hvac.Client()

client.secrets.kv.v2.patch(

    path='hvac',

    secret=dict(pssst='this is a patched secret'),

)

```

####### Delete Latest Version of Secret[¶](#delete-latest-version-of-secret "Permalink to this headline")

[`hvac.api.secrets\_engines.KvV2.delete\_latest\_version\_of\_secret()`](index.html#hvac.api.secrets_engines.KvV2.delete_latest_version_of_secret "hvac.api.secrets_engines.KvV2.delete_latest_version_of_secret")

```

import hvac

client = hvac.Client()

client.secrets.kv.v2.delete\_latest\_version\_of\_secret(

    path=hvac,

)

```

####### Delete Secret Versions[¶](#delete-secret-versions "Permalink to this headline")

[`hvac.api.secrets\_engines.KvV2.delete\_secret\_versions()`](index.html#hvac.api.secrets_engines.KvV2.delete_secret_versions "hvac.api.secrets_engines.KvV2.delete_secret_versions")

Marking the first 3 versions of a secret deleted under path “hvac”:

```

import hvac

client = hvac.Client()

client.secrets.kv.v2.delete\_secret\_versions(

    path='hvac',

    versions=[1, 2, 3],

)

```

####### Undelete Secret Versions[¶](#undelete-secret-versions "Permalink to this headline")

[`hvac.api.secrets\_engines.KvV2.undelete\_secret\_versions()`](index.html#hvac.api.secrets_engines.KvV2.undelete_secret_versions "hvac.api.secrets_engines.KvV2.undelete_secret_versions")

Marking the last 3 versions of a secret deleted under path “hvac” as “undeleted”:

```

import hvac

client = hvac.Client()

hvac\_path\_metadata = client.secrets.kv.v2.read\_secret\_metadata(

    path='hvac',

)

oldest\_version = hvac\_path\_metadata['data']['oldest\_version']

current\_version = hvac\_path\_metadata['data']['current\_version']

versions\_to\_undelete = range(max(oldest\_version, current\_version - 2), current\_version + 1)

client.secrets.kv.v2.undelete\_secret\_versions(

    path='hvac',

    versions=versions\_to\_undelete,

)

```

####### Destroy Secret Versions[¶](#destroy-secret-versions "Permalink to this headline")

[`hvac.api.secrets\_engines.KvV2.destroy\_secret\_versions()`](index.html#hvac.api.secrets_engines.KvV2.destroy_secret_versions "hvac.api.secrets_engines.KvV2.destroy_secret_versions")

Destroying the first three versions of a secret under path ‘hvac’:

```

import hvac

client = hvac.Client()

client.secrets.kv.v2.destroy\_secret\_versions(

    path='hvac',

    versions=[1, 2, 3],

)

```

####### List Secrets[¶](#list-secrets "Permalink to this headline")

[`hvac.api.secrets\_engines.KvV2.list\_secrets()`](index.html#hvac.api.secrets_engines.KvV2.list_secrets "hvac.api.secrets_engines.KvV2.list_secrets")

Listing secrets under the ‘hvac’ path prefix:

```

import hvac

client = hvac.Client()

client.secrets.kv.v2.create\_or\_update\_secret(

    path='hvac/big-ole-secret',

    secret=dict(pssst='this is a large secret'),

)

client.secrets.kv.v2.create\_or\_update\_secret(

    path='hvac/lil-secret',

    secret=dict(pssst='this secret... not so big'),

)

list\_response = client.secrets.kv.v2.list\_secrets(

    path='hvac',

)

print('The following paths are available under "hvac" prefix: {keys}'.format(

    keys=','.join(list\_response['data']['keys']),

))

```

####### Read Secret Metadata[¶](#read-secret-metadata "Permalink to this headline")

[`hvac.api.secrets\_engines.KvV2.read\_secret\_metadata()`](index.html#hvac.api.secrets_engines.KvV2.read_secret_metadata "hvac.api.secrets_engines.KvV2.read_secret_metadata")

```

import hvac

client = hvac.Client()

hvac\_path\_metadata = client.secrets.kv.v2.read\_secret\_metadata(

    path='hvac',

)

print('Secret under path hvac is on version {cur\_ver}, with an oldest version of {old\_ver}'.format(

    cur\_ver=hvac\_path\_metadata['data']['oldest\_version'],

    old\_ver=hvac\_path\_metadata['data']['current\_version'],

))

```

####### Update Metadata[¶](#update-metadata "Permalink to this headline")

[`hvac.api.secrets\_engines.KvV2.update\_metadata()`](index.html#hvac.api.secrets_engines.KvV2.update_metadata "hvac.api.secrets_engines.KvV2.update_metadata")

Set max versions for a given path (“hvac”) to 3:

```

import hvac

client = hvac.Client()

client.secrets.kv.v2.update\_metadata(

    path='hvac',

    max\_versions=3,

)

```

Set cas (check-and-set) parameter as required for a given path (“hvac”):

```

import hvac

client = hvac.Client()

client.secrets.kv.v2.update\_metadata(

    path='hvac',

    cas\_required=True,

)

```

Set “delete\_version\_after” value to 30 minutes for all new versions written to the “hvac” path / key:

```

import hvac

client = hvac.Client()

client.secrets.kv.v2.update\_metadata(

    path='hvac',

    delete\_version\_after="30m",

)

```

####### Delete Metadata and All Versions[¶](#delete-metadata-and-all-versions "Permalink to this headline")

[`hvac.api.secrets\_engines.KvV2.delete\_metadata\_and\_all\_versions()`](index.html#hvac.api.secrets_engines.KvV2.delete_metadata_and_all_versions "hvac.api.secrets_engines.KvV2.delete_metadata_and_all_versions")

Delete all versions and metadata for a given path:

```

import hvac

client = hvac.Client()

client.secrets.kv.v2.delete\_metadata\_and\_all\_versions(

    path='hvac',

)

```

#### Transform[¶](#transform "Permalink to this headline")

* [Encode/Decode Example](#encode-decode-example)

* [Create/Update Role](#create-update-role)

* [Read Role](#read-role)

* [List Roles](#list-roles)

* [Delete Role](#delete-role)

* [Create/Update Transformation](#create-update-transformation)

* [Read Transformation](#read-transformation)

* [List Transformations](#list-transformations)

* [Delete Transformation](#delete-transformation)

* [Create/Update Template](#create-update-template)

* [Read Template](#read-template)

* [List Templates](#list-templates)

* [Delete Template](#delete-template)

* [Create/Update Alphabet](#create-update-alphabet)

* [Read Alphabet](#read-alphabet)

* [List Alphabets](#list-alphabets)

* [Delete Alphabet](#delete-alphabet)

* [Create Or Update FPE Transformation](#create-or-update-fpe-transformation)

* [Create Or Update Masking Transformation](#create-or-update-masking-transformation)

* [Create Or Update Tokenization Transformation](#create-or-update-tokenization-transformation)

* [Create Or Update Tokenization Store](#create-or-update-tokenization-store)

* [Encode](#encode)

* [Validate Token](#validate-token)

* [Check Tokenization](#check-tokenization)

* [Retrieve Token Metadata](#retrieve-token-metadata)

* [Snapshot Tokenization State](#snapshot-tokenization-state)

* [Restore Tokenization State](#restore-tokenization-state)

* [Export Decoded Tokenization State](#export-decoded-tokenization-state)

* [Rotate Tokenization Key](#rotate-tokenization-key)

* [Update Tokenization Key Config](#update-tokenization-key-config)

* [List Tokenization Key Configuration](#list-tokenization-key-configuration)

* [Read Tokenization Key Configuration](#read-tokenization-key-configuration)

* [Trim Tokenization Key Version](#trim-tokenization-key-version)

##### [Encode/Decode Example](#id1)[¶](#encode-decode-example "Permalink to this headline")

[`hvac.api.secrets\_engines.Transform.encode()`](index.html#hvac.api.secrets_engines.Transform.encode "hvac.api.secrets_engines.Transform.encode")

[`hvac.api.secrets\_engines.Transform.decode()`](index.html#hvac.api.secrets_engines.Transform.decode "hvac.api.secrets_engines.Transform.decode")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

input\_value = '1111-1111-1111-1111'

role\_name = 'hvac-role'

transformation\_name = 'hvac-fpe-credit-card'

transformations = [transformation\_name]

# Create a role and a transformation

client.secrets.transform.create\_or\_update\_role(

    name=role\_name,

    transformations=transformations,

)

client.secrets.transform.create\_or\_update\_transformation(

    name=transformation\_name,

    transform\_type='fpe',

    template='builtin/creditcardnumber',

    tweak\_source='internal',

    allowed\_roles=[role\_name],

)

# Use the role/transformation combination to encode a value

encode\_response = client.secrets.transform.encode(

    role\_name=role\_name,

    value=input\_value,

    transformation=transformation\_name,

)

print('The encoded value is: %s' % encode\_response['data']['encoded\_value'])

# Use the role/transformation combination to decode a value

decode\_response = client.secrets.transform.decode(

    role\_name=role\_name,

    value=encode\_response['data']['encoded\_value'],

    transformation=transformation\_name,

)

print('The decoded value is: %s' % decode\_response['data']['decoded\_value'])

```

```

The encoded value is: ...

The decoded value is: 1111-1111-1111-1111

```

##### [Create/Update Role](#id2)[¶](#create-update-role "Permalink to this headline")

[`hvac.api.secrets\_engines.Transform.create\_or\_update\_role()`](index.html#hvac.api.secrets_engines.Transform.create_or_update_role "hvac.api.secrets_engines.Transform.create_or_update_role")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

client.secrets.transform.create\_or\_update\_role(

    name='hvac-role',

    transformations=[

        'hvac-fpe-credit-card',

    ],

)

```

##### [Read Role](#id3)[¶](#read-role "Permalink to this headline")

[`hvac.api.secrets\_engines.Transform.read\_role()`](index.html#hvac.api.secrets_engines.Transform.read_role "hvac.api.secrets_engines.Transform.read_role")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

role\_name = 'hvac-role'

client.secrets.transform.create\_or\_update\_role(

    name=role\_name,

    transformations=[

        'hvac-fpe-credit-card',

    ],

)

read\_response = client.secrets.transform.read\_role(

    name=role\_name,

)

print('Role "{}" has the following transformations configured: {}'.format(

    role\_name,

    ', '.join(read\_response['data']['transformations']),

))

```

```

Role "hvac-role" has the following transformations configured: hvac-fpe-credit-card

```

##### [List Roles](#id4)[¶](#list-roles "Permalink to this headline")

[`hvac.api.secrets\_engines.Transform.list\_roles()`](index.html#hvac.api.secrets_engines.Transform.list_roles "hvac.api.secrets_engines.Transform.list_roles")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

client.secrets.transform.create\_or\_update\_role(

    name='hvac-role',

    transformations=[

        'hvac-fpe-credit-card',

    ],

)

list\_response = client.secrets.transform.list\_roles()

print('List of transform role names: {}'.format(

    ', '.join(list\_response['data']['keys']),

))

```

```

List of transform role names: hvac-role

```

##### [Delete Role](#id5)[¶](#delete-role "Permalink to this headline")

[`hvac.api.secrets\_engines.Transform.delete\_role()`](index.html#hvac.api.secrets_engines.Transform.delete_role "hvac.api.secrets_engines.Transform.delete_role")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

role\_name = 'hvac-role'

# Create a role

client.secrets.transform.create\_or\_update\_role(

    name=role\_name,

    transformations=[

        'hvac-fpe-credit-card',

    ],

)

# Subsequently delete it...

client.secrets.transform.delete\_role(

    name=role\_name,

)

```

##### [Create/Update Transformation](#id6)[¶](#create-update-transformation "Permalink to this headline")

[`hvac.api.secrets\_engines.Transform.create\_or\_update\_transformation()`](index.html#hvac.api.secrets_engines.Transform.create_or_update_transformation "hvac.api.secrets_engines.Transform.create_or_update_transformation")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

transformation\_name = 'hvac-fpe-credit-card'

template = 'builtin/creditcardnumber'

client.secrets.transform.create\_or\_update\_transformation(

    name=transformation\_name,

    transform\_type='fpe',

    template=template,

    tweak\_source='internal',

    allowed\_roles=[

        'test-role'

    ],

)

```

##### [Read Transformation](#id7)[¶](#read-transformation "Permalink to this headline")

[`hvac.api.secrets\_engines.Transform.read\_transformation()`](index.html#hvac.api.secrets_engines.Transform.read_transformation "hvac.api.secrets_engines.Transform.read_transformation")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

transformation\_name = 'hvac-fpe-credit-card'

template = 'builtin/creditcardnumber'

client.secrets.transform.create\_or\_update\_transformation(

    name=transformation\_name,

    transform\_type='fpe',

    template=template,

    tweak\_source='internal',

    allowed\_roles=[

        'hvac-role'

    ],

)

read\_response = client.secrets.transform.read\_transformation(

    name=transformation\_name,

)

print('Transformation "{}" has the following type configured: {}'.format(

    transformation\_name,

    read\_response['data']['type'],

))

```

```

Transformation "hvac-fpe-credit-card" has the following type configured: fpe

```

##### [List Transformations](#id8)[¶](#list-transformations "Permalink to this headline")

[`hvac.api.secrets\_engines.Transform.list\_transformations()`](index.html#hvac.api.secrets_engines.Transform.list_transformations "hvac.api.secrets_engines.Transform.list_transformations")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

transformation\_name = 'hvac-fpe-credit-card'

template = 'builtin/creditcardnumber'

client.secrets.transform.create\_or\_update\_transformation(

    name=transformation\_name,

    transform\_type='fpe',

    template=template,

    tweak\_source='internal',

    allowed\_roles=[

        'hvac-role'

    ],

)

list\_response = client.secrets.transform.list\_transformations()

print('List of transformations: {}'.format(

    ', '.join(list\_response['data']['keys']),

))

```

```

List of transformations: hvac-fpe-credit-card

```

##### [Delete Transformation](#id9)[¶](#delete-transformation "Permalink to this headline")

[`hvac.api.secrets\_engines.Transform.delete\_transformation()`](index.html#hvac.api.secrets_engines.Transform.delete_transformation "hvac.api.secrets_engines.Transform.delete_transformation")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

transformation\_name = 'hvac-fpe-credit-card'

template = 'builtin/creditcardnumber'

# Create a transformation

client.secrets.transform.create\_or\_update\_transformation(

    name=transformation\_name,

    transform\_type='fpe',

    template=template,

    tweak\_source='internal',

    allowed\_roles=[

        'hvac-role'

    ],

)

# Subsequently delete it...

client.secrets.transform.delete\_role(

    name=role\_name,

)

```

##### [Create/Update Template](#id10)[¶](#create-update-template "Permalink to this headline")

[`hvac.api.secrets\_engines.Transform.create\_or\_update\_template()`](index.html#hvac.api.secrets_engines.Transform.create_or_update_template "hvac.api.secrets_engines.Transform.create_or_update_template")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

template\_name = 'hvac-template'

create\_response = client.secrets.transform.create\_or\_update\_template(

    name=template\_name,

    template\_type='regex',

    pattern='(\\d{9})',

    alphabet='builtin/numeric',

)

```

##### [Read Template](#id11)[¶](#read-template "Permalink to this headline")

[`hvac.api.secrets\_engines.Transform.read\_template()`](index.html#hvac.api.secrets_engines.Transform.read_template "hvac.api.secrets_engines.Transform.read_template")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

template\_name = 'hvac-template'

client.secrets.transform.create\_or\_update\_template(

    name=template\_name,

    template\_type='regex',

    pattern='(\\d{9})',

    alphabet='builtin/numeric',

)

read\_response = client.secrets.transform.read\_template(

    name=template\_name,

)

print('Template "{}" has the following type configured: {}'.format(

    template\_name,

    read\_response['data']['type'],

))

```

```

Template "hvac-template" has the following type configured: regex

```

##### [List Templates](#id12)[¶](#list-templates "Permalink to this headline")

[`hvac.api.secrets\_engines.Transform.list\_templates()`](index.html#hvac.api.secrets_engines.Transform.list_templates "hvac.api.secrets_engines.Transform.list_templates")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

template\_name = 'hvac-template'

client.secrets.transform.create\_or\_update\_template(

    name=template\_name,

    template\_type='regex',

    pattern='(\\d{9})',

    alphabet='builtin/numeric',

)

list\_response = client.secrets.transform.list\_templates()

print('List of templates: {}'.format(

    ', '.join(list\_response['data']['keys']),

))

```

```

List of templates: builtin/creditcardnumber, builtin/socialsecuritynumber, hvac-template

```

##### [Delete Template](#id13)[¶](#delete-template "Permalink to this headline")

[`hvac.api.secrets\_engines.Transform.delete\_template()`](index.html#hvac.api.secrets_engines.Transform.delete_template "hvac.api.secrets_engines.Transform.delete_template")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

template\_name = 'hvac-template'

client.secrets.transform.create\_or\_update\_template(

    name=template\_name,

    template\_type='regex',

    pattern='(\\d{9})',

    alphabet='builtin/numeric',

)

# Subsequently delete it...

client.secrets.transform.delete\_template(

    name=template\_name,

)

```

##### [Create/Update Alphabet](#id14)[¶](#create-update-alphabet "Permalink to this headline")

[`hvac.api.secrets\_engines.Transform.create\_or\_update\_alphabet()`](index.html#hvac.api.secrets_engines.Transform.create_or_update_alphabet "hvac.api.secrets_engines.Transform.create_or_update_alphabet")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

alphabet\_name = 'hvac-alphabet'

alphabet\_value = 'abc'

client.secrets.transform.create\_or\_update\_alphabet(

    name=alphabet\_name,

    alphabet=alphabet\_value,

)

```

##### [Read Alphabet](#id15)[¶](#read-alphabet "Permalink to this headline")

[`hvac.api.secrets\_engines.Transform.read\_alphabet()`](index.html#hvac.api.secrets_engines.Transform.read_alphabet "hvac.api.secrets_engines.Transform.read_alphabet")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

alphabet\_name = 'hvac-alphabet'

alphabet\_value = 'abc'

client.secrets.transform.create\_or\_update\_alphabet(

    name=alphabet\_name,

    alphabet=alphabet\_value,

)

read\_response = client.secrets.transform.read\_alphabet(

    name=alphabet\_name,

)

print('Alphabet "{}" has this jazz: {}'.format(

    alphabet\_name,

    read\_response['data']['alphabet'],

))

```

```

Alphabet "hvac-alphabet" has this jazz: abc

```

##### [List Alphabets](#id16)[¶](#list-alphabets "Permalink to this headline")

[`hvac.api.secrets\_engines.Transform.list\_alphabets()`](index.html#hvac.api.secrets_engines.Transform.list_alphabets "hvac.api.secrets_engines.Transform.list_alphabets")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

alphabet\_name = 'hvac-alphabet'

alphabet\_value = 'abc'

client.secrets.transform.create\_or\_update\_alphabet(

    name=alphabet\_name,

    alphabet=alphabet\_value,

)

list\_response = client.secrets.transform.list\_alphabets()

print('List of alphabets: {}'.format(

    ', '.join(list\_response['data']['keys']),

))

```

```

List of alphabets: builtin/alphalower, ..., hvac-alphabet

```

##### [Delete Alphabet](#id17)[¶](#delete-alphabet "Permalink to this headline")

[`hvac.api.secrets\_engines.Transform.delete\_alphabet()`](index.html#hvac.api.secrets_engines.Transform.delete_alphabet "hvac.api.secrets_engines.Transform.delete_alphabet")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

alphabet\_name = 'hvac-alphabet'

alphabet\_value = 'abc'

# Create an alphabet

client.secrets.transform.create\_or\_update\_alphabet(

    name=alphabet\_name,

    alphabet=alphabet\_value,

)

# Subsequently delete it...

client.secrets.transform.delete\_alphabet(

    name=alphabet\_name,

)

```

##### [Create Or Update FPE Transformation](#id18)[¶](#create-or-update-fpe-transformation "Permalink to this headline")

[`hvac.api.secrets\_engines.Transform.create\_or\_update\_fpe\_transformation()`](index.html#hvac.api.secrets_engines.Transform.create_or_update_fpe_transformation "hvac.api.secrets_engines.Transform.create_or_update_fpe_transformation")

Creates or update an FPE transformation with the given name.

If a transformation with the name does not exist, it will be created. If the transformation exists, it will be

updated with the new attributes.

Supported methods:POST: /{mount\_point}/transformations/fpe/:name.

param name

The name of the transformation to create or update. This is part of

the request URL.

type name

str

param template

The template name to use for matching value on encode and decode

operations when using this transformation.

type template

str

param tweak\_source

Specifies the source of where the tweak value comes from. Valid sources are:

supplied, generated, and internal.

type tweak\_source

str

param allowed\_roles

A list of allowed roles that this transformation can be assigned to.

A role using this transformation must exist in this list in order for

encode and decode operations to properly function.

type allowed\_roles

list

param mount\_point

The “path” the method/backend was mounted on.

type mount\_point

str

return

The response of the create\_or\_update\_fpe\_transformation request.

rtype

requests.Response

##### [Create Or Update Masking Transformation](#id19)[¶](#create-or-update-masking-transformation "Permalink to this headline")

[`hvac.api.secrets\_engines.Transform.create\_or\_update\_masking\_transformation()`](index.html#hvac.api.secrets_engines.Transform.create_or_update_masking_transformation "hvac.api.secrets_engines.Transform.create_or_update_masking_transformation")

Creates or update a masking transformation with the given name. If a

transformation with the name does not exist, it will be created. If the

transformation exists, it will be updated with the new attributes.

Supported methods:POST: /{mount\_point}/transformations/masking/:name.

param name

The name of the transformation to create or update. This is part of

the request URL.

type name

str

param template

The template name to use for matching value on encode and decode

operations when using this transformation.

type template

str

param masking\_character

The character to use for masking. If multiple characters are

provided, only the first one is used and the rest is ignored. Only used when

the type is masking.

type masking\_character

str

param allowed\_roles

A list of allowed roles that this transformation can be assigned to.

A role using this transformation must exist in this list in order for

encode and decode operations to properly function.

type allowed\_roles

list

param mount\_point

The “path” the method/backend was mounted on.

type mount\_point

str

return

The response of the create\_or\_update\_masking\_transformation request.

rtype

requests.Response

##### [Create Or Update Tokenization Transformation](#id20)[¶](#create-or-update-tokenization-transformation "Permalink to this headline")

[`hvac.api.secrets\_engines.Transform.create\_or\_update\_tokenization\_transformation()`](index.html#hvac.api.secrets_engines.Transform.create_or_update_tokenization_transformation "hvac.api.secrets_engines.Transform.create_or_update_tokenization_transformation")

This endpoint creates or updates a tokenization transformation with the given name. If a

transformation with the name does not exist, it will be created. If the

transformation exists, it will be updated with the new attributes.

Supported methods:POST: /{mount\_point}/transformations/tokenization/:name.

param max\_ttl

The maximum TTL of a token. If 0 or unspecified, tokens may have no expiration.

type max\_ttl

str

param mapping\_mode

Specifies the mapping mode for stored tokenization values.

* default is strongly recommended for highest security

* exportable exportable allows for all plaintexts to be decoded via the export-decoded endpoint in an emergency.

type mapping\_mode

str

param allowed\_roles

aAlist of allowed roles that this transformation can be assigned to.

A role using this transformation must exist in this list in order for

encode and decode operations to properly function.

type allowed\_roles

list

param stores

list of tokenization stores to use for tokenization state. Vault’s

internal storage is used by default.

type stores

list

param mount\_point

The “path” the method/backend was mounted on.

type mount\_point

str

return

The response of the create\_or\_update\_tokenization\_transformation request.

rtype

requests.Response

##### [Create Or Update Tokenization Store](#id21)[¶](#create-or-update-tokenization-store "Permalink to this headline")

[`hvac.api.secrets\_engines.Transform.create\_or\_update\_tokenization\_store()`](index.html#hvac.api.secrets_engines.Transform.create_or_update_tokenization_store "hvac.api.secrets_engines.Transform.create_or_update_tokenization_store")

Create or update a storage configuration for use with tokenization.

The database user configured here should only have permission to SELECT, INSERT, and UPDATE rows in the tables.

Supported methods:POST: /{mount\_point}/store/:name.

param name

The name of the store to create or update.

type name

str

param type

Specifies the type of store. Currently only sql is supported.

type type

str

param driver

Specifies the database driver to use, and thus which SQL database type.

Currently the supported options are postgres or mysql

type driver

str

param supported\_transformations

The types of transformations this store can host. Currently only tokenization is supported.

type supported\_transformations

list(str)

param connection\_string

database connection string with template slots for username and password that

Vault will use for locating and connecting to a database. Each

database driver type has a different syntax for its connection strings.

type connection\_string

str

param username

username value to use when connecting to the database.

type username

str

param password

password value to use when connecting to the database.

type password

str

param schema

schema within the database to expect tokenization state tables.

type schema

str

param max\_open\_connections

maximum number of connections to the database at any given time.

type max\_open\_connections

int

param max\_idle\_connections

maximum number of idle connections to the database at any given time.

type max\_idle\_connections

int

param max\_connection\_lifetime

means no limit.

type max\_connection\_lifetime

duration

param mount\_point

The “path” the method/backend was mounted on.

type mount\_point

str

return

The response of the create\_or\_update\_tokenization\_store request.

rtype

requests.Response

##### [Encode](#id22)[¶](#encode "Permalink to this headline")

[`hvac.api.secrets\_engines.Transform.encode()`](index.html#hvac.api.secrets_engines.Transform.encode "hvac.api.secrets_engines.Transform.encode")

Encode the provided value using a named role.

Supported methods:POST: /{mount\_point}/encode/:role\_name.

param role\_name

the role name to use for this operation. This is specified as part

of the URL.

type role\_name

str | unicode

param value

the value to be encoded.

type value

str | unicode

param transformation

the transformation within the role that should be used for this

encode operation. If a single transformation exists for role, this parameter

may be skipped and will be inferred. If multiple transformations exist, one

must be specified.

type transformation

str | unicode

param tweak

the tweak source.

type tweak

str | unicode

param batch\_input

a list of items to be encoded in a single batch. When this

parameter is set, the ‘value’, ‘transformation’ and ‘tweak’ parameters are

ignored. Instead, the aforementioned parameters should be provided within

each object in the list.

type batch\_input

list

param mount\_point

The “path” the secrets engine was mounted on.

type mount\_point

str | unicode

return

The response of the encode request.

rtype

requests.Response

##### [Validate Token](#id23)[¶](#validate-token "Permalink to this headline")

[`hvac.api.secrets\_engines.Transform.validate\_token()`](index.html#hvac.api.secrets_engines.Transform.validate_token "hvac.api.secrets_engines.Transform.validate_token")

Determine if a provided tokenized value is valid and unexpired.

Only valid for tokenization transformations.

Supported methods:POST: /{mount\_point}/validate/:role\_name.

param role\_name

the role name to use for this operation. This is specified as part

of the URL.

type role\_name

str

param value

the token for which to check validity.

type value

str

param transformation

the transformation within the role that should be used for this

decode operation. If a single transformation exists for role, this parameter

may be skipped and will be inferred. If multiple transformations exist, one

must be specified.

type transformation

str

param batch\_input

a list of items to be decoded in a single batch. When this

parameter is set, the ‘value’ parameter is

ignored. Instead, the aforementioned parameters should be provided within

each object in the list.

type batch\_input

list

param mount\_point

The “path” the method/backend was mounted on.

type mount\_point

str

return

The response of the validate\_token request.

rtype

requests.Response

##### [Check Tokenization](#id24)[¶](#check-tokenization "Permalink to this headline")

[`hvac.api.secrets\_engines.Transform.check\_tokenization()`](index.html#hvac.api.secrets_engines.Transform.check_tokenization "hvac.api.secrets_engines.Transform.check_tokenization")

Determine if a provided plaintext value has an valid, unexpired tokenized value.

Note that this cannot return the token, just confirm that a

tokenized value exists. This endpoint is only valid for tokenization

transformations.

Supported methods:POST: /{mount\_point}/tokenized/:role\_name.

param role\_name

the role name to use for this operation. This is specified as part

of the URL.

type role\_name

str

param value

the token to test for whether it has a valid tokenization.

type value

str

param transformation

the transformation within the role that should be used for this

decode operation. If a single transformation exists for role, this parameter

may be skipped and will be inferred. If multiple transformations exist, one

must be specified.

type transformation

str

param batch\_input

a list of items to be decoded in a single batch. When this

parameter is set, the ‘value’ parameter is

ignored. Instead, the aforementioned parameters should be provided within

each object in the list.

type batch\_input

list

param mount\_point

The “path” the method/backend was mounted on.

type mount\_point

str

return

The response of the check\_tokenization request.

rtype

requests.Response

##### [Retrieve Token Metadata](#id25)[¶](#retrieve-token-metadata "Permalink to this headline")

[`hvac.api.secrets\_engines.Transform.retrieve\_token\_metadata()`](index.html#hvac.api.secrets_engines.Transform.retrieve_token_metadata "hvac.api.secrets_engines.Transform.retrieve_token_metadata")

This endpoint retrieves metadata for a tokenized value using a named role.

Only valid for tokenization transformations.

Supported methods:POST: /{mount\_point}/metadata/:role\_name.

param role\_name

the role name to use for this operation. This is specified as part

of the URL.

type role\_name

str

param value

the token for which to retrieve metadata.

type value

str

param transformation

the transformation within the role that should be used for this

decode operation. If a single transformation exists for role, this parameter

may be skipped and will be inferred. If multiple transformations exist, one

must be specified.

type transformation

str

param batch\_input

a list of items to be decoded in a single batch. When this

parameter is set, the ‘value’ parameter is

ignored. Instead, the aforementioned parameters should be provided within

each object in the list.

type batch\_input

list

param mount\_point

The “path” the method/backend was mounted on.

type mount\_point

str

return

The response of the retrieve\_token\_metadata request.

rtype

requests.Response

##### [Snapshot Tokenization State](#id26)[¶](#snapshot-tokenization-state "Permalink to this headline")

[`hvac.api.secrets\_engines.Transform.snapshot\_tokenization\_state()`](index.html#hvac.api.secrets_engines.Transform.snapshot_tokenization_state "hvac.api.secrets_engines.Transform.snapshot_tokenization_state")

This endpoint starts or continues retrieving a snapshot of the stored

state of a tokenization transform. This state is protected as it is

in the underlying store, and so is safe for storage or transport. Snapshots

may be used for backup purposes or to migrate from one store to another.

If more than one store is configured for a tokenization transform, the

snapshot data contains the contents of the first store.

Supported methods:POST: /{mount\_point}/transformations/tokenization/snapshot/:name.

param name

the name of the transformation to snapshot.

type name

str

param limit

maximum number of tokenized value states to return on this call.

type limit

int

param continuation

absent or empty, a new snapshot is started. If present, the

snapshot should continue at the next available value.

type continuation

str

param mount\_point

The “path” the method/backend was mounted on.

type mount\_point

str

return

The response of the snapshot\_tokenization\_state request.

rtype

requests.Response

##### [Restore Tokenization State](#id27)[¶](#restore-tokenization-state "Permalink to this headline")

[`hvac.api.secrets\_engines.Transform.restore\_tokenization\_state()`](index.html#hvac.api.secrets_engines.Transform.restore_tokenization_state "hvac.api.secrets_engines.Transform.restore_tokenization_state")

This endpoint restores previously snapshotted tokenization state values

to the underlying store(s) of a tokenization transform. Calls to this

endpoint are idempotent, so multiple outputs from a snapshot run can

be applied via restore in any order and duplicates will not cause a problem.

Supported methods:POST: /{mount\_point}/transformations/tokenization/restore/:name.

param name

the name of the transformation to restore.

type name

str

param values

number of tokenization state values from a previous snapshot call.

type values

str

param mount\_point

The “path” the method/backend was mounted on.

type mount\_point

str

return

The response of the restore\_tokenization\_state request.

rtype

requests.Response

##### [Export Decoded Tokenization State](#id28)[¶](#export-decoded-tokenization-state "Permalink to this headline")

[`hvac.api.secrets\_engines.Transform.export\_decoded\_tokenization\_state()`](index.html#hvac.api.secrets_engines.Transform.export_decoded_tokenization_state "hvac.api.secrets_engines.Transform.export_decoded_tokenization_state")

Start or continue retrieving an export of tokenization state, including the tokens and their decoded values.

This call is only supported on tokenization stores configured with the exportable mapping mode.

Refer to the Tokenization documentation for when to use the exportable mapping mode.

Decoded values are in Base64 representation.

Supported methods:POST: /{mount\_point}/transformations/tokenization/export-decoded/:name.

param name

the name of the transformation to export.

type name

str

param limit

maximum number of tokenized value states to return on this call.

type limit

int

param continuation

absent or empty, a new export is started. If present, the

export should continue at the next available value.

type continuation

str

param mount\_point

The “path” the method/backend was mounted on.

type mount\_point

str

return

The response of the export\_decoded\_tokenization\_state request.

rtype

requests.Response

##### [Rotate Tokenization Key](#id29)[¶](#rotate-tokenization-key "Permalink to this headline")

[`hvac.api.secrets\_engines.Transform.rotate\_tokenization\_key()`](index.html#hvac.api.secrets_engines.Transform.rotate_tokenization_key "hvac.api.secrets_engines.Transform.rotate_tokenization_key")

Rotate the version of the named key.

After rotation, new requests will be encoded with the new version of the key.

Supported methods:POST: /{mount\_point}/tokenization/keys/{transform\_name}/rotate.

param transform\_name

the transform name to use for this operation. This is specified as part

of the URL.

type transform\_name

str

param mount\_point

The “path” the method/backend was mounted on.

type mount\_point

str

return

The response of the rotate\_tokenization\_key request.

rtype

requests.Response

##### [Update Tokenization Key Config](#id30)[¶](#update-tokenization-key-config "Permalink to this headline")

[`hvac.api.secrets\_engines.Transform.update\_tokenization\_key\_config()`](index.html#hvac.api.secrets_engines.Transform.update_tokenization_key_config "hvac.api.secrets_engines.Transform.update_tokenization_key_config")

Allow the minimum key version to be set for decode operations.

Only valid for tokenization transformations.

Supported methods:POST: /{mount\_point}/tokenization/keys/{transform\_name}/config.

param transform\_name

the transform name to use for this operation. This is specified as part

of the URL.

type transform\_name

str

param min\_decryption\_version

the minimum key version that vault can use to decode values for the

corresponding transform.

type min\_decryption\_version

int

param mount\_point

The “path” the method/backend was mounted on.

type mount\_point

str

return

The response of the update\_tokenization\_key\_config request.

rtype

requests.Response

##### [List Tokenization Key Configuration](#id31)[¶](#list-tokenization-key-configuration "Permalink to this headline")

[`hvac.api.secrets\_engines.Transform.list\_tokenization\_key\_configuration()`](index.html#hvac.api.secrets_engines.Transform.list_tokenization_key_configuration "hvac.api.secrets_engines.Transform.list_tokenization_key_configuration")

List all tokenization keys.

Only valid for tokenization transformations.

Supported methods:LIST: /{mount\_point}/tokenization/keys/.

param mount\_point

The “path” the method/backend was mounted on.

type mount\_point

str

return

The response of the list\_tokenization\_key\_configuration request.

rtype

requests.Response

##### [Read Tokenization Key Configuration](#id32)[¶](#read-tokenization-key-configuration "Permalink to this headline")

[`hvac.api.secrets\_engines.Transform.read\_tokenization\_key\_configuration()`](index.html#hvac.api.secrets_engines.Transform.read_tokenization_key_configuration "hvac.api.secrets_engines.Transform.read_tokenization_key_configuration")

Read tokenization key configuration for a particular transform.

Only valid for tokenization transformations.

Supported methods:GET: /{mount\_point}/tokenization/keys/:{mount\_point}\_name.

param transform\_name

the transform name to use for this operation. This is specified as part

of the URL.

type transform\_name

str

param mount\_point

The “path” the method/backend was mounted on.

type mount\_point

str

return

The response of the read\_tokenization\_key\_configuration request.

rtype

requests.Response

##### [Trim Tokenization Key Version](#id33)[¶](#trim-tokenization-key-version "Permalink to this headline")

[`hvac.api.secrets\_engines.Transform.trim\_tokenization\_key\_version()`](index.html#hvac.api.secrets_engines.Transform.trim_tokenization_key_version "hvac.api.secrets_engines.Transform.trim_tokenization_key_version")

Trim older key versions setting a minimum version for the keyring.

Once trimmed, previous versions of the key cannot be recovered.

Supported methods:POST: /{mount\_point}/tokenization/keys/{transform\_name}/trim.

param transform\_name

the transform name to use for this operation. This is specified as part

of the URL.

type transform\_name

str

param min\_available\_version

type min\_available\_version

int

param mount\_point

The “path” the method/backend was mounted on.

type mount\_point

str

return

The response of the trim\_tokenization\_key\_version request.

rtype

requests.Response

#### Transit[¶](#transit "Permalink to this headline")

* [Create Key](#create-key)

* [Read Key](#read-key)

* [List Keys](#list-keys)

* [Delete Key](#delete-key)

* [Update Key Configuration](#update-key-configuration)

* [Rotate Key](#rotate-key)

* [Export Key](#export-key)

* [Encrypt Data](#encrypt-data)

* [Decrypt Data](#decrypt-data)

* [Rewrap Data](#rewrap-data)

* [Generate Data Key](#generate-data-key)

* [Generate Random Bytes](#generate-random-bytes)

* [Hash Data](#hash-data)

* [Generate Hmac](#generate-hmac)

* [Sign Data](#sign-data)

* [Verify Signed Data](#verify-signed-data)

* [Backup Key](#backup-key)

* [Restore Key](#restore-key)

* [Trim Key](#trim-key)

Note

The following helper method is used various of the examples included here.

```

import sys

def base64ify(bytes\_or\_str):

    """Helper method to perform base64 encoding across Python 2.7 and Python 3.X"""

    if sys.version\_info[0] >= 3 and isinstance(bytes\_or\_str, str):

        input\_bytes = bytes\_or\_str.encode('utf8')

    else:

        input\_bytes = bytes\_or\_str

    output\_bytes = base64.urlsafe\_b64encode(input\_bytes)

    if sys.version\_info[0] >= 3:

        return output\_bytes.decode('ascii')

    else:

        return output\_bytes

```

##### [Create Key](#id19)[¶](#create-key "Permalink to this headline")

`Transit.``create_key`(*name*, *convergent\_encryption=None*, *derived=None*, *exportable=None*, *allow\_plaintext\_backup=None*, *key\_type=None*, *mount\_point='transit'*)[[source]](_modules/hvac/api/secrets_engines/transit.html#Transit.create_key)

Create a new named encryption key of the specified type.

The values set here cannot be changed after key creation.

Supported methods:POST: /{mount\_point}/keys/{name}. Produces: 204 (empty body)

Parameters

* **name** (*str | unicode*) – Specifies the name of the encryption key to create. This is specified as part of the URL.

* **convergent\_encryption** (*bool*) – If enabled, the key will support convergent encryption, where the same plaintext

creates the same ciphertext. This requires derived to be set to true. When enabled, each

encryption(/decryption/rewrap/datakey) operation will derive a nonce value rather than randomly generate it.

* **derived** (*bool*) – Specifies if key derivation is to be used. If enabled, all encrypt/decrypt requests to this

named key must provide a context which is used for key derivation.

* **exportable** (*bool*) – Enables keys to be exportable. This allows for all the valid keys in the key ring to be

exported. Once set, this cannot be disabled.

* **allow\_plaintext\_backup** (*bool*) – If set, enables taking backup of named key in the plaintext format. Once set,

this cannot be disabled.

* **key\_type** (*str | unicode*) – Specifies the type of key to create. The currently-supported types are:

	+ **aes256-gcm96**: AES-256 wrapped with GCM using a 96-bit nonce size AEAD

	+ **chacha20-poly1305**: ChaCha20-Poly1305 AEAD (symmetric, supports derivation and convergent encryption)

	+ **ed25519**: ED25519 (asymmetric, supports derivation).

	+ **ecdsa-p256**: ECDSA using the P-256 elliptic curve (asymmetric)

	+ **ecdsa-p384**: ECDSA using the P-384 elliptic curve (asymmetric)

	+ **ecdsa-p521**: ECDSA using the P-521 elliptic curve (asymmetric)

	+ **rsa-2048**: RSA with bit size of 2048 (asymmetric)

	+ **rsa-3072**: RSA with bit size of 3072 (asymmetric)

	+ **rsa-4096**: RSA with bit size of 4096 (asymmetric)

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the request.

Return type

requests.Response

###### Examples[¶](#examples "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

client.secrets.transit.create\_key(name='hvac-key')

```

##### [Read Key](#id20)[¶](#read-key "Permalink to this headline")

`Transit.``read_key`(*name*, *mount\_point='transit'*)[[source]](_modules/hvac/api/secrets_engines/transit.html#Transit.read_key)

Read information about a named encryption key.

The keys object shows the creation time of each key version; the values are not the keys themselves. Depending

on the type of key, different information may be returned, e.g. an asymmetric key will return its public key in

a standard format for the type.

Supported methods:GET: /{mount\_point}/keys/{name}. Produces: 200 application/json

Parameters

* **name** (*str | unicode*) – Specifies the name of the encryption key to read. This is specified as part of the URL.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the read\_key request.

Return type

dict

###### Examples[¶](#id1 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

read\_key\_response = client.secrets.transit.read\_key(name='hvac-key')

latest\_version = read\_key\_response['data']['latest\_version']

print('Latest version for key "hvac-key" is: {ver}'.format(ver=latest\_version))

```

Example output:

```

Latest version for key "hvac-key" is: 1

```

##### [List Keys](#id21)[¶](#list-keys "Permalink to this headline")

`Transit.``list_keys`(*mount\_point='transit'*)[[source]](_modules/hvac/api/secrets_engines/transit.html#Transit.list_keys)

List keys (if there are any).

Only the key names are returned (not the actual keys themselves).

An exception is thrown if there are no keys.

Supported methods:LIST: /{mount\_point}/keys. Produces: 200 application/json

Parameters

**mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

###### Examples[¶](#id2 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

list\_keys\_response = client.secrets.transit.read\_key(name='hvac-key')

keys = list\_keys\_response['data']['keys']

print('Currently configured keys: {keys}'.format(keys=keys))

```

Example output:

```

Currently configured keys: {'1': ...}

```

##### [Delete Key](#id22)[¶](#delete-key "Permalink to this headline")

`Transit.``delete_key`(*name*, *mount\_point='transit'*)[[source]](_modules/hvac/api/secrets_engines/transit.html#Transit.delete_key)

Delete a named encryption key.

It will no longer be possible to decrypt any data encrypted with the named key. Because this is a potentially

catastrophic operation, the deletion\_allowed tunable must be set in the key’s /config endpoint.

Supported methods:DELETE: /{mount\_point}/keys/{name}. Produces: 204 (empty body)

Parameters

* **name** (*str | unicode*) – Specifies the name of the encryption key to delete. This is specified as part of the URL.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the request.

Return type

requests.Response

###### Examples[¶](#id3 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

key\_name = 'gonna-delete-this-key'

client.secrets.transit.create\_key(

    name=key\_name,

)

# Update key subsequently to allow deletion...

client.secrets.transit.update\_key\_configuration(

    name=key\_name,

    deletion\_allowed=True,

)

# Finally, delete the key

client.secrets.transit.delete\_key(name=key\_name)

```

##### [Update Key Configuration](#id23)[¶](#update-key-configuration "Permalink to this headline")

`Transit.``update_key_configuration`(*name*, *min\_decryption\_version=None*, *min\_encryption\_version=None*, *deletion\_allowed=None*, *exportable=None*, *allow\_plaintext\_backup=None*, *mount\_point='transit'*)[[source]](_modules/hvac/api/secrets_engines/transit.html#Transit.update_key_configuration)

Tune configuration values for a given key.

These values are returned during a read operation on the named key.

Supported methods:POST: /{mount\_point}/keys/{name}/config. Produces: 204 (empty body)

Parameters

* **name** (*str | unicode*) – Specifies the name of the encryption key to update configuration for.

* **min\_decryption\_version** (*int*) – Specifies the minimum version of ciphertext allowed to be decrypted. Adjusting

this as part of a key rotation policy can prevent old copies of ciphertext from being decrypted, should they

fall into the wrong hands. For signatures, this value controls the minimum version of signature that can be

verified against. For HMACs, this controls the minimum version of a key allowed to be used as the key for

verification.

* **min\_encryption\_version** (*int*) – Specifies the minimum version of the key that can be used to encrypt plaintext,

sign payloads, or generate HMACs. Must be 0 (which will use the latest version) or a value greater or equal

to min\_decryption\_version.

* **deletion\_allowed** (*bool*) – Specifies if the key is allowed to be deleted.

* **exportable** (*bool*) – Enables keys to be exportable. This allows for all the valid keys in the key ring to be

exported. Once set, this cannot be disabled.

* **allow\_plaintext\_backup** (*bool*) – If set, enables taking backup of named key in the plaintext format. Once set,

this cannot be disabled.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the request.

Return type

requests.Response

###### Examples[¶](#id4 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

# allow key "hvac-key" to be exported in subsequent requests

client.secrets.transit.update\_key\_configuration(

    name='hvac-key',

    exportable=True,

)

```

##### [Rotate Key](#id24)[¶](#rotate-key "Permalink to this headline")

`Transit.``rotate_key`(*name*, *mount\_point='transit'*)[[source]](_modules/hvac/api/secrets_engines/transit.html#Transit.rotate_key)

Rotate the version of the named key.

After rotation, new plaintext requests will be encrypted with the new version of the key. To upgrade ciphertext

to be encrypted with the latest version of the key, use the rewrap endpoint. This is only supported with keys

that support encryption and decryption operations.

Supported methods:POST: /{mount\_point}/keys/{name}/rotate. Produces: 204 (empty body)

Parameters

* **name** (*str | unicode*) – Specifies the name of the key to read information about. This is specified as part of the URL.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the request.

Return type

requests.Response

###### Examples[¶](#id5 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

client.secrets.transit.rotate\_key(name='hvac-key')

```

##### [Export Key](#id25)[¶](#export-key "Permalink to this headline")

`Transit.``export_key`(*name*, *key\_type*, *version=None*, *mount\_point='transit'*)[[source]](_modules/hvac/api/secrets_engines/transit.html#Transit.export_key)

Return the named key.

The keys object shows the value of the key for each version. If version is specified, the specific version will

be returned. If latest is provided as the version, the current key will be provided. Depending on the type of

key, different information may be returned. The key must be exportable to support this operation and the version

must still be valid.

Supported methods:GET: /{mount\_point}/export/{key\_type}/{name}(/{version}). Produces: 200 application/json

Parameters

* **name** (*str | unicode*) – Specifies the name of the key to read information about. This is specified as part of the URL.

* **key\_type** (*str | unicode*) – Specifies the type of the key to export. This is specified as part of the URL. Valid values are:

encryption-key

signing-key

hmac-key

* **version** (*str | unicode*) – Specifies the version of the key to read. If omitted, all versions of the key will be returned.

If the version is set to latest, the current key will be returned.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

###### Examples[¶](#id6 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

export\_key\_response = client.secrets.transit.export\_key(

    name='hvac-key',

    key\_type='hmac-key',

)

print('Exported keys: %s' % export\_key\_response['data']['keys'])

```

Example output:

```

Exported keys: {...}

```

##### [Encrypt Data](#id26)[¶](#encrypt-data "Permalink to this headline")

`Transit.``encrypt_data`(*name*, *plaintext*, *context=None*, *key\_version=None*, *nonce=None*, *batch\_input=None*, *type=None*, *convergent\_encryption=None*, *mount\_point='transit'*)[[source]](_modules/hvac/api/secrets_engines/transit.html#Transit.encrypt_data)

Encrypt the provided plaintext using the named key.

This path supports the create and update policy capabilities as follows: if the user has the create capability

for this endpoint in their policies, and the key does not exist, it will be upserted with default values

(whether the key requires derivation depends on whether the context parameter is empty or not). If the user only

has update capability and the key does not exist, an error will be returned.

Supported methods:POST: /{mount\_point}/encrypt/{name}. Produces: 200 application/json

Parameters

* **name** (*str | unicode*) – Specifies the name of the encryption key to encrypt against. This is specified as part of the URL.

* **plaintext** (*str | unicode*) – Specifies base64 encoded plaintext to be encoded.

* **context** (*str | unicode*) – Specifies the base64 encoded context for key derivation. This is required if key derivation is

enabled for this key.

* **key\_version** (*int*) – Specifies the version of the key to use for encryption. If not set, uses the latest version.

Must be greater than or equal to the key’s min\_encryption\_version, if set.

* **nonce** (*str | unicode*) – Specifies the base64 encoded nonce value. This must be provided if convergent encryption is

enabled for this key and the key was generated with Vault 0.6.1. Not required for keys created in 0.6.2+.

The value must be exactly 96 bits (12 bytes) long and the user must ensure that for any given context (and

thus, any given encryption key) this nonce value is never reused.

* **batch\_input** (*List**[**dict**]*) – Specifies a list of items to be encrypted in a single batch. When this parameter is set, if

the parameters ‘plaintext’, ‘context’ and ‘nonce’ are also set, they will be ignored. The format for the

input is: [dict(context=”b64\_context”, plaintext=”b64\_plaintext”), …]

* **type** (*str | unicode*) – This parameter is required when encryption key is expected to be created. When performing an

upsert operation, the type of key to create.

* **convergent\_encryption** (*str | unicode*) – This parameter will only be used when a key is expected to be created. Whether to

support convergent encryption. This is only supported when using a key with key derivation enabled and will

require all requests to carry both a context and 96-bit (12-byte) nonce. The given nonce will be used in

place of a randomly generated nonce. As a result, when the same context and nonce are supplied, the same

ciphertext is generated. It is very important when using this mode that you ensure that all nonces are

unique for a given context. Failing to do so will severely impact the ciphertext’s security.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

###### Examples[¶](#id7 "Permalink to this headline")

```

import base64

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

encrypt\_data\_response = client.secrets.transit.encrypt\_data(

    name='hvac-key',

    plaintext=base64ify('hi its me hvac'.encode()),

)

ciphertext = encrypt\_data\_response['data']['ciphertext']

print('Encrypted plaintext ciphertext is: {cipher}'.format(cipher=ciphertext))

```

Example output:

```

Encrypted plaintext ciphertext is: vault:...

```

##### [Decrypt Data](#id27)[¶](#decrypt-data "Permalink to this headline")

`Transit.``decrypt_data`(*name*, *ciphertext*, *context=None*, *nonce=None*, *batch\_input=None*, *mount\_point='transit'*)[[source]](_modules/hvac/api/secrets_engines/transit.html#Transit.decrypt_data)

Decrypt the provided ciphertext using the named key.

Supported methods:POST: /{mount\_point}/decrypt/{name}. Produces: 200 application/json

Parameters

* **name** (*str | unicode*) – Specifies the name of the encryption key to decrypt against. This is specified as part of the URL.

* **ciphertext** (*str | unicode*) – the ciphertext to decrypt.

* **context** (*str | unicode*) – Specifies the base64 encoded context for key derivation. This is required if key derivation is

enabled.

* **nonce** (*str | unicode*) – Specifies a base64 encoded nonce value used during encryption. Must be provided if convergent

encryption is enabled for this key and the key was generated with Vault 0.6.1. Not required for keys created

in 0.6.2+.

* **batch\_input** (*List**[**dict**]*) – Specifies a list of items to be decrypted in a single batch. When this parameter is set, if

the parameters ‘ciphertext’, ‘context’ and ‘nonce’ are also set, they will be ignored. Format for the input

goes like this: [dict(context=”b64\_context”, ciphertext=”b64\_plaintext”), …]

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

###### Examples[¶](#id8 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

decrypt\_data\_response = client.secrets.transit.decrypt\_data(

    name='hvac-key',

    ciphertext=ciphertext,

)

plaintext = decrypt\_data\_response['data']['plaintext']

print('Decrypted plaintext is: {text}'.format(text=plaintext))

```

Example output:

```

Decrypted plaintext is: ...

```

##### [Rewrap Data](#id28)[¶](#rewrap-data "Permalink to this headline")

`Transit.``rewrap_data`(*name*, *ciphertext*, *context=None*, *key\_version=None*, *nonce=None*, *batch\_input=None*, *mount\_point='transit'*)[[source]](_modules/hvac/api/secrets_engines/transit.html#Transit.rewrap_data)

Rewrap the provided ciphertext using the latest version of the named key.

Because this never returns plaintext, it is possible to delegate this functionality to untrusted users or scripts.

Supported methods:POST: /{mount\_point}/rewrap/{name}. Produces: 200 application/json

Parameters

* **name** (*str | unicode*) – Specifies the name of the encryption key to re-encrypt against. This is specified as part of the URL.

* **ciphertext** (*str | unicode*) – Specifies the ciphertext to re-encrypt.

* **context** (*str | unicode*) – Specifies the base64 encoded context for key derivation. This is required if key derivation is

enabled.

* **key\_version** (*int*) – Specifies the version of the key to use for the operation. If not set, uses the latest

version. Must be greater than or equal to the key’s min\_encryption\_version, if set.

* **nonce** (*str | unicode*) – Specifies a base64 encoded nonce value used during encryption. Must be provided if convergent

encryption is enabled for this key and the key was generated with Vault 0.6.1. Not required for keys created

in 0.6.2+.

* **batch\_input** (*List**[**dict**]*) – Specifies a list of items to be decrypted in a single batch. When this parameter is set, if

the parameters ‘ciphertext’, ‘context’ and ‘nonce’ are also set, they will be ignored. Format for the input

goes like this: [dict(context=”b64\_context”, ciphertext=”b64\_plaintext”), …]

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

###### Examples[¶](#id9 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

encrypt\_data\_response = client.secrets.transit.rewrap\_data(

    name='hvac-key',

    ciphertext=ciphertext,

)

rewrapped\_ciphertext = encrypt\_data\_response['data']['ciphertext']

print('Rewrapped ciphertext is: {cipher}'.format(cipher=rewrapped\_ciphertext))

```

Example output:

```

Rewrapped ciphertext is: vault:...

```

##### [Generate Data Key](#id29)[¶](#generate-data-key "Permalink to this headline")

`Transit.``generate_data_key`(*name*, *key\_type*, *context=None*, *nonce=None*, *bits=None*, *mount\_point='transit'*)[[source]](_modules/hvac/api/secrets_engines/transit.html#Transit.generate_data_key)

Generates a new high-entropy key and the value encrypted with the named key.

Optionally return the plaintext of the key as well. Whether plaintext is returned depends on the path; as a

result, you can use Vault ACL policies to control whether a user is allowed to retrieve the plaintext value of a

key. This is useful if you want an untrusted user or operation to generate keys that are then made available to

trusted users.

Supported methods:POST: /{mount\_point}/datakey/{key\_type}/{name}. Produces: 200 application/json

Parameters

* **name** (*str | unicode*) – Specifies the name of the encryption key to use to encrypt the datakey. This is specified as part

of the URL.

* **key\_type** (*str | unicode*) – Specifies the type of key to generate. If plaintext, the plaintext key will be returned along

with the ciphertext. If wrapped, only the ciphertext value will be returned. This is specified as part of

the URL.

* **context** (*str | unicode*) – Specifies the key derivation context, provided as a base64-encoded string. This must be provided

if derivation is enabled.

* **nonce** (*str | unicode*) – Specifies a nonce value, provided as base64 encoded. Must be provided if convergent encryption is

enabled for this key and the key was generated with Vault 0.6.1. Not required for keys created in 0.6.2+.

The value must be exactly 96 bits (12 bytes) long and the user must ensure that for any given context (and

thus, any given encryption key) this nonce value is never reused.

* **bits** (*int*) – Specifies the number of bits in the desired key. Can be 128, 256, or 512.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

###### Examples[¶](#id10 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

gen\_key\_response = client.secrets.transit.generate\_data\_key(

    name='hvac-key',

    key\_type='plaintext',

)

ciphertext = gen\_key\_response['data']['ciphertext']

print('Generated data key ciphertext is: {cipher}'.format(cipher=ciphertext))

```

Example output:

```

Generated data key ciphertext is: vault:...

```

##### [Generate Random Bytes](#id30)[¶](#generate-random-bytes "Permalink to this headline")

`Transit.``generate_random_bytes`(*n\_bytes=None*, *output\_format=None*, *mount\_point='transit'*)[[source]](_modules/hvac/api/secrets_engines/transit.html#Transit.generate_random_bytes)

Return high-quality random bytes of the specified length.

Supported methods:POST: /{mount\_point}/random(/{bytes}). Produces: 200 application/json

Parameters

* **n\_bytes** (*int*) – Specifies the number of bytes to return. This value can be specified either in the request body,

or as a part of the URL.

* **output\_format** (*str | unicode*) – Specifies the output encoding. Valid options are hex or base64.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

###### Examples[¶](#id11 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

gen\_bytes\_response = client.secrets.transit.generate\_random\_bytes(n\_bytes=32)

random\_bytes = gen\_bytes\_response['data']['random\_bytes']

print('Here are some random bytes: {bytes}'.format(bytes=random\_bytes))

```

Example output:

```

Here are some random bytes: ...

```

##### [Hash Data](#id31)[¶](#hash-data "Permalink to this headline")

`Transit.``hash_data`(*hash\_input*, *algorithm=None*, *output\_format=None*, *mount\_point='transit'*)[[source]](_modules/hvac/api/secrets_engines/transit.html#Transit.hash_data)

Return the cryptographic hash of given data using the specified algorithm.

Supported methods:POST: /{mount\_point}/hash(/{algorithm}). Produces: 200 application/json

Parameters

* **hash\_input** (*str | unicode*) – Specifies the base64 encoded input data.

* **algorithm** (*str | unicode*) – Specifies the hash algorithm to use. This can also be specified as part of the URL.

Currently-supported algorithms are: sha2-224, sha2-256, sha2-384, sha2-512

* **output\_format** (*str | unicode*) – Specifies the output encoding. This can be either hex or base64.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

###### Examples[¶](#id12 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

hash\_data\_response = client.secrets.transit.hash\_data(

    hash\_input=base64ify('hi its me hvac'),

    algorithm='sha2-256',

)

sum = hash\_data\_response['data']['sum']

print('Hashed data is: {sum}'.format(sum=sum))

```

Example output:

```

Hashed data is: ...

```

##### [Generate Hmac](#id32)[¶](#generate-hmac "Permalink to this headline")

`Transit.``generate_hmac`(*name*, *hash\_input*, *key\_version=None*, *algorithm=None*, *mount\_point='transit'*)[[source]](_modules/hvac/api/secrets_engines/transit.html#Transit.generate_hmac)

Return the digest of given data using the specified hash algorithm and the named key.

The key can be of any type supported by transit; the raw key will be marshaled into bytes to be used for the

HMAC function. If the key is of a type that supports rotation, the latest (current) version will be used.

Supported methods:POST: /{mount\_point}/hmac/{name}(/{algorithm}). Produces: 200 application/json

Parameters

* **name** (*str | unicode*) – Specifies the name of the encryption key to generate hmac against. This is specified as part of the

URL.

* **hash\_input** – Specifies the base64 encoded input data.

* **key\_version** (*int*) – Specifies the version of the key to use for the operation. If not set, uses the latest

version. Must be greater than or equal to the key’s min\_encryption\_version, if set.

* **algorithm** (*str | unicode*) – Specifies the hash algorithm to use. This can also be specified as part of the URL.

Currently-supported algorithms are: sha2-224, sha2-256, sha2-384, sha2-512

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

###### Examples[¶](#id13 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

generate\_hmac\_response = client.secrets.transit.generate\_hmac(

    name='hvac-key',

    hash\_input=base64ify('hi its me hvac'),

    algorithm='sha2-256',

)

hmac = generate\_hmac\_response['data']

print("HMAC'd data is: {hmac}".format(hmac=hmac))

```

Example output:

```

HMAC'd data is: {'hmac': 'vault:...'}

```

##### [Sign Data](#id33)[¶](#sign-data "Permalink to this headline")

`Transit.``sign_data`(*name*, *hash\_input*, *key\_version=None*, *hash\_algorithm=None*, *context=None*, *prehashed=None*, *signature\_algorithm=None*, *marshaling\_algorithm=None*, *mount\_point='transit'*)[[source]](_modules/hvac/api/secrets_engines/transit.html#Transit.sign_data)

Return the cryptographic signature of the given data using the named key and the specified hash algorithm.

The key must be of a type that supports signing.

Supported methods:POST: /{mount\_point}/sign/{name}(/{hash\_algorithm}). Produces: 200 application/json

Parameters

* **name** (*str | unicode*) – Specifies the name of the encryption key to use for signing. This is specified as part of the URL.

* **hash\_input** (*str | unicode*) – Specifies the base64 encoded input data.

* **key\_version** (*int*) – Specifies the version of the key to use for signing. If not set, uses the latest version.

Must be greater than or equal to the key’s min\_encryption\_version, if set.

* **hash\_algorithm** (*str | unicode*) – Specifies the hash algorithm to use for supporting key types (notably, not including

ed25519 which specifies its own hash algorithm). This can also be specified as part of the URL.

Currently-supported algorithms are: sha2-224, sha2-256, sha2-384, sha2-512

* **context** (*str | unicode*) – Base64 encoded context for key derivation. Required if key derivation is enabled; currently only

available with ed25519 keys.

* **prehashed** (*bool*) – Set to true when the input is already hashed. If the key type is rsa-2048 or rsa-4096, then

the algorithm used to hash the input should be indicated by the hash\_algorithm parameter. Just as the value

to sign should be the base64-encoded representation of the exact binary data you want signed, when set, input

is expected to be base64-encoded binary hashed data, not hex-formatted. (As an example, on the command line,

you could generate a suitable input via openssl dgst -sha256 -binary | base64.)

* **signature\_algorithm** (*str | unicode*) – When using a RSA key, specifies the RSA signature algorithm to use for signing.

Supported signature types are: pss, pkcs1v15

* **marshaling\_algorithm** (*str | unicode*) – Specifies the way in which the signature should be marshaled. This currently only applies to ECDSA keys.

Supported types are: asn1, jws

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

###### Examples[¶](#id14 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

key\_name = 'hvac-signing-key'

# Note: some key types do no support signing...

# E.g., "key type aes256-gcm96 does not support verification"

client.secrets.transit.create\_key(

    name=key\_name,

    key\_type='ed25519',

)

sign\_data\_response = client.secrets.transit.sign\_data(

    name=key\_name,

    hash\_input=base64ify('hi its me hvac'),

)

signature = sign\_data\_response['data']['signature']

print('Signature is: {signature}'.format(signature=signature))

```

Example output:

```

Signature is: vault:...

```

##### [Verify Signed Data](#id34)[¶](#verify-signed-data "Permalink to this headline")

`Transit.``verify_signed_data`(*name*, *hash\_input*, *signature=None*, *hmac=None*, *hash\_algorithm=None*, *context=None*, *prehashed=None*, *signature\_algorithm=None*, *marshaling\_algorithm=None*, *mount\_point='transit'*)[[source]](_modules/hvac/api/secrets_engines/transit.html#Transit.verify_signed_data)

Return whether the provided signature is valid for the given data.

Supported methods:POST: /{mount\_point}/verify/{name}(/{hash\_algorithm}). Produces: 200 application/json

Parameters

* **name** (*str | unicode*) – Specifies the name of the encryption key that was used to generate the signature or HMAC.

* **hash\_input** – Specifies the base64 encoded input data.

* **signature** (*str | unicode*) – Specifies the signature output from the /transit/sign function. Either this must be supplied

or hmac must be supplied.

* **hmac** (*str | unicode*) – Specifies the signature output from the /transit/hmac function. Either this must be supplied or

signature must be supplied.

* **hash\_algorithm** (*str | unicode*) – Specifies the hash algorithm to use. This can also be specified as part of the URL.

Currently-supported algorithms are: sha2-224, sha2-256, sha2-384, sha2-512

* **context** (*str | unicode*) – Base64 encoded context for key derivation. Required if key derivation is enabled; currently only

available with ed25519 keys.

* **prehashed** (*bool*) – Set to true when the input is already hashed. If the key type is rsa-2048 or rsa-4096, then

the algorithm used to hash the input should be indicated by the hash\_algorithm parameter.

* **signature\_algorithm** (*str | unicode*) – When using a RSA key, specifies the RSA signature algorithm to use for signature

verification. Supported signature types are: pss, pkcs1v15

* **marshaling\_algorithm** (*str | unicode*) – Specifies the way in which the signature should be marshaled. This currently only applies to ECDSA keys.

Supported types are: asn1, jws

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

###### Examples[¶](#id15 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

verify\_signed\_data\_response = client.secrets.transit.verify\_signed\_data(

    name='hvac-signing-key',

    hash\_input=base64ify('hi its me hvac'),

    signature=signature,

)

valid = verify\_signed\_data\_response['data']['valid']

print('Signature is valid?: {valid}'.format(valid=valid))

```

Example output:

```

Signature is valid?: True

```

##### [Backup Key](#id35)[¶](#backup-key "Permalink to this headline")

`Transit.``backup_key`(*name*, *mount\_point='transit'*)[[source]](_modules/hvac/api/secrets_engines/transit.html#Transit.backup_key)

Return a plaintext backup of a named key.

The backup contains all the configuration data and keys of all the versions along with the HMAC key. The

response from this endpoint can be used with the /restore endpoint to restore the key.

Supported methods:GET: /{mount\_point}/backup/{name}. Produces: 200 application/json

Parameters

* **name** (*str | unicode*) – Name of the key.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

###### Examples[¶](#id16 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

key\_name = 'hvac-key'

# Update the key configuration to allow exporting

client.secrets.transit.update\_key\_configuration(

    name=key\_name,

    exportable=True,

    allow\_plaintext\_backup=True,

)

backup\_key\_response = client.secrets.transit.backup\_key(

    name=key\_name,

)

backed\_up\_key = backup\_key\_response['data']['backup']

print('Backed up key: %s' % backed\_up\_key)

```

Example output:

```

Backed up key: ...

```

##### [Restore Key](#id36)[¶](#restore-key "Permalink to this headline")

`Transit.``restore_key`(*backup*, *name=None*, *force=None*, *mount\_point='transit'*)[[source]](_modules/hvac/api/secrets_engines/transit.html#Transit.restore_key)

Restore the backup as a named key.

This will restore the key configurations and all the versions of the named key along with HMAC keys. The input

to this endpoint should be the output of /backup endpoint. For safety, by default the backend will refuse to

restore to an existing key. If you want to reuse a key name, it is recommended you delete the key before

restoring. It is a good idea to attempt restoring to a different key name first to verify that the operation

successfully completes.

Supported methods:POST: /{mount\_point}/restore(/name). Produces: 204 (empty body)

Parameters

* **backup** (*str | unicode*) – Backed up key data to be restored. This should be the output from the /backup endpoint.

* **name** (*str | unicode*) – If set, this will be the name of the restored key.

* **force** (*bool*) – If set, force the restore to proceed even if a key by this name already exists.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the request.

Return type

requests.Response

###### Examples[¶](#id17 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

client.secrets.transit.update\_key\_configuration(

    name=key\_name,

    deletion\_allowed=True,

)

delete\_resp = client.secrets.transit.delete\_key(name=key\_name)

# Restore a key after deletion

client.secrets.transit.restore\_key(backup=backed\_up\_key)

```

##### [Trim Key](#id37)[¶](#trim-key "Permalink to this headline")

`Transit.``trim_key`(*name*, *min\_version*, *mount\_point='transit'*)[[source]](_modules/hvac/api/secrets_engines/transit.html#Transit.trim_key)

Trims older key versions setting a minimum version for the keyring.

Once trimmed, previous versions of the key cannot be recovered.

Supported methods:POST: /{mount\_point}/keys/{name}/trim. Produces: 200 application/json

Parameters

* **name** (*str | unicode*) – Specifies the name of the key to be trimmed.

* **min\_version** (*int*) – The minimum version for the key ring. All versions before this version will be permanently

deleted. This value can at most be equal to the lesser of min\_decryption\_version and min\_encryption\_version.

This is not allowed to be set when either min\_encryption\_version or min\_decryption\_version is set to zero.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the request.

Return type

dict

###### Examples[¶](#id18 "Permalink to this headline")

Note

Transit key trimming was added for Vault versions >=0.11.4.

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

key\_name = 'hvac-key'

for \_ in range(0, 10):

    # Rotate the key a bunch...

    client.secrets.transit.rotate\_key(

        name=key\_name,

    )

# Set a minimum encryption version

client.secrets.transit.update\_key\_configuration(

    name=key\_name,

    min\_decryption\_version=3,

    min\_encryption\_version=5,

)

# Trim any unneeded versions remaining of the key...

client.secrets.transit.trim\_key(

    name='hvac-key',

    min\_version=3,

)

```

### Auth Methods[¶](#auth-methods "Permalink to this headline")

#### [Approle](#id1)[¶](#approle "Permalink to this headline")

Contents

* [Approle](#approle)

	+ [Enabling](#enabling)

	+ [Authentication](#authentication)

	+ [Create or Update AppRole](#create-or-update-approle)

	+ [Read Role ID](#read-role-id)

	+ [Generate Secret ID](#generate-secret-id)

##### [Enabling](#id2)[¶](#enabling "Permalink to this headline")

[`hvac.api.system\_backend.Auth.enable\_auth\_method()`](index.html#hvac.api.system_backend.Auth.enable_auth_method "hvac.api.system_backend.Auth.enable_auth_method")

```

import hvac

client = hvac.Client()

client.sys.enable\_auth\_method(

    method\_type='approle',

)

# Mount approle auth method under a different path:

client.sys.enable\_auth\_method(

    method\_type='approle',

    path='my-approle',

)

```

##### [Authentication](#id3)[¶](#authentication "Permalink to this headline")

[`hvac.api.auth\_methods.AppRole.login()`](index.html#hvac.api.auth_methods.AppRole.login "hvac.api.auth_methods.AppRole.login")

```

import hvac

client = hvac.Client()

client.auth.approle.login(

    role\_id='<some\_role\_id>',

    secret\_id='<some\_secret\_id>',

)

```

##### [Create or Update AppRole](#id4)[¶](#create-or-update-approle "Permalink to this headline")

[`hvac.api.auth\_methods.AppRole.create\_or\_update\_approle()`](index.html#hvac.api.auth_methods.AppRole.create_or_update_approle "hvac.api.auth_methods.AppRole.create_or_update_approle")

```

import hvac

client = hvac.Client()

client.auth.approle.create\_or\_update\_approle(

    role\_name='some-role',

    token\_policies=['some-policy'],

    token\_type='service,

)

```

##### [Read Role ID](#id5)[¶](#read-role-id "Permalink to this headline")

[`hvac.api.auth\_methods.AppRole.read\_role\_id()`](index.html#hvac.api.auth_methods.AppRole.read_role_id "hvac.api.auth_methods.AppRole.read_role_id")

```

import hvac

client = hvac.Client()

resp = client.auth.approle.read\_role\_id(

    role\_name='some-role',

)

print(f'AppRole role ID for some-role: {resp["data"]["role\_id"]}')

```

##### [Generate Secret ID](#id6)[¶](#generate-secret-id "Permalink to this headline")

[`hvac.api.auth\_methods.AppRole.generate\_secret\_id()`](index.html#hvac.api.auth_methods.AppRole.generate_secret_id "hvac.api.auth_methods.AppRole.generate_secret_id")

```

import hvac

client = hvac.Client()

resp = client.auth.approle.generate\_secret\_id(

    role\_name='some-role',

    cidr\_list=['127.0.0.1/32'],

)

print(f'AppRole secret ID for some-role: {resp["data"]["secret\_id"]}')

```

#### [AWS](#id2)[¶](#aws "Permalink to this headline")

Contents

* [AWS](#aws)

	+ [IAM Authentication](#iam-authentication)

	

	

		- [Static Access Key Strings](#static-access-key-strings)

		- [Boto3 Session](#boto3-session)

		- [EC2 Metadata Service](#ec2-metadata-service)

		- [Lambda and/or EC2 Instance](#lambda-and-or-ec2-instance)

		- [Caveats For Non-Default AWS Regions](#caveats-for-non-default-aws-regions)

	+ [EC2 Authentication](#ec2-authentication)

	

	

		- [EC2 Metadata Service](#id1)

	+ [Methods](#methods)

	

	

		- [Configure](#configure)

		- [Read Config](#read-config)

		- [Delete Config](#delete-config)

		- [Configure Identity Integration](#configure-identity-integration)

		- [Read Identity Integration](#read-identity-integration)

		- [Create Certificate Configuration](#create-certificate-configuration)

		- [Read Certificate Configuration](#read-certificate-configuration)

		- [Delete Certificate Configuration](#delete-certificate-configuration)

		- [List Certificate Configurations](#list-certificate-configurations)

		- [Create Sts Role](#create-sts-role)

		- [Read Sts Role](#read-sts-role)

		- [List Sts Roles](#list-sts-roles)

		- [Delete Sts Role](#delete-sts-role)

		- [Configure Identity Whitelist Tidy](#configure-identity-whitelist-tidy)

		- [Read Identity Whitelist Tidy](#read-identity-whitelist-tidy)

		- [Delete Identity Whitelist Tidy](#delete-identity-whitelist-tidy)

		- [Configure Role Tag Blacklist Tidy](#configure-role-tag-blacklist-tidy)

		- [Read Role Tag Blacklist Tidy](#read-role-tag-blacklist-tidy)

		- [Delete Role Tag Blacklist Tidy](#delete-role-tag-blacklist-tidy)

		- [Create Role](#create-role)

		- [Read Role](#read-role)

		- [List Roles](#list-roles)

		- [Delete Role](#delete-role)

		- [Create Role Tags](#create-role-tags)

		- [IAM Login](#iam-login)

		- [EC2 Login](#ec2-login)

		- [Place Role Tags In Blacklist](#place-role-tags-in-blacklist)

		- [Read Role Tag Blacklist](#read-role-tag-blacklist)

		- [List Blacklist Tags](#list-blacklist-tags)

		- [Delete Blacklist Tags](#delete-blacklist-tags)

		- [Tidy Blacklist Tags](#tidy-blacklist-tags)

		- [Read Identity Whitelist](#read-identity-whitelist)

		- [List Identity Whitelist](#list-identity-whitelist)

		- [Delete Identity Whitelist Entries](#delete-identity-whitelist-entries)

		- [Tidy Identity Whitelist Entries](#tidy-identity-whitelist-entries)

##### [IAM Authentication](#id3)[¶](#iam-authentication "Permalink to this headline")

Source reference: [`hvac.api.auth\_methods.Aws.iam\_login()`](index.html#hvac.api.auth_methods.Aws.iam_login "hvac.api.auth_methods.Aws.iam_login")

###### [Static Access Key Strings](#id4)[¶](#static-access-key-strings "Permalink to this headline")

Various examples of authenticating with static access key strings:

```

import hvac

client = hvac.Client()

client.auth.aws.iam\_login('MY\_AWS\_ACCESS\_KEY\_ID', 'MY\_AWS\_SECRET\_ACCESS\_KEY')

client.auth.aws.iam\_login('MY\_AWS\_ACCESS\_KEY\_ID', 'MY\_AWS\_SECRET\_ACCESS\_KEY', 'MY\_AWS\_SESSION\_TOKEN')

client.auth.aws.iam\_login('MY\_AWS\_ACCESS\_KEY\_ID', 'MY\_AWS\_SECRET\_ACCESS\_KEY', role='MY\_ROLE')

```

###### [Boto3 Session](#id5)[¶](#boto3-session "Permalink to this headline")

Retrieving credentials from a boto3 Session object:

```

import boto3

import hvac

session = boto3.Session()

credentials = session.get\_credentials()

client = hvac.Client()

client.auth.aws.iam\_login(credentials.access\_key, credentials.secret\_key, credentials.token)

```

###### [EC2 Metadata Service](#id6)[¶](#ec2-metadata-service "Permalink to this headline")

Retrieving static instance role credentials within an EC2 instnace using the EC2 metadata service (the EC2 auth method is probably a better fit for this case, which is outlined below under [EC2 Authentication](#ec2-authentication)):

```

import logging

import requests

from requests.exceptions import RequestException

import hvac

logger = logging.getLogger(\_\_name\_\_)

EC2\_METADATA\_URL\_BASE = 'http://169.254.169.254'

def load\_aws\_ec2\_role\_iam\_credentials(role\_name, metadata\_url\_base=EC2\_METADATA\_URL\_BASE):

    """

 Requests an ec2 instance's IAM security credentials from the EC2 metadata service.

 :param role\_name: Name of the instance's role.

 :param metadata\_url\_base: IP address for the EC2 metadata service.

 :return: dict, unmarshalled JSON response of the instance's security credentials

 """

    metadata\_pkcs7\_url = '{base}/latest/meta-data/iam/security-credentials/{role}'.format(

        base=metadata\_url\_base,

        role=role\_name,

    )

    logger.debug("load\_aws\_ec2\_role\_iam\_credentials connecting to %s" % metadata\_pkcs7\_url)

    response = requests.get(url=metadata\_pkcs7\_url)

    response.raise\_for\_status()

    security\_credentials = response.json()

    return security\_credentials

credentials = load\_aws\_ec2\_role\_iam\_credentials('some-instance-role')

client = hvac.Client()

client.auth.aws.iam\_login(credentials['AccessKeyId'], credentials['SecretAccessKey'], credentials['Token'])

```

###### [Lambda and/or EC2 Instance](#id7)[¶](#lambda-and-or-ec2-instance "Permalink to this headline")

```

import os

import hvac

def infer\_credentials\_from\_iam\_role(iam\_role):

    on\_lambda = 'AWS\_LAMBDA\_FUNCTION\_NAME' in os.environ

    if on\_lambda:

        return os.environ['AWS\_ACCESS\_KEY\_ID'], os.environ['AWS\_SECRET\_ACCESS\_KEY'], os.environ['AWS\_SESSION\_TOKEN']

    else:

        security\_credentials = load\_aws\_ec2\_role\_iam\_credentials(iam\_role)

        return security\_credentials['AccessKeyId'], security\_credentials['SecretAccessKey']

access\_key\_id, secret\_access\_key, session\_token = infer\_credentials\_from\_iam\_role('some-role')

client = hvac.Client()

client.auth.aws.iam\_login(access\_key\_id, secret\_access\_key, session\_token)

```

###### [Caveats For Non-Default AWS Regions](#id8)[¶](#caveats-for-non-default-aws-regions "Permalink to this headline")

I.e., calling [`hvac.api.auth\_methods.Aws.iam\_login()`](index.html#hvac.api.auth_methods.Aws.iam_login "hvac.api.auth_methods.Aws.iam_login") with a region argument other than its default of “**us-east-1**”. For additional background / context on this matter, see the comments at [hvac#251](https://github.com/hvac/hvac/issues/251) and/or [vault-ruby#161](https://github.com/hashicorp/vault-ruby/pull/161#issuecomment-355723269).

The following code snippets are for authenticating hosts in the **us-west-1** region:

Note

In order to authenticate to various regions, the AWS auth method configuration needs to be set up with an “endpoint URL” corresponding to the region in question. E.g.: “**https://sts.us-west-1.amazonaws.com**” in the case of this example. Vault defaults to an endpoint of “**https://sts.amazonaws.com**” if not configured with a different endpoint URL.

```

import boto3

import hvac

VAULT\_ADDR = os.environ["VAULT\_ADDR"]

VAULT\_HEADER\_VALUE = os.environ["VAULT\_HEADER\_VALUE"]

client = hvac.Client(url=VAULT\_ADDR)

# One-time setup of the credentials / configuration for the Vault server to use.

# Note the explicit region subdomain bit included in the endpoint argument.

client.auth.aws.configure(

    access\_key='SOME\_ACCESS\_KEY\_FOR\_VAULTS\_USE',

    secret\_key='SOME\_ACCESS\_KEY\_FOR\_VAULTS\_USE',

    endpoint='https://sts.us-west-1.amazonaws.com',

)

session = boto3.Session()

creds = session.get\_credentials().get\_frozen\_credentials()

client.auth.aws.iam\_login((

    access\_key=creds.access\_key,

    secret\_key=creds.secret\_key,

    session\_token=creds.token,

    header\_value=VAULT\_HEADER\_VALUE,

    role='some-role,

    use\_token=True,

    region='us-west-1',

)

```

##### [EC2 Authentication](#id9)[¶](#ec2-authentication "Permalink to this headline")

Source reference: [`hvac.api.auth\_methods.Aws.ec2\_login()`](index.html#hvac.api.auth_methods.Aws.ec2_login "hvac.api.auth_methods.Aws.ec2_login")

###### [EC2 Metadata Service](#id10)[¶](#id1 "Permalink to this headline")

Authentication using EC2 instance role credentials and the EC2 metadata service

```

#!/usr/bin/env python

import logging.handlers

import os

import hvac

import requests

from requests.exceptions import RequestException

logger = logging.getLogger(\_\_name\_\_)

VAULT\_URL = os.getenv('VAULT\_ADDR', 'https://127.0.0.1:8200')

VAULT\_CERTS = ('/etc/vault.d/ssl/bundle.crt', '/etc/vault.d/ssl/vault.key')

TOKEN\_NONCE\_PATH = os.getenv('WP\_VAULT\_TOKEN\_NONCE\_PATH', '/root/.vault-token-meta-nonce')

EC2\_METADATA\_URL\_BASE = 'http://169.254.169.254'

def load\_aws\_ec2\_pkcs7\_string(metadata\_url\_base=EC2\_METADATA\_URL\_BASE):

    """

 Requests an ec2 instance's pkcs7-encoded identity document from the EC2 metadata service.

 :param metadata\_url\_base: IP address for the EC2 metadata service.

 :return: string, pkcs7-encoded identity document from the EC2 metadata service

 """

    metadata\_pkcs7\_url = '{base}/latest/dynamic/instance-identity/pkcs7'.format(base=metadata\_url\_base)

    logger.debug("load\_aws\_ec2\_pkcs7\_string connecting to %s" % metadata\_pkcs7\_url)

    response = requests.get(url=metadata\_pkcs7\_url)

    response.raise\_for\_status()

    pcks7 = response.text.replace('\n', '')

    return pcks7

def load\_aws\_ec2\_nonce\_from\_disk(token\_nonce\_path=TOKEN\_NONCE\_PATH):

    """

 Helper method to load a previously stored "token\_meta\_nonce" returned in the

 initial authorization AWS EC2 request from the current instance to our Vault service.

 :param token\_nonce\_path: string, the full filesystem path to a file containing the instance's

 token meta nonce.

 :return: string, a previously stored "token\_meta\_nonce"

 """

    logger.debug("Attempting to load vault token meta nonce from path: %s" % token\_nonce\_path)

    try:

        with open(token\_nonce\_path, 'rb') as nonce\_file:

            nonce = nonce\_file.readline()

    except IOError:

        logger.warning("Unable to load vault token meta nonce at path: %s" % token\_nonce\_path)

        nonce = None

    logger.debug("Nonce loaded: %s" % nonce)

    return nonce

def write\_aws\_ec2\_nonce\_to\_disk(token\_meta\_nonce, token\_nonce\_path=TOKEN\_NONCE\_PATH):

    """

 Helper method to store the current "token\_meta\_nonce" returned from authorization AWS EC2 request

 from the current instance to our Vault service.

 :return: string, a previously stored "token\_meta\_nonce"

 :param token\_meta\_nonce: string, the actual nonce

 :param token\_nonce\_path: string, the full filesystem path to a file containing the instance's

 token meta nonce.

 :return: None

 """

    logger.debug('Writing nonce "{0}" to file "{1}".'.format(token\_meta\_nonce, token\_nonce\_path))

    with open(token\_nonce\_path, 'w') as nonce\_file:

        nonce\_file.write(token\_meta\_nonce)

def auth\_ec2(vault\_client, pkcs7=None, nonce=None, role=None, mount\_point='aws', store\_nonce=True):

    """

 Helper method to authenticate to vault using the "auth\_ec2" backend.

 :param vault\_client: hvac.Client

 :param pkcs7: pkcs7-encoded identity document from the EC2 metadata service

 :param nonce: string, the nonce retruned from the initial AWS EC2 auth request (if applicable)

 :param role: string, the role/policy to request. Defaults to the current instance's AMI ID if not provided.

 :param mount\_point: string, the path underwhich the AWS EC2 auth backend is provided

 :param store\_nonce: bool, if True, store the nonce received in the auth\_ec2 response on disk for later use.

 Especially useful for automated secure introduction.

 :param kwargs: dict, remaining arguments blindly passed through by this lookup module class

 :return: None

 """

    if pkcs7 is None:

        logger.debug('No pkcs7 argument provided to auth\_ec2 backend.')

        logger.debug('Attempting to retrieve information from EC2 metadata service.')

        pkcs7 = load\_aws\_ec2\_pkcs7\_string()

    if nonce is None:

        logger.debug('No nonce argument provided to auth\_ec2 backend.'

        logger.debug('Attempting to retrieve information from disk.')

        nonce = load\_aws\_ec2\_nonce\_from\_disk()

    auth\_ec2\_resp = vault\_client.auth.aws.ec2\_login(

        pkcs7=pkcs7,

        nonce=nonce,

        role=role,

        use\_token=False,

        mount\_point=mount\_point

    )

    if store\_nonce and 'metadata' in auth\_ec2\_resp.get('auth', dict()):

        token\_meta\_nonce = auth\_ec2\_resp['auth']['metadata'].get('nonce')

        if token\_meta\_nonce is not None:

            logger.debug('token\_meta\_nonce received back from auth\_ec2 call: %s' % token\_meta\_nonce)

            write\_aws\_ec2\_nonce\_to\_disk(token\_meta\_nonce)

        else:

            logger.warning('No token meta nonce returned in auth response.')

    return auth\_ec2\_resp

def get\_vault\_client(vault\_url=VAULT\_URL, certs=VAULT\_CERTS, verify\_certs=True, ec2\_role=None):

    """

 Instantiates a hvac / vault client.

 :param vault\_url: string, protocol + address + port for the vault service

 :param certs: tuple, Optional tuple of self-signed certs to use for verification with hvac's requests

 :param verify\_certs: bool, if True use the provided certs tuple for verification with hvac's requests.

 If False, don't verify SSL with hvac's requests (typically used with local development).

 :param ec2\_role: str, Name of the Vault AWS auth backend role to use when retrieving a token (if applicable)

 :return: hvac.Client

 """

    logger.debug('Retrieving a vault (hvac) client...')

    if verify\_certs:

        # We use a self-signed certificate for the vault service itself, so we need to include our

        # local ca bundle here for the underlying requests module.

        os.environ['REQUESTS\_CA\_BUNDLE'] = '/etc/ssl/certs/ca-certificates.crt'

        vault\_client = hvac.Client(

            url=vault\_url,

            cert=certs,

        )

    else:

        vault\_client = hvac.Client(

            url=vault\_url,

            verify=False,

        )

    vault\_client.token = load\_vault\_token(vault\_client, ec2\_role=ec2\_role)

    if not vault\_client.is\_authenticated():

        raise hvac.exceptions.Unauthorized('Unable to authenticate to the Vault service')

    return vault\_client

authenticated\_vault\_client = get\_vault\_client()

```

##### [Methods](#id11)[¶](#methods "Permalink to this headline")

###### [Configure](#id12)[¶](#configure "Permalink to this headline")

Source reference: [`hvac.api.auth\_methods.Aws.configure()`](index.html#hvac.api.auth_methods.Aws.configure "hvac.api.auth_methods.Aws.configure")

###### [Read Config](#id13)[¶](#read-config "Permalink to this headline")

Source reference: [`hvac.api.auth\_methods.Aws.read\_config()`](index.html#hvac.api.auth_methods.Aws.read_config "hvac.api.auth_methods.Aws.read_config")

###### [Delete Config](#id14)[¶](#delete-config "Permalink to this headline")

Source reference: [`hvac.api.auth\_methods.Aws.delete\_config()`](index.html#hvac.api.auth_methods.Aws.delete_config "hvac.api.auth_methods.Aws.delete_config")

###### [Configure Identity Integration](#id15)[¶](#configure-identity-integration "Permalink to this headline")

Source reference: [`hvac.api.auth\_methods.Aws.configure\_identity\_integration()`](index.html#hvac.api.auth_methods.Aws.configure_identity_integration "hvac.api.auth_methods.Aws.configure_identity_integration")

###### [Read Identity Integration](#id16)[¶](#read-identity-integration "Permalink to this headline")

Source reference: [`hvac.api.auth\_methods.Aws.read\_identity\_integration()`](index.html#hvac.api.auth_methods.Aws.read_identity_integration "hvac.api.auth_methods.Aws.read_identity_integration")

###### [Create Certificate Configuration](#id17)[¶](#create-certificate-configuration "Permalink to this headline")

Source reference: [`hvac.api.auth\_methods.Aws.create\_certificate\_configuration()`](index.html#hvac.api.auth_methods.Aws.create_certificate_configuration "hvac.api.auth_methods.Aws.create_certificate_configuration")

###### [Read Certificate Configuration](#id18)[¶](#read-certificate-configuration "Permalink to this headline")

Source reference: [`hvac.api.auth\_methods.Aws.read\_certificate\_configuration()`](index.html#hvac.api.auth_methods.Aws.read_certificate_configuration "hvac.api.auth_methods.Aws.read_certificate_configuration")

###### [Delete Certificate Configuration](#id19)[¶](#delete-certificate-configuration "Permalink to this headline")

Source reference: [`hvac.api.auth\_methods.Aws.delete\_certificate\_configuration()`](index.html#hvac.api.auth_methods.Aws.delete_certificate_configuration "hvac.api.auth_methods.Aws.delete_certificate_configuration")

###### [List Certificate Configurations](#id20)[¶](#list-certificate-configurations "Permalink to this headline")

Source reference: [`hvac.api.auth\_methods.Aws.list\_certificate\_configurations()`](index.html#hvac.api.auth_methods.Aws.list_certificate_configurations "hvac.api.auth_methods.Aws.list_certificate_configurations")

###### [Create Sts Role](#id21)[¶](#create-sts-role "Permalink to this headline")

Source reference: [`hvac.api.auth\_methods.Aws.create\_sts\_role()`](index.html#hvac.api.auth_methods.Aws.create_sts_role "hvac.api.auth_methods.Aws.create_sts_role")

###### [Read Sts Role](#id22)[¶](#read-sts-role "Permalink to this headline")

Source reference: [`hvac.api.auth\_methods.Aws.read\_sts\_role()`](index.html#hvac.api.auth_methods.Aws.read_sts_role "hvac.api.auth_methods.Aws.read_sts_role")

###### [List Sts Roles](#id23)[¶](#list-sts-roles "Permalink to this headline")

Source reference: [`hvac.api.auth\_methods.Aws.list\_sts\_roles()`](index.html#hvac.api.auth_methods.Aws.list_sts_roles "hvac.api.auth_methods.Aws.list_sts_roles")

###### [Delete Sts Role](#id24)[¶](#delete-sts-role "Permalink to this headline")

Source reference: [`hvac.api.auth\_methods.Aws.delete\_sts\_role()`](index.html#hvac.api.auth_methods.Aws.delete_sts_role "hvac.api.auth_methods.Aws.delete_sts_role")

###### [Configure Identity Whitelist Tidy](#id25)[¶](#configure-identity-whitelist-tidy "Permalink to this headline")

Source reference: [`hvac.api.auth\_methods.Aws.configure\_identity\_whitelist\_tidy()`](index.html#hvac.api.auth_methods.Aws.configure_identity_whitelist_tidy "hvac.api.auth_methods.Aws.configure_identity_whitelist_tidy")

###### [Read Identity Whitelist Tidy](#id26)[¶](#read-identity-whitelist-tidy "Permalink to this headline")

Source reference: [`hvac.api.auth\_methods.Aws.read\_identity\_whitelist\_tidy()`](index.html#hvac.api.auth_methods.Aws.read_identity_whitelist_tidy "hvac.api.auth_methods.Aws.read_identity_whitelist_tidy")

###### [Delete Identity Whitelist Tidy](#id27)[¶](#delete-identity-whitelist-tidy "Permalink to this headline")

Source reference: [`hvac.api.auth\_methods.Aws.delete\_identity\_whitelist\_tidy()`](index.html#hvac.api.auth_methods.Aws.delete_identity_whitelist_tidy "hvac.api.auth_methods.Aws.delete_identity_whitelist_tidy")

###### [Configure Role Tag Blacklist Tidy](#id28)[¶](#configure-role-tag-blacklist-tidy "Permalink to this headline")

Source reference: [`hvac.api.auth\_methods.Aws.configure\_role\_tag\_blacklist\_tidy()`](index.html#hvac.api.auth_methods.Aws.configure_role_tag_blacklist_tidy "hvac.api.auth_methods.Aws.configure_role_tag_blacklist_tidy")

###### [Read Role Tag Blacklist Tidy](#id29)[¶](#read-role-tag-blacklist-tidy "Permalink to this headline")

Source reference: [`hvac.api.auth\_methods.Aws.read\_role\_tag\_blacklist\_tidy()`](index.html#hvac.api.auth_methods.Aws.read_role_tag_blacklist_tidy "hvac.api.auth_methods.Aws.read_role_tag_blacklist_tidy")

###### [Delete Role Tag Blacklist Tidy](#id30)[¶](#delete-role-tag-blacklist-tidy "Permalink to this headline")

Source reference: [`hvac.api.auth\_methods.Aws.delete\_role\_tag\_blacklist\_tidy()`](index.html#hvac.api.auth_methods.Aws.delete_role_tag_blacklist_tidy "hvac.api.auth_methods.Aws.delete_role_tag_blacklist_tidy")

###### [Create Role](#id31)[¶](#create-role "Permalink to this headline")

Source reference: [`hvac.api.auth\_methods.Aws.create\_role()`](index.html#hvac.api.auth_methods.Aws.create_role "hvac.api.auth_methods.Aws.create_role")

###### [Read Role](#id32)[¶](#read-role "Permalink to this headline")

Source reference: [`hvac.api.auth\_methods.Aws.read\_role()`](index.html#hvac.api.auth_methods.Aws.read_role "hvac.api.auth_methods.Aws.read_role")

###### [List Roles](#id33)[¶](#list-roles "Permalink to this headline")

Source reference: [`hvac.api.auth\_methods.Aws.list\_roles()`](index.html#hvac.api.auth_methods.Aws.list_roles "hvac.api.auth_methods.Aws.list_roles")

###### [Delete Role](#id34)[¶](#delete-role "Permalink to this headline")

Source reference: [`hvac.api.auth\_methods.Aws.delete\_role()`](index.html#hvac.api.auth_methods.Aws.delete_role "hvac.api.auth_methods.Aws.delete_role")

###### [Create Role Tags](#id35)[¶](#create-role-tags "Permalink to this headline")

Source reference: [`hvac.api.auth\_methods.Aws.create\_role\_tags()`](index.html#hvac.api.auth_methods.Aws.create_role_tags "hvac.api.auth_methods.Aws.create_role_tags")

###### [IAM Login](#id36)[¶](#iam-login "Permalink to this headline")

Source reference: [`hvac.api.auth\_methods.Aws.iam\_login()`](index.html#hvac.api.auth_methods.Aws.iam_login "hvac.api.auth_methods.Aws.iam_login")

###### [EC2 Login](#id37)[¶](#ec2-login "Permalink to this headline")

Source reference: [`hvac.api.auth\_methods.Aws.ec2\_login()`](index.html#hvac.api.auth_methods.Aws.ec2_login "hvac.api.auth_methods.Aws.ec2_login")

###### [Place Role Tags In Blacklist](#id38)[¶](#place-role-tags-in-blacklist "Permalink to this headline")

Source reference: [`hvac.api.auth\_methods.Aws.place\_role\_tags\_in\_blacklist()`](index.html#hvac.api.auth_methods.Aws.place_role_tags_in_blacklist "hvac.api.auth_methods.Aws.place_role_tags_in_blacklist")

###### [Read Role Tag Blacklist](#id39)[¶](#read-role-tag-blacklist "Permalink to this headline")

Source reference: [`hvac.api.auth\_methods.Aws.read\_role\_tag\_blacklist()`](index.html#hvac.api.auth_methods.Aws.read_role_tag_blacklist "hvac.api.auth_methods.Aws.read_role_tag_blacklist")

###### [List Blacklist Tags](#id40)[¶](#list-blacklist-tags "Permalink to this headline")

Source reference: [`hvac.api.auth\_methods.Aws.list\_blacklist\_tags()`](index.html#hvac.api.auth_methods.Aws.list_blacklist_tags "hvac.api.auth_methods.Aws.list_blacklist_tags")

###### [Delete Blacklist Tags](#id41)[¶](#delete-blacklist-tags "Permalink to this headline")

Source reference: [`hvac.api.auth\_methods.Aws.delete\_blacklist\_tags()`](index.html#hvac.api.auth_methods.Aws.delete_blacklist_tags "hvac.api.auth_methods.Aws.delete_blacklist_tags")

###### [Tidy Blacklist Tags](#id42)[¶](#tidy-blacklist-tags "Permalink to this headline")

Source reference: [`hvac.api.auth\_methods.Aws.tidy\_blacklist\_tags()`](index.html#hvac.api.auth_methods.Aws.tidy_blacklist_tags "hvac.api.auth_methods.Aws.tidy_blacklist_tags")

###### [Read Identity Whitelist](#id43)[¶](#read-identity-whitelist "Permalink to this headline")

Source reference: [`hvac.api.auth\_methods.Aws.read\_identity\_whitelist()`](index.html#hvac.api.auth_methods.Aws.read_identity_whitelist "hvac.api.auth_methods.Aws.read_identity_whitelist")

###### [List Identity Whitelist](#id44)[¶](#list-identity-whitelist "Permalink to this headline")

Source reference: [`hvac.api.auth\_methods.Aws.list\_identity\_whitelist()`](index.html#hvac.api.auth_methods.Aws.list_identity_whitelist "hvac.api.auth_methods.Aws.list_identity_whitelist")

###### [Delete Identity Whitelist Entries](#id45)[¶](#delete-identity-whitelist-entries "Permalink to this headline")

Source reference: [`hvac.api.auth\_methods.Aws.delete\_identity\_whitelist\_entries()`](index.html#hvac.api.auth_methods.Aws.delete_identity_whitelist_entries "hvac.api.auth_methods.Aws.delete_identity_whitelist_entries")

###### [Tidy Identity Whitelist Entries](#id46)[¶](#tidy-identity-whitelist-entries "Permalink to this headline")

Source reference: [`hvac.api.auth\_methods.Aws.tidy\_identity\_whitelist\_entries()`](index.html#hvac.api.auth_methods.Aws.tidy_identity_whitelist_entries "hvac.api.auth_methods.Aws.tidy_identity_whitelist_entries")

#### Azure[¶](#azure "Permalink to this headline")

Note

Every method under the `Client class's azure attribute` includes a mount\_point parameter that can be used to address the Azure auth method under a custom mount path. E.g., If enabling the Azure auth method using Vault’s CLI commands via vault auth enable -path=my-azure azure”, the mount\_point parameter in [`hvac.api.auth\_methods.Azure()`](index.html#hvac.api.auth_methods.Azure "hvac.api.auth_methods.Azure") methods would be set to “my-azure”.

##### Enabling the Auth Method[¶](#enabling-the-auth-method "Permalink to this headline")

[`hvac.v1.Client.enable\_auth\_backend()`](index.html#hvac.v1.Client.enable_auth_backend "hvac.v1.Client.enable_auth_backend")

```

import hvac

client = hvac.Client()

azure\_auth\_path = 'company-azure'

description = 'Auth method for use by team members in our company's Azure organization'

if '%s/' % azure\_auth\_path not in vault\_client.sys.list\_auth\_methods()['data']:

    print('Enabling the azure auth backend at mount\_point: {path}'.format(

        path=azure\_auth\_path,

    ))

    client.sys.enable\_auth\_method(

        method\_type='azure',

        description=description,

        path=azure\_auth\_path,

    )

```

##### Configure[¶](#configure "Permalink to this headline")

[`hvac.api.auth\_methods.Azure.configure()`](index.html#hvac.api.auth_methods.Azure.configure "hvac.api.auth_methods.Azure.configure")

```

import os

import hvac

client = hvac.Client()

client.auth.azure.configure(

    tenant\_id='my-tenant-id'

    resource='my-resource',

    client\_id=os.environ.get('AZURE\_CLIENT\_ID'),

    client\_secret=os.environ.get('AZURE\_CLIENT\_SECRET'),

)

```

##### Read Config[¶](#read-config "Permalink to this headline")

[`hvac.api.auth\_methods.Azure.read\_config()`](index.html#hvac.api.auth_methods.Azure.read_config "hvac.api.auth_methods.Azure.read_config")

```

import hvac

client = hvac.Client()

read\_config = client.auth.azure.read\_config()

print('The configured tenant\_id is: {id}'.format(id=read\_config['tenant\_id'))

```

##### Delete Config[¶](#delete-config "Permalink to this headline")

[`hvac.api.auth\_methods.Azure.delete\_config()`](index.html#hvac.api.auth_methods.Azure.delete_config "hvac.api.auth_methods.Azure.delete_config")

```

import hvac

client = hvac.Client()

client.auth.azure.delete\_config()

```

##### Create a Role[¶](#create-a-role "Permalink to this headline")

[`hvac.api.auth\_methods.Azure.create\_role()`](index.html#hvac.api.auth_methods.Azure.create_role "hvac.api.auth_methods.Azure.create_role")

```

import hvac

client = hvac.Client()

client.auth.azure.create\_role(

    name='my-role',

    policies=policies,

    bound\_service\_principal\_ids=bound\_service\_principal\_ids,

)

```

##### Read A Role[¶](#read-a-role "Permalink to this headline")

[`hvac.api.auth\_methods.Azure.read\_role()`](index.html#hvac.api.auth_methods.Azure.read_role "hvac.api.auth_methods.Azure.read_role")

```

import hvac

client = hvac.Client()

role\_name = 'my-role'

read\_role\_response = client.auth.azure.read\_role(

    name=role\_name,

)

print('Policies for role "{name}": {policies}'.format(

    name='my-role',

    policies=','.join(read\_role\_response['policies']),

))

```

##### List Roles[¶](#list-roles "Permalink to this headline")

[`hvac.api.auth\_methods.Azure.list\_roles()`](index.html#hvac.api.auth_methods.Azure.list_roles "hvac.api.auth_methods.Azure.list_roles")

```

import hvac

client = hvac.Client()

roles = client.auth.azure.list\_roles()

print('The following Azure auth roles are configured: {roles}'.format(

    roles=','.join(roles['keys']),

))

```

##### Delete A Role[¶](#delete-a-role "Permalink to this headline")

[`hvac.api.auth\_methods.Azure.delete\_role()`](index.html#hvac.api.auth_methods.Azure.delete_role "hvac.api.auth_methods.Azure.delete_role")

```

import hvac

client = hvac.Client()

client.auth.azure.delete\_role(

    name='my-role',

)

```

##### Login[¶](#login "Permalink to this headline")

[`hvac.api.auth\_methods.Azure.login()`](index.html#hvac.api.auth_methods.Azure.login "hvac.api.auth_methods.Azure.login")

```

import hvac

client = hvac.Client()

client.auth.azure.login(

    role=role\_name,

    jwt='Some MST JWT...',

)

client.is\_authenticated  # ==> returns True

```

#### GCP[¶](#gcp "Permalink to this headline")

Note

Every method under the `Client class's gcp.auth attribute` includes a mount\_point parameter that can be used to address the GCP auth method under a custom mount path. E.g., If enabling the GCP auth method using Vault’s CLI commands via vault auth enable -path=my-gcp gcp”, the mount\_point parameter in `hvac.api.auth.Gcp()` methods would be set to “my-gcp”.

##### Enabling the Auth Method[¶](#enabling-the-auth-method "Permalink to this headline")

Source reference: [`hvac.v1.Client.enable\_auth\_backend()`](index.html#hvac.v1.Client.enable_auth_backend "hvac.v1.Client.enable_auth_backend")

```

import hvac

client = hvac.Client()

gcp\_auth\_path = 'company-gcp'

description = 'Auth method for use by team members in our company's Gcp organization'

if '%s/' % gcp\_auth\_path not in vault\_client.sys.list\_auth\_methods()['data']:

    print('Enabling the gcp auth backend at mount\_point: {path}'.format(

        path=gcp\_auth\_path,

    ))

    client.sys.enable\_auth\_method(

        method\_type='gcp',

        description=description,

        path=gcp\_auth\_path,

    )

```

##### Configure[¶](#configure "Permalink to this headline")

Source reference: `hvac.api.auth.Gcp.configure()`

```

import hvac

client = hvac.Client()

client.auth.gcp.configure(

    credentials='some signed JSON web token for the Vault server...'

)

```

##### Read Config[¶](#read-config "Permalink to this headline")

Source reference: `hvac.api.auth.Gcp.read\_config()`

```

import hvac

client = hvac.Client()

read\_config = client.auth.gcp.read\_config()

print('The configured project\_id is: {id}'.format(id=read\_config['project\_id'))

```

##### Delete Config[¶](#delete-config "Permalink to this headline")

Source reference: `hvac.api.auth.Gcp.delete\_config()`

```

import hvac

client = hvac.Client()

client.auth.gcp.delete\_config()

```

##### Create Role[¶](#create-role "Permalink to this headline")

Source reference: `hvac.api.auth.Gcp.create\_role()`

```

import hvac

client = hvac.Client()

    client.auth.gcp.create\_role(

            name='some-gcp-role-name',

            role\_type='iam',

            project\_id='some-gcp-project-id',

            bound\_service\_accounts=['\*'],

    )

```

##### Edit Service Accounts On IAM Role[¶](#edit-service-accounts-on-iam-role "Permalink to this headline")

Source reference: `hvac.api.auth.Gcp.edit\_service\_accounts\_on\_iam\_role()`

```

import hvac

client = hvac.Client()

client.gcp.edit\_service\_accounts\_on\_iam\_role(

            name='some-gcp-role-name',

    add=['hvac@appspot.gserviceaccount.com'],

)

client.gcp.edit\_service\_accounts\_on\_iam\_role(

            name='some-gcp-role-name',

    remove=['disallowed-service-account@appspot.gserviceaccount.com'],

)

```

##### Edit Labels On GCE Role[¶](#edit-labels-on-gce-role "Permalink to this headline")

Source reference: `hvac.api.auth.Gcp.edit\_labels\_on\_gce\_role()`

```

import hvac

client = hvac.Client()

client.gcp.edit\_labels\_on\_gce\_role(

            name='some-gcp-role-name',

    add=['some-key:some-value'],

)

client.gcp.edit\_labels\_on\_gce\_role(

            name='some-gcp-role-name',

    remove=['some-bad-key:some-bad-value'],

)

```

##### Read A Role[¶](#read-a-role "Permalink to this headline")

Source reference: `hvac.api.auth.Gcp.read\_role()`

```

import hvac

client = hvac.Client()

read\_role\_response = client.gcp.read\_role(

    name=role\_name,

)

print('Policies for role "{name}": {policies}'.format(

    name='my-role',

    policies=','.join(read\_role\_response['policies']),

))

```

##### List Roles[¶](#list-roles "Permalink to this headline")

Source reference: `hvac.api.auth.Gcp.list\_roles()`

```

import hvac

client = hvac.Client()

roles = client.auth.gcp.list\_roles()

print('The following GCP auth roles are configured: {roles}'.format(

    roles=','.join(roles['keys']),

))

```

##### Delete A Role[¶](#delete-a-role "Permalink to this headline")

Source reference: `hvac.api.auth.Gcp.delete\_role()`

```

import hvac

client = hvac.Client()

client.gcp.delete\_role(

)

```

##### Login[¶](#login "Permalink to this headline")

Source reference: `hvac.api.auth.Gcp.login()`

```

import hvac

client = hvac.Client()

client.gcp.login(

    role=role\_name,

    jwt='some signed JSON web token...',

)

client.is\_authenticated  # ==> returns True

```

###### Example with google-api-python-client Usage[¶](#example-with-google-api-python-client-usage "Permalink to this headline")

```

import time

import googleapiclient.discovery # pip install google-api-python-client

from google.oauth2 import service\_account # pip install google-auth

import hvac # pip install hvac

# First load some previously generated GCP service account key

path\_to\_sa\_json = 'some-service-account-path.json'

credentials = service\_account.Credentials.from\_service\_account\_file(path\_to\_sa\_json)

with open(path\_to\_sa\_json, 'r') as f:

    creds = json.load(f)

    project = creds['project\_id']

    service\_account = creds['client\_email']

# Generate a payload for subsequent "signJwt()" call

# Reference: https://google-auth.readthedocs.io/en/latest/reference/google.auth.jwt.html#google.auth.jwt.Credentials

now = int(time.time())

expires = now + 900  # 15 mins in seconds, can't be longer.

payload = {

    'iat': now,

    'exp': expires,

    'sub': service\_account,

    'aud': 'vault/my-role'

}

body = {'payload': json.dumps(payload)}

name = f'projects/{project}/serviceAccounts/{service\_account}'

# Perform the GCP API call

iam = googleapiclient.discovery.build('iam', 'v1', credentials=credentials)

request = iam.projects().serviceAccounts().signJwt(name=name, body=body)

resp = request.execute()

jwt = resp['signedJwt']

# Perform hvac call to configured GCP auth method

client.auth.gcp.login(

    role='my-role',

    jwt=jwt,

)

```

#### GitHub[¶](#github "Permalink to this headline")

Note

Every method under the `Client class's github attribute` includes a mount\_point parameter that can be used to address the Github auth method under a custom mount path. E.g., If enabling the Github auth method using Vault’s CLI commands via vault auth enable -path=my-github github”, the mount\_point parameter in [`hvac.api.auth\_methods.Github()`](index.html#hvac.api.auth_methods.Github "hvac.api.auth_methods.Github") methods would be set to “my-github”.

##### Enabling the Auth Method[¶](#enabling-the-auth-method "Permalink to this headline")

[`hvac.v1.Client.enable\_auth\_backend()`](index.html#hvac.v1.Client.enable_auth_backend "hvac.v1.Client.enable_auth_backend")

```

import hvac

client = hvac.Client()

github\_auth\_path = 'company-github'

description = 'Auth method for use by team members in our company's Github organization'

if '%s/' % github\_auth\_path not in vault\_client.sys.list\_auth\_methods()['data']:

    print('Enabling the github auth backend at mount\_point: {path}'.format(

        path=github\_auth\_path,

    ))

    client.sys.enable\_auth\_method(

        method\_type='github',

        description=description,

        path=github\_auth\_path,

    )

```

##### Configure Connection Parameters[¶](#configure-connection-parameters "Permalink to this headline")

[`hvac.api.auth\_methods.Github.configure()`](index.html#hvac.api.auth_methods.Github.configure "hvac.api.auth_methods.Github.configure")

```

import hvac

client = hvac.Client()

client.auth.github.configure(

    organization='our-lovely-company',

    max\_ttl='48h',  # i.e., A given token can only be renewed for up to 48 hours

)

```

##### Reading Configuration[¶](#reading-configuration "Permalink to this headline")

[`hvac.api.auth\_methods.Github.read\_configuration()`](index.html#hvac.api.auth_methods.Github.read_configuration "hvac.api.auth_methods.Github.read_configuration")

```

import hvac

client = hvac.Client()

github\_config = client.auth.github.read\_configuration()

print('The Github auth method is configured with a ttl of: {ttl}'.format(

    ttl=github\_config['data']['ttl']

)

```

##### Mapping Teams to Policies[¶](#mapping-teams-to-policies "Permalink to this headline")

[`hvac.api.auth\_methods.Github.map\_team()`](index.html#hvac.api.auth_methods.Github.map_team "hvac.api.auth_methods.Github.map_team")

```

import hvac

client = hvac.Client()

teams = [

    dict(name='some-dev-team', policies=['dev-team']),

    dict(name='admin-team', policies=['administrator']),

]

for team in teams:

    client.auth.github.map\_team(

        team\_name=team['name'],

        policies=team['policies'],

    )

```

##### Reading Team Mappings[¶](#reading-team-mappings "Permalink to this headline")

[`hvac.api.auth\_methods.Github.read\_team\_mapping()`](index.html#hvac.api.auth_methods.Github.read_team_mapping "hvac.api.auth_methods.Github.read_team_mapping")

```

import hvac

client = hvac.Client()

team\_name = 'my-super-cool-team'

github\_config = client.auth.github.read\_team\_mapping(

    team\_name=team\_name,

)

print('The Github team {team} is mapped to the following policies: {policies}'.format(

    team=team\_name,

    policies=github\_config['data']['value'],

)

```

##### Mapping Users to Policies[¶](#mapping-users-to-policies "Permalink to this headline")

[`hvac.api.auth\_methods.Github.map\_user()`](index.html#hvac.api.auth_methods.Github.map_user "hvac.api.auth_methods.Github.map_user")

```

import hvac

client = hvac.Client()

users = [

    dict(name='some-dev-user', policies=['dev-team']),

    dict(name='some-admin-user', policies=['administrator']),

]

for user in users:

    client.auth.github.map\_user(

        user\_name=user['name'],

        policies=user['policies'],

    )

```

##### Reading User Mappings[¶](#reading-user-mappings "Permalink to this headline")

[`hvac.api.auth\_methods.Github.read\_user\_mapping()`](index.html#hvac.api.auth_methods.Github.read_user_mapping "hvac.api.auth_methods.Github.read_user_mapping")

```

import hvac

client = hvac.Client()

user\_name = 'some-dev-user'

github\_config = client.auth.github.read\_user\_mapping(

    user\_name=user\_name,

)

print('The Github user "{user}" is mapped to the following policies: {policies}'.format(

    user=user\_name,

    policies=github\_config['data']['value'],

)

```

##### Authentication / Login[¶](#authentication-login "Permalink to this headline")

[`hvac.api.auth\_methods.Github.login()`](index.html#hvac.api.auth_methods.Github.login "hvac.api.auth_methods.Github.login")

Log in and automatically update the underlying “token” attribute on the [`hvac.adapters.Adapter()`](index.html#hvac.adapters.Adapter "hvac.adapters.Adapter") instance:

```

import hvac

client = hvac.Client()

login\_response = client.auth.github.login(token='some personal github token')

```

#### [JWT/OIDC](#id1)[¶](#jwt-oidc "Permalink to this headline")

Contents

* [JWT/OIDC](#jwt-oidc)

	+ [Enabling](#enabling)

	+ [Configure](#configure)

	+ [Read Config](#read-config)

	+ [Create Role](#create-role)

	+ [Read Role](#read-role)

	+ [List Roles](#list-roles)

	+ [Delete Role](#delete-role)

	+ [OIDC Authorization URL Request](#oidc-authorization-url-request)

	+ [JWT Login](#jwt-login)

Note

The [`hvac.api.auth\_methods.JWT`](index.html#hvac.api.auth_methods.JWT "hvac.api.auth_methods.JWT") and [`hvac.api.auth\_methods.OIDC`](index.html#hvac.api.auth_methods.OIDC "hvac.api.auth_methods.OIDC") share all the same methods.

They only differ in the default path their methods will use. I.e., v1/auth/jwt versus v1/auth/oidc.

##### [Enabling](#id2)[¶](#enabling "Permalink to this headline")

```

import hvac

client = hvac.Client()

# For JWT

client.sys.enable\_auth\_method(

    method\_type='jwt',

)

# For OIDC

client.sys.enable\_auth\_method(

    method\_type='oidc',

)

```

##### [Configure](#id3)[¶](#configure "Permalink to this headline")

[`hvac.api.auth\_methods.JWT.configure()`](index.html#hvac.api.auth_methods.JWT.configure "hvac.api.auth_methods.JWT.configure")

```

import hvac

client = hvac.Client()

client.auth.jwt.configure(

    oidc\_discovery\_url=oidc\_discovery\_url,

    oidc\_discovery\_ca\_pem=some\_ca\_file\_contents,

)

# or

client.auth.oidc.configure(

    oidc\_discovery\_url=oidc\_discovery\_url,

    oidc\_discovery\_ca\_pem=some\_ca\_file\_contents,

)

```

##### [Read Config](#id4)[¶](#read-config "Permalink to this headline")

[`hvac.api.auth\_methods.JWT.read\_config()`](index.html#hvac.api.auth_methods.JWT.read_config "hvac.api.auth_methods.JWT.read_config")

```

import hvac

client = hvac.Client()

read\_response = client.auth.jwt.read\_config()

# or

read\_response = client.auth.oidc.read\_config()

discovery\_url = read\_response['data']['oidc\_discovery\_url']

print('Current OIDC discovery URL is set to: %s' % discovery\_url)

```

##### [Create Role](#id5)[¶](#create-role "Permalink to this headline")

[`hvac.api.auth\_methods.JWT.create\_role()`](index.html#hvac.api.auth_methods.JWT.create_role "hvac.api.auth_methods.JWT.create_role")

```

import hvac

client = hvac.Client()

role\_name = 'hvac'

allowed\_redirect\_uris = ['https://localhost:8200/jwt-test/callback']

user\_claim = 'https://vault/user'

# JWT

client.auth.jwt.create\_role(

    name=role\_name,

    role\_type='jwt',

    allowed\_redirect\_uris=allowed\_redirect\_uris,

    user\_claim='sub',

    bound\_audiences=['12345'],

)

# OIDC

client.auth.oidc.create\_role(

    name=role\_name,

    allowed\_redirect\_uris=allowed\_redirect\_uris,

    user\_claim=user\_claim,

)

```

##### [Read Role](#id6)[¶](#read-role "Permalink to this headline")

[`hvac.api.auth\_methods.JWT.read\_role()`](index.html#hvac.api.auth_methods.JWT.read_role "hvac.api.auth_methods.JWT.read_role")

```

import hvac

client = hvac.Client()

response = client.auth.jwt.read\_role(

    name='hvac',

)

print('hvac role has a user\_claim setting of: %s' % response['data']['user\_claim'])

```

##### [List Roles](#id7)[¶](#list-roles "Permalink to this headline")

[`hvac.api.auth\_methods.JWT.list\_roles()`](index.html#hvac.api.auth_methods.JWT.list_roles "hvac.api.auth_methods.JWT.list_roles")

```

import hvac

client = hvac.Client()

list\_resp = client.auth.jwt.list\_roles()

print('Configured roles: %s' % ', '.join(list\_resp['data']['keys']))

```

##### [Delete Role](#id8)[¶](#delete-role "Permalink to this headline")

[`hvac.api.auth\_methods.JWT.delete\_role()`](index.html#hvac.api.auth_methods.JWT.delete_role "hvac.api.auth_methods.JWT.delete_role")

```

import hvac

client = hvac.Client()

client.auth.jwt.delete\_role(

    name='hvac',

)

```

##### [OIDC Authorization URL Request](#id9)[¶](#oidc-authorization-url-request "Permalink to this headline")

[`hvac.api.auth\_methods.JWT.oidc\_authorization\_url\_request()`](index.html#hvac.api.auth_methods.JWT.oidc_authorization_url_request "hvac.api.auth_methods.JWT.oidc_authorization_url_request")

```

import webbrowser

import http.server

import hvac

client = hvac.Client()

auth\_url\_response = client.auth.oidc.oidc\_authorization\_url\_request(

    role='hvac',

    redirect\_uri='http://localhost:8250/oidc/callback'

)

auth\_url = auth\_url\_response['data']['auth\_url']

if auth\_url == '':

    return None

params = parse.parse\_qs(auth\_url.split('?')[1])

auth\_url\_nonce = params['nonce'][0]

auth\_url\_state = params['state'][0]

webbrowser.open(auth\_url)

token = login\_odic\_get\_token()

auth\_result = client.auth.oidc.oidc\_callback(

    code=token, path='oidc', nonce=auth\_url\_nonce, state=auth\_url\_state

)

print('Client token returned: %s' % auth\_result['auth']['client\_token'])

# handles the callback

def login\_odic\_get\_token(self):

    from http.server import BaseHTTPRequestHandler, HTTPServer

    class HttpServ(HTTPServer):

        def \_\_init\_\_(self, \*args, \*\*kwargs):

            HTTPServer.\_\_init\_\_(self, \*args, \*\*kwargs)

            self.token = None

    class AuthHandler(BaseHTTPRequestHandler):

        token = ''

        def do\_GET(self):

            params = parse.parse\_qs(self.path.split('?')[1])

            self.server.token = params['code'][0]

            self.send\_response(200)

            self.end\_headers()

            self.wfile.write(str.encode('<div>Authentication successful, you can close the browser now.</div>'))

    server\_address = ('', 8250)

    httpd = HttpServ(server\_address, AuthHandler)

    httpd.handle\_request()

    return httpd.token

```

##### [JWT Login](#id10)[¶](#jwt-login "Permalink to this headline")

[`hvac.api.auth\_methods.JWT.jwt\_login()`](index.html#hvac.api.auth_methods.JWT.jwt_login "hvac.api.auth_methods.JWT.jwt_login")

```

import hvac

client = hvac.Client()

response = client.auth.jwt.jwt\_login(

    role=role\_name,

    jwt=generate\_token\_response['data']['token'],

)

print('Client token returned: %s' % response['auth']['client\_token'])

```

#### Kubernetes[¶](#kubernetes "Permalink to this headline")

##### Authentication[¶](#authentication "Permalink to this headline")

```

# Kubernetes (from k8s pod)

f = open('/var/run/secrets/kubernetes.io/serviceaccount/token')

jwt = f.read()

client.auth\_kubernetes("example", jwt)

```

#### LDAP[¶](#ldap "Permalink to this headline")

Note

Every method under the `Client class's ldap attribute` includes a mount\_point parameter that can be used to address the LDAP auth method under a custom mount path. E.g., If enabling the LDAP auth method using Vault’s CLI commands via vault auth enable -path=my-ldap ldap”, the mount\_point parameter in [`hvac.api.auth\_methods.Ldap()`](index.html#hvac.api.auth_methods.Ldap "hvac.api.auth_methods.Ldap") methods would be set to “my-ldap”.

##### Enabling the LDAP Auth Method[¶](#enabling-the-ldap-auth-method "Permalink to this headline")

[`hvac.v1.Client.enable\_auth\_backend()`](index.html#hvac.v1.Client.enable_auth_backend "hvac.v1.Client.enable_auth_backend")

```

import hvac

client = hvac.Client()

ldap\_auth\_path = 'company-ldap'

description = "Auth method for use by team members in our company's LDAP organization"

if '%s/' % ldap\_auth\_path not in vault\_client.sys.list\_auth\_methods()['data']:

    print('Enabling the ldap auth backend at mount\_point: {path}'.format(

        path=ldap\_auth\_path,

    ))

    client.sys.enable\_auth\_method(

        method\_type='ldap',

        description=description,

        path=ldap\_auth\_path,

    )

```

##### Configure LDAP Auth Method Settings[¶](#configure-ldap-auth-method-settings "Permalink to this headline")

[`hvac.api.auth\_methods.Ldap.configure()`](index.html#hvac.api.auth_methods.Ldap.configure "hvac.api.auth_methods.Ldap.configure")

```

import hvac

client = hvac.Client()

client.auth.ldap.configure(

    user\_dn='dc=users,dc=hvac,dc=network',

    group\_dn='ou=groups,dc=hvac,dc=network',

    url='ldaps://ldap.hvac.network:12345',

    bind\_dn='cn=admin,dc=hvac,dc=network',

    bind\_pass='ourverygoodadminpassword'

    user\_attr='uid',

    group\_attr='cn',

)

```

##### Reading the LDAP Auth Method Configuration[¶](#reading-the-ldap-auth-method-configuration "Permalink to this headline")

[`hvac.api.auth\_methods.Ldap.read\_configuration()`](index.html#hvac.api.auth_methods.Ldap.read_configuration "hvac.api.auth_methods.Ldap.read_configuration")

```

import hvac

client = hvac.Client()

ldap\_configuration = client.auth.ldap.read\_configuration()

print('The LDAP auth method is configured with a LDAP server URL of: {url}'.format(

    url=ldap\_configuration['data']['url']

)

```

##### Create or Update a LDAP Group Mapping[¶](#create-or-update-a-ldap-group-mapping "Permalink to this headline")

[`hvac.api.auth\_methods.Ldap.create\_or\_update\_group()`](index.html#hvac.api.auth_methods.Ldap.create_or_update_group "hvac.api.auth_methods.Ldap.create_or_update_group")

```

import hvac

client = hvac.Client()

client.auth.ldap.create\_or\_update\_group(

    name='some-dudes',

    policies=['policy-for-some-dudes'],

)

```

##### List LDAP Group Mappings[¶](#list-ldap-group-mappings "Permalink to this headline")

[`hvac.api.auth\_methods.Ldap.list\_groups()`](index.html#hvac.api.auth_methods.Ldap.list_groups "hvac.api.auth_methods.Ldap.list_groups")

```

import hvac

client = hvac.Client()

ldap\_groups = client.auth.ldap.list\_groups()

print('The following groups are configured in the LDAP auth method: {groups}'.format(

    groups=','.join(ldap\_groups['data']['keys'])

)

```

##### Read LDAP Group Mapping[¶](#read-ldap-group-mapping "Permalink to this headline")

[`hvac.api.auth\_methods.Ldap.read\_group()`](index.html#hvac.api.auth_methods.Ldap.read_group "hvac.api.auth_methods.Ldap.read_group")

```

import hvac

client = hvac.Client()

some\_dudes\_ldap\_group = client.auth.ldap.read\_group(

    name='somedudes',

)

print('The "somedudes" group in the LDAP auth method are mapped to the following policies: {policies}'.format(

    policies=','.join(some\_dudes\_ldap\_group['data']['policies'])

)

```

##### Deleting a LDAP Group Mapping[¶](#deleting-a-ldap-group-mapping "Permalink to this headline")

[`hvac.api.auth\_methods.Ldap.delete\_group()`](index.html#hvac.api.auth_methods.Ldap.delete_group "hvac.api.auth_methods.Ldap.delete_group")

```

import hvac

client = hvac.Client()

client.auth.ldap.delete\_group(

    name='some-group',

)

```

##### Creating or Updating a LDAP User Mapping[¶](#creating-or-updating-a-ldap-user-mapping "Permalink to this headline")

[`hvac.api.auth\_methods.Ldap.create\_or\_update\_user()`](index.html#hvac.api.auth_methods.Ldap.create_or_update_user "hvac.api.auth_methods.Ldap.create_or_update_user")

```

import hvac

client = hvac.Client()

client.auth.ldap.create\_or\_update\_user(

    username='somedude',

    policies=['policy-for-some-dudes'],

)

```

##### Listing LDAP User Mappings[¶](#listing-ldap-user-mappings "Permalink to this headline")

[`hvac.api.auth\_methods.Ldap.list\_users()`](index.html#hvac.api.auth_methods.Ldap.list_users "hvac.api.auth_methods.Ldap.list_users")

```

import hvac

client = hvac.Client()

ldap\_users = client.auth.ldap.list\_users()

print('The following users are configured in the LDAP auth method: {users}'.format(

    users=','.join(ldap\_users['data']['keys'])

)

```

##### Reading a LDAP User Mapping[¶](#reading-a-ldap-user-mapping "Permalink to this headline")

[`hvac.api.auth\_methods.Ldap.read\_user()`](index.html#hvac.api.auth_methods.Ldap.read_user "hvac.api.auth_methods.Ldap.read_user")

```

import hvac

client = hvac.Client()

some\_dude\_ldap\_user = client.auth.ldap.read\_user(

    username='somedude'

)

print('The "somedude" user in the LDAP auth method is mapped to the following policies: {policies}'.format(

    policies=','.join(some\_dude\_ldap\_user['data']['policies'])

)

```

##### Deleting a Configured User Mapping[¶](#deleting-a-configured-user-mapping "Permalink to this headline")

[`hvac.api.auth\_methods.Ldap.delete\_user()`](index.html#hvac.api.auth_methods.Ldap.delete_user "hvac.api.auth_methods.Ldap.delete_user")

```

import hvac

client = hvac.Client()

client.auth.ldap.delete\_user(

    username='somedude',

)

```

##### Authentication / Login[¶](#authentication-login "Permalink to this headline")

`hvac.api.auth\_methods.Ldap.login\_with\_user()`

For a LDAP backend mounted under a non-default (ldap) path.

E.g., via Vault CLI with vault auth enable -path=prod-ldap ldap

```

from getpass import getpass

import hvac

service\_account\_username = 'someuser'

password\_prompt = 'Please enter your password for the LDAP authentication backend: '

service\_account\_password = getpass(prompt=password\_prompt)

client = hvac.Client()

# Here the mount\_point parameter corresponds to the path provided when enabling the backend

client.auth.ldap.login(

    username=service\_account\_username,

    password=service\_account\_password,

    mount\_point='prod-ldap'

)

print(client.is\_authenticated())  # => True

```

#### MFA[¶](#mfa "Permalink to this headline")

##### Configure MFA Auth Method Settings[¶](#configure-mfa-auth-method-settings "Permalink to this headline")

[`hvac.api.auth\_methods.Mfa.configure()`](index.html#hvac.api.auth_methods.Mfa.configure "hvac.api.auth_methods.Mfa.configure")

Note

The legacy/unsupported MFA auth method covered by this class’s configuration API route only supports integration with a subset of Vault auth methods. See the list of supported auth methods in this module’s `"SUPPORTED\_AUTH\_METHODS" attribute` and/or the associated [Vault MFA documentation](https://www.vaultproject.io/docs/auth/mfa.html) for additional information.

```

import hvac

client = hvac.Client()

userpass\_auth\_path = 'some-userpass'

if '%s/' % userpass\_auth\_path not in vault\_client.sys.list\_auth\_methods()['data']:

    print('Enabling the userpass auth backend at mount\_point: {path}'.format(

        path=userpass\_auth\_path,

    ))

    client.sys.enable\_auth\_method(

        method\_type='userpass',

        path=userpass\_auth\_path,

    )

client.auth.mfa.configure(

    mount\_point=userpass\_auth\_path,

)

```

##### Reading the MFA Auth Method Configuration[¶](#reading-the-mfa-auth-method-configuration "Permalink to this headline")

[`hvac.api.auth\_methods.Mfa.read\_configuration()`](index.html#hvac.api.auth_methods.Mfa.read_configuration "hvac.api.auth_methods.Mfa.read_configuration")

```

import hvac

client = hvac.Client()

mfa\_configuration = client.auth.mfa.read\_configuration()

print('The MFA auth method is configured with a MFA type of: {mfa\_type}'.format(

    mfa\_type=mfa\_configuration['data']['type']

)

```

##### Configure Duo MFA Type Access Credentials[¶](#configure-duo-mfa-type-access-credentials "Permalink to this headline")

[`hvac.api.auth\_methods.Mfa.configure\_duo\_access()`](index.html#hvac.api.auth_methods.Mfa.configure_duo_access "hvac.api.auth_methods.Mfa.configure_duo_access")

```

from getpass import getpass

import hvac

client = hvac.Client()

secret\_key\_prompt = 'Please enter the Duo access secret key to configure: '

duo\_access\_secret\_key = getpass(prompt=secret\_key\_prompt)

client.auth.mfa.configure\_duo\_access(

    mount\_point=userpass\_auth\_path,

    host='api-1234abcd.duosecurity.com',

    integration\_key='SOME\_DUO\_IKEY',

    secret\_key=duo\_access\_secret\_key,

)

```

##### Configure Duo MFA Type Behavior[¶](#configure-duo-mfa-type-behavior "Permalink to this headline")

[`hvac.api.auth\_methods.Mfa.configure\_duo\_behavior()`](index.html#hvac.api.auth_methods.Mfa.configure_duo_behavior "hvac.api.auth_methods.Mfa.configure_duo_behavior")

```

import hvac

client = hvac.Client()

client.auth.mfa.configure\_duo\_behavior(

    mount\_point=userpass\_auth\_path,

    username\_format='%s@hvac.network',

)

```

##### Read Duo MFA Type Behavior[¶](#read-duo-mfa-type-behavior "Permalink to this headline")

[`hvac.api.auth\_methods.Mfa.read\_duo\_behavior\_configuration()`](index.html#hvac.api.auth_methods.Mfa.read_duo_behavior_configuration "hvac.api.auth_methods.Mfa.read_duo_behavior_configuration")

```

import hvac

client = hvac.Client()

duo\_behavior\_config = client.auth.mfa.read\_duo\_behavior\_configuration(

    mount\_point=userpass\_auth\_path,

)

print('The Duo MFA behvaior is configured with a username\_format of: {username\_format}'.format(

    username\_format=duo\_behavior\_config['data']['username\_format'],

)

```

##### Authentication / Login[¶](#authentication-login "Permalink to this headline")

```

from getpass import getpass

import hvac

login\_username = 'someuser'

password\_prompt = 'Please enter your password for the userpass (with MFA) authentication backend: '

login\_password = getpass(prompt=password\_prompt)

passcode\_prompt = 'Please enter your OTP for the userpass (with MFA) authentication backend: '

userpass\_mfa\_passcode = getpass(prompt=passcode\_prompt)

client = hvac.Client()

# Here the mount\_point parameter corresponds to the path provided when enabling the backend

client.auth.mfa.auth\_userpass(

    username=login\_username,

    password=login\_password,

    mount\_point=userpass\_auth\_path,

    passcode=userpass\_mfa\_passcode,

)

print(client.is\_authenticated)  # => True

```

#### Okta[¶](#okta "Permalink to this headline")

Note

Every method under the `Client class's okta attribute` includes a mount\_point parameter that can be used to address the Okta auth method under a custom mount path. E.g., If enabling the Okta auth method using Vault’s CLI commands via vault secret enable -path=my-okta okta”, the mount\_point parameter in Source reference: [`hvac.api.auth\_methods.Okta()`](index.html#hvac.api.auth_methods.Okta "hvac.api.auth_methods.Okta") methods would be set to “my-okta”.

##### Enabling the Auth Method[¶](#enabling-the-auth-method "Permalink to this headline")

Source reference: `hvac.v1.client.sys.enable\_secrets\_engine()`

```

import hvac

client = hvac.Client()

okta\_path = 'company-okta'

description = 'Auth method for use by team members in our company's Okta organization'

if '%s/' % okta\_path not in vault\_client.sys.list\_auth\_methods()['data']:

    print('Enabling the okta secret backend at mount\_point: {path}'.format(

        path=okta\_secret\_path,

    ))

    client.sys.enable\_auth\_method(

        method\_type='okta',

        description=description,

        path=okta\_secret\_path,

    )

```

##### Configure[¶](#configure "Permalink to this headline")

Source reference: [`hvac.api.auth\_methods.Okta.configure()`](index.html#hvac.api.auth_methods.Okta.configure "hvac.api.auth_methods.Okta.configure")

```

import hvac

client = hvac.Client()

client.auth.okta.configure(

    org\_name='hvac-project'

)

```

##### Read Config[¶](#read-config "Permalink to this headline")

Source reference: [`hvac.api.auth\_methods.Okta.read\_config()`](index.html#hvac.api.auth_methods.Okta.read_config "hvac.api.auth_methods.Okta.read_config")

```

import hvac

client = hvac.Client()

okta\_config = client.auth.okta.read\_config()

print('The Okta auth method at path /okta has a configured organization name of: {name}'.format(

    name=okta\_config['data']['org\_name'],

))

```

##### List Users[¶](#list-users "Permalink to this headline")

Source reference: [`hvac.api.auth\_methods.Okta.list\_users()`](index.html#hvac.api.auth_methods.Okta.list_users "hvac.api.auth_methods.Okta.list_users")

```

import hvac

client = hvac.Client()

users = client.auth.okta.list\_users()

print('The following Okta users are registered: {users}'.format(

    users=','.join(users['data']['keys']),

))

```

##### Register User[¶](#register-user "Permalink to this headline")

Source reference: [`hvac.api.auth\_methods.Okta.register\_user()`](index.html#hvac.api.auth_methods.Okta.register_user "hvac.api.auth_methods.Okta.register_user")

```

import hvac

client = hvac.Client()

client.auth.okta.register\_user(

    username='hvac-person',

    policies=['hvac-admin'],

)

```

##### Read User[¶](#read-user "Permalink to this headline")

Source reference: [`hvac.api.auth\_methods.Okta.read\_user()`](index.html#hvac.api.auth_methods.Okta.read_user "hvac.api.auth_methods.Okta.read_user")

```

import hvac

client = hvac.Client()

read\_user = client.auth.okta.read\_user(

    username='hvac-person',

)

print('Okta user "{name}" has the following attached policies: {policies}'.format(

    name='hvac-person',

    policies=', '.join(read\_user['data']['policies'],

))

```

##### Delete User[¶](#delete-user "Permalink to this headline")

Source reference: [`hvac.api.auth\_methods.Okta.delete\_user()`](index.html#hvac.api.auth_methods.Okta.delete_user "hvac.api.auth_methods.Okta.delete_user")

```

import hvac

client = hvac.Client()

client.auth.okta.delete\_user(

    username='hvac-person'

)

```

##### List Groups[¶](#list-groups "Permalink to this headline")

Source reference: [`hvac.api.auth\_methods.Okta.list\_groups()`](index.html#hvac.api.auth_methods.Okta.list_groups "hvac.api.auth_methods.Okta.list_groups")

```

import hvac

client = hvac.Client()

groups = client.auth.okta.list\_groups()

print('The following Okta groups are registered: {groups}'.format(

    groups=','.join(groups['data']['keys']),

))

```

##### Register Group[¶](#register-group "Permalink to this headline")

Source reference: [`hvac.api.auth\_methods.Okta.register\_group()`](index.html#hvac.api.auth_methods.Okta.register_group "hvac.api.auth_methods.Okta.register_group")

```

import hvac

client = hvac.Client()

client.auth.okta.register\_group(

    name='hvac-group',

    policies=['hvac-group-members'],

)

```

##### Read Group[¶](#read-group "Permalink to this headline")

Source reference: [`hvac.api.auth\_methods.Okta.read\_group()`](index.html#hvac.api.auth_methods.Okta.read_group "hvac.api.auth_methods.Okta.read_group")

```

import hvac

client = hvac.Client()

read\_group = client.auth.okta.read\_group(

    name='hvac-group',

)

print('Okta group "{name}" has the following attached policies: {policies}'.format(

    name='hvac-group',

    policies=', '.join(read\_group['data']['policies'],

))

```

##### Delete Group[¶](#delete-group "Permalink to this headline")

Source reference: [`hvac.api.auth\_methods.Okta.delete\_group()`](index.html#hvac.api.auth_methods.Okta.delete_group "hvac.api.auth_methods.Okta.delete_group")

```

import hvac

client = hvac.Client()

client.auth.okta.delete\_group(

    name='hvac-group',

)

```

##### Login[¶](#login "Permalink to this headline")

Source reference: [`hvac.api.auth\_methods.Okta.login()`](index.html#hvac.api.auth_methods.Okta.login "hvac.api.auth_methods.Okta.login")

```

from getpass import getpass

import hvac

client = hvac.Client()

password\_prompt = 'Please enter your password for the Okta authentication backend: '

okta\_password = getpass(prompt=password\_prompt)

client.auth.okta.login(

    username='hvac-person',

    password=okta\_password,

)

```

#### Token[¶](#token "Permalink to this headline")

##### Authentication[¶](#authentication "Permalink to this headline")

```

# Token

client.token = 'MY\_TOKEN'

assert client.is\_authenticated() # => True

```

##### Token Management[¶](#token-management "Permalink to this headline")

Token creation and revocation:

```

token = client.auth.token.create(policies=['root'], lease='1h')

current\_token = client.auth.token.lookup\_self()

some\_other\_token = client.auth.token.lookup('xxx')

client.auth.token.revoke('xxx')

client.auth.token.revoke('yyy', orphan=True)

# revoke current token

client.auth.token.revoke\_self()

# logout and revoke current token

client.logout(revoke\_token=True)

client.auth.token.renew('aaa')

```

Lookup and revoke tokens via a token accessor:

```

token = client.auth.token.create(policies=['root'], lease='1h')

token\_accessor = token['auth']['accessor']

same\_token = client.auth.token.lookup(token\_accessor, accessor=True)

client.auth.token.revoke(token\_accessor, accessor=True)

```

Wrapping/unwrapping a token:

```

wrap = client.auth.token.create(policies=['root'], lease='1h', wrap\_ttl='1m')

result = self.client.unwrap(wrap['wrap\_info']['token'])

```

Login with a wrapped token:

```

wrap = client.auth.token.create(policies=['root'], lease='1h', wrap\_ttl='1m')

new\_client = hvac.Client()

new\_client.auth\_cubbyhole(wrap['wrap\_info']['token'])

assert new\_client.token != wrapped\_token['wrap\_info']['token']

```

#### Authenticate to different auth backends[¶](#authenticate-to-different-auth-backends "Permalink to this headline")

```

# App ID

client.auth\_app\_id('MY\_APP\_ID', 'MY\_USER\_ID')

# GitHub

client.auth\_github('MY\_GITHUB\_TOKEN')

# TLS

client = Client(cert=('path/to/cert.pem', 'path/to/key.pem'))

client.auth\_tls()

# Non-default mount point (available on all auth types)

client.auth\_userpass('MY\_USERNAME', 'MY\_PASSWORD', mount\_point='CUSTOM\_MOUNT\_POINT')

# Authenticating without changing to new token (available on all auth types)

result = client.auth\_github('MY\_GITHUB\_TOKEN', use\_token=False)

print(result['auth']['client\_token']) # => u'NEW\_TOKEN'

# Custom or unsupported auth type

params = {

    'username': 'MY\_USERNAME',

    'password': 'MY\_PASSWORD',

    'custom\_param': 'MY\_CUSTOM\_PARAM',

}

result = client.login('/v1/auth/CUSTOM\_AUTH/login', json=params)

# Logout

client.logout()

```

### System Backend[¶](#system-backend "Permalink to this headline")

#### Audit[¶](#audit "Permalink to this headline")

* [Examples](#examples)

* [List Enabled Audit Devices](#list-enabled-audit-devices)

* [Enable Audit Device](#enable-audit-device)

* [Disable Audit Device](#disable-audit-device)

* [Calculate Hash](#calculate-hash)

##### [Examples](#id5)[¶](#examples "Permalink to this headline")

```

audit\_devices = client.sys.list\_enabled\_audit\_devices()

options = {

    'path': '/tmp/vault.log',

    'log\_raw': True,

}

client.sys.enable\_audit\_device('file', options=options, path='somefile')

client.sys.disable\_audit\_device('oldfile')

```

##### [List Enabled Audit Devices](#id6)[¶](#list-enabled-audit-devices "Permalink to this headline")

`Audit.``list_enabled_audit_devices`()[[source]](_modules/hvac/api/system_backend/audit.html#Audit.list_enabled_audit_devices)

List enabled audit devices.

It does not list all available audit devices.

This endpoint requires sudo capability in addition to any path-specific capabilities.

Supported methods:GET: /sys/audit. Produces: 200 application/json

Returns

JSON response of the request.

Return type

dict

###### Examples[¶](#id1 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

enabled\_audit\_devices = client.sys.list\_enabled\_audit\_devices()

print('The following audit devices are enabled: {audit\_devices\_list}'.format(

    audit\_devices\_list=', '.join(enabled\_audit\_devices['data'].keys()),

))

```

Example output:

```

The following audit devices are enabled: somefile/

```

##### [Enable Audit Device](#id7)[¶](#enable-audit-device "Permalink to this headline")

`Audit.``enable_audit_device`(*device\_type*, *description=None*, *options=None*, *path=None*, *local=None*)[[source]](_modules/hvac/api/system_backend/audit.html#Audit.enable_audit_device)

Enable a new audit device at the supplied path.

The path can be a single word name or a more complex, nested path.

Supported methods:PUT: /sys/audit/{path}. Produces: 204 (empty body)

Parameters

* **device\_type** (*str | unicode*) – Specifies the type of the audit device.

* **description** (*str | unicode*) – Human-friendly description of the audit device.

* **options** (*str | unicode*) – Configuration options to pass to the audit device itself. This is

dependent on the audit device type.

* **path** (*str | unicode*) – Specifies the path in which to enable the audit device. This is part of

the request URL.

* **local** (*bool*) – Specifies if the audit device is a local only.

Returns

The response of the request.

Return type

requests.Response

###### Examples[¶](#id2 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

options = {

    'path': '/tmp/vault.audit.log'

}

client.sys.enable\_audit\_device(

    device\_type='file',

    options=options,

    path='tmp-file-audit',

)

```

##### [Disable Audit Device](#id8)[¶](#disable-audit-device "Permalink to this headline")

`Audit.``disable_audit_device`(*path*)[[source]](_modules/hvac/api/system_backend/audit.html#Audit.disable_audit_device)

Disable the audit device at the given path.

Supported methods:DELETE: /sys/audit/{path}. Produces: 204 (empty body)

Parameters

**path** (*str | unicode*) – The path of the audit device to delete. This is part of the request URL.

Returns

The response of the request.

Return type

requests.Response

###### Examples[¶](#id3 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

client.sys.disable\_audit\_device(

    path='tmp-file-audit',

)

```

##### [Calculate Hash](#id9)[¶](#calculate-hash "Permalink to this headline")

`Audit.``calculate_hash`(*path*, *input\_to\_hash*)[[source]](_modules/hvac/api/system_backend/audit.html#Audit.calculate_hash)

Hash the given input data with the specified audit device’s hash function and salt.

This endpoint can be used to discover whether a given plaintext string (the input parameter) appears in the

audit log in obfuscated form.

Supported methods:POST: /sys/audit-hash/{path}. Produces: 204 (empty body)

Parameters

* **path** (*str | unicode*) – The path of the audit device to generate hashes for. This is part of the request URL.

* **input\_to\_hash** (*str | unicode*) – The input string to hash.

Returns

The JSON response of the request.

Return type

requests.Response

###### Examples[¶](#id4 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

input\_to\_hash = 'some sort of string thinger'

audit\_hash = client.sys.calculate\_hash(

    path='tmp-file-audit',

    input\_to\_hash=input\_to\_hash,

)

print('The hash for the provided input is: %s' % audit\_hash['data']['hash'])

```

Example output:

```

The hash for the provided input is: hmac-sha256:...

```

#### Auth[¶](#auth "Permalink to this headline")

* [Examples](#examples)

* [List Auth Methods](#list-auth-methods)

* [Enable Auth Method](#enable-auth-method)

* [Disable Auth Method](#disable-auth-method)

* [Read Auth Method Tuning](#read-auth-method-tuning)

* [Tune Auth Method](#tune-auth-method)

##### [Examples](#id6)[¶](#examples "Permalink to this headline")

```

methods = client.sys.list\_auth\_methods()

client.sys.enable\_auth\_method('userpass', path='customuserpass')

client.sys.disable\_auth\_method('github')

```

##### [List Auth Methods](#id7)[¶](#list-auth-methods "Permalink to this headline")

`Auth.``list_auth_methods`()[[source]](_modules/hvac/api/system_backend/auth.html#Auth.list_auth_methods)

List all enabled auth methods.

Supported methods:GET: /sys/auth. Produces: 200 application/json

Returns

The JSON response of the request.

Return type

dict

###### Examples[¶](#id1 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

auth\_methods = client.sys.list\_auth\_methods()

print('The following auth methods are enabled: {auth\_methods\_list}'.format(

    auth\_methods\_list=', '.join(auth\_methods['data'].keys()),

))

```

Example output:

```

The following auth methods are enabled: token/

```

##### [Enable Auth Method](#id8)[¶](#enable-auth-method "Permalink to this headline")

`Auth.``enable_auth_method`(*method\_type*, *description=None*, *config=None*, *plugin\_name=None*, *local=False*, *path=None*, *\*\*kwargs*)[[source]](_modules/hvac/api/system_backend/auth.html#Auth.enable_auth_method)

Enable a new auth method.

After enabling, the auth method can be accessed and configured via the auth path specified as part of the URL.

This auth path will be nested under the auth prefix.

Supported methods:POST: /sys/auth/{path}. Produces: 204 (empty body)

Parameters

* **method\_type** (*str | unicode*) – The name of the authentication method type, such as “github” or “token”.

* **description** (*str | unicode*) – A human-friendly description of the auth method.

* **config** (*dict*) – Configuration options for this auth method. These are the possible values:

	+ **default\_lease\_ttl**: The default lease duration, specified as a string duration like “5s” or “30m”.

	+ **max\_lease\_ttl**: The maximum lease duration, specified as a string duration like “5s” or “30m”.

	+ **audit\_non\_hmac\_request\_keys**: Comma-separated list of keys that will not be HMAC’d by audit devices in

	the request data object.

	+ **audit\_non\_hmac\_response\_keys**: Comma-separated list of keys that will not be HMAC’d by audit devices in

	the response data object.

	+ **listing\_visibility**: Speficies whether to show this mount in the UI-specific listing endpoint.

	+ **passthrough\_request\_headers**: Comma-separated list of headers to whitelist and pass from the request to

	the backend.

* **plugin\_name** (*str | unicode*) – The name of the auth plugin to use based from the name in the plugin catalog. Applies only

to plugin methods.

* **local** (*bool*) – <Vault enterprise only> Specifies if the auth method is a local only. Local auth methods are not

replicated nor (if a secondary) removed by replication.

* **path** (*str | unicode*) – The path to mount the method on. If not provided, defaults to the value of the “method\_type”

argument.

* **kwargs** (*dict*) – All dicts are accepted and passed to vault. See your specific secret engine for details on which

extra key-word arguments you might want to pass.

Returns

The response of the request.

Return type

requests.Response

###### Examples[¶](#id2 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

client.sys.enable\_auth\_method(

    method\_type='github',

    path='github-hvac',

)

```

##### [Disable Auth Method](#id9)[¶](#disable-auth-method "Permalink to this headline")

`Auth.``disable_auth_method`(*path*)[[source]](_modules/hvac/api/system_backend/auth.html#Auth.disable_auth_method)

Disable the auth method at the given auth path.

Supported methods:DELETE: /sys/auth/{path}. Produces: 204 (empty body)

Parameters

**path** (*str | unicode*) – The path the method was mounted on. If not provided, defaults to the value of the “method\_type”

argument.

Returns

The response of the request.

Return type

requests.Response

###### Examples[¶](#id3 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

client.sys.disable\_auth\_method(

    path='github-hvac',

)

```

##### [Read Auth Method Tuning](#id10)[¶](#read-auth-method-tuning "Permalink to this headline")

`Auth.``read_auth_method_tuning`(*path*)[[source]](_modules/hvac/api/system_backend/auth.html#Auth.read_auth_method_tuning)

Read the given auth path’s configuration.

This endpoint requires sudo capability on the final path, but the same functionality can be achieved without

sudo via sys/mounts/auth/[auth-path]/tune.

Supported methods:GET: /sys/auth/{path}/tune. Produces: 200 application/json

Parameters

**path** (*str | unicode*) – The path the method was mounted on. If not provided, defaults to the value of the “method\_type”

argument.

Returns

The JSON response of the request.

Return type

dict

###### Examples[¶](#id4 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

response = client.sys.read\_auth\_method\_tuning(

    path='github-hvac',

)

print('The max lease TTL for the auth method under path "github-hvac" is: {max\_ttl}'.format(

    max\_ttl=response['data']['max\_lease\_ttl'],

))

```

Example output:

```

The max lease TTL for the auth method under path "github-hvac" is: 2764800

```

##### [Tune Auth Method](#id11)[¶](#tune-auth-method "Permalink to this headline")

`Auth.``tune_auth_method`(*path*, *default\_lease\_ttl=None*, *max\_lease\_ttl=None*, *description=None*, *audit\_non\_hmac\_request\_keys=None*, *audit\_non\_hmac\_response\_keys=None*, *listing\_visibility=None*, *passthrough\_request\_headers=None*, *\*\*kwargs*)[[source]](_modules/hvac/api/system_backend/auth.html#Auth.tune_auth_method)

Tune configuration parameters for a given auth path.

This endpoint requires sudo capability on the final path, but the same functionality can be achieved without

sudo via sys/mounts/auth/[auth-path]/tune.

Supported methods:POST: /sys/auth/{path}/tune. Produces: 204 (empty body)

Parameters

* **path** (*str | unicode*) – The path the method was mounted on. If not provided, defaults to the value of the “method\_type”

argument.

* **default\_lease\_ttl** (*int*) – Specifies the default time-to-live. If set on a specific auth path, this overrides the

global default.

* **max\_lease\_ttl** (*int*) – The maximum time-to-live. If set on a specific auth path, this overrides the global

default.

* **description** (*str | unicode*) – Specifies the description of the mount. This overrides the current stored value, if any.

* **audit\_non\_hmac\_request\_keys** (*array*) – Specifies the list of keys that will not be HMAC’d by audit devices in the

request data object.

* **audit\_non\_hmac\_response\_keys** (*list*) – Specifies the list of keys that will not be HMAC’d by audit devices in the

response data object.

* **listing\_visibility** (*list*) – Specifies whether to show this mount in the UI-specific listing endpoint. Valid

values are “unauth” or “”.

* **passthrough\_request\_headers** (*list*) – List of headers to whitelist and pass from the request to the backend.

* **kwargs** (*dict*) – All dicts are accepted and passed to vault. See your specific secret engine for details on which

extra key-word arguments you might want to pass.

Returns

The response of the request.

Return type

requests.Response

###### Examples[¶](#id5 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

client.sys.tune\_auth\_method(

    path='github-hvac',

    description='The Github auth method for hvac users',

)

```

#### Health[¶](#health "Permalink to this headline")

* [Read Status](#read-status)

##### [Read Status](#id1)[¶](#read-status "Permalink to this headline")

`Health.``read_health_status`(*standby\_ok=None*, *active\_code=None*, *standby\_code=None*, *dr\_secondary\_code=None*, *performance\_standby\_code=None*, *sealed\_code=None*, *uninit\_code=None*, *method='HEAD'*)[[source]](_modules/hvac/api/system_backend/health.html#Health.read_health_status)

Read the health status of Vault.

This matches the semantics of a Consul HTTP health check and provides a simple way to monitor the health of a

Vault instance.

Parameters

* **standby\_ok** (*bool*) – Specifies if being a standby should still return the active status code instead of the

standby status code. This is useful when Vault is behind a non-configurable load balance that just wants a

200-level response.

* **active\_code** (*int*) – The status code that should be returned for an active node.

* **standby\_code** (*int*) – Specifies the status code that should be returned for a standby node.

* **dr\_secondary\_code** (*int*) – Specifies the status code that should be returned for a DR secondary node.

* **performance\_standby\_code** (*int*) – Specifies the status code that should be returned for a performance standby

node.

* **sealed\_code** (*int*) – Specifies the status code that should be returned for a sealed node.

* **uninit\_code** (*int*) – Specifies the status code that should be returned for a uninitialized node.

* **method** (*str | unicode*) – Supported methods:

HEAD: /sys/health. Produces: 000 (empty body)

GET: /sys/health. Produces: 000 application/json

Returns

The JSON response of the request.

Return type

requests.Response

###### Examples[¶](#examples "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

status = client.sys.read\_health\_status(method='GET')

print('Vault initialization status is: %s' % status['initialized'])

```

Example output:

```

Vault initialization status is: True

```

#### Init[¶](#init "Permalink to this headline")

* [Read Status](#read-status)

* [Is Initialized](#is-initialized)

* [Initialize](#initialize)

##### [Read Status](#id3)[¶](#read-status "Permalink to this headline")

`Init.``read_init_status`()[[source]](_modules/hvac/api/system_backend/init.html#Init.read_init_status)

Read the initialization status of Vault.

Supported methods:GET: /sys/init. Produces: 200 application/json

Returns

The JSON response of the request.

Return type

dict

###### Examples[¶](#examples "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

read\_response = client.sys.read\_init\_status()

print('Vault initialize status: %s' % read\_response['initialized'])

```

Example output:

```

Vault initialize status: True

```

##### [Is Initialized](#id4)[¶](#is-initialized "Permalink to this headline")

`Init.``is_initialized`()[[source]](_modules/hvac/api/system_backend/init.html#Init.is_initialized)

Determine is Vault is initialized or not.

Returns

True if Vault is initialized, False otherwise.

Return type

bool

###### Examples[¶](#id1 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

print('Vault initialize status: %s' % client.sys.is\_initialized())

```

Example output:

```

Vault initialize status: True

```

##### [Initialize](#id5)[¶](#initialize "Permalink to this headline")

`Init.``initialize`(*secret\_shares=5*, *secret\_threshold=3*, *pgp\_keys=None*, *root\_token\_pgp\_key=None*, *stored\_shares=None*, *recovery\_shares=None*, *recovery\_threshold=None*, *recovery\_pgp\_keys=None*)[[source]](_modules/hvac/api/system_backend/init.html#Init.initialize)

Initialize a new Vault.

The Vault must not have been previously initialized. The recovery options, as well as the stored shares option,

are only available when using Vault HSM.

Supported methods:PUT: /sys/init. Produces: 200 application/json

Parameters

* **secret\_shares** (*int*) – The number of shares to split the master key into.

* **secret\_threshold** (*int*) – Specifies the number of shares required to reconstruct the master key. This must be

less than or equal secret\_shares. If using Vault HSM with auto-unsealing, this value must be the same as

secret\_shares.

* **pgp\_keys** (*list*) – List of PGP public keys used to encrypt the output unseal keys.

Ordering is preserved. The keys must be base64-encoded from their original binary representation.

The size of this array must be the same as secret\_shares.

* **root\_token\_pgp\_key** (*str | unicode*) – Specifies a PGP public key used to encrypt the initial root token. The

key must be base64-encoded from its original binary representation.

* **stored\_shares** (*int*) – <enterprise only> Specifies the number of shares that should be encrypted by the HSM and

stored for auto-unsealing. Currently must be the same as secret\_shares.

* **recovery\_shares** (*int*) – <enterprise only> Specifies the number of shares to split the recovery key into.

* **recovery\_threshold** (*int*) – <enterprise only> Specifies the number of shares required to reconstruct the recovery

key. This must be less than or equal to recovery\_shares.

* **recovery\_pgp\_keys** (*list*) – <enterprise only> Specifies an array of PGP public keys used to encrypt the output

recovery keys. Ordering is preserved. The keys must be base64-encoded from their original binary

representation. The size of this array must be the same as recovery\_shares.

Returns

The JSON response of the request.

Return type

dict

###### Examples[¶](#id2 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

init\_result = client.sys.initialize()

root\_token = init\_result['root\_token']

unseal\_keys = init\_result['keys']

```

When called for a previously initialized Vault cluster, an exception is raised:

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

init\_result = client.sys.initialize()

```

Example output:

```

Traceback (most recent call last):

  ...

hvac.exceptions.InvalidRequest: Vault is already initialized

```

#### Key[¶](#key "Permalink to this headline")

* [Read Root Generation Progress](#read-root-generation-progress)

* [Start Root Token Generation](#start-root-token-generation)

* [Cancel Root Generation](#cancel-root-generation)

* [Generate Root](#generate-root)

* [Get Encryption Key Status](#get-encryption-key-status)

* [Rotate Encryption Key](#rotate-encryption-key)

* [Read Rekey Progress](#read-rekey-progress)

* [Start Rekey](#start-rekey)

* [Cancel Rekey](#cancel-rekey)

* [Rekey](#rekey)

* [Rekey Multi](#rekey-multi)

* [Read Rekey Verify Progress](#read-rekey-verify-progress)

* [Cancel Rekey Verify](#cancel-rekey-verify)

* [Rekey Verify](#rekey-verify)

* [Rekey Verify Multi](#rekey-verify-multi)

* [Read Backup Keys](#read-backup-keys)

##### [Read Root Generation Progress](#id16)[¶](#read-root-generation-progress "Permalink to this headline")

`Key.``read_root_generation_progress`()[[source]](_modules/hvac/api/system_backend/key.html#Key.read_root_generation_progress)

Read the configuration and process of the current root generation attempt.

Supported methods:GET: /sys/generate-root/attempt. Produces: 200 application/json

Returns

The JSON response of the request.

Return type

dict

###### Examples[¶](#examples "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

root\_gen\_progress = client.sys.read\_root\_generation\_progress()

print('Root generation "started" status: %s' % root\_gen\_progress['started'])

```

Example output:

```

Root generation "started" status: ...

```

##### [Start Root Token Generation](#id17)[¶](#start-root-token-generation "Permalink to this headline")

`Key.``start_root_token_generation`(*otp=None*, *pgp\_key=None*)[[source]](_modules/hvac/api/system_backend/key.html#Key.start_root_token_generation)

Initialize a new root generation attempt.

Only a single root generation attempt can take place at a time. One (and only one) of otp or pgp\_key are

required.

Supported methods:PUT: /sys/generate-root/attempt. Produces: 200 application/json

Parameters

* **otp** (*str | unicode*) – Specifies a base64-encoded 16-byte value. The raw bytes of the token will be XOR’d with this value

before being returned to the final unseal key provider.

* **pgp\_key** (*str | unicode*) – Specifies a base64-encoded PGP public key. The raw bytes of the token will be encrypted with

this value before being returned to the final unseal key provider.

Returns

The JSON response of the request.

Return type

dict

###### Examples[¶](#id1 "Permalink to this headline")

```

import hvac

from tests.utils import get\_generate\_root\_otp

client = hvac.Client(url='https://127.0.0.1:8200')

new\_otp = get\_generate\_root\_otp()

start\_generate\_root\_response = client.sys.start\_root\_token\_generation(

    otp=new\_otp,

)

nonce = start\_generate\_root\_response['nonce']

print('Nonce for root generation is: %s' % nonce)

```

Example output:

```

Nonce for root generation is: ...

```

##### [Cancel Root Generation](#id18)[¶](#cancel-root-generation "Permalink to this headline")

`Key.``cancel_root_generation`()[[source]](_modules/hvac/api/system_backend/key.html#Key.cancel_root_generation)

Cancel any in-progress root generation attempt.

This clears any progress made. This must be called to change the OTP or PGP key being used.

Supported methods:DELETE: /sys/generate-root/attempt. Produces: 204 (empty body)

Returns

The response of the request.

Return type

request.Response

###### Examples[¶](#id2 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

client.sys.cancel\_root\_generation()

```

##### [Generate Root](#id19)[¶](#generate-root "Permalink to this headline")

`Key.``generate_root`(*key*, *nonce*)[[source]](_modules/hvac/api/system_backend/key.html#Key.generate_root)

Enter a single master key share to progress the root generation attempt.

If the threshold number of master key shares is reached, Vault will complete the root generation and issue the

new token. Otherwise, this API must be called multiple times until that threshold is met. The attempt nonce must

be provided with each call.

Supported methods:PUT: /sys/generate-root/update. Produces: 200 application/json

Parameters

* **key** (*str | unicode*) – Specifies a single master key share.

* **nonce** (*str | unicode*) – The nonce of the attempt.

Returns

The JSON response of the request.

Return type

dict

###### Examples[¶](#id3 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

client.sys.generate\_root(

    key=key,

    nonce=nonce,

)

```

##### [Get Encryption Key Status](#id20)[¶](#get-encryption-key-status "Permalink to this headline")

`Client.``key_status`

GET /sys/key-status

Returns

Information about the current encryption key used by Vault.

Return type

dict

###### Examples[¶](#id4 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

print('Encryption key term is: %s' % client.key\_status['term'])

```

Example output:

```

Encryption key term is: 1

```

##### [Rotate Encryption Key](#id21)[¶](#rotate-encryption-key "Permalink to this headline")

`Key.``rotate_encryption_key`()[[source]](_modules/hvac/api/system_backend/key.html#Key.rotate_encryption_key)

Trigger a rotation of the backend encryption key.

This is the key that is used to encrypt data written to the storage backend, and is not provided to operators.

This operation is done online. Future values are encrypted with the new key, while old values are decrypted with

previous encryption keys.

This path requires sudo capability in addition to update.

Supported methods:PUT: /sys/rorate. Produces: 204 (empty body)

Returns

The response of the request.

Return type

requests.Response

###### Examples[¶](#id5 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

client.sys.rotate\_encryption\_key()

```

##### [Read Rekey Progress](#id22)[¶](#read-rekey-progress "Permalink to this headline")

`Key.``read_rekey_progress`(*recovery\_key=False*)[[source]](_modules/hvac/api/system_backend/key.html#Key.read_rekey_progress)

Read the configuration and progress of the current rekey attempt.

Supported methods:GET: /sys/rekey-recovery-key/init. Produces: 200 application/json

GET: /sys/rekey/init. Produces: 200 application/json

Parameters

**recovery\_key** (*bool*) – If true, send requests to “rekey-recovery-key” instead of “rekey” api path.

Returns

The JSON response of the request.

Return type

requests.Response

###### Examples[¶](#id6 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

print('Rekey "started" status is: %s' % client.sys.read\_rekey\_progress()['started'])

```

Example output:

```

Rekey "started" status is: False

```

##### [Start Rekey](#id23)[¶](#start-rekey "Permalink to this headline")

`Key.``start_rekey`(*secret\_shares=5*, *secret\_threshold=3*, *pgp\_keys=None*, *backup=False*, *require\_verification=False*, *recovery\_key=False*)[[source]](_modules/hvac/api/system_backend/key.html#Key.start_rekey)

Initializes a new rekey attempt.

Only a single recovery key rekeyattempt can take place at a time, and changing the parameters of a rekey

requires canceling and starting a new rekey, which will also provide a new nonce.

Supported methods:PUT: /sys/rekey/init. Produces: 204 (empty body)

PUT: /sys/rekey-recovery-key/init. Produces: 204 (empty body)

Parameters

* **secret\_shares** (*int*) – Specifies the number of shares to split the master key into.

* **secret\_threshold** (*int*) – Specifies the number of shares required to reconstruct the master key. This must be

less than or equal to secret\_shares.

* **pgp\_keys** (*list*) – Specifies an array of PGP public keys used to encrypt the output unseal keys. Ordering is

preserved. The keys must be base64-encoded from their original binary representation. The size of this array

must be the same as secret\_shares.

* **backup** (*bool*) – Specifies if using PGP-encrypted keys, whether Vault should also store a plaintext backup of the

PGP-encrypted keys at core/unseal-keys-backup in the physical storage backend. These can then be retrieved

and removed via the sys/rekey/backup endpoint.

* **require\_verification** (*bool*) – This turns on verification functionality. When verification is turned on, after

successful authorization with the current unseal keys, the new unseal keys are returned but the master key

is not actually rotated. The new keys must be provided to authorize the actual rotation of the master key.

This ensures that the new keys have been successfully saved and protects against a risk of the keys being

lost after rotation but before they can be persisted. This can be used with without pgp\_keys, and when used

with it, it allows ensuring that the returned keys can be successfully decrypted before committing to the

new shares, which the backup functionality does not provide.

* **recovery\_key** (*bool*) – If true, send requests to “rekey-recovery-key” instead of “rekey” api path.

Returns

The JSON dict of the response.

Return type

dict | request.Response

###### Examples[¶](#id7 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

rekey\_response = client.sys.start\_rekey()

nonce = rekey\_response['nonce']

print('Nonce for rekey is: %s' % nonce)

```

Example output:

```

Nonce for rekey is: ...

```

##### [Cancel Rekey](#id24)[¶](#cancel-rekey "Permalink to this headline")

`Key.``cancel_rekey`(*recovery\_key=False*)[[source]](_modules/hvac/api/system_backend/key.html#Key.cancel_rekey)

Cancel any in-progress rekey.

This clears the rekey settings as well as any progress made. This must be called to change the parameters of the

rekey.

Note: Verification is still a part of a rekey. If rekeying is canceled during the verification flow, the current

unseal keys remain valid.

Supported methods:DELETE: /sys/rekey/init. Produces: 204 (empty body)

DELETE: /sys/rekey-recovery-key/init. Produces: 204 (empty body)

Parameters

**recovery\_key** (*bool*) – If true, send requests to “rekey-recovery-key” instead of “rekey” api path.

Returns

The response of the request.

Return type

requests.Response

###### Examples[¶](#id8 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

client.sys.cancel\_rekey()

```

##### [Rekey](#id25)[¶](#rekey "Permalink to this headline")

`Key.``rekey`(*key*, *nonce=None*, *recovery\_key=False*)[[source]](_modules/hvac/api/system_backend/key.html#Key.rekey)

Enter a single recovery key share to progress the rekey of the Vault.

If the threshold number of recovery key shares is reached, Vault will complete the rekey. Otherwise, this API

must be called multiple times until that threshold is met. The rekey nonce operation must be provided with each

call.

Supported methods:PUT: /sys/rekey/update. Produces: 200 application/json

PUT: /sys/rekey-recovery-key/update. Produces: 200 application/json

Parameters

* **key** (*str | unicode*) – Specifies a single recovery share key.

* **nonce** (*str | unicode*) – Specifies the nonce of the rekey operation.

* **recovery\_key** (*bool*) – If true, send requests to “rekey-recovery-key” instead of “rekey” api path.

Returns

The JSON response of the request.

Return type

dict

###### Examples[¶](#id9 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

client.sys.rekey(

    key=key,

    nonce=nonce,

)

```

##### [Rekey Multi](#id26)[¶](#rekey-multi "Permalink to this headline")

`Key.``rekey_multi`(*keys*, *nonce=None*, *recovery\_key=False*)[[source]](_modules/hvac/api/system_backend/key.html#Key.rekey_multi)

Enter multiple recovery key shares to progress the rekey of the Vault.

If the threshold number of recovery key shares is reached, Vault will complete the rekey.

Parameters

* **keys** (*list*) – Specifies multiple recovery share keys.

* **nonce** (*str | unicode*) – Specifies the nonce of the rekey operation.

* **recovery\_key** (*bool*) – If true, send requests to “rekey-recovery-key” instead of “rekey” api path.

Returns

The last response of the rekey request.

Return type

response.Request

###### Examples[¶](#id10 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

client.sys.rekey\_multi(

    keys,

    nonce=nonce,

)

```

##### [Read Rekey Verify Progress](#id27)[¶](#read-rekey-verify-progress "Permalink to this headline")

`Key.``read_rekey_verify_progress`()[[source]](_modules/hvac/api/system_backend/key.html#Key.read_rekey_verify_progress)

Read the configuration and progress of the current rekey verify attempt.

Supported methods:GET: /sys/rekey/verify. Produces: 200 application/json

Returns

The JSON response of the request.

Return type

requests.Response

###### Examples[¶](#id11 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

response = client.sys.read\_rekey\_verify\_progress()

print(

    'Rekey verify progress is %d out of %d' % (

        response['progress'],

        response['t'],

    )

)

```

Example output:

```

Rekey verify progress is 0 out of 3

```

##### [Cancel Rekey Verify](#id28)[¶](#cancel-rekey-verify "Permalink to this headline")

`Key.``cancel_rekey_verify`()[[source]](_modules/hvac/api/system_backend/key.html#Key.cancel_rekey_verify)

Cancel any in-progress rekey verification.

This clears any progress made and resets the nonce. Unlike cancel\_rekey, this only resets

the current verification operation, not the entire rekey atttempt.

The return value is the same as GET along with the new nonce.

Supported methods:DELETE: /sys/rekey/verify. Produces: 204 (empty body)

Returns

The response of the request.

Return type

requests.Response

###### Examples[¶](#id12 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

client.sys.cancel\_rekey\_verify()

```

##### [Rekey Verify](#id29)[¶](#rekey-verify "Permalink to this headline")

`Key.``rekey_verify`(*key*, *nonce*)[[source]](_modules/hvac/api/system_backend/key.html#Key.rekey_verify)

Enter a single new recovery key share to progress the rekey verification of the Vault.

If the threshold number of new recovery key shares is reached, Vault will complete the

rekey. Otherwise, this API must be called multiple times until that threshold is met.

The rekey verification nonce must be provided with each call.

Supported methods:PUT: /sys/rekey/verify. Produces: 200 application/json

Parameters

* **key** (*str | unicode*) – Specifies multiple recovery share keys.

* **nonce** (*str | unicode*) – Specifies the nonce of the rekey verify operation.

Returns

The JSON response of the request.

Return type

dict

###### Examples[¶](#id13 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

client.sys.rekey\_verify(

    key,

    nonce=verify\_nonce,

)

```

##### [Rekey Verify Multi](#id30)[¶](#rekey-verify-multi "Permalink to this headline")

`Key.``rekey_verify_multi`(*keys*, *nonce*)[[source]](_modules/hvac/api/system_backend/key.html#Key.rekey_verify_multi)

Enter multiple new recovery key shares to progress the rekey verification of the Vault.

If the threshold number of new recovery key shares is reached, Vault will complete the

rekey. Otherwise, this API must be called multiple times until that threshold is met.

The rekey verification nonce must be provided with each call.

Supported methods:PUT: /sys/rekey/verify. Produces: 200 application/json

Parameters

* **keys** (*list*) – Specifies multiple recovery share keys.

* **nonce** (*str | unicode*) – Specifies the nonce of the rekey verify operation.

Returns

The JSON response of the request.

Return type

dict

###### Examples[¶](#id14 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

client.sys.rekey\_verify\_multi(

    keys,

    nonce=verify\_nonce,

)

```

##### [Read Backup Keys](#id31)[¶](#read-backup-keys "Permalink to this headline")

`Key.``read_backup_keys`(*recovery\_key=False*)[[source]](_modules/hvac/api/system_backend/key.html#Key.read_backup_keys)

Retrieve the backup copy of PGP-encrypted unseal keys.

The returned value is the nonce of the rekey operation and a map of PGP key fingerprint to hex-encoded

PGP-encrypted key.

Supported methods:PUT: /sys/rekey/backup. Produces: 200 application/json

PUT: /sys/rekey-recovery-key/backup. Produces: 200 application/json

Parameters

**recovery\_key** (*bool*) – If true, send requests to “rekey-recovery-key” instead of “rekey” api path.

Returns

The JSON response of the request.

Return type

dict

###### Examples[¶](#id15 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

rekey\_response = client.sys.start\_rekey(

    secret\_shares=1,

    secret\_threshold=1,

    pgp\_keys=pgp\_keys,

    backup=True,

)

nonce = rekey\_response['nonce']

client.sys.rekey\_multi(

    keys,

    nonce=nonce,

)

print('Backup keys are: %s' % client.sys.read\_backup\_keys()['data']['keys'])

```

Example output:

```

Backup keys are: {'...': [...]}

```

#### Leader[¶](#leader "Permalink to this headline")

* [Read Leader Status](#read-leader-status)

* [Step Down](#step-down)

##### [Read Leader Status](#id2)[¶](#read-leader-status "Permalink to this headline")

`Leader.``read_leader_status`()[[source]](_modules/hvac/api/system_backend/leader.html#Leader.read_leader_status)

Read the high availability status and current leader instance of Vault.

Supported methods:GET: /sys/leader. Produces: 200 application/json

Returns

The JSON response of the request.

Return type

dict

###### Examples[¶](#examples "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

status = client.sys.read\_leader\_status()

print('HA status is: %s' % status['ha\_enabled'])

```

Example output:

```

HA status is: False

```

##### [Step Down](#id3)[¶](#step-down "Permalink to this headline")

`Leader.``step_down`()[[source]](_modules/hvac/api/system_backend/leader.html#Leader.step_down)

Force the node to give up active status.

If the node does not have active status, this endpoint does nothing.

Note that the node will sleep for ten seconds before attempting to grab

the active lock again, but if no standby nodes grab the active lock in

the interim, the same node may become the active node again. Requires a

token with root policy or sudo capability on the path.

Returns

The JSON response of the request.

Return type

dict

###### Examples[¶](#id1 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

client.sys.step\_down()

```

#### Lease[¶](#lease "Permalink to this headline")

* [View and Manage Leases](#view-and-manage-leases)

* [Read Lease](#read-lease)

* [List Leases](#list-leases)

* [Renew Lease](#renew-lease)

* [Revoke Lease](#revoke-lease)

* [Revoke Prefix](#revoke-prefix)

* [Revoke Force](#revoke-force)

##### [View and Manage Leases](#id6)[¶](#view-and-manage-leases "Permalink to this headline")

Read a lease:

```

>>> read\_lease\_response = client.sys.read\_lease(lease\_id=lease\_id)

>>> print('Expire time for lease ID {id} is: {expire\_time}'.format(

...     id=lease\_id,

...     expire\_time=read\_lease\_response['data']['expire\_time'],

... ))

Expire time for lease ID pki/issue/my-role/... is: 20...

```

Renewing a lease:

```

>>> renew\_lease\_resp = client.sys.renew\_lease(lease\_id=lease\_id)

>>> print('Lease ID: "{id}" renewed, lease duration: "{duration}"'.format(

...     id=renew\_lease\_resp['lease\_id'],

...     duration=renew\_lease\_resp['lease\_duration'],

... ))

Lease ID: "pki/issue/my-role/d05138a2-edeb-889d-db98-2057ecd5138f" renewed, lease duration: "2764790"

```

Revoking a lease:

```

>>> client.sys.revoke\_lease(lease\_id=lease\_id)

<Response [204]>

```

##### [Read Lease](#id7)[¶](#read-lease "Permalink to this headline")

`Lease.``read_lease`(*lease\_id*)[[source]](_modules/hvac/api/system_backend/lease.html#Lease.read_lease)

Retrieve lease metadata.

Supported methods:PUT: /sys/leases/lookup. Produces: 200 application/json

Parameters

**lease\_id** (*str | unicode*) – the ID of the lease to lookup.

Returns

Parsed JSON response from the leases PUT request

Return type

dict.

###### Examples[¶](#examples "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

read\_lease\_resp = client.sys.read\_lease(

    lease\_id=lease\_id,

)

# expire\_time in the form of something like: 2019-02-25T07:41:30.000038-06:00

print('Current expire time for lease ID {id} is: {expires}'.format(

    id=lease\_id,

    expires=read\_lease\_resp['data']['expire\_time'],

))

```

Example output:

```

Current expire time for lease ID pki/issue/my-role/... is: ...

```

##### [List Leases](#id8)[¶](#list-leases "Permalink to this headline")

`Lease.``list_leases`(*prefix*)[[source]](_modules/hvac/api/system_backend/lease.html#Lease.list_leases)

Retrieve a list of lease ids.

Supported methods:LIST: /sys/leases/lookup/{prefix}. Produces: 200 application/json

Parameters

**prefix** (*str | unicode*) – Lease prefix to filter list by.

Returns

The JSON response of the request.

Return type

dict

###### Examples[¶](#id1 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

list\_leases\_response = client.sys.list\_leases(

    prefix='pki',

)

print('The follow lease keys are active under the "pki" prefix: %s' % list\_leases\_response['data']['keys'])

```

Example output:

```

The follow lease keys are active under the "pki" prefix: ['issue/']

```

##### [Renew Lease](#id9)[¶](#renew-lease "Permalink to this headline")

`Lease.``renew_lease`(*lease\_id*, *increment=None*)[[source]](_modules/hvac/api/system_backend/lease.html#Lease.renew_lease)

Renew a lease, requesting to extend the lease.

Supported methods:PUT: /sys/leases/renew. Produces: 200 application/json

Parameters

* **lease\_id** (*str | unicode*) – The ID of the lease to extend.

* **increment** (*int*) – The requested amount of time (in seconds) to extend the lease.

Returns

The JSON response of the request

Return type

dict

###### Examples[¶](#id2 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

client.sys.renew\_lease(

    lease\_id=lease\_id,

    increment=500,

)

```

##### [Revoke Lease](#id10)[¶](#revoke-lease "Permalink to this headline")

`Lease.``revoke_lease`(*lease\_id*)[[source]](_modules/hvac/api/system_backend/lease.html#Lease.revoke_lease)

Revoke a lease immediately.

Supported methods:PUT: /sys/leases/revoke. Produces: 204 (empty body)

Parameters

**lease\_id** (*str | unicode*) – Specifies the ID of the lease to revoke.

Returns

The response of the request.

Return type

requests.Response

###### Examples[¶](#id3 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

client.sys.revoke\_lease(

    lease\_id=lease\_id,

)

```

##### [Revoke Prefix](#id11)[¶](#revoke-prefix "Permalink to this headline")

`Lease.``revoke_prefix`(*prefix*)[[source]](_modules/hvac/api/system_backend/lease.html#Lease.revoke_prefix)

Revoke all secrets (via a lease ID prefix) or tokens (via the tokens’ path property) generated under a given

prefix immediately.

This requires sudo capability and access to it should be tightly controlled as it can be used to revoke very

large numbers of secrets/tokens at once.

Supported methods:PUT: /sys/leases/revoke-prefix/{prefix}. Produces: 204 (empty body)

Parameters

**prefix** (*str | unicode*) – The prefix to revoke.

Returns

The response of the request.

Return type

requests.Response

###### Examples[¶](#id4 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

client.sys.revoke\_prefix(

    prefix='pki',

)

```

##### [Revoke Force](#id12)[¶](#revoke-force "Permalink to this headline")

`Lease.``revoke_force`(*prefix*)[[source]](_modules/hvac/api/system_backend/lease.html#Lease.revoke_force)

Revoke all secrets or tokens generated under a given prefix immediately.

Unlike revoke\_prefix, this path ignores backend errors encountered during revocation. This is potentially very

dangerous and should only be used in specific emergency situations where errors in the backend or the connected

backend service prevent normal revocation.

Supported methods:PUT: /sys/leases/revoke-force/{prefix}. Produces: 204 (empty body)

Parameters

**prefix** (*str | unicode*) – The prefix to revoke.

Returns

The response of the request.

Return type

requests.Response

###### Examples[¶](#id5 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

client.sys.revoke\_force(

    prefix='pki',

)

```

#### Mount[¶](#mount "Permalink to this headline")

* [Manipulate secret backends](#manipulate-secret-backends)

* [List Mounted Secrets Engines](#list-mounted-secrets-engines)

* [Enable Secrets Engine](#enable-secrets-engine)

* [Disable Secrets Engine](#disable-secrets-engine)

* [Read Mount Configuration](#read-mount-configuration)

* [Tune Mount Configuration](#tune-mount-configuration)

* [Move Backend](#move-backend)

##### [Manipulate secret backends](#id6)[¶](#manipulate-secret-backends "Permalink to this headline")

```

backends = client.sys.list\_mounted\_secrets\_engines()['data']

client.sys.enable\_secrets\_engine('aws', path='aws-us-east-1')

client.sys.disable\_secrets\_engine('mysql')

client.sys.tune\_mount\_configuration(path='test', default\_lease\_ttl='3600s', max\_lease\_ttl='8600s')

client.sys.read\_mount\_configuration(path='test')

client.sys.move\_backend('aws-us-east-1', 'aws-east')

```

##### [List Mounted Secrets Engines](#id7)[¶](#list-mounted-secrets-engines "Permalink to this headline")

`Mount.``list_mounted_secrets_engines`()[[source]](_modules/hvac/api/system_backend/mount.html#Mount.list_mounted_secrets_engines)

Lists all the mounted secrets engines.

Supported methods:POST: /sys/mounts. Produces: 200 application/json

Returns

JSON response of the request.

Return type

dict

###### Examples[¶](#examples "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

secrets\_engines\_list = client.sys.list\_mounted\_secrets\_engines()['data']

print('The following secrets engines are mounted: %s' % ', '.join(sorted(secrets\_engines\_list.keys())))

```

Example output:

```

The following secrets engines are mounted: cubbyhole/, identity/, secret/, sys/

```

##### [Enable Secrets Engine](#id8)[¶](#enable-secrets-engine "Permalink to this headline")

`Mount.``enable_secrets_engine`(*backend\_type*, *path=None*, *description=None*, *config=None*, *plugin\_name=None*, *options=None*, *local=False*, *seal\_wrap=False*, *\*\*kwargs*)[[source]](_modules/hvac/api/system_backend/mount.html#Mount.enable_secrets_engine)

Enable a new secrets engine at the given path.

Supported methods:POST: /sys/mounts/{path}. Produces: 204 (empty body)

Parameters

* **backend\_type** (*str | unicode*) – The name of the backend type, such as “github” or “token”.

* **path** (*str | unicode*) – The path to mount the method on. If not provided, defaults to the value of the “backend\_type”

argument.

* **description** (*str | unicode*) – A human-friendly description of the mount.

* **config** (*dict*) – Configuration options for this mount. These are the possible values:

	+ **default\_lease\_ttl**: The default lease duration, specified as a string duration like “5s” or “30m”.

	+ **max\_lease\_ttl**: The maximum lease duration, specified as a string duration like “5s” or “30m”.

	+ **force\_no\_cache**: Disable caching.

	+ **plugin\_name**: The name of the plugin in the plugin catalog to use.

	+ **audit\_non\_hmac\_request\_keys**: Comma-separated list of keys that will not be HMAC’d by audit devices in

	the request data object.

	+ **audit\_non\_hmac\_response\_keys**: Comma-separated list of keys that will not be HMAC’d by audit devices in

	the response data object.

	+ **listing\_visibility**: Specifies whether to show this mount in the UI-specific listing endpoint. (“unauth” or “hidden”)

	+ **passthrough\_request\_headers**: Comma-separated list of headers to whitelist and pass from the request to

	the backend.

* **options** (*dict*) – Specifies mount type specific options that are passed to the backend.

	+ **version**: <KV> The version of the KV to mount. Set to “2” for mount KV v2.

* **plugin\_name** (*str | unicode*) – Specifies the name of the plugin to use based from the name in the plugin catalog. Applies only to plugin backends.

* **local** (*bool*) – <Vault enterprise only> Specifies if the auth method is a local only. Local auth methods are not

replicated nor (if a secondary) removed by replication.

* **seal\_wrap** (*bool*) – <Vault enterprise only> Enable seal wrapping for the mount.

* **kwargs** (*dict*) – All dicts are accepted and passed to vault. See your specific secret engine for details on which

extra key-word arguments you might want to pass.

Returns

The response of the request.

Return type

requests.Response

###### Examples[¶](#id1 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

client.sys.enable\_secrets\_engine(

    backend\_type='kv',

    path='hvac-kv',

)

```

##### [Disable Secrets Engine](#id9)[¶](#disable-secrets-engine "Permalink to this headline")

`Mount.``disable_secrets_engine`(*path*)[[source]](_modules/hvac/api/system_backend/mount.html#Mount.disable_secrets_engine)

Disable the mount point specified by the provided path.

Supported methods:DELETE: /sys/mounts/{path}. Produces: 204 (empty body)

Parameters

**path** (*str | unicode*) – Specifies the path where the secrets engine will be mounted. This is specified as part of the URL.

Returns

The response of the request.

Return type

requests.Response

###### Examples[¶](#id2 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

client.sys.disable\_secrets\_engine(

    path='hvac-kv',

)

```

##### [Read Mount Configuration](#id10)[¶](#read-mount-configuration "Permalink to this headline")

`Mount.``read_mount_configuration`(*path*)[[source]](_modules/hvac/api/system_backend/mount.html#Mount.read_mount_configuration)

Read the given mount’s configuration.

Unlike the mounts endpoint, this will return the current time in seconds for each TTL, which may be the system

default or a mount-specific value.

Supported methods:GET: /sys/mounts/{path}/tune. Produces: 200 application/json

Parameters

**path** (*str | unicode*) – Specifies the path where the secrets engine will be mounted. This is specified as part of the URL.

Returns

The JSON response of the request.

Return type

requests.Response

###### Examples[¶](#id3 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

secret\_backend\_tuning = client.sys.read\_mount\_configuration(path='hvac-kv')

print('The max lease TTL for the "hvac-kv" backend is: {max\_lease\_ttl}'.format(

    max\_lease\_ttl=secret\_backend\_tuning['data']['max\_lease\_ttl'],

 ))

```

Example output:

```

The max lease TTL for the "hvac-kv" backend is: 2764800

```

##### [Tune Mount Configuration](#id11)[¶](#tune-mount-configuration "Permalink to this headline")

`Mount.``tune_mount_configuration`(*path*, *default\_lease\_ttl=None*, *max\_lease\_ttl=None*, *description=None*, *audit\_non\_hmac\_request\_keys=None*, *audit\_non\_hmac\_response\_keys=None*, *listing\_visibility=None*, *passthrough\_request\_headers=None*, *options=None*, *force\_no\_cache=None*, *\*\*kwargs*)[[source]](_modules/hvac/api/system_backend/mount.html#Mount.tune_mount_configuration)

Tune configuration parameters for a given mount point.

Supported methods:POST: /sys/mounts/{path}/tune. Produces: 204 (empty body)

Parameters

* **path** (*str | unicode*) – Specifies the path where the secrets engine will be mounted. This is specified as part of the URL.

* **mount\_point** (*str*) – The path the associated secret backend is mounted

* **description** (*str*) – Specifies the description of the mount. This overrides the current stored value, if any.

* **default\_lease\_ttl** (*int*) – Default time-to-live. This overrides the global default. A value of 0 is equivalent to

the system default TTL

* **max\_lease\_ttl** (*int*) – Maximum time-to-live. This overrides the global default. A value of 0 are equivalent and

set to the system max TTL.

* **audit\_non\_hmac\_request\_keys** (*list*) – Specifies the comma-separated list of keys that will not be HMAC’d by audit

devices in the request data object.

* **audit\_non\_hmac\_response\_keys** (*list*) – Specifies the comma-separated list of keys that will not be HMAC’d by audit

devices in the response data object.

* **listing\_visibility** (*str*) – Speficies whether to show this mount in the UI-specific listing endpoint. Valid

values are “unauth” or “”.

* **passthrough\_request\_headers** (*str*) – Comma-separated list of headers to whitelist and pass from the request

to the backend.

* **options** (*dict*) – Specifies mount type specific options that are passed to the backend.

	+ **version**: <KV> The version of the KV to mount. Set to “2” for mount KV v2.

* **force\_no\_cache** (*bool*) – Disable caching.

* **kwargs** (*dict*) – All dicts are accepted and passed to vault. See your specific secret engine for details on which

extra key-word arguments you might want to pass.

Returns

The response from the request.

Return type

request.Response

###### Examples[¶](#id4 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

client.sys.tune\_mount\_configuration(

    path='hvac-kv',

    default\_lease\_ttl='3600s',

    max\_lease\_ttl='8600s',

)

```

##### [Move Backend](#id12)[¶](#move-backend "Permalink to this headline")

`Mount.``move_backend`(*from\_path*, *to\_path*)[[source]](_modules/hvac/api/system_backend/mount.html#Mount.move_backend)

Move an already-mounted backend to a new mount point.

Supported methods:POST: /sys/remount. Produces: 204 (empty body)

Parameters

* **from\_path** (*str | unicode*) – Specifies the previous mount point.

* **to\_path** (*str | unicode*) – Specifies the new destination mount point.

Returns

The response of the request.

Return type

requests.Response

###### Examples[¶](#id5 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

client.sys.move\_backend(

    from\_path='hvac-kv',

    to\_path='kv-hvac',

)

```

#### Namespace[¶](#namespace "Permalink to this headline")

* [Create Namespace](#create-namespace)

* [List Namespaces](#list-namespaces)

* [Delete Namespace](#delete-namespace)

##### [Create Namespace](#id3)[¶](#create-namespace "Permalink to this headline")

`Namespace.``create_namespace`(*path*)[[source]](_modules/hvac/api/system_backend/namespace.html#Namespace.create_namespace)

Create a namespace at the given path.

Supported methods:POST: /sys/namespaces/{path}. Produces: 200 application/json

Returns

The response of the request.

Return type

requests.Response

###### Examples[¶](#examples "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

# Create namespace team1 where team1 is a child of root

client.sys.create\_namespace(path="team1")

# Create namespace team1/app1 where app1 is a child of team1

client2 = hvac.Client(url='https://127.0.0.1:8200', namespace="team1")

client2.sys.create\_namespace(path="app1")

```

Example output:

> 

> print(client.sys.create\_namespace(path=”team1”))

> {“request\_id”:”<redacted>”,”lease\_id”:””,”renewable”:false,”lease\_duration”:0,”data”:{“id”:”nf28f”,”path”:”team1/”},”wrap\_info”:null,”warnings”:null,”auth”:null}

> 

> 

> print(client2.sys.create\_namespace(path=”app1”))

> {“request\_id”:”<redacted>”,”lease\_id”:””,”renewable”:false,”lease\_duration”:0,”data”:{“id”:”EGqRJ”,”path”:”team1/app1/”},”wrap\_info”:null,”warnings”:null,”auth”:null}

> 

> 

> 

##### [List Namespaces](#id4)[¶](#list-namespaces "Permalink to this headline")

`Namespace.``list_namespaces`()[[source]](_modules/hvac/api/system_backend/namespace.html#Namespace.list_namespaces)

Lists all the namespaces.

Supported methods:LIST: /sys/namespaces. Produces: 200 application/json

Returns

The JSON response of the request.

Return type

dict

###### Examples[¶](#id1 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

client.sys.create\_namespace(path='testns')

client.sys.list\_namespaces()

```

Example output:

> 

> print(client.sys.list\_namespaces())

> {“request\_id”:”<redacted>”,”lease\_id”:””,”renewable”:false,”lease\_duration”:0,”data”:{“key\_info”:{“testns/”:{“id”:”ekiUn”,”path”:”testns/”}},”keys”:[“testns/”]},”wrap\_info”:null,”warnings”:null,”auth”:null}

> 

> 

> 

##### [Delete Namespace](#id5)[¶](#delete-namespace "Permalink to this headline")

`Namespace.``delete_namespace`(*path*)[[source]](_modules/hvac/api/system_backend/namespace.html#Namespace.delete_namespace)

Delete a namespaces. You cannot delete a namespace with existing child namespaces.

Supported methods:DELETE: /sys/namespaces. Produces: 204 (empty body)

Returns

The response of the request.

Return type

requests.Response

###### Examples[¶](#id2 "Permalink to this headline")

```

import hvac

# Delete namespace app1 where app1 is a child of team1

client2 = hvac.Client(url='https://127.0.0.1:8200', namespace="team1")

client2.sys.delete\_namespace(path="app1")

# Delete namespace team1

client = hvac.Client(url='https://127.0.0.1:8200')

client.sys.delete\_namespace(path="team1")

```

#### Policy[¶](#policy "Permalink to this headline")

* [Manipulate policies](#manipulate-policies)

* [List Policies](#list-policies)

* [Read Policy](#read-policy)

* [Create Or Update Policy](#create-or-update-policy)

* [Delete Policy](#delete-policy)

##### [Manipulate policies](#id4)[¶](#manipulate-policies "Permalink to this headline")

```

policies = client.sys.list\_policies()['data']['policies'] # => ['root']

policy = """

path "sys" {

 capabilities = ["deny"]

}

path "secret/\*" {

 capabilities = ["read", "list"]

}

path "secret/foo" {

 capabilities = ["create", "read", "update", "delete", "list"]

}

"""

client.sys.create\_or\_update\_policy(

    name='secret-writer',

    policy=policy,

)

client.sys.delete\_policy('oldthing')

# The get\_policy method offers some additional features and is available in the Client class.

policy = client.get\_policy('mypolicy')

# Requires pyhcl to automatically parse HCL into a Python dictionary

policy = client.get\_policy('mypolicy', parse=True)

```

###### Using Python Variable(s) In Policy Rules[¶](#using-python-variable-s-in-policy-rules "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

key = 'some-key-string'

policy\_body = """

path "transit/encrypt/%s" {

 capabilities = ["update"]

}

""" % key

client.sys.create\_or\_update\_policy(

    name='my-policy-name',

    policy=policy\_body,

)

```

##### [List Policies](#id5)[¶](#list-policies "Permalink to this headline")

`Policy.``list_policies`()[[source]](_modules/hvac/api/system_backend/policy.html#Policy.list_policies)

List all configured policies.

Supported methods:GET: /sys/policy. Produces: 200 application/json

Returns

The JSON response of the request.

Return type

dict

###### Examples[¶](#examples "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

list\_policies\_resp = client.sys.list\_policies()['data']['policies']

print('List of currently configured policies: %s' % ', '.join(list\_policies\_resp))

```

Example output:

```

List of currently configured policies: default, my-policy-name, secret-writer, root

```

##### [Read Policy](#id6)[¶](#read-policy "Permalink to this headline")

`Policy.``read_policy`(*name*)[[source]](_modules/hvac/api/system_backend/policy.html#Policy.read_policy)

Retrieve the policy body for the named policy.

Supported methods:GET: /sys/policy/{name}. Produces: 200 application/json

Parameters

**name** (*str | unicode*) – The name of the policy to retrieve.

Returns

The response of the request

Return type

dict

###### Examples[¶](#id1 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

hvac\_policy\_rules = client.sys.read\_policy(name='secret-writer')['data']['rules']

print('secret-writer policy rules:\n%s' % hvac\_policy\_rules)

```

Example output:

```

secret-writer policy rules:

path "sys" {

  capabilities = ["deny"]

}

path "secret/*" {

  capabilities = ["read", "list"]

}

path "secret/foo" {

  capabilities = ["create", "read", "update", "delete", "list"]

}

...

```

##### [Create Or Update Policy](#id7)[¶](#create-or-update-policy "Permalink to this headline")

`Policy.``create_or_update_policy`(*name*, *policy*, *pretty\_print=True*)[[source]](_modules/hvac/api/system_backend/policy.html#Policy.create_or_update_policy)

Add a new or update an existing policy.

Once a policy is updated, it takes effect immediately to all associated users.

Supported methods:PUT: /sys/policy/{name}. Produces: 204 (empty body)

Parameters

* **name** (*str | unicode*) – Specifies the name of the policy to create.

* **policy** (*str | unicode | dict*) – Specifies the policy document.

* **pretty\_print** (*bool*) – If True, and provided a dict for the policy argument, send the policy JSON to Vault with

“pretty” formatting.

Returns

The response of the request.

Return type

requests.Response

###### Examples[¶](#id2 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

policy = '''

 path "sys" {

 capabilities = ["deny"]

 }

 path "secret" {

 capabilities = ["create", "read", "update", "delete", "list"]

 }

'''

client.sys.create\_or\_update\_policy(

    name='secret-writer',

    policy=policy,

)

```

##### [Delete Policy](#id8)[¶](#delete-policy "Permalink to this headline")

`Policy.``delete_policy`(*name*)[[source]](_modules/hvac/api/system_backend/policy.html#Policy.delete_policy)

Delete the policy with the given name.

This will immediately affect all users associated with this policy.

Supported methods:DELETE: /sys/policy/{name}. Produces: 204 (empty body)

Parameters

**name** (*str | unicode*) – Specifies the name of the policy to delete.

Returns

The response of the request.

Return type

requests.Response

###### Examples[¶](#id3 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

client.sys.delete\_policy(

    name='secret-writer',

)

```

#### Raft[¶](#raft "Permalink to this headline")

[`hvac.api.system\_backend.Raft()`](index.html#hvac.api.system_backend.Raft "hvac.api.system_backend.Raft")

* [Join Raft Cluster](#join-raft-cluster)

* [Read Raft Configuration](#read-raft-configuration)

* [Remove Raft Node](#remove-raft-node)

##### [Join Raft Cluster](#id1)[¶](#join-raft-cluster "Permalink to this headline")

[`hvac.api.system\_backend.Raft.join\_raft\_cluster()`](index.html#hvac.api.system_backend.Raft.join_raft_cluster "hvac.api.system_backend.Raft.join_raft_cluster")

```

import hvac

client = hvac.Client()

client.sys.join\_raft\_cluster(

    leader\_api\_addr='https://some-vault-node',

)

```

##### [Read Raft Configuration](#id2)[¶](#read-raft-configuration "Permalink to this headline")

[`hvac.api.system\_backend.Raft.read\_raft\_config()`](index.html#hvac.api.system_backend.Raft.read_raft_config "hvac.api.system_backend.Raft.read_raft_config")

```

import hvac

client = hvac.Client()

raft\_config = c.sys.read\_raft\_config()

num\_servers\_in\_cluster = len(raft\_config['data']['config']['servers'])

```

##### [Remove Raft Node](#id3)[¶](#remove-raft-node "Permalink to this headline")

[`hvac.api.system\_backend.Raft.remove\_raft\_node()`](index.html#hvac.api.system_backend.Raft.remove_raft_node "hvac.api.system_backend.Raft.remove_raft_node")

```

import hvac

client = hvac.Client()

client.sys.remove\_raft\_node(

    server\_id='i-somenodeid',

)

```

#### Seal[¶](#seal "Permalink to this headline")

* [Seal Status](#seal-status)

* [Is Sealed](#is-sealed)

* [Read Seal Status](#read-seal-status)

* [Seal](#id3)

* [Submit Unseal Key](#submit-unseal-key)

* [Submit Unseal Keys](#submit-unseal-keys)

##### [Seal Status](#id7)[¶](#seal-status "Permalink to this headline")

`Client.``seal_status`

Read the seal status of the Vault.

This is an unauthenticated endpoint.

Supported methods:GET: /sys/seal-status. Produces: 200 application/json

Returns

The JSON response of the request.

Return type

dict

###### Examples[¶](#examples "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

print('Is Vault sealed: %s' % client.seal\_status['sealed'])

```

Example output:

```

Is Vault sealed: False

```

##### [Is Sealed](#id8)[¶](#is-sealed "Permalink to this headline")

`Seal.``is_sealed`()[[source]](_modules/hvac/api/system_backend/seal.html#Seal.is_sealed)

Determine if Vault is sealed.

Returns

True if Vault is seal, False otherwise.

Return type

bool

###### Examples[¶](#id1 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

print('Is Vault sealed: %s' % client.sys.is\_sealed())

```

Example output:

```

Is Vault sealed: False

```

##### [Read Seal Status](#id9)[¶](#read-seal-status "Permalink to this headline")

`Seal.``read_seal_status`()[[source]](_modules/hvac/api/system_backend/seal.html#Seal.read_seal_status)

Read the seal status of the Vault.

This is an unauthenticated endpoint.

Supported methods:GET: /sys/seal-status. Produces: 200 application/json

Returns

The JSON response of the request.

Return type

dict

###### Examples[¶](#id2 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

print('Is Vault sealed: %s' % client.sys.read\_seal\_status()['sealed'])

```

Example output:

```

Is Vault sealed: False

```

##### [Seal](#id10)[¶](#id3 "Permalink to this headline")

`Seal.``seal`()[[source]](_modules/hvac/api/system_backend/seal.html#Seal.seal)

Seal the Vault.

In HA mode, only an active node can be sealed. Standby nodes should be restarted to get the same effect.

Requires a token with root policy or sudo capability on the path.

Supported methods:PUT: /sys/seal. Produces: 204 (empty body)

Returns

The response of the request.

Return type

requests.Response

###### Examples[¶](#id4 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

client.sys.seal()

```

##### [Submit Unseal Key](#id11)[¶](#submit-unseal-key "Permalink to this headline")

`Seal.``submit_unseal_key`(*key=None*, *reset=False*, *migrate=False*)[[source]](_modules/hvac/api/system_backend/seal.html#Seal.submit_unseal_key)

Enter a single master key share to progress the unsealing of the Vault.

If the threshold number of master key shares is reached, Vault will attempt to unseal the Vault. Otherwise, this

API must be called multiple times until that threshold is met.

Either the key or reset parameter must be provided; if both are provided, reset takes precedence.

Supported methods:PUT: /sys/unseal. Produces: 200 application/json

Parameters

* **key** (*str | unicode*) – Specifies a single master key share. This is required unless reset is true.

* **reset** (*bool*) – Specifies if previously-provided unseal keys are discarded and the unseal process is reset.

* **migrate** – Available in 1.0 Beta - Used to migrate the seal from shamir to autoseal or autoseal to shamir.

Must be provided on all unseal key calls.

Type

migrate: bool

Returns

The JSON response of the request.

Return type

dict

###### Examples[¶](#id5 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

client.sys.submit\_unseal\_key(key=key)

```

##### [Submit Unseal Keys](#id12)[¶](#submit-unseal-keys "Permalink to this headline")

`Seal.``submit_unseal_keys`(*keys*, *migrate=False*)[[source]](_modules/hvac/api/system_backend/seal.html#Seal.submit_unseal_keys)

Enter multiple master key share to progress the unsealing of the Vault.

Parameters

* **keys** (*List**[**str**]*) – List of master key shares.

* **migrate** – Available in 1.0 Beta - Used to migrate the seal from shamir to autoseal or autoseal to shamir.

Must be provided on all unseal key calls.

Type

migrate: bool

Returns

The JSON response of the last unseal request.

Return type

dict

###### Examples[¶](#id6 "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

client.sys.submit\_unseal\_keys(keys=keys)

```

#### Wrapping[¶](#wrapping "Permalink to this headline")

* [Unwrap](#unwrap)

* [Is Sealed](#is-sealed)

##### [Unwrap](#id1)[¶](#unwrap "Permalink to this headline")

##### [Is Sealed](#id2)[¶](#is-sealed "Permalink to this headline")

`Seal.``is_sealed`()[[source]](_modules/hvac/api/system_backend/seal.html#Seal.is_sealed)

Determine if Vault is sealed.

Returns

True if Vault is seal, False otherwise.

Return type

bool

###### Examples[¶](#examples "Permalink to this headline")

```

import hvac

client = hvac.Client(url='https://127.0.0.1:8200')

client.write(

    path="auth/approle-test/role/testrole",

)

result = client.write(

    path='auth/approle-test/role/testrole/secret-id',

    wrap\_ttl="10s",

)

unwrap\_response = client.sys.unwrap(

    token=result['wrap\_info']['token'],

)

print('Unwrapped approle role token secret id accessor: "%s"' % unwrap\_response['data']['secret\_id\_accessor'])

```

Example output:

```

Unwrapped approle role token secret id accessor: "..."

```

### Initialize and seal/unseal[¶](#initialize-and-seal-unseal "Permalink to this headline")

```

print(client.sys.is\_initialized()) # => False

shares = 5

threshold = 3

result = client.sys.initialize(shares, threshold)

root\_token = result['root\_token']

keys = result['keys']

print(client.sys.is\_initialized()) # => True

print(client.sys.is\_sealed()) # => True

# unseal with individual keys

client.sys.unseal(keys[0])

client.sys.unseal(keys[1])

client.sys.unseal(keys[2])

# unseal with multiple keys until threshold met

client.sys.unseal\_multi(keys)

print(client.sys.is\_sealed()) # => False

client.sys.seal()

print(client.sys.is\_sealed()) # => True

```

Advanced Usage[¶](#advanced-usage "Permalink to this headline")

---------------------------------------------------------------

* [Making Use of Private CA](#making-use-of-private-ca)

* [Custom Requests / HTTP Adapter](#custom-requests-http-adapter)

* [Vault Agent Unix Socket Listener](#vault-agent-unix-socket-listener)

### [Making Use of Private CA](#id1)[¶](#making-use-of-private-ca "Permalink to this headline")

There is a not uncommon use case of people deploying Hashicorp Vault with a private certificate authority. Unfortunately the requests module does not make use of the system CA certificates. Instead of disabling SSL verification you can make use of the requests’ verify parameter.

As [documented in the advanced usage section for requests](https://requests.readthedocs.io/en/master/user/advanced/#ssl-cert-verification) this variable can point to a file that is comprised of all CA certificates you may wish to use. This can be a single private CA, or an existing list of root certificates with the private appended to the end. The following example shows how to achieve this:

```

$ cp "$(python -c 'import certifi;print certifi.where();')" /tmp/bundle.pem

$ cat /path/to/custom.pem >> /tmp/bundle.pem

```

You then use hvac’s Client.session and requests.Session() to pass the new CA bundle to hvac.

```

import os

import hvac

import requests

def get\_vault\_client(vault\_url=VAULT\_URL, certs=VAULT\_CERTS):

        """

 Instantiates a hvac / vault client.

 :param vault\_url: string, protocol + address + port for the vault service

 :param certs: tuple, Optional tuple of self-signed certs to use for verification

 with hvac's requests adapater.

 :return: hvac.Client

 """

        logger.debug('Retrieving a vault (hvac) client...')

        vault\_client = hvac.Client(

                url=vault\_url,

                cert=certs,

        )

        if certs:

        # When use a self-signed certificate for the vault service itself, we need to

        # include our local ca bundle here for the underlying requests module.

                rs = requests.Session()

                vault\_client.session = rs

                rs.verify = certs

        vault\_client.token = load\_vault\_token(vault\_client)

        if not vault\_client.is\_authenticated():

                error\_msg = 'Unable to authenticate to the Vault service'

                raise hvac.exceptions.Unauthorized(error\_msg)

        return vault\_client

```

### [Custom Requests / HTTP Adapter](#id2)[¶](#custom-requests-http-adapter "Permalink to this headline")

New in version 0.6.2.

Calls to the [requests module](http://requests.readthedocs.io/en/master/). (which provides the methods hvac utilizes to send HTTP/HTTPS request to Vault instances) were extracted from the [`Client`](index.html#hvac.v1.Client "hvac.v1.Client") class and moved to a newly added [`hvac.adapters()`](index.html#module-hvac.adapters "hvac.adapters") module. The [`Client`](index.html#hvac.v1.Client "hvac.v1.Client") class itself defaults to an instance of the [`JSONAdapter`](index.html#hvac.adapters.JSONAdapter "hvac.adapters.JSONAdapter") class for its `\_adapter` private attribute attribute if no adapter argument is provided to its [`constructor`](index.html#hvac.v1.Client.__init__ "hvac.v1.Client.__init__"). This attribute provides an avenue for modifying the manner in which hvac completes request. To enable this type of customization, implement a class of type [`hvac.adapters.Adapter()`](index.html#hvac.adapters.Adapter "hvac.adapters.Adapter"), override its abstract methods, and pass this custom class to the adapter argument of the [`Client constructor`](index.html#hvac.v1.Client.__init__ "hvac.v1.Client.__init__")

### [Vault Agent Unix Socket Listener](#id3)[¶](#vault-agent-unix-socket-listener "Permalink to this headline")

hvac does not currently offer direct support of requests to a [Vault agent process configured with a unix socket listener](https://github.com/hashicorp/vault/pull/6220/). However this use case can be handled with the help of the [requests\_unixsocket module](https://pypi.org/project/requests-unixsocket/). To accomplish this, first ensure the module is available (e.g. pip install requests\_unixsocket), and then instantiate the [`Client`](index.html#hvac.v1.Client "hvac.v1.Client") class in the following manner:

```

import urllib.parse

import requests\_unixsocket

import hvac

vault\_agent\_socket\_path = '/var/run/vault/agent.sock'

socket\_url = 'http+unix://{encoded\_path}'.format(

        encoded\_path=urllib.parse.quote(vault\_agent\_socket\_path, safe='')

)

socket\_session = requests\_unixsocket.Session()

client = hvac.Client(

        url=socket\_url,

        session=socket\_session,

)

print(client.secrets.kv.read\_secret\_version(path='some-secret'))

```

Source Reference[¶](#source-reference "Permalink to this headline")

-------------------------------------------------------------------

### hvac.v1[¶](#module-hvac.v1 "Permalink to this headline")

**Classes**

| [`Client`](#hvac.v1.Client "hvac.v1.Client")([url, token, cert, verify, timeout, …]) | The hvac Client class for HashiCorp’s Vault. |

*class* `hvac.v1.``Client`(*url=None*, *token=None*, *cert=None*, *verify=None*, *timeout=30*, *proxies=None*, *allow\_redirects=True*, *session=None*, *adapter=<class 'hvac.adapters.JSONAdapter'>*, *namespace=None*, *\*\*kwargs*)[[source]](_modules/hvac/v1.html#Client)[¶](#hvac.v1.Client "Permalink to this definition")

Bases: `object`

The hvac Client class for HashiCorp’s Vault.

**Methods**

| [`\_\_init\_\_`](#hvac.v1.Client.__init__ "hvac.v1.Client.__init__")([url, token, cert, verify, …]) | Creates a new hvac client instance. |

| [`audit\_hash`](#hvac.v1.Client.audit_hash "hvac.v1.Client.audit_hash")(name, input) | Call to deprecated function ‘audit\_hash’. |

| [`auth\_app\_id`](#hvac.v1.Client.auth_app_id "hvac.v1.Client.auth_app_id")(app\_id, user\_id[, mount\_point, …]) | Call to deprecated function ‘auth\_app\_id’. |

| [`auth\_approle`](#hvac.v1.Client.auth_approle "hvac.v1.Client.auth_approle")(role\_id[, secret\_id, …]) | Call to deprecated function ‘auth\_approle’. |

| [`auth\_aws\_iam`](#hvac.v1.Client.auth_aws_iam "hvac.v1.Client.auth_aws_iam")(access\_key, secret\_key[, …]) | Call to deprecated function ‘auth\_aws\_iam’. |

| [`auth\_cubbyhole`](#hvac.v1.Client.auth_cubbyhole "hvac.v1.Client.auth_cubbyhole")(token) | Perform a login request with a wrapped token. |

| [`auth\_ec2`](#hvac.v1.Client.auth_ec2 "hvac.v1.Client.auth_ec2")(pkcs7[, nonce, role, use\_token, …]) | Call to deprecated function ‘auth\_ec2’. |

| [`auth\_gcp`](#hvac.v1.Client.auth_gcp "hvac.v1.Client.auth_gcp")(\*args, \*\*kwargs) | Call to deprecated function ‘auth\_gcp’. |

| [`auth\_github`](#hvac.v1.Client.auth_github "hvac.v1.Client.auth_github")(\*args, \*\*kwargs) | Call to deprecated function ‘auth\_github’. |

| [`auth\_kubernetes`](#hvac.v1.Client.auth_kubernetes "hvac.v1.Client.auth_kubernetes")(role, jwt[, use\_token, …]) | Call to deprecated function ‘auth\_kubernetes’. |

| [`auth\_ldap`](#hvac.v1.Client.auth_ldap "hvac.v1.Client.auth_ldap")(\*args, \*\*kwargs) | Call to deprecated function ‘auth\_ldap’. |

| [`auth\_tls`](#hvac.v1.Client.auth_tls "hvac.v1.Client.auth_tls")([mount\_point, use\_token]) | Call to deprecated function ‘auth\_tls’. |

| [`auth\_userpass`](#hvac.v1.Client.auth_userpass "hvac.v1.Client.auth_userpass")(username, password[, …]) | Call to deprecated function ‘auth\_userpass’. |

| [`cancel\_generate\_root`](#hvac.v1.Client.cancel_generate_root "hvac.v1.Client.cancel_generate_root")() | Call to deprecated function ‘cancel\_generate\_root’. |

| [`cancel\_rekey`](#hvac.v1.Client.cancel_rekey "hvac.v1.Client.cancel_rekey")() | Call to deprecated function ‘cancel\_rekey’. |

| [`close`](#hvac.v1.Client.close "hvac.v1.Client.close")() | Call to deprecated function ‘close’. |

| [`create\_app\_id`](#hvac.v1.Client.create_app_id "hvac.v1.Client.create_app_id")(app\_id, policies[, …]) | Call to deprecated function ‘create\_app\_id’. |

| [`create\_ec2\_role`](#hvac.v1.Client.create_ec2_role "hvac.v1.Client.create_ec2_role")(role[, bound\_ami\_id, …]) | Call to deprecated function ‘create\_ec2\_role’. |

| [`create\_ec2\_role\_tag`](#hvac.v1.Client.create_ec2_role_tag "hvac.v1.Client.create_ec2_role_tag")(role[, policies, …]) | Call to deprecated function ‘create\_ec2\_role\_tag’. |

| [`create\_kubernetes\_configuration`](#hvac.v1.Client.create_kubernetes_configuration "hvac.v1.Client.create_kubernetes_configuration")(kubernetes\_host) | Call to deprecated function ‘create\_kubernetes\_configuration’. |

| [`create\_kubernetes\_role`](#hvac.v1.Client.create_kubernetes_role "hvac.v1.Client.create_kubernetes_role")(name, …[, ttl, …]) | Call to deprecated function ‘create\_kubernetes\_role’. |

| [`create\_role`](#hvac.v1.Client.create_role "hvac.v1.Client.create_role")(role\_name[, mount\_point]) | Call to deprecated function ‘create\_role’. |

| [`create\_role\_custom\_secret\_id`](#hvac.v1.Client.create_role_custom_secret_id "hvac.v1.Client.create_role_custom_secret_id")(role\_name, …) | Call to deprecated function ‘create\_role\_custom\_secret\_id’. |

| [`create\_role\_secret\_id`](#hvac.v1.Client.create_role_secret_id "hvac.v1.Client.create_role_secret_id")(role\_name[, meta, …]) | Call to deprecated function ‘create\_role\_secret\_id’. |

| [`create\_token`](#hvac.v1.Client.create_token "hvac.v1.Client.create_token")([role, token\_id, policies, …]) | Call to deprecated function ‘create\_token’. |

| [`create\_token\_role`](#hvac.v1.Client.create_token_role "hvac.v1.Client.create_token_role")(role[, allowed\_policies, …]) | Call to deprecated function ‘create\_token\_role’. |

| [`create\_user\_id`](#hvac.v1.Client.create_user_id "hvac.v1.Client.create_user_id")(user\_id, app\_id[, …]) | Call to deprecated function ‘create\_user\_id’. |

| [`create\_userpass`](#hvac.v1.Client.create_userpass "hvac.v1.Client.create_userpass")(username, password, policies) | Call to deprecated function ‘create\_userpass’. |

| [`create\_vault\_ec2\_certificate\_configuration`](#hvac.v1.Client.create_vault_ec2_certificate_configuration "hvac.v1.Client.create_vault_ec2_certificate_configuration")(…) | Call to deprecated function ‘create\_vault\_ec2\_certificate\_configuration’. |

| [`create\_vault\_ec2\_client\_configuration`](#hvac.v1.Client.create_vault_ec2_client_configuration "hvac.v1.Client.create_vault_ec2_client_configuration")(…[, …]) | Call to deprecated function ‘create\_vault\_ec2\_client\_configuration’. |

| [`delete`](#hvac.v1.Client.delete "hvac.v1.Client.delete")(path) | DELETE /<path> |

| [`delete\_app\_id`](#hvac.v1.Client.delete_app_id "hvac.v1.Client.delete_app_id")(app\_id[, mount\_point]) | Call to deprecated function ‘delete\_app\_id’. |

| [`delete\_ec2\_role`](#hvac.v1.Client.delete_ec2_role "hvac.v1.Client.delete_ec2_role")(role[, mount\_point]) | Call to deprecated function ‘delete\_ec2\_role’. |

| [`delete\_kubernetes\_role`](#hvac.v1.Client.delete_kubernetes_role "hvac.v1.Client.delete_kubernetes_role")(role[, mount\_point]) | Call to deprecated function ‘delete\_kubernetes\_role’. |

| [`delete\_policy`](#hvac.v1.Client.delete_policy "hvac.v1.Client.delete_policy")(name) | Call to deprecated function ‘delete\_policy’. |

| [`delete\_role`](#hvac.v1.Client.delete_role "hvac.v1.Client.delete_role")(role\_name[, mount\_point]) | Call to deprecated function ‘delete\_role’. |

| [`delete\_role\_secret\_id`](#hvac.v1.Client.delete_role_secret_id "hvac.v1.Client.delete_role_secret_id")(role\_name, secret\_id) | Call to deprecated function ‘delete\_role\_secret\_id’. |

| [`delete\_role\_secret\_id\_accessor`](#hvac.v1.Client.delete_role_secret_id_accessor "hvac.v1.Client.delete_role_secret_id_accessor")(role\_name, …) | Call to deprecated function ‘delete\_role\_secret\_id\_accessor’. |

| [`delete\_token\_role`](#hvac.v1.Client.delete_token_role "hvac.v1.Client.delete_token_role")(role) | Call to deprecated function ‘delete\_token\_role’. |

| [`delete\_user\_id`](#hvac.v1.Client.delete_user_id "hvac.v1.Client.delete_user_id")(user\_id[, mount\_point]) | Call to deprecated function ‘delete\_user\_id’. |

| [`delete\_userpass`](#hvac.v1.Client.delete_userpass "hvac.v1.Client.delete_userpass")(username[, mount\_point]) | Call to deprecated function ‘delete\_userpass’. |

| [`delete\_vault\_ec2\_client\_configuration`](#hvac.v1.Client.delete_vault_ec2_client_configuration "hvac.v1.Client.delete_vault_ec2_client_configuration")([…]) | Call to deprecated function ‘delete\_vault\_ec2\_client\_configuration’. |

| [`disable\_audit\_backend`](#hvac.v1.Client.disable_audit_backend "hvac.v1.Client.disable_audit_backend")(name) | Call to deprecated function ‘disable\_audit\_backend’. |

| [`disable\_auth\_backend`](#hvac.v1.Client.disable_auth_backend "hvac.v1.Client.disable_auth_backend")(mount\_point) | Call to deprecated function ‘disable\_auth\_backend’. |

| [`disable\_secret\_backend`](#hvac.v1.Client.disable_secret_backend "hvac.v1.Client.disable_secret_backend")(mount\_point) | Call to deprecated function ‘disable\_secret\_backend’. |

| [`enable\_audit\_backend`](#hvac.v1.Client.enable_audit_backend "hvac.v1.Client.enable_audit_backend")(backend\_type[, …]) | Call to deprecated function ‘enable\_audit\_backend’. |

| [`enable\_auth\_backend`](#hvac.v1.Client.enable_auth_backend "hvac.v1.Client.enable_auth_backend")(backend\_type[, …]) | Call to deprecated function ‘enable\_auth\_backend’. |

| [`enable\_secret\_backend`](#hvac.v1.Client.enable_secret_backend "hvac.v1.Client.enable_secret_backend")(backend\_type[, …]) | Call to deprecated function ‘enable\_secret\_backend’. |

| [`generate\_root`](#hvac.v1.Client.generate_root "hvac.v1.Client.generate_root")(key, nonce) | Call to deprecated function ‘generate\_root’. |

| [`get\_app\_id`](#hvac.v1.Client.get_app_id "hvac.v1.Client.get_app_id")(app\_id[, mount\_point, wrap\_ttl]) | Call to deprecated function ‘get\_app\_id’. |

| [`get\_auth\_backend\_tuning`](#hvac.v1.Client.get_auth_backend_tuning "hvac.v1.Client.get_auth_backend_tuning")(backend\_type[, …]) | Call to deprecated function ‘get\_auth\_backend\_tuning’. |

| [`get\_backed\_up\_keys`](#hvac.v1.Client.get_backed_up_keys "hvac.v1.Client.get_backed_up_keys")() | Call to deprecated function ‘get\_backed\_up\_keys’. |

| [`get\_ec2\_role`](#hvac.v1.Client.get_ec2_role "hvac.v1.Client.get_ec2_role")(role[, mount\_point]) | Call to deprecated function ‘get\_ec2\_role’. |

| [`get\_kubernetes\_configuration`](#hvac.v1.Client.get_kubernetes_configuration "hvac.v1.Client.get_kubernetes_configuration")([mount\_point]) | Call to deprecated function ‘get\_kubernetes\_configuration’. |

| [`get\_kubernetes\_role`](#hvac.v1.Client.get_kubernetes_role "hvac.v1.Client.get_kubernetes_role")(name[, mount\_point]) | Call to deprecated function ‘get\_kubernetes\_role’. |

| [`get\_policy`](#hvac.v1.Client.get_policy "hvac.v1.Client.get_policy")(name[, parse]) | Retrieve the policy body for the named policy. |

| [`get\_role`](#hvac.v1.Client.get_role "hvac.v1.Client.get_role")(role\_name[, mount\_point]) | Call to deprecated function ‘get\_role’. |

| [`get\_role\_id`](#hvac.v1.Client.get_role_id "hvac.v1.Client.get_role_id")(role\_name[, mount\_point]) | Call to deprecated function ‘get\_role\_id’. |

| [`get\_role\_secret\_id`](#hvac.v1.Client.get_role_secret_id "hvac.v1.Client.get_role_secret_id")(role\_name, secret\_id[, …]) | Call to deprecated function ‘get\_role\_secret\_id’. |

| [`get\_role\_secret\_id\_accessor`](#hvac.v1.Client.get_role_secret_id_accessor "hvac.v1.Client.get_role_secret_id_accessor")(role\_name, …) | Call to deprecated function ‘get\_role\_secret\_id\_accessor’. |

| [`get\_secret\_backend\_tuning`](#hvac.v1.Client.get_secret_backend_tuning "hvac.v1.Client.get_secret_backend_tuning")(backend\_type[, …]) | Call to deprecated function ‘get\_secret\_backend\_tuning’. |

| [`get\_user\_id`](#hvac.v1.Client.get_user_id "hvac.v1.Client.get_user_id")(user\_id[, mount\_point, wrap\_ttl]) | Call to deprecated function ‘get\_user\_id’. |

| [`get\_vault\_ec2\_certificate\_configuration`](#hvac.v1.Client.get_vault_ec2_certificate_configuration "hvac.v1.Client.get_vault_ec2_certificate_configuration")(…) | Call to deprecated function ‘get\_vault\_ec2\_certificate\_configuration’. |

| [`get\_vault\_ec2\_client\_configuration`](#hvac.v1.Client.get_vault_ec2_client_configuration "hvac.v1.Client.get_vault_ec2_client_configuration")([mount\_point]) | Call to deprecated function ‘get\_vault\_ec2\_client\_configuration’. |

| [`initialize`](#hvac.v1.Client.initialize "hvac.v1.Client.initialize")([secret\_shares, …]) | Call to deprecated function ‘initialize’. |

| [`is\_authenticated`](#hvac.v1.Client.is_authenticated "hvac.v1.Client.is_authenticated")() | Helper method which returns the authentication status of the client |

| [`is\_initialized`](#hvac.v1.Client.is_initialized "hvac.v1.Client.is_initialized")() | Call to deprecated function ‘is\_initialized’. |

| [`is\_sealed`](#hvac.v1.Client.is_sealed "hvac.v1.Client.is_sealed")() | Call to deprecated function ‘is\_sealed’. |

| [`list`](#hvac.v1.Client.list "hvac.v1.Client.list")(path) | GET /<path>?list=true |

| [`list\_audit\_backends`](#hvac.v1.Client.list_audit_backends "hvac.v1.Client.list_audit_backends")() | Call to deprecated function ‘list\_audit\_backends’. |

| [`list\_auth\_backends`](#hvac.v1.Client.list_auth_backends "hvac.v1.Client.list_auth_backends")() | Call to deprecated function ‘list\_auth\_backends’. |

| [`list\_ec2\_roles`](#hvac.v1.Client.list_ec2_roles "hvac.v1.Client.list_ec2_roles")([mount\_point]) | Call to deprecated function ‘list\_ec2\_roles’. |

| [`list\_kubernetes\_roles`](#hvac.v1.Client.list_kubernetes_roles "hvac.v1.Client.list_kubernetes_roles")([mount\_point]) | Call to deprecated function ‘list\_kubernetes\_roles’. |

| [`list\_policies`](#hvac.v1.Client.list_policies "hvac.v1.Client.list_policies")() | Call to deprecated function ‘list\_policies’. |

| [`list\_role\_secrets`](#hvac.v1.Client.list_role_secrets "hvac.v1.Client.list_role_secrets")(role\_name[, mount\_point]) | Call to deprecated function ‘list\_role\_secrets’. |

| [`list\_roles`](#hvac.v1.Client.list_roles "hvac.v1.Client.list_roles")([mount\_point]) | Call to deprecated function ‘list\_roles’. |

| [`list\_secret\_backends`](#hvac.v1.Client.list_secret_backends "hvac.v1.Client.list_secret_backends")() | Call to deprecated function ‘list\_secret\_backends’. |

| [`list\_token\_roles`](#hvac.v1.Client.list_token_roles "hvac.v1.Client.list_token_roles")() | Call to deprecated function ‘list\_token\_roles’. |

| [`list\_userpass`](#hvac.v1.Client.list_userpass "hvac.v1.Client.list_userpass")([mount\_point]) | Call to deprecated function ‘list\_userpass’. |

| [`list\_vault\_ec2\_certificate\_configurations`](#hvac.v1.Client.list_vault_ec2_certificate_configurations "hvac.v1.Client.list_vault_ec2_certificate_configurations")([…]) | Call to deprecated function ‘list\_vault\_ec2\_certificate\_configurations’. |

| [`login`](#hvac.v1.Client.login "hvac.v1.Client.login")(url[, use\_token]) | Perform a login request. |

| [`logout`](#hvac.v1.Client.logout "hvac.v1.Client.logout")([revoke\_token]) | Clears the token used for authentication, optionally revoking it before doing so. |

| [`lookup\_token`](#hvac.v1.Client.lookup_token "hvac.v1.Client.lookup_token")([token, accessor, wrap\_ttl]) | GET /auth/token/lookup/<token> |

| [`read`](#hvac.v1.Client.read "hvac.v1.Client.read")(path[, wrap\_ttl]) | GET /<path> |

| [`read\_lease`](#hvac.v1.Client.read_lease "hvac.v1.Client.read_lease")(lease\_id) | Call to deprecated function ‘read\_lease’. |

| [`read\_userpass`](#hvac.v1.Client.read_userpass "hvac.v1.Client.read_userpass")(username[, mount\_point]) | Call to deprecated function ‘read\_userpass’. |

| [`rekey`](#hvac.v1.Client.rekey "hvac.v1.Client.rekey")(key[, nonce]) | Call to deprecated function ‘rekey’. |

| [`rekey\_multi`](#hvac.v1.Client.rekey_multi "hvac.v1.Client.rekey_multi")(keys[, nonce]) | Call to deprecated function ‘rekey\_multi’. |

| [`remount\_secret\_backend`](#hvac.v1.Client.remount_secret_backend "hvac.v1.Client.remount_secret_backend")(from\_mount\_point, …) | Call to deprecated function ‘remount\_secret\_backend’. |

| [`renew\_secret`](#hvac.v1.Client.renew_secret "hvac.v1.Client.renew_secret")(lease\_id[, increment]) | Call to deprecated function ‘renew\_secret’. |

| [`renew\_self\_token`](#hvac.v1.Client.renew_self_token "hvac.v1.Client.renew_self_token")([increment, wrap\_ttl]) | Call to deprecated function ‘renew\_self\_token’. |

| [`renew\_token`](#hvac.v1.Client.renew_token "hvac.v1.Client.renew_token")([token, increment, wrap\_ttl]) | POST /auth/token/renew |

| [`revoke\_secret`](#hvac.v1.Client.revoke_secret "hvac.v1.Client.revoke_secret")(lease\_id) | Call to deprecated function ‘revoke\_secret’. |

| [`revoke\_secret\_prefix`](#hvac.v1.Client.revoke_secret_prefix "hvac.v1.Client.revoke_secret_prefix")(path\_prefix) | Call to deprecated function ‘revoke\_secret\_prefix’. |

| [`revoke\_self\_token`](#hvac.v1.Client.revoke_self_token "hvac.v1.Client.revoke_self_token")() | Call to deprecated function ‘revoke\_self\_token’. |

| [`revoke\_token`](#hvac.v1.Client.revoke_token "hvac.v1.Client.revoke_token")(token[, orphan, accessor]) | POST /auth/token/revoke |

| [`revoke\_token\_prefix`](#hvac.v1.Client.revoke_token_prefix "hvac.v1.Client.revoke_token_prefix")(prefix) | Call to deprecated function ‘revoke\_token\_prefix’. |

| [`rotate`](#hvac.v1.Client.rotate "hvac.v1.Client.rotate")() | Call to deprecated function ‘rotate’. |

| [`seal`](#hvac.v1.Client.seal "hvac.v1.Client.seal")() | Call to deprecated function ‘seal’. |

| [`set\_policy`](#hvac.v1.Client.set_policy "hvac.v1.Client.set_policy")(name, rules) | Call to deprecated function ‘set\_policy’. |

| [`set\_role\_id`](#hvac.v1.Client.set_role_id "hvac.v1.Client.set_role_id")(role\_name, role\_id[, mount\_point]) | Call to deprecated function ‘set\_role\_id’. |

| [`start\_generate\_root`](#hvac.v1.Client.start_generate_root "hvac.v1.Client.start_generate_root")(key[, otp]) | Call to deprecated function ‘start\_generate\_root’. |

| [`start\_rekey`](#hvac.v1.Client.start_rekey "hvac.v1.Client.start_rekey")([secret\_shares, …]) | Call to deprecated function ‘start\_rekey’. |

| [`token\_role`](#hvac.v1.Client.token_role "hvac.v1.Client.token_role")(role) | Call to deprecated function ‘token\_role’. |

| [`transit\_create\_key`](#hvac.v1.Client.transit_create_key "hvac.v1.Client.transit_create_key")(name[, …]) | Call to deprecated function ‘transit\_create\_key’. |

| [`transit\_decrypt\_data`](#hvac.v1.Client.transit_decrypt_data "hvac.v1.Client.transit_decrypt_data")(name, ciphertext[, …]) | Call to deprecated function ‘transit\_decrypt\_data’. |

| [`transit\_delete\_key`](#hvac.v1.Client.transit_delete_key "hvac.v1.Client.transit_delete_key")(name[, mount\_point]) | Call to deprecated function ‘transit\_delete\_key’. |

| [`transit\_encrypt\_data`](#hvac.v1.Client.transit_encrypt_data "hvac.v1.Client.transit_encrypt_data")(name, plaintext[, …]) | Call to deprecated function ‘transit\_encrypt\_data’. |

| [`transit\_export\_key`](#hvac.v1.Client.transit_export_key "hvac.v1.Client.transit_export_key")(name, key\_type[, …]) | Call to deprecated function ‘transit\_export\_key’. |

| [`transit\_generate\_data\_key`](#hvac.v1.Client.transit_generate_data_key "hvac.v1.Client.transit_generate_data_key")(name, key\_type[, …]) | Call to deprecated function ‘transit\_generate\_data\_key’. |

| [`transit\_generate\_hmac`](#hvac.v1.Client.transit_generate_hmac "hvac.v1.Client.transit_generate_hmac")(name, hmac\_input[, …]) | Call to deprecated function ‘transit\_generate\_hmac’. |

| [`transit\_generate\_rand\_bytes`](#hvac.v1.Client.transit_generate_rand_bytes "hvac.v1.Client.transit_generate_rand_bytes")([data\_bytes, …]) | Call to deprecated function ‘transit\_generate\_rand\_bytes’. |

| [`transit\_hash\_data`](#hvac.v1.Client.transit_hash_data "hvac.v1.Client.transit_hash_data")(hash\_input[, algorithm, …]) | Call to deprecated function ‘transit\_hash\_data’. |

| [`transit\_list\_keys`](#hvac.v1.Client.transit_list_keys "hvac.v1.Client.transit_list_keys")([mount\_point]) | Call to deprecated function ‘transit\_list\_keys’. |

| [`transit\_read\_key`](#hvac.v1.Client.transit_read_key "hvac.v1.Client.transit_read_key")(name[, mount\_point]) | Call to deprecated function ‘transit\_read\_key’. |

| [`transit\_rewrap\_data`](#hvac.v1.Client.transit_rewrap_data "hvac.v1.Client.transit_rewrap_data")(name, ciphertext[, …]) | Call to deprecated function ‘transit\_rewrap\_data’. |

| [`transit\_rotate\_key`](#hvac.v1.Client.transit_rotate_key "hvac.v1.Client.transit_rotate_key")(name[, mount\_point]) | Call to deprecated function ‘transit\_rotate\_key’. |

| [`transit\_sign\_data`](#hvac.v1.Client.transit_sign_data "hvac.v1.Client.transit_sign_data")(name, input\_data[, …]) | Call to deprecated function ‘transit\_sign\_data’. |

| [`transit\_update\_key`](#hvac.v1.Client.transit_update_key "hvac.v1.Client.transit_update_key")(name[, …]) | Call to deprecated function ‘transit\_update\_key’. |

| [`transit\_verify\_signed\_data`](#hvac.v1.Client.transit_verify_signed_data "hvac.v1.Client.transit_verify_signed_data")(name, input\_data) | Call to deprecated function ‘transit\_verify\_signed\_data’. |

| [`tune\_auth\_backend`](#hvac.v1.Client.tune_auth_backend "hvac.v1.Client.tune_auth_backend")(backend\_type[, …]) | Call to deprecated function ‘tune\_auth\_backend’. |

| [`tune\_secret\_backend`](#hvac.v1.Client.tune_secret_backend "hvac.v1.Client.tune_secret_backend")(backend\_type[, …]) | Call to deprecated function ‘tune\_secret\_backend’. |

| [`unseal`](#hvac.v1.Client.unseal "hvac.v1.Client.unseal")(key) | Call to deprecated function ‘unseal’. |

| [`unseal\_multi`](#hvac.v1.Client.unseal_multi "hvac.v1.Client.unseal_multi")(keys) | Call to deprecated function ‘unseal\_multi’. |

| [`unseal\_reset`](#hvac.v1.Client.unseal_reset "hvac.v1.Client.unseal_reset")() | Call to deprecated function ‘unseal\_reset’. |

| [`unwrap`](#hvac.v1.Client.unwrap "hvac.v1.Client.unwrap")([token]) | Call to deprecated function ‘unwrap’. |

| [`update\_userpass\_password`](#hvac.v1.Client.update_userpass_password "hvac.v1.Client.update_userpass_password")(username, password) | Call to deprecated function ‘update\_userpass\_password’. |

| [`update\_userpass\_policies`](#hvac.v1.Client.update_userpass_policies "hvac.v1.Client.update_userpass_policies")(username, policies) | Call to deprecated function ‘update\_userpass\_policies’. |

| [`urljoin`](#hvac.v1.Client.urljoin "hvac.v1.Client.urljoin")(\*args, \*\*kwargs) | Call to deprecated function ‘urljoin’. |

| [`write`](#hvac.v1.Client.write "hvac.v1.Client.write")(path[, wrap\_ttl]) | POST /<path> |

**Attributes**

| [`adapter`](#hvac.v1.Client.adapter "hvac.v1.Client.adapter") |  |

| [`allow\_redirects`](#hvac.v1.Client.allow_redirects "hvac.v1.Client.allow_redirects") |  |

| [`auth`](#hvac.v1.Client.auth "hvac.v1.Client.auth") | Accessor for the Client instance’s auth methods. |

| [`generate\_root\_status`](#hvac.v1.Client.generate_root_status "hvac.v1.Client.generate_root_status") |  |

| [`ha\_status`](#hvac.v1.Client.ha_status "hvac.v1.Client.ha_status") | Read the high availability status and current leader instance of Vault. |

| [`key\_status`](#hvac.v1.Client.key_status "hvac.v1.Client.key_status") | GET /sys/key-status |

| [`rekey\_status`](#hvac.v1.Client.rekey_status "hvac.v1.Client.rekey_status") |  |

| [`seal\_status`](#hvac.v1.Client.seal_status "hvac.v1.Client.seal_status") | Read the seal status of the Vault. |

| [`secrets`](#hvac.v1.Client.secrets "hvac.v1.Client.secrets") | Accessor for the Client instance’s secrets engines. |

| [`session`](#hvac.v1.Client.session "hvac.v1.Client.session") |  |

| [`sys`](#hvac.v1.Client.sys "hvac.v1.Client.sys") | Accessor for the Client instance’s system backend methods. |

| [`token`](#hvac.v1.Client.token "hvac.v1.Client.token") |  |

| [`url`](#hvac.v1.Client.url "hvac.v1.Client.url") |  |

`__init__`(*url=None*, *token=None*, *cert=None*, *verify=None*, *timeout=30*, *proxies=None*, *allow\_redirects=True*, *session=None*, *adapter=<class 'hvac.adapters.JSONAdapter'>*, *namespace=None*, *\*\*kwargs*)[[source]](_modules/hvac/v1.html#Client.__init__)[¶](#hvac.v1.Client.__init__ "Permalink to this definition")

Creates a new hvac client instance.

Parameters

* **url** (*str*) – Base URL for the Vault instance being addressed.

* **token** (*str*) – Authentication token to include in requests sent to Vault.

* **cert** (*tuple*) – Certificates for use in requests sent to the Vault instance. This should be a tuple with the

certificate and then key.

* **verify** (*Union**[**bool**,**str**]*) – Either a boolean to indicate whether TLS verification should be performed when sending requests to Vault,

or a string pointing at the CA bundle to use for verification. See <http://docs.python-requests.org/en/master/user/advanced/#ssl-cert-verification>.

* **timeout** (*int*) – The timeout value for requests sent to Vault.

* **proxies** (*dict*) – Proxies to use when performing requests.

See: <http://docs.python-requests.org/en/master/user/advanced/#proxies>

* **allow\_redirects** (*bool*) – Whether to follow redirects when sending requests to Vault.

* **session** (*request.Session*) – Optional session object to use when performing request.

* **adapter** ([*hvac.adapters.Adapter*](index.html#hvac.adapters.Adapter "hvac.adapters.Adapter")) – Optional class to be used for performing requests. If none is provided, defaults to

hvac.adapters.JSONRequest

* **kwargs** (*dict*) – Additional parameters to pass to the adapter constructor.

* **namespace** (*str*) – Optional Vault Namespace.

*property* `adapter`[¶](#hvac.v1.Client.adapter "Permalink to this definition")

*property* `allow_redirects`[¶](#hvac.v1.Client.allow_redirects "Permalink to this definition")

`audit_hash`(*name*, *input*)[[source]](_modules/hvac/v1.html#Client.audit_hash)[¶](#hvac.v1.Client.audit_hash "Permalink to this definition")

Call to deprecated function ‘audit\_hash’. This method will be removed in version ‘0.9.0’ Please use the ‘calculate\_hash’ method on the ‘hvac.api.system\_backend.audit’ class moving forward.Docstring content from this method’s replacement copied below:

Hash the given input data with the specified audit device’s hash function and salt.

This endpoint can be used to discover whether a given plaintext string (the input parameter) appears in the

audit log in obfuscated form.

Supported methods:POST: /sys/audit-hash/{path}. Produces: 204 (empty body)

Parameters

* **path** (*str | unicode*) – The path of the audit device to generate hashes for. This is part of the request URL.

* **input\_to\_hash** (*str | unicode*) – The input string to hash.

Returns

The JSON response of the request.

Return type

requests.Response

*property* `auth`[¶](#hvac.v1.Client.auth "Permalink to this definition")

Accessor for the Client instance’s auth methods. Provided via the [`hvac.api.AuthMethods`](index.html#hvac.api.AuthMethods "hvac.api.AuthMethods") class.

:return: This Client instance’s associated Auth instance.

:rtype: hvac.api.AuthMethods

`auth_app_id`(*app\_id*, *user\_id*, *mount\_point='app-id'*, *use\_token=True*)[[source]](_modules/hvac/v1.html#Client.auth_app_id)[¶](#hvac.v1.Client.auth_app_id "Permalink to this definition")

Call to deprecated function ‘auth\_app\_id’. This method will be removed in version ‘1.0.0’

`auth_approle`(*role\_id*, *secret\_id=None*, *mount\_point='approle'*, *use\_token=True*)[[source]](_modules/hvac/v1.html#Client.auth_approle)[¶](#hvac.v1.Client.auth_approle "Permalink to this definition")

Call to deprecated function ‘auth\_approle’. This method will be removed in version ‘0.12.0’ Please use the ‘login’ method on the ‘hvac.api.auth\_methods.approle’ class moving forward.Docstring content from this method’s replacement copied below:

Login with APPROLE credentials.

Supported methods:POST: /auth/{mount\_point}/login. Produces: 200 application/json

Parameters

* **role\_id** (*str | unicode*) – Role ID of the role.

* **secret\_id** (*str | unicode*) – Secret ID of the role.

* **use\_token** (*bool*) – if True, uses the token in the response received from the auth request to set the “token”

attribute on the the [`hvac.adapters.Adapter()`](index.html#hvac.adapters.Adapter "hvac.adapters.Adapter") instance under the \_adapater Client attribute.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the read\_role\_id request.

Return type

dict

`auth_aws_iam`(*access\_key*, *secret\_key*, *session\_token=None*, *header\_value=None*, *mount\_point='aws'*, *role=''*, *use\_token=True*, *region='us-east-1'*)[[source]](_modules/hvac/v1.html#Client.auth_aws_iam)[¶](#hvac.v1.Client.auth_aws_iam "Permalink to this definition")

Call to deprecated function ‘auth\_aws\_iam’. This method will be removed in version ‘0.11.2’ Please use the ‘iam\_login’ method on the ‘hvac.api.auth\_methods.aws’ class moving forward.

> 

> Docstring content from this method’s replacement copied below:

> Fetch a token

> 

> 

> 

This endpoint verifies the pkcs7 signature of the instance identity document or the signature of the

signed GetCallerIdentity request. With the ec2 auth method, or when inferring an EC2 instance,

verifies that the instance is actually in a running state. Cross checks the constraints defined on the

role with which the login is being performed. With the ec2 auth method, as an alternative to pkcs7

signature, the identity document along with its RSA digest can be supplied to this endpoint

Parameters

* **role** (*str*) – Name of the role against which the login is being attempted.

* **use\_token** (*bool*) – if True, uses the token in the response received from the auth request to set the “token”

attribute on the the [`hvac.adapters.Adapter()`](index.html#hvac.adapters.Adapter "hvac.adapters.Adapter") instance under the \_adapater Client attribute.

* **mount\_point** (*str*) – The path the AWS auth method was mounted on.

Returns

The response of the request.

Return type

requests.Response

`auth_cubbyhole`(*token*)[[source]](_modules/hvac/v1.html#Client.auth_cubbyhole)[¶](#hvac.v1.Client.auth_cubbyhole "Permalink to this definition")

Perform a login request with a wrapped token.

Stores the unwrapped token in the resulting Vault response for use by the [`hvac.adapters.Adapter()`](index.html#hvac.adapters.Adapter "hvac.adapters.Adapter")instance under the \_adapater Client attribute.

Parameters

**token** (*str | unicode*) – Wrapped token

Returns

The (JSON decoded) response of the auth request

Return type

dict

`auth_ec2`(*pkcs7*, *nonce=None*, *role=None*, *use\_token=True*, *mount\_point='aws-ec2'*)[[source]](_modules/hvac/v1.html#Client.auth_ec2)[¶](#hvac.v1.Client.auth_ec2 "Permalink to this definition")

Call to deprecated function ‘auth\_ec2’. This method will be removed in version ‘0.11.2’ Please use the ‘ec2\_login’ method on the ‘hvac.api.auth\_methods.aws’ class moving forward.Docstring content from this method’s replacement copied below:

Retrieve a Vault token using an AWS authentication method mount’s EC2 role.

Parameters

* **pkcs7** (*str*) – PKCS7 signature of the identity document with all newline characters removed.

* **nonce** (*str*) – The nonce to be used for subsequent login requests.

* **role** (*str*) – Name of the role against which the login is being attempted.

* **use\_token** (*bool*) – if True, uses the token in the response received from the auth request to set the “token”

attribute on the the [`hvac.adapters.Adapter()`](index.html#hvac.adapters.Adapter "hvac.adapters.Adapter") instance under the \_adapater Client attribute.

* **mount\_point** (*str*) – The path the AWS auth method was mounted on.

Returns

The response of the request.

Return type

requests.Response

`auth_gcp`(*\*args*, *\*\*kwargs*)[[source]](_modules/hvac/v1.html#Client.auth_gcp)[¶](#hvac.v1.Client.auth_gcp "Permalink to this definition")

Call to deprecated function ‘auth\_gcp’. This method will be removed in version ‘0.9.0’ Please use the ‘login’ method on the ‘hvac.api.auth\_methods.gcp’ class moving forward.Docstring content from this method’s replacement copied below:

Login to retrieve a Vault token via the GCP auth method.

This endpoint takes a signed JSON Web Token (JWT) and a role name for some entity. It verifies the JWTsignature with Google Cloud to authenticate that entity and then authorizes the entity for the given role.

Supported methods:POST: /auth/{mount\_point}/login. Produces: 200 application/json

Parameters

* **role** (*str | unicode*) – The name of the role against which the login is being attempted.

* **jwt** (*str | unicode*) – A signed JSON web token

* **use\_token** (*bool*) – if True, uses the token in the response received from the auth request to set the “token”

attribute on the the [`hvac.adapters.Adapter()`](index.html#hvac.adapters.Adapter "hvac.adapters.Adapter") instance under the \_adapater Client attribute.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

`auth_github`(*\*args*, *\*\*kwargs*)[[source]](_modules/hvac/v1.html#Client.auth_github)[¶](#hvac.v1.Client.auth_github "Permalink to this definition")

Call to deprecated function ‘auth\_github’. This method will be removed in version ‘0.8.0’ Please use the ‘login’ method on the ‘hvac.api.auth\_methods.github’ class moving forward.Docstring content from this method’s replacement copied below:

Login using GitHub access token.

Supported methods:POST: /auth/{mount\_point}/login. Produces: 200 application/json

Parameters

* **token** (*str | unicode*) – GitHub personal API token.

* **use\_token** (*bool*) – if True, uses the token in the response received from the auth request to set the “token”

attribute on the the [`hvac.adapters.Adapter()`](index.html#hvac.adapters.Adapter "hvac.adapters.Adapter") instance under the \_adapater Client attribute.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the login request.

Return type

dict

`auth_kubernetes`(*role*, *jwt*, *use\_token=True*, *mount\_point='kubernetes'*)[[source]](_modules/hvac/v1.html#Client.auth_kubernetes)[¶](#hvac.v1.Client.auth_kubernetes "Permalink to this definition")

Call to deprecated function ‘auth\_kubernetes’. This method will be removed in version ‘1.0.0’ Please use the ‘login’ method on the ‘hvac.api.auth\_methods.kubernetes’ class moving forward.Docstring content from this method’s replacement copied below:

Fetch a token.

This endpoint takes a signed JSON Web Token (JWT) and a role name for some entity. It verifies the JWT signature

to authenticate that entity and then authorizes the entity for the given role.

Supported methods:POST: /auth/{mount\_point}/login. Produces: 200 application/json

Parameters

* **role** (*str | unicode*) – Name of the role against which the login is being attempted.

* **jwt** (*str | unicode*) – Signed JSON Web Token (JWT) from Azure MSI.

* **use\_token** (*bool*) – if True, uses the token in the response received from the auth request to set the “token”

attribute on the the [`hvac.adapters.Adapter()`](index.html#hvac.adapters.Adapter "hvac.adapters.Adapter") instance under the \_adapater Client attribute.

* **mount\_point** (*str | unicode*) – The “path” the azure auth method was mounted on.

Returns

The JSON response of the request.

Return type

dict

`auth_ldap`(*\*args*, *\*\*kwargs*)[[source]](_modules/hvac/v1.html#Client.auth_ldap)[¶](#hvac.v1.Client.auth_ldap "Permalink to this definition")

Call to deprecated function ‘auth\_ldap’. This method will be removed in version ‘0.8.0’ Please use the ‘login’ method on the ‘hvac.api.auth\_methods.ldap’ class moving forward.Docstring content from this method’s replacement copied below:

Log in with LDAP credentials.

Supported methods:POST: /auth/{mount\_point}/login/{username}. Produces: 200 application/json

Parameters

* **username** (*str | unicode*) – The username of the LDAP user

* **password** (*str | unicode*) – The password for the LDAP user

* **use\_token** (*bool*) – if True, uses the token in the response received from the auth request to set the “token”

attribute on the the [`hvac.adapters.Adapter()`](index.html#hvac.adapters.Adapter "hvac.adapters.Adapter") instance under the \_adapater Client attribute.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the login\_with\_user request.

Return type

requests.Response

`auth_tls`(*mount\_point='cert'*, *use\_token=True*)[[source]](_modules/hvac/v1.html#Client.auth_tls)[¶](#hvac.v1.Client.auth_tls "Permalink to this definition")

Call to deprecated function ‘auth\_tls’. This method will be removed in version ‘0.13.0’ Please use the ‘login’ method on the ‘hvac.api.auth\_methods.cert’ class moving forward.Docstring content from this method’s replacement copied below:

Log in and fetch a token. If there is a valid chain to a CA configured in the method and all role constraintsare matched, a token will be issued. If the certificate has DNS SANs in it, each of those will be verified.

If Common Name is required to be verified, then it should be a fully qualified DNS domain name and must be

duplicated as a DNS SAN

Supported methods:POST: /auth/<mount point>/login Produces: 200 application/json

Parameters

* **name** (*str | unicode*) – Authenticate against only the named certificate role, returning its policy list if successful. If

not set, defaults to trying all certificate roles and returning any one that matches.

* **cacert** (*str | bool*) – The value used here is for the Vault TLS Listener CA certificate, not the CA that issued the

client authentication certificate. This can be omitted if the CA used to issue the Vault server certificate

is trusted by the local system executing this command.

* **cert\_pem** – Location of the cert.pem used to authenticate the host.

* **key\_pem** – Location of the public key.pem used to authenticate the host.

* **key\_pem** – str | unicode

* **mount\_point** –

* **use\_token** – If the returned token is stored in the client

* **use\_token** – bool

Tupe cert\_pem

str | unicode

Returns

The response of the login request.

Return type

requests.Response

`auth_userpass`(*username*, *password*, *mount\_point='userpass'*, *use\_token=True*, *\*\*kwargs*)[[source]](_modules/hvac/v1.html#Client.auth_userpass)[¶](#hvac.v1.Client.auth_userpass "Permalink to this definition")

Call to deprecated function ‘auth\_userpass’. This method will be removed in version ‘1.0.0’ Please use the ‘login’ method on the ‘hvac.api.auth\_methods.userpass’ class moving forward.Docstring content from this method’s replacement copied below:

Log in with USERPASS credentials.

Supported methods:POST: /auth/{mount\_point}/login/{username}. Produces: 200 application/json

Parameters

* **username** (*str | unicode*) – The username for the user.

* **password** (*str | unicode*) – The password for the user. Only required when creating the user.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

`cancel_generate_root`()[[source]](_modules/hvac/v1.html#Client.cancel_generate_root)[¶](#hvac.v1.Client.cancel_generate_root "Permalink to this definition")

Call to deprecated function ‘cancel\_generate\_root’. This method will be removed in version ‘0.9.0’ Please use the ‘cancel\_root\_generation’ method on the ‘hvac.api.system\_backend.key’ class moving forward.Docstring content from this method’s replacement copied below:

Cancel any in-progress root generation attempt.

This clears any progress made. This must be called to change the OTP or PGP key being used.

Supported methods:DELETE: /sys/generate-root/attempt. Produces: 204 (empty body)

Returns

The response of the request.

Return type

request.Response

`cancel_rekey`()[[source]](_modules/hvac/v1.html#Client.cancel_rekey)[¶](#hvac.v1.Client.cancel_rekey "Permalink to this definition")

Call to deprecated function ‘cancel\_rekey’. This method will be removed in version ‘0.9.0’ Please use the ‘cancel\_rekey’ method on the ‘hvac.api.system\_backend.key’ class moving forward.Docstring content from this method’s replacement copied below:

Cancel any in-progress rekey.

This clears the rekey settings as well as any progress made. This must be called to change the parameters of the

rekey.

Note: Verification is still a part of a rekey. If rekeying is canceled during the verification flow, the current

unseal keys remain valid.

Supported methods:DELETE: /sys/rekey/init. Produces: 204 (empty body)

DELETE: /sys/rekey-recovery-key/init. Produces: 204 (empty body)

Parameters

**recovery\_key** (*bool*) – If true, send requests to “rekey-recovery-key” instead of “rekey” api path.

Returns

The response of the request.

Return type

requests.Response

`close`()[[source]](_modules/hvac/v1.html#Client.close)[¶](#hvac.v1.Client.close "Permalink to this definition")

Call to deprecated function ‘close’. This method will be removed in version ‘0.8.0’ Please use the ‘close’ method on the ‘hvac.adapters’ class moving forward.

Docstring content from this method’s replacement copied below:

Close the underlying Requests session.

`create_app_id`(*app\_id*, *policies*, *display\_name=None*, *mount\_point='app-id'*, *\*\*kwargs*)[[source]](_modules/hvac/v1.html#Client.create_app_id)[¶](#hvac.v1.Client.create_app_id "Permalink to this definition")

Call to deprecated function ‘create\_app\_id’. This method will be removed in version ‘1.0.0’

`create_ec2_role`(*role*, *bound\_ami\_id=None*, *bound\_account\_id=None*, *bound\_iam\_role\_arn=None*, *bound\_iam\_instance\_profile\_arn=None*, *bound\_ec2\_instance\_id=None*, *bound\_region=None*, *bound\_vpc\_id=None*, *bound\_subnet\_id=None*, *role\_tag=None*, *ttl=None*, *max\_ttl=None*, *period=None*, *policies=None*, *allow\_instance\_migration=False*, *disallow\_reauthentication=False*, *resolve\_aws\_unique\_ids=None*, *mount\_point='aws-ec2'*)[[source]](_modules/hvac/v1.html#Client.create_ec2_role)[¶](#hvac.v1.Client.create_ec2_role "Permalink to this definition")

Call to deprecated function ‘create\_ec2\_role’. This method will be removed in version ‘0.11.2’ Please use the ‘create\_role’ method on the ‘hvac.api.auth\_methods.aws’ class moving forward.Docstring content from this method’s replacement copied below:

Register a role in the method.

Parameters

* **role** –

* **auth\_type** –

* **bound\_ami\_id** –

* **bound\_account\_id** –

* **bound\_region** –

* **bound\_vpc\_id** –

* **bound\_subnet\_id** –

* **bound\_iam\_role\_arn** –

* **bound\_iam\_instance\_profile\_arn** –

* **bound\_ec2\_instance\_id** –

* **role\_tag** –

* **bound\_iam\_principal\_arn** –

* **inferred\_entity\_type** –

* **inferred\_aws\_region** –

* **resolve\_aws\_unique\_ids** –

* **ttl** –

* **max\_ttl** –

* **period** –

* **policies** –

* **allow\_instance\_migration** –

* **disallow\_reauthentication** –

* **mount\_point** (*str*) – The path the AWS auth method was mounted on.

Returns

The response of the request.

Return type

requests.Response

`create_ec2_role_tag`(*role*, *policies=None*, *max\_ttl=None*, *instance\_id=None*, *disallow\_reauthentication=False*, *allow\_instance\_migration=False*, *mount\_point='aws-ec2'*)[[source]](_modules/hvac/v1.html#Client.create_ec2_role_tag)[¶](#hvac.v1.Client.create_ec2_role_tag "Permalink to this definition")

Call to deprecated function ‘create\_ec2\_role\_tag’. This method will be removed in version ‘0.11.2’ Please use the ‘create\_role\_tags’ method on the ‘hvac.api.auth\_methods.aws’ class moving forward.Docstring content from this method’s replacement copied below:

Create a role tag on the role, which helps in restricting the capabilities that are set on the role.

Role tags are not tied to any specific ec2 instance unless specified explicitly using the

instance\_id parameter. By default, role tags are designed to be used across all instances that

satisfies the constraints on the role. Regardless of which instances have role tags on them, capabilities

defined in a role tag must be a strict subset of the given role’s capabilities. Note that, since adding

and removing a tag is often a widely distributed privilege, care needs to be taken to ensure that the

instances are attached with correct tags to not let them gain more privileges than what were intended.

If a role tag is changed, the capabilities inherited by the instance will be those defined on the new role

tag. Since those must be a subset of the role capabilities, the role should never provide more capabilities

than any given instance can be allowed to gain in a worst-case scenario

Parameters

* **role** (*str*) – Name of the role.

* **policies** (*list*) – Policies to be associated with the tag. If set, must be a subset of the role’s policies. If

set, but set to an empty value, only the ‘default’ policy will be given to issued tokens.

* **max\_ttl** (*str*) – The maximum allowed lifetime of tokens issued using this role.

* **instance\_id** (*str*) – Instance ID for which this tag is intended for. If set, the created tag can only be used by

the instance with the given ID.

* **disallow\_reauthentication** (*bool*) – If set, only allows a single token to be granted per instance ID. This can be

cleared with the auth/aws/identity-whitelist endpoint. Defaults to ‘false’. Mutually exclusive with

allow\_instance\_migration.

* **allow\_instance\_migration** (*bool*) – If set, allows migration of the underlying instance where the client resides.

This keys off of pendingTime in the metadata document, so essentially, this disables the client nonce check

whenever the instance is migrated to a new host and pendingTime is newer than the previously-remembered

time. Use with caution. Defaults to ‘false’. Mutually exclusive with disallow\_reauthentication.

* **mount\_point** (*str*) – The path the AWS auth method was mounted on.

Returns

The create role tag response.

Return type

dict

`create_kubernetes_configuration`(*kubernetes\_host*, *kubernetes\_ca\_cert=None*, *token\_reviewer\_jwt=None*, *pem\_keys=None*, *mount\_point='kubernetes'*)[[source]](_modules/hvac/v1.html#Client.create_kubernetes_configuration)[¶](#hvac.v1.Client.create_kubernetes_configuration "Permalink to this definition")

Call to deprecated function ‘create\_kubernetes\_configuration’. This method will be removed in version ‘1.0.0’ Please use the ‘configure’ method on the ‘hvac.api.auth\_methods.kubernetes’ class moving forward.Docstring content from this method’s replacement copied below:

Configure the connection parameters for Kubernetes.

This path honors the distinction between the create and update capabilities inside ACL policies.

Supported methods:POST: /auth/{mount\_point}/config. Produces: 204 (empty body)

Parameters

* **kubernetes\_host** (*str | unicode*) – Host must be a host string, a host:port pair, or a URL to the base of the

Kubernetes API server. Example: https://k8s.example.com:443

* **kubernetes\_ca\_cert** (*str | unicode*) – PEM encoded CA cert for use by the TLS client used to talk with the Kubernetes API.

NOTE: Every line must end with a newline:

* **token\_reviewer\_jwt** (*str | unicode*) – A service account JWT used to access the TokenReview API to validate other

JWTs during login. If not set the JWT used for login will be used to access the API.

* **pem\_keys** (*list*) – Optional list of PEM-formatted public keys or certificates used to verify the signatures of

Kubernetes service account JWTs. If a certificate is given, its public key will be extracted. Not every

installation of Kubernetes exposes these keys.

* **issuer** – Optional JWT issuer.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the configure\_method request.

Return type

requests.Response

`create_kubernetes_role`(*name*, *bound\_service\_account\_names*, *bound\_service\_account\_namespaces*, *ttl=''*, *max\_ttl=''*, *period=''*, *policies=None*, *token\_type=''*, *mount\_point='kubernetes'*)[[source]](_modules/hvac/v1.html#Client.create_kubernetes_role)[¶](#hvac.v1.Client.create_kubernetes_role "Permalink to this definition")

Call to deprecated function ‘create\_kubernetes\_role’. This method will be removed in version ‘1.0.0’ Please use the ‘create\_role’ method on the ‘hvac.api.auth\_methods.kubernetes’ class moving forward.Docstring content from this method’s replacement copied below:

Create a role in the method.

Registers a role in the auth method. Role types have specific entities that can perform login operations

against this endpoint. Constraints specific to the role type must be set on the role. These are applied to

the authenticated entities attempting to login.

Supported methods:POST: /auth/{mount\_point}/role/{name}. Produces: 204 (empty body)

Parameters

* **name** (*str | unicode*) – Name of the role.

* **bound\_service\_account\_names** (*list | str | unicode*) – List of service account names able to access this role. If set to “\*”

all names are allowed.

* **bound\_service\_account\_namespaces** (*list | str | unicode*) – List of namespaces allowed to access this role. If set to “\*” all

namespaces are allowed.

* **ttl** (*str | unicode*) – The TTL period of tokens issued using this role in seconds.

* **max\_ttl** (*str | unicode*) – The maximum allowed lifetime of tokens issued in seconds using this role.

* **period** (*str | unicode*) – If set, indicates that the token generated using this role should never expire. The token should

be renewed within the duration specified by this value. At each renewal, the token’s TTL will be set to the

value of this parameter.

* **policies** (*list | str | unicode*) – Policies to be set on tokens issued using this role.

* **token\_type** (*str*) – The type of token that should be generated. Can be service, batch, or default to use the

mount’s tuned default (which unless changed will be service tokens). For token store roles, there are two

additional possibilities: default-service and default-batch which specify the type to return unless the

client requests a different type at generation time.

* **mount\_point** (*str | unicode*) – The “path” the azure auth method was mounted on.

Returns

The response of the request.

Return type

requests.Response

`create_role`(*role\_name*, *mount\_point='approle'*, *\*\*kwargs*)[[source]](_modules/hvac/v1.html#Client.create_role)[¶](#hvac.v1.Client.create_role "Permalink to this definition")

Call to deprecated function ‘create\_role’. This method will be removed in version ‘0.12.0’ Please use the ‘create\_or\_update\_approle’ method on the ‘hvac.api.auth\_methods.approle’ class moving forward.Docstring content from this method’s replacement copied below:

Create/update approle.

Supported methods:POST: /auth/{mount\_point}/role/{role\_name}. Produces: 204 (empty body)

Parameters

* **role\_name** (*str | unicode*) – The name for the approle.

* **bind\_secret\_id** (*bool*) – Require secret\_id to be presented when logging in using this approle.

* **secret\_id\_bound\_cidrs** (*list*) – Blocks of IP addresses which can perform login operations.

* **secret\_id\_num\_uses** (*int*) – Number of times any secret\_id can be used to fetch a token.

A value of zero allows unlimited uses.

* **secret\_id\_ttl** (*str | unicode*) – Duration after which a secret\_id expires. This can be specified

as an integer number of seconds or as a duration value like “5m”.

* **enable\_local\_secret\_ids** (*bool*) – Secret IDs generated using role will be cluster local.

* **token\_ttl** (*str | unicode*) – Incremental lifetime for generated tokens. This can be specified

as an integer number of seconds or as a duration value like “5m”.

* **token\_max\_ttl** (*str | unicode*) – Maximum lifetime for generated tokens: This can be specified

as an integer number of seconds or as a duration value like “5m”.

* **token\_policies** (*list*) – List of policies to encode onto generated tokens.

* **token\_bound\_cidrs** (*list*) – Blocks of IP addresses which can authenticate successfully.

* **token\_explicit\_max\_ttl** (*str | unicode*) – If set, will encode an explicit max TTL onto the token. This can be specified

as an integer number of seconds or as a duration value like “5m”.

* **token\_no\_default\_policy** (*bool*) – Do not add the default policy to generated tokens, use only tokens

specified in token\_policies.

* **token\_num\_uses** (*int*) – Maximum number of times a generated token may be used. A value of zero

allows unlimited uses.

* **token\_period** (*str | unicode*) – The period, if any, to set on the token. This can be specified

as an integer number of seconds or as a duration value like “5m”.

* **token\_type** (*str | unicode*) – The type of token that should be generated, can be “service”, “batch”, or “default”.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

`create_role_custom_secret_id`(*role\_name*, *secret\_id*, *meta=None*, *mount\_point='approle'*)[[source]](_modules/hvac/v1.html#Client.create_role_custom_secret_id)[¶](#hvac.v1.Client.create_role_custom_secret_id "Permalink to this definition")

Call to deprecated function ‘create\_role\_custom\_secret\_id’. This method will be removed in version ‘0.12.0’ Please use the ‘create\_custom\_secret\_id’ method on the ‘hvac.api.auth\_methods.approle’ class moving forward.Docstring content from this method’s replacement copied below:

Generates and issues a new Secret ID on a role in the auth method.

Supported methods:POST: /auth/{mount\_point}/role/{role\_name}/custom-secret-id. Produces: 200 application/json

Parameters

* **role\_name** (*str | unicode*) – The name for the role.

* **secret\_id** (*str | unicode*) – The Secret ID to read.

* **metadata** (*dict*) – Metadata to be tied to the Secret ID.

* **cidr\_list** (*list*) – Blocks of IP addresses which can perform login operations.

* **token\_bound\_cidrs** (*list*) – Blocks of IP addresses which can authenticate successfully.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the read\_role\_id request.

Return type

dict

`create_role_secret_id`(*role\_name*, *meta=None*, *cidr\_list=None*, *token\_bound\_cidrs=None*, *wrap\_ttl=None*, *mount\_point='approle'*)[[source]](_modules/hvac/v1.html#Client.create_role_secret_id)[¶](#hvac.v1.Client.create_role_secret_id "Permalink to this definition")

Call to deprecated function ‘create\_role\_secret\_id’. This method will be removed in version ‘0.12.0’ Please use the ‘generate\_secret\_id’ method on the ‘hvac.api.auth\_methods.approle’ class moving forward.Docstring content from this method’s replacement copied below:

Generates and issues a new Secret ID on a role in the auth method.

Supported methods:POST: /auth/{mount\_point}/role/{role\_name}/secret-id. Produces: 200 application/json

Parameters

* **role\_name** (*str | unicode*) – The name for the role.

* **metadata** (*dict*) – Metadata to be tied to the Secret ID.

* **cidr\_list** (*list*) – Blocks of IP addresses which can perform login operations.

* **token\_bound\_cidrs** (*list*) – Blocks of IP addresses which can authenticate successfully.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the read\_role\_id request.

Return type

dict

`create_token`(*role=None*, *token\_id=None*, *policies=None*, *meta=None*, *no\_parent=False*, *lease=None*, *display\_name=None*, *num\_uses=None*, *no\_default\_policy=False*, *ttl=None*, *orphan=False*, *wrap\_ttl=None*, *renewable=None*, *explicit\_max\_ttl=None*, *period=None*, *token\_type=None*)[[source]](_modules/hvac/v1.html#Client.create_token)[¶](#hvac.v1.Client.create_token "Permalink to this definition")

Call to deprecated function ‘create\_token’. This method will be removed in version ‘1.0.0’ Please use the ‘create’ method on the ‘hvac.api.auth\_methods.token’ class moving forward.Docstring content from this method’s replacement copied below:

Create a new token.

Certain options are only available when called by a root token. If used

via the /auth/token/create-orphan endpoint, a root token is not required

to create an orphan token (otherwise set with the no\_parent option). If

used with a role name in the path, the token will be created against the

specified role name; this may override options set during this call.

Parameters

* **id** (*str*) – The ID of the client token. Can only be specified by a root token.

The ID provided may not contain a . character. Otherwise, the

token ID is a randomly generated value.

* **role\_name** (*str*) – The name of the token role.

* **policies** (*list*) – A list of policies for the token. This must be a

subset of the policies belonging to the token making the request, unless root.

If not specified, defaults to all the policies of the calling token.

* **meta** (*map*) – A map of string to string valued metadata. This is

passed through to the audit devices.

* **no\_parent** (*bool*) – This argument only has effect if used by a root or sudo caller.

When set to True, the token created will not have a parent.

* **no\_default\_policy** (*bool*) – If True the default policy will not be contained in this token’s policy set.

* **renewable** (*bool*) – Set to false to disable the ability of the token to be renewed past its initial TTL.

Setting the value to true will allow the token to be renewable up to the system/mount maximum TTL.

* **ttl** (*str*) – The TTL period of the token, provided as “1h”, where hour is the largest suffix. If not provided,

the token is valid for the default lease TTL, or indefinitely if the root policy is used.

* **type** (*str*) – The token type. Can be “batch” or “service”. Defaults to the type

specified by the role configuration named by role\_name.

* **explicit\_max\_ttl** (*str*) – If set, the token will have an explicit max TTL set upon it.

This maximum token TTL cannot be changed later, and unlike with normal tokens, updates to the system/mount

max TTL value will have no effect at renewal time – the token will never be able to be renewed or used past

the value set at issue time.

* **display\_name** (*str*) – The display name of the token.

* **num\_uses** (*int*) – The maximum uses for the given token. This can be

used to create a one-time-token or limited use token. The value of 0 has no

limit to the number of uses.

* **period** (*str*) – If specified, the token will be periodic; it will have

no maximum TTL (unless an “explicit-max-ttl” is also set) but every renewal

will use the given period. Requires a root token or one with the sudo capability.

* **entity\_alias** (*str*) – Name of the entity alias to associate with during token creation.

Only works in combination with role\_name argument and used entity alias must be listed in

allowed\_entity\_aliases. If this has been specified, the entity will not be inherited from the parent.

* **wrap\_ttl** (*str*) – Specifies response wrapping token creation with duration. IE: ’15s’, ‘20m’, ‘25h’.

* **mount\_point** (*str*) – The “path” the method/backend was mounted on.

Returns

The response of the create request.

Return type

requests.Response

`create_token_role`(*role*, *allowed\_policies=None*, *disallowed\_policies=None*, *orphan=None*, *period=None*, *renewable=None*, *path\_suffix=None*, *explicit\_max\_ttl=None*)[[source]](_modules/hvac/v1.html#Client.create_token_role)[¶](#hvac.v1.Client.create_token_role "Permalink to this definition")

Call to deprecated function ‘create\_token\_role’. This method will be removed in version ‘1.0.0’ Please use the ‘create\_or\_update\_role’ method on the ‘hvac.api.auth\_methods.token’ class moving forward.Docstring content from this method’s replacement copied below:

Create (or replace) the named role.

Roles enforce specific behavior when creating tokens that allow token functionality that is otherwise not

available or would require sudo/root privileges to access. Role parameters, when set, override any provided

options to the create endpoints. The role name is also included in the token path, allowing all tokens created

against a role to be revoked using the /sys/leases/revoke-prefix endpoint.

Supported methods:POST: /auth/{mount\_point}/roles/{role\_name}.

Parameters

* **role\_name** (*str*) – The name of the token role.

* **allowed\_policies** (*list*) – will be added to the created

token automatically.

* **disallowed\_policies** (*list*) – being added automatically to created

tokens.

* **orphan** (*bool*) – tokens created against this policy will

be orphan tokens (they will have no parent). As such, they will not be

automatically revoked by the revocation of any other token.

* **renewable** (*bool*) – allow

the token to be renewable up to the system/mount maximum TTL.

* **path\_suffix** (*str*) –

* **allowed\_entity\_aliases** (*str*) – not case sensitive.

* **mount\_point** (*str*) – The “path” the method/backend was mounted on.

Returns

The response of the create\_or\_update\_role request.

Return type

requests.Response

`create_user_id`(*user\_id*, *app\_id*, *cidr\_block=None*, *mount\_point='app-id'*, *\*\*kwargs*)[[source]](_modules/hvac/v1.html#Client.create_user_id)[¶](#hvac.v1.Client.create_user_id "Permalink to this definition")

Call to deprecated function ‘create\_user\_id’. This method will be removed in version ‘1.0.0’

`create_userpass`(*username*, *password*, *policies*, *mount\_point='userpass'*, *\*\*kwargs*)[[source]](_modules/hvac/v1.html#Client.create_userpass)[¶](#hvac.v1.Client.create_userpass "Permalink to this definition")

Call to deprecated function ‘create\_userpass’. This method will be removed in version ‘1.0.0’ Please use the ‘create\_or\_update\_user’ method on the ‘hvac.api.auth\_methods.userpass’ class moving forward.Docstring content from this method’s replacement copied below:

Create/update user in userpass.

Supported methods:POST: /auth/{mount\_point}/users/{username}. Produces: 204 (empty body)

Parameters

* **username** (*str | unicode*) – The username for the user.

* **password** (*str | unicode*) – The password for the user. Only required when creating the user.

* **policies** (*str | unicode*) – The list of policies to be set on username created.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

* **kwargs** (*dict*) – Additional arguments to pass along with the corresponding request to Vault.

`create_vault_ec2_certificate_configuration`(*cert\_name*, *aws\_public\_cert*, *mount\_point='aws-ec2'*)[[source]](_modules/hvac/v1.html#Client.create_vault_ec2_certificate_configuration)[¶](#hvac.v1.Client.create_vault_ec2_certificate_configuration "Permalink to this definition")

Call to deprecated function ‘create\_vault\_ec2\_certificate\_configuration’. This method will be removed in version ‘0.11.2’ Please use the ‘create\_certificate\_configuration’ method on the ‘hvac.api.auth\_methods.aws’ class moving forward.Docstring content from this method’s replacement copied below:

Register AWS public key to be used to verify the instance identity documents.

While the PKCS#7 signature of the identity documents have DSA digest, the identity signature will have RSA

digest, and hence the public keys for each type varies respectively. Indicate the type of the public key using

the “type” parameter

Supported methods:POST: /auth/{mount\_point}/config/certificate/:cert\_name Produces: 204 (empty body)

Parameters

* **cert\_name** (*string | unicode*) – Name of the certificate

* **aws\_public\_cert** – Base64 encoded AWS Public key required to verify PKCS7 signature of the EC2 instance

metadata

* **document\_type** (*string | unicode*) – Takes the value of either “pkcs7” or “identity”, indicating the type of document which can be

verified using the given certificate

* **mount\_point** (*str | unicode*) – The path the AWS auth method was mounted on.

Returns

The response of the request

Return type

request.Response

`create_vault_ec2_client_configuration`(*access\_key*, *secret\_key*, *endpoint=None*, *mount\_point='aws-ec2'*)[[source]](_modules/hvac/v1.html#Client.create_vault_ec2_client_configuration)[¶](#hvac.v1.Client.create_vault_ec2_client_configuration "Permalink to this definition")

Call to deprecated function ‘create\_vault\_ec2\_client\_configuration’. This method will be removed in version ‘0.11.2’ Please use the ‘configure’ method on the ‘hvac.api.auth\_methods.aws’ class moving forward.Docstring content from this method’s replacement copied below:

Configure the credentials required to perform API calls to AWS as well as custom endpoints to talk to AWS API.

The instance identity document fetched from the PKCS#7 signature will provide the EC2 instance ID.

The credentials configured using this endpoint will be used to query the status of the instances via

DescribeInstances API. If static credentials are not provided using this endpoint, then the credentials will be

retrieved from the environment variables AWS\_ACCESS\_KEY, AWS\_SECRET\_KEY and AWS\_REGION respectively.

If the credentials are still not found and if the method is configured on an EC2 instance with metadata querying

capabilities, the credentials are fetched automatically

Supported methods:POST: /auth/{mount\_point}/config Produces: 204 (empty body)

Parameters

* **max\_retries** (*int*) – Number of max retries the client should use for recoverable errors.

The default (-1) falls back to the AWS SDK’s default behavior

* **access\_key** (*str | unicode*) – AWS Access key with permissions to query AWS APIs. The permissions required depend on the

specific configurations. If using the iam auth method without inferencing, then no credentials are

necessary. If using the ec2 auth method or using the iam auth method with inferencing, then these

credentials need access to ec2:DescribeInstances. If additionally a bound\_iam\_role is specified, then

these credentials also need access to iam:GetInstanceProfile. If, however, an alternate sts configuration

is set for the target account, then the credentials must be permissioned to call sts:AssumeRole on the

configured role, and that role must have the permissions described here

* **secret\_key** (*str | unicode*) – AWS Secret key with permissions to query AWS APIs

* **endpoint** (*str | unicode*) – URL to override the default generated endpoint for making AWS EC2 API calls

* **iam\_endpoint** (*str | unicode*) – URL to override the default generated endpoint for making AWS IAM API calls

* **sts\_endpoint** (*str | unicode*) – URL to override the default generated endpoint for making AWS STS API calls

* **iam\_server\_id\_header\_value** (*str | unicode*) – The value to require in the X-Vault-AWS-IAM-Server-ID header as part of

GetCallerIdentity requests that are used in the iam auth method. If not set, then no value is required or

validated. If set, clients must include an X-Vault-AWS-IAM-Server-ID header in the headers of login

requests, and further this header must be among the signed headers validated by AWS. This is to protect

against different types of replay attacks, for example a signed request sent to a dev server being resent

to a production server

* **mount\_point** (*str | unicode*) – The path the AWS auth method was mounted on.

Returns

The response of the request.

Return type

requests.Response

`delete`(*path*)[[source]](_modules/hvac/v1.html#Client.delete)[¶](#hvac.v1.Client.delete "Permalink to this definition")

DELETE /<path>

Parameters

**path** – 

Returns

Return type

`delete_app_id`(*app\_id*, *mount\_point='app-id'*)[[source]](_modules/hvac/v1.html#Client.delete_app_id)[¶](#hvac.v1.Client.delete_app_id "Permalink to this definition")

Call to deprecated function ‘delete\_app\_id’. This method will be removed in version ‘1.0.0’

`delete_ec2_role`(*role*, *mount\_point='aws-ec2'*)[[source]](_modules/hvac/v1.html#Client.delete_ec2_role)[¶](#hvac.v1.Client.delete_ec2_role "Permalink to this definition")

Call to deprecated function ‘delete\_ec2\_role’. This method will be removed in version ‘0.11.2’ Please use the ‘delete\_role’ method on the ‘hvac.api.auth\_methods.aws’ class moving forward.Docstring content from this method’s replacement copied below:

Deletes the previously registered role

Parameters

* **role** –

* **mount\_point** (*str*) – The path the AWS auth method was mounted on.

Returns

The response of the request.

Return type

requests.Response

`delete_kubernetes_role`(*role*, *mount\_point='kubernetes'*)[[source]](_modules/hvac/v1.html#Client.delete_kubernetes_role)[¶](#hvac.v1.Client.delete_kubernetes_role "Permalink to this definition")

Call to deprecated function ‘delete\_kubernetes\_role’. This method will be removed in version ‘1.0.0’ Please use the ‘delete\_role’ method on the ‘hvac.api.auth\_methods.kubernetes’ class moving forward.Docstring content from this method’s replacement copied below:

Delete the previously registered role.

Supported methods:DELETE: /auth/{mount\_point}/role/{name}. Produces: 204 (empty body)

Parameters

* **name** (*str | unicode*) – Name of the role.

* **mount\_point** (*str | unicode*) – The “path” the kubernetes auth method was mounted on.

Returns

The response of the request.

Return type

requests.Response

`delete_policy`(*name*)[[source]](_modules/hvac/v1.html#Client.delete_policy)[¶](#hvac.v1.Client.delete_policy "Permalink to this definition")

Call to deprecated function ‘delete\_policy’. This method will be removed in version ‘0.9.0’ Please use the ‘delete\_policy’ method on the ‘hvac.api.system\_backend.policy’ class moving forward.Docstring content from this method’s replacement copied below:

Delete the policy with the given name.

This will immediately affect all users associated with this policy.

Supported methods:DELETE: /sys/policy/{name}. Produces: 204 (empty body)

Parameters

**name** (*str | unicode*) – Specifies the name of the policy to delete.

Returns

The response of the request.

Return type

requests.Response

`delete_role`(*role\_name*, *mount\_point='approle'*)[[source]](_modules/hvac/v1.html#Client.delete_role)[¶](#hvac.v1.Client.delete_role "Permalink to this definition")

Call to deprecated function ‘delete\_role’. This method will be removed in version ‘0.12.0’ Please use the ‘delete\_role’ method on the ‘hvac.api.auth\_methods.approle’ class moving forward.Docstring content from this method’s replacement copied below:

Delete role in the auth method.

Supported methods:DELETE: /auth/{mount\_point}/role/{role\_name}. Produces: 204 (empty body)

Parameters

* **role\_name** (*str | unicode*) – The name for the role.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

`delete_role_secret_id`(*role\_name*, *secret\_id*, *mount\_point='approle'*)[[source]](_modules/hvac/v1.html#Client.delete_role_secret_id)[¶](#hvac.v1.Client.delete_role_secret_id "Permalink to this definition")

Call to deprecated function ‘delete\_role\_secret\_id’. This method will be removed in version ‘0.12.0’ Please use the ‘destroy\_secret\_id’ method on the ‘hvac.api.auth\_methods.approle’ class moving forward.Docstring content from this method’s replacement copied below:

Destroys a Secret ID for a role in the auth method.

Supported methods:POST: /auth/{mount\_point}/role/{role\_name}/secret-id/destroy. Produces 204 (empty body)

Parameters

* **role\_name** (*str | unicode*) – The name for the role

* **secret\_id** (*str | unicode*) – The Secret ID to read.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

`delete_role_secret_id_accessor`(*role\_name*, *secret\_id\_accessor*, *mount\_point='approle'*)[[source]](_modules/hvac/v1.html#Client.delete_role_secret_id_accessor)[¶](#hvac.v1.Client.delete_role_secret_id_accessor "Permalink to this definition")

Call to deprecated function ‘delete\_role\_secret\_id\_accessor’. This method will be removed in version ‘0.12.0’ Please use the ‘destroy\_secret\_id\_accessor’ method on the ‘hvac.api.auth\_methods.approle’ class moving forward.Docstring content from this method’s replacement copied below:

Destroys a Secret ID for a role in the auth method.

Supported methods:POST: /auth/{mount\_point}/role/{role\_name}/secret-id-accessor/destroy. Produces: 204 (empty body)

Parameters

* **role\_name** (*str | unicode*) – The name for the role

* **secret\_id\_accessor** (*str | unicode*) – The accessor for the Secret ID to read.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

`delete_token_role`(*role*)[[source]](_modules/hvac/v1.html#Client.delete_token_role)[¶](#hvac.v1.Client.delete_token_role "Permalink to this definition")

Call to deprecated function ‘delete\_token\_role’. This method will be removed in version ‘1.0.0’ Please use the ‘delete\_role’ method on the ‘hvac.api.auth\_methods.token’ class moving forward.Docstring content from this method’s replacement copied below:

Delete the named token role.

Supported methods:DELETE: /auth/{mount\_point}/roles/{role\_name}.

Parameters

* **role\_name** (*str*) – The name of the token role.

* **mount\_point** (*str*) – The “path” the method/backend was mounted on.

Returns

The response of the delete\_role request.

Return type

requests.Response

`delete_user_id`(*user\_id*, *mount\_point='app-id'*)[[source]](_modules/hvac/v1.html#Client.delete_user_id)[¶](#hvac.v1.Client.delete_user_id "Permalink to this definition")

Call to deprecated function ‘delete\_user\_id’. This method will be removed in version ‘1.0.0’

`delete_userpass`(*username*, *mount\_point='userpass'*)[[source]](_modules/hvac/v1.html#Client.delete_userpass)[¶](#hvac.v1.Client.delete_userpass "Permalink to this definition")

Call to deprecated function ‘delete\_userpass’. This method will be removed in version ‘1.0.0’ Please use the ‘delete\_user’ method on the ‘hvac.api.auth\_methods.userpass’ class moving forward.Docstring content from this method’s replacement copied below:

Delete user in the auth method.

Supported methods:GET: /auth/{mount\_point}/users/{username}. Produces: 200 application/json

Parameters

* **username** – The username for the user.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the read\_group request.

Return type

dict

`delete_vault_ec2_client_configuration`(*mount\_point='aws-ec2'*)[[source]](_modules/hvac/v1.html#Client.delete_vault_ec2_client_configuration)[¶](#hvac.v1.Client.delete_vault_ec2_client_configuration "Permalink to this definition")

Call to deprecated function ‘delete\_vault\_ec2\_client\_configuration’. This method will be removed in version ‘0.11.2’ Please use the ‘delete\_config’ method on the ‘hvac.api.auth\_methods.aws’ class moving forward.Docstring content from this method’s replacement copied below:

Delete previously configured AWS access credentials,

Supported methods:DELETE: /auth/{mount\_point}/config Produces: 204 (empty body)

Parameters

**mount\_point** (*str | unicode*) – The path the AWS auth method was mounted on.

Returns

The response of the request.

Return type

requests.Response

`disable_audit_backend`(*name*)[[source]](_modules/hvac/v1.html#Client.disable_audit_backend)[¶](#hvac.v1.Client.disable_audit_backend "Permalink to this definition")

Call to deprecated function ‘disable\_audit\_backend’. This method will be removed in version ‘0.9.0’ Please use the ‘disable\_audit\_device’ method on the ‘hvac.api.system\_backend.audit’ class moving forward.Docstring content from this method’s replacement copied below:

Disable the audit device at the given path.

Supported methods:DELETE: /sys/audit/{path}. Produces: 204 (empty body)

Parameters

**path** (*str | unicode*) – The path of the audit device to delete. This is part of the request URL.

Returns

The response of the request.

Return type

requests.Response

`disable_auth_backend`(*mount\_point*)[[source]](_modules/hvac/v1.html#Client.disable_auth_backend)[¶](#hvac.v1.Client.disable_auth_backend "Permalink to this definition")

Call to deprecated function ‘disable\_auth\_backend’. This method will be removed in version ‘0.9.0’ Please use the ‘disable\_auth\_method’ method on the ‘hvac.api.system\_backend.auth’ class moving forward.Docstring content from this method’s replacement copied below:

Disable the auth method at the given auth path.

Supported methods:DELETE: /sys/auth/{path}. Produces: 204 (empty body)

Parameters

**path** (*str | unicode*) – The path the method was mounted on. If not provided, defaults to the value of the “method\_type”

argument.

Returns

The response of the request.

Return type

requests.Response

`disable_secret_backend`(*mount\_point*)[[source]](_modules/hvac/v1.html#Client.disable_secret_backend)[¶](#hvac.v1.Client.disable_secret_backend "Permalink to this definition")

Call to deprecated function ‘disable\_secret\_backend’. This method will be removed in version ‘0.9.0’ Please use the ‘disable\_secrets\_engine’ method on the ‘hvac.api.system\_backend.mount’ class moving forward.Docstring content from this method’s replacement copied below:

Disable the mount point specified by the provided path.

Supported methods:DELETE: /sys/mounts/{path}. Produces: 204 (empty body)

Parameters

**path** (*str | unicode*) – Specifies the path where the secrets engine will be mounted. This is specified as part of the URL.

Returns

The response of the request.

Return type

requests.Response

`enable_audit_backend`(*backend\_type*, *description=None*, *options=None*, *name=None*)[[source]](_modules/hvac/v1.html#Client.enable_audit_backend)[¶](#hvac.v1.Client.enable_audit_backend "Permalink to this definition")

Call to deprecated function ‘enable\_audit\_backend’. This method will be removed in version ‘0.9.0’ Please use the ‘enable\_audit\_device’ method on the ‘hvac.api.system\_backend.audit’ class moving forward.Docstring content from this method’s replacement copied below:

Enable a new audit device at the supplied path.

The path can be a single word name or a more complex, nested path.

Supported methods:PUT: /sys/audit/{path}. Produces: 204 (empty body)

Parameters

* **device\_type** (*str | unicode*) – Specifies the type of the audit device.

* **description** (*str | unicode*) – Human-friendly description of the audit device.

* **options** (*str | unicode*) – Configuration options to pass to the audit device itself. This is

dependent on the audit device type.

* **path** (*str | unicode*) – Specifies the path in which to enable the audit device. This is part of

the request URL.

* **local** (*bool*) – Specifies if the audit device is a local only.

Returns

The response of the request.

Return type

requests.Response

`enable_auth_backend`(*backend\_type*, *description=None*, *mount\_point=None*, *config=None*, *plugin\_name=None*)[[source]](_modules/hvac/v1.html#Client.enable_auth_backend)[¶](#hvac.v1.Client.enable_auth_backend "Permalink to this definition")

Call to deprecated function ‘enable\_auth\_backend’. This method will be removed in version ‘0.9.0’ Please use the ‘enable\_auth\_method’ method on the ‘hvac.api.system\_backend.auth’ class moving forward.Docstring content from this method’s replacement copied below:

Enable a new auth method.

After enabling, the auth method can be accessed and configured via the auth path specified as part of the URL.

This auth path will be nested under the auth prefix.

Supported methods:POST: /sys/auth/{path}. Produces: 204 (empty body)

Parameters

* **method\_type** (*str | unicode*) – The name of the authentication method type, such as “github” or “token”.

* **description** (*str | unicode*) – A human-friendly description of the auth method.

* **config** (*dict*) – Configuration options for this auth method. These are the possible values:

	+ **default\_lease\_ttl**: The default lease duration, specified as a string duration like “5s” or “30m”.

	+ **max\_lease\_ttl**: The maximum lease duration, specified as a string duration like “5s” or “30m”.

	+ **audit\_non\_hmac\_request\_keys**: Comma-separated list of keys that will not be HMAC’d by audit devices in

	the request data object.

	+ **audit\_non\_hmac\_response\_keys**: Comma-separated list of keys that will not be HMAC’d by audit devices in

	the response data object.

	+ **listing\_visibility**: Speficies whether to show this mount in the UI-specific listing endpoint.

	+ **passthrough\_request\_headers**: Comma-separated list of headers to whitelist and pass from the request to

	the backend.

* **plugin\_name** (*str | unicode*) – The name of the auth plugin to use based from the name in the plugin catalog. Applies only

to plugin methods.

* **local** (*bool*) – <Vault enterprise only> Specifies if the auth method is a local only. Local auth methods are not

replicated nor (if a secondary) removed by replication.

* **path** (*str | unicode*) – The path to mount the method on. If not provided, defaults to the value of the “method\_type”

argument.

* **kwargs** (*dict*) – All dicts are accepted and passed to vault. See your specific secret engine for details on which

extra key-word arguments you might want to pass.

Returns

The response of the request.

Return type

requests.Response

`enable_secret_backend`(*backend\_type*, *description=None*, *mount\_point=None*, *config=None*, *options=None*)[[source]](_modules/hvac/v1.html#Client.enable_secret_backend)[¶](#hvac.v1.Client.enable_secret_backend "Permalink to this definition")

Call to deprecated function ‘enable\_secret\_backend’. This method will be removed in version ‘0.9.0’ Please use the ‘enable\_secrets\_engine’ method on the ‘hvac.api.system\_backend.mount’ class moving forward.Docstring content from this method’s replacement copied below:

Enable a new secrets engine at the given path.

Supported methods:POST: /sys/mounts/{path}. Produces: 204 (empty body)

Parameters

* **backend\_type** (*str | unicode*) – The name of the backend type, such as “github” or “token”.

* **path** (*str | unicode*) – The path to mount the method on. If not provided, defaults to the value of the “backend\_type”

argument.

* **description** (*str | unicode*) – A human-friendly description of the mount.

* **config** (*dict*) – Configuration options for this mount. These are the possible values:

	+ **default\_lease\_ttl**: The default lease duration, specified as a string duration like “5s” or “30m”.

	+ **max\_lease\_ttl**: The maximum lease duration, specified as a string duration like “5s” or “30m”.

	+ **force\_no\_cache**: Disable caching.

	+ **plugin\_name**: The name of the plugin in the plugin catalog to use.

	+ **audit\_non\_hmac\_request\_keys**: Comma-separated list of keys that will not be HMAC’d by audit devices in

	the request data object.

	+ **audit\_non\_hmac\_response\_keys**: Comma-separated list of keys that will not be HMAC’d by audit devices in

	the response data object.

	+ **listing\_visibility**: Specifies whether to show this mount in the UI-specific listing endpoint. (“unauth” or “hidden”)

	+ **passthrough\_request\_headers**: Comma-separated list of headers to whitelist and pass from the request to

	the backend.

* **options** (*dict*) – Specifies mount type specific options that are passed to the backend.

	+ **version**: <KV> The version of the KV to mount. Set to “2” for mount KV v2.

* **plugin\_name** (*str | unicode*) – Specifies the name of the plugin to use based from the name in the plugin catalog. Applies only to plugin backends.

* **local** (*bool*) – <Vault enterprise only> Specifies if the auth method is a local only. Local auth methods are not

replicated nor (if a secondary) removed by replication.

* **seal\_wrap** (*bool*) – <Vault enterprise only> Enable seal wrapping for the mount.

* **kwargs** (*dict*) – All dicts are accepted and passed to vault. See your specific secret engine for details on which

extra key-word arguments you might want to pass.

Returns

The response of the request.

Return type

requests.Response

`generate_root`(*key*, *nonce*)[[source]](_modules/hvac/v1.html#Client.generate_root)[¶](#hvac.v1.Client.generate_root "Permalink to this definition")

Call to deprecated function ‘generate\_root’. This method will be removed in version ‘0.9.0’ Please use the ‘generate\_root’ method on the ‘hvac.api.system\_backend.key’ class moving forward.Docstring content from this method’s replacement copied below:

Enter a single master key share to progress the root generation attempt.

If the threshold number of master key shares is reached, Vault will complete the root generation and issue the

new token. Otherwise, this API must be called multiple times until that threshold is met. The attempt nonce must

be provided with each call.

Supported methods:PUT: /sys/generate-root/update. Produces: 200 application/json

Parameters

* **key** (*str | unicode*) – Specifies a single master key share.

* **nonce** (*str | unicode*) – The nonce of the attempt.

Returns

The JSON response of the request.

Return type

dict

*property* `generate_root_status`[¶](#hvac.v1.Client.generate_root_status "Permalink to this definition")

`get_app_id`(*app\_id*, *mount\_point='app-id'*, *wrap\_ttl=None*)[[source]](_modules/hvac/v1.html#Client.get_app_id)[¶](#hvac.v1.Client.get_app_id "Permalink to this definition")

Call to deprecated function ‘get\_app\_id’. This method will be removed in version ‘1.0.0’

`get_auth_backend_tuning`(*backend\_type*, *mount\_point=None*)[[source]](_modules/hvac/v1.html#Client.get_auth_backend_tuning)[¶](#hvac.v1.Client.get_auth_backend_tuning "Permalink to this definition")

Call to deprecated function ‘get\_auth\_backend\_tuning’. This method will be removed in version ‘0.9.0’ Please use the ‘read\_auth\_method\_tuning’ method on the ‘hvac.api.system\_backend.auth’ class moving forward.Docstring content from this method’s replacement copied below:

Read the given auth path’s configuration.

This endpoint requires sudo capability on the final path, but the same functionality can be achieved without

sudo via sys/mounts/auth/[auth-path]/tune.

Supported methods:GET: /sys/auth/{path}/tune. Produces: 200 application/json

Parameters

**path** (*str | unicode*) – The path the method was mounted on. If not provided, defaults to the value of the “method\_type”

argument.

Returns

The JSON response of the request.

Return type

dict

`get_backed_up_keys`()[[source]](_modules/hvac/v1.html#Client.get_backed_up_keys)[¶](#hvac.v1.Client.get_backed_up_keys "Permalink to this definition")

Call to deprecated function ‘get\_backed\_up\_keys’. This method will be removed in version ‘0.9.0’ Please use the ‘read\_backup\_keys’ method on the ‘hvac.api.system\_backend.key’ class moving forward.Docstring content from this method’s replacement copied below:

Retrieve the backup copy of PGP-encrypted unseal keys.

The returned value is the nonce of the rekey operation and a map of PGP key fingerprint to hex-encoded

PGP-encrypted key.

Supported methods:PUT: /sys/rekey/backup. Produces: 200 application/json

PUT: /sys/rekey-recovery-key/backup. Produces: 200 application/json

Parameters

**recovery\_key** (*bool*) – If true, send requests to “rekey-recovery-key” instead of “rekey” api path.

Returns

The JSON response of the request.

Return type

dict

`get_ec2_role`(*role*, *mount\_point='aws-ec2'*)[[source]](_modules/hvac/v1.html#Client.get_ec2_role)[¶](#hvac.v1.Client.get_ec2_role "Permalink to this definition")

Call to deprecated function ‘get\_ec2\_role’. This method will be removed in version ‘0.11.2’ Please use the ‘read\_role’ method on the ‘hvac.api.auth\_methods.aws’ class moving forward.Docstring content from this method’s replacement copied below:

Returns the previously registered role configuration

Parameters

* **role** –

* **mount\_point** (*str*) – The path the AWS auth method was mounted on.

Returns

The response of the request.

Return type

requests.Response

`get_kubernetes_configuration`(*mount\_point='kubernetes'*)[[source]](_modules/hvac/v1.html#Client.get_kubernetes_configuration)[¶](#hvac.v1.Client.get_kubernetes_configuration "Permalink to this definition")

Call to deprecated function ‘get\_kubernetes\_configuration’. This method will be removed in version ‘1.0.0’ Please use the ‘read\_config’ method on the ‘hvac.api.auth\_methods.kubernetes’ class moving forward.Docstring content from this method’s replacement copied below:

Return the previously configured config, including credentials.

Supported methods:GET: /auth/{mount\_point}/config. Produces: 200 application/json

Parameters

**mount\_point** (*str | unicode*) – The “path” the kubernetes auth method was mounted on.

Returns

The data key from the JSON response of the request.

Return type

dict

`get_kubernetes_role`(*name*, *mount\_point='kubernetes'*)[[source]](_modules/hvac/v1.html#Client.get_kubernetes_role)[¶](#hvac.v1.Client.get_kubernetes_role "Permalink to this definition")

Call to deprecated function ‘get\_kubernetes\_role’. This method will be removed in version ‘1.0.0’ Please use the ‘read\_role’ method on the ‘hvac.api.auth\_methods.kubernetes’ class moving forward.Docstring content from this method’s replacement copied below:

Returns the previously registered role configuration.

Supported methods:POST: /auth/{mount\_point}/role/{name}. Produces: 200 application/json

Parameters

* **name** (*str | unicode*) – Name of the role.

* **mount\_point** (*str | unicode*) – The “path” the kubernetes auth method was mounted on.

Returns

The “data” key from the JSON response of the request.

Return type

dict

`get_policy`(*name*, *parse=False*)[[source]](_modules/hvac/v1.html#Client.get_policy)[¶](#hvac.v1.Client.get_policy "Permalink to this definition")

Retrieve the policy body for the named policy.

Parameters

* **name** (*str | unicode*) – The name of the policy to retrieve.

* **parse** (*bool*) – Specifies whether to parse the policy body using pyhcl or not.

Returns

The (optionally parsed) policy body for the specified policy.

Return type

str | dict

`get_role`(*role\_name*, *mount\_point='approle'*)[[source]](_modules/hvac/v1.html#Client.get_role)[¶](#hvac.v1.Client.get_role "Permalink to this definition")

Call to deprecated function ‘get\_role’. This method will be removed in version ‘0.12.0’ Please use the ‘read\_role’ method on the ‘hvac.api.auth\_methods.approle’ class moving forward.Docstring content from this method’s replacement copied below:

Read role in the auth method.

Supported methods:GET: /auth/{mount\_point}/role/{role\_name}. Produces: 200 application/json

Parameters

* **role\_name** (*str | unicode*) – The name for the role.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the read\_role request.

Return type

dict

`get_role_id`(*role\_name*, *mount\_point='approle'*)[[source]](_modules/hvac/v1.html#Client.get_role_id)[¶](#hvac.v1.Client.get_role_id "Permalink to this definition")

Call to deprecated function ‘get\_role\_id’. This method will be removed in version ‘0.12.0’ Please use the ‘read\_role\_id’ method on the ‘hvac.api.auth\_methods.approle’ class moving forward.Docstring content from this method’s replacement copied below:

Reads the Role ID of a role in the auth method.

Supported methods:GET: /auth/{mount\_point}/role/{role\_name}/role-id. Produces: 200 application/json

Parameters

* **role\_name** (*str | unicode*) – The name for the role.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the read\_role\_id request.

Return type

dict

`get_role_secret_id`(*role\_name*, *secret\_id*, *mount\_point='approle'*)[[source]](_modules/hvac/v1.html#Client.get_role_secret_id)[¶](#hvac.v1.Client.get_role_secret_id "Permalink to this definition")

Call to deprecated function ‘get\_role\_secret\_id’. This method will be removed in version ‘0.12.0’ Please use the ‘read\_secret\_id’ method on the ‘hvac.api.auth\_methods.approle’ class moving forward.Docstring content from this method’s replacement copied below:

Read the properties of a Secret ID for a role in the auth method.

Supported methods:POST: /auth/{mount\_point}/role/{role\_name}/secret-id/lookup. Produces: 200 application/json

Parameters

* **role\_name** (*str | unicode*) – The name for the role

* **secret\_id** (*str | unicode*) – The Secret ID to read.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the read\_role\_id request.

Return type

dict

`get_role_secret_id_accessor`(*role\_name*, *secret\_id\_accessor*, *mount\_point='approle'*)[[source]](_modules/hvac/v1.html#Client.get_role_secret_id_accessor)[¶](#hvac.v1.Client.get_role_secret_id_accessor "Permalink to this definition")

Call to deprecated function ‘get\_role\_secret\_id\_accessor’. This method will be removed in version ‘0.12.0’ Please use the ‘read\_secret\_id\_accessor’ method on the ‘hvac.api.auth\_methods.approle’ class moving forward.Docstring content from this method’s replacement copied below:

Read the properties of a Secret ID for a role in the auth method.

Supported methods:POST: /auth/{mount\_point}/role/{role\_name}/secret-id-accessor/lookup. Produces: 200 application/json

Parameters

* **role\_name** (*str | unicode*) – The name for the role

* **secret\_id\_accessor** (*str | unicode*) – The accessor for the Secret ID to read.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the read\_role\_id request.

Return type

dict

`get_secret_backend_tuning`(*backend\_type*, *mount\_point=None*)[[source]](_modules/hvac/v1.html#Client.get_secret_backend_tuning)[¶](#hvac.v1.Client.get_secret_backend_tuning "Permalink to this definition")

Call to deprecated function ‘get\_secret\_backend\_tuning’. This method will be removed in version ‘0.9.0’ Please use the ‘read\_mount\_configuration’ method on the ‘hvac.api.system\_backend.mount’ class moving forward.Docstring content from this method’s replacement copied below:

Read the given mount’s configuration.

Unlike the mounts endpoint, this will return the current time in seconds for each TTL, which may be the system

default or a mount-specific value.

Supported methods:GET: /sys/mounts/{path}/tune. Produces: 200 application/json

Parameters

**path** (*str | unicode*) – Specifies the path where the secrets engine will be mounted. This is specified as part of the URL.

Returns

The JSON response of the request.

Return type

requests.Response

`get_user_id`(*user\_id*, *mount\_point='app-id'*, *wrap\_ttl=None*)[[source]](_modules/hvac/v1.html#Client.get_user_id)[¶](#hvac.v1.Client.get_user_id "Permalink to this definition")

Call to deprecated function ‘get\_user\_id’. This method will be removed in version ‘1.0.0’

`get_vault_ec2_certificate_configuration`(*cert\_name*, *mount\_point='aws-ec2'*)[[source]](_modules/hvac/v1.html#Client.get_vault_ec2_certificate_configuration)[¶](#hvac.v1.Client.get_vault_ec2_certificate_configuration "Permalink to this definition")

Call to deprecated function ‘get\_vault\_ec2\_certificate\_configuration’. This method will be removed in version ‘0.11.2’ Please use the ‘read\_certificate\_configuration’ method on the ‘hvac.api.auth\_methods.aws’ class moving forward.Docstring content from this method’s replacement copied below:

Return previously configured AWS public key.

Supported methods:GET: /v1/auth/{mount\_point}/config/certificate/:cert\_name Produces: 200 application/json

Parameters

* **cert\_name** (*str | unicode*) – Name of the certificate

* **mount\_point** – The path the AWS auth method was mounted on.

Returns

The data key from the JSON response of the request.

Return type

dict

`get_vault_ec2_client_configuration`(*mount\_point='aws-ec2'*)[[source]](_modules/hvac/v1.html#Client.get_vault_ec2_client_configuration)[¶](#hvac.v1.Client.get_vault_ec2_client_configuration "Permalink to this definition")

Call to deprecated function ‘get\_vault\_ec2\_client\_configuration’. This method will be removed in version ‘0.11.2’ Please use the ‘read\_config’ method on the ‘hvac.api.auth\_methods.aws’ class moving forward.Docstring content from this method’s replacement copied below:

Read previously configured AWS access credentials.

Supported methods:GET: /auth/{mount\_point}/config. Produces: 200 application/json

Parameters

**mount\_point** (*str | unicode*) – The path the AWS auth method was mounted on.

Returns

The data key from the JSON response of the request.

Return type

dict

*property* `ha_status`[¶](#hvac.v1.Client.ha_status "Permalink to this definition")

Read the high availability status and current leader instance of Vault.

Returns

The JSON response returned by read\_leader\_status()

Return type

dict

`initialize`(*secret\_shares=5*, *secret\_threshold=3*, *pgp\_keys=None*)[[source]](_modules/hvac/v1.html#Client.initialize)[¶](#hvac.v1.Client.initialize "Permalink to this definition")

Call to deprecated function ‘initialize’. This method will be removed in version ‘0.9.0’ Please use the ‘initialize’ method on the ‘hvac.api.system\_backend.init’ class moving forward.Docstring content from this method’s replacement copied below:

Initialize a new Vault.

The Vault must not have been previously initialized. The recovery options, as well as the stored shares option,

are only available when using Vault HSM.

Supported methods:PUT: /sys/init. Produces: 200 application/json

Parameters

* **secret\_shares** (*int*) – The number of shares to split the master key into.

* **secret\_threshold** (*int*) – Specifies the number of shares required to reconstruct the master key. This must be

less than or equal secret\_shares. If using Vault HSM with auto-unsealing, this value must be the same as

secret\_shares.

* **pgp\_keys** (*list*) – List of PGP public keys used to encrypt the output unseal keys.

Ordering is preserved. The keys must be base64-encoded from their original binary representation.

The size of this array must be the same as secret\_shares.

* **root\_token\_pgp\_key** (*str | unicode*) – Specifies a PGP public key used to encrypt the initial root token. The

key must be base64-encoded from its original binary representation.

* **stored\_shares** (*int*) – <enterprise only> Specifies the number of shares that should be encrypted by the HSM and

stored for auto-unsealing. Currently must be the same as secret\_shares.

* **recovery\_shares** (*int*) – <enterprise only> Specifies the number of shares to split the recovery key into.

* **recovery\_threshold** (*int*) – <enterprise only> Specifies the number of shares required to reconstruct the recovery

key. This must be less than or equal to recovery\_shares.

* **recovery\_pgp\_keys** (*list*) – <enterprise only> Specifies an array of PGP public keys used to encrypt the output

recovery keys. Ordering is preserved. The keys must be base64-encoded from their original binary

representation. The size of this array must be the same as recovery\_shares.

Returns

The JSON response of the request.

Return type

dict

`is_authenticated`()[[source]](_modules/hvac/v1.html#Client.is_authenticated)[¶](#hvac.v1.Client.is_authenticated "Permalink to this definition")

Helper method which returns the authentication status of the client

Returns

Return type

`is_initialized`()[[source]](_modules/hvac/v1.html#Client.is_initialized)[¶](#hvac.v1.Client.is_initialized "Permalink to this definition")

Call to deprecated function ‘is\_initialized’. This method will be removed in version ‘0.9.0’ Please use the ‘is\_initialized’ method on the ‘hvac.api.system\_backend.init’ class moving forward.Docstring content from this method’s replacement copied below:

Determine is Vault is initialized or not.

Returns

True if Vault is initialized, False otherwise.

Return type

bool

`is_sealed`()[[source]](_modules/hvac/v1.html#Client.is_sealed)[¶](#hvac.v1.Client.is_sealed "Permalink to this definition")

Call to deprecated function ‘is\_sealed’. This method will be removed in version ‘0.9.0’ Please use the ‘is\_sealed’ method on the ‘hvac.api.system\_backend.seal’ class moving forward.Docstring content from this method’s replacement copied below:

Determine if Vault is sealed.

Returns

True if Vault is seal, False otherwise.

Return type

bool

*property* `key_status`[¶](#hvac.v1.Client.key_status "Permalink to this definition")

GET /sys/key-status

Returns

Information about the current encryption key used by Vault.

Return type

dict

`list`(*path*)[[source]](_modules/hvac/v1.html#Client.list)[¶](#hvac.v1.Client.list "Permalink to this definition")

GET /<path>?list=true

Parameters

**path** – 

Returns

Return type

`list_audit_backends`()[[source]](_modules/hvac/v1.html#Client.list_audit_backends)[¶](#hvac.v1.Client.list_audit_backends "Permalink to this definition")

Call to deprecated function ‘list\_audit\_backends’. This method will be removed in version ‘0.9.0’ Please use the ‘list\_enabled\_audit\_devices’ method on the ‘hvac.api.system\_backend.audit’ class moving forward.Docstring content from this method’s replacement copied below:

List enabled audit devices.

It does not list all available audit devices.

This endpoint requires sudo capability in addition to any path-specific capabilities.

Supported methods:GET: /sys/audit. Produces: 200 application/json

Returns

JSON response of the request.

Return type

dict

`list_auth_backends`()[[source]](_modules/hvac/v1.html#Client.list_auth_backends)[¶](#hvac.v1.Client.list_auth_backends "Permalink to this definition")

Call to deprecated function ‘list\_auth\_backends’. This method will be removed in version ‘0.9.0’ Please use the ‘list\_auth\_methods’ method on the ‘hvac.api.system\_backend.auth’ class moving forward.Docstring content from this method’s replacement copied below:

List all enabled auth methods.

Supported methods:GET: /sys/auth. Produces: 200 application/json

Returns

The JSON response of the request.

Return type

dict

`list_ec2_roles`(*mount\_point='aws-ec2'*)[[source]](_modules/hvac/v1.html#Client.list_ec2_roles)[¶](#hvac.v1.Client.list_ec2_roles "Permalink to this definition")

Call to deprecated function ‘list\_ec2\_roles’. This method will be removed in version ‘0.11.2’ Please use the ‘list\_roles’ method on the ‘hvac.api.auth\_methods.aws’ class moving forward.Docstring content from this method’s replacement copied below:

Lists all the roles that are registered with the method

Parameters

**mount\_point** (*str*) – The path the AWS auth method was mounted on.

Returns

The response of the request.

Return type

requests.Response

`list_kubernetes_roles`(*mount\_point='kubernetes'*)[[source]](_modules/hvac/v1.html#Client.list_kubernetes_roles)[¶](#hvac.v1.Client.list_kubernetes_roles "Permalink to this definition")

Call to deprecated function ‘list\_kubernetes\_roles’. This method will be removed in version ‘1.0.0’ Please use the ‘list\_roles’ method on the ‘hvac.api.auth\_methods.kubernetes’ class moving forward.Docstring content from this method’s replacement copied below:

List all the roles that are registered with the plugin.

Supported methods:LIST: /auth/{mount\_point}/role. Produces: 200 application/json

Parameters

**mount\_point** (*str | unicode*) – The “path” the kubernetes auth method was mounted on.

Returns

The “data” key from the JSON response of the request.

Return type

dict

`list_policies`()[[source]](_modules/hvac/v1.html#Client.list_policies)[¶](#hvac.v1.Client.list_policies "Permalink to this definition")

Call to deprecated function ‘list\_policies’. This method will be removed in version ‘0.9.0’ Please use the ‘list\_policies’ method on the ‘hvac.api.system\_backend.policy’ class moving forward.Docstring content from this method’s replacement copied below:

List all configured policies.

Supported methods:GET: /sys/policy. Produces: 200 application/json

Returns

The JSON response of the request.

Return type

dict

`list_role_secrets`(*role\_name*, *mount\_point='approle'*)[[source]](_modules/hvac/v1.html#Client.list_role_secrets)[¶](#hvac.v1.Client.list_role_secrets "Permalink to this definition")

Call to deprecated function ‘list\_role\_secrets’. This method will be removed in version ‘0.12.0’ Please use the ‘list\_secret\_id\_accessors’ method on the ‘hvac.api.auth\_methods.approle’ class moving forward.Docstring content from this method’s replacement copied below:

Lists accessors of all issued Secret IDs for a role in the auth method.

Supported methods:LIST: /auth/{mount\_point}/role/{role\_name}/secret-id. Produces: 200 application/json

Parameters

* **role\_name** (*str | unicode*) – The name for the role

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the read\_role\_id request.

Return type

dict

`list_roles`(*mount\_point='approle'*)[[source]](_modules/hvac/v1.html#Client.list_roles)[¶](#hvac.v1.Client.list_roles "Permalink to this definition")

Call to deprecated function ‘list\_roles’. This method will be removed in version ‘0.12.0’ Please use the ‘list\_roles’ method on the ‘hvac.api.auth\_methods.approle’ class moving forward.Docstring content from this method’s replacement copied below:

List existing roles created in the auth method.

Supported methods:LIST: /auth/{mount\_point}/role. Produces: 200 application/json

Parameters

**mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the list\_roles request.

Return type

dict

`list_secret_backends`()[[source]](_modules/hvac/v1.html#Client.list_secret_backends)[¶](#hvac.v1.Client.list_secret_backends "Permalink to this definition")

Call to deprecated function ‘list\_secret\_backends’. This method will be removed in version ‘0.9.0’ Please use the ‘list\_mounted\_secrets\_engines’ method on the ‘hvac.api.system\_backend.mount’ class moving forward.Docstring content from this method’s replacement copied below:

Lists all the mounted secrets engines.

Supported methods:POST: /sys/mounts. Produces: 200 application/json

Returns

JSON response of the request.

Return type

dict

`list_token_roles`()[[source]](_modules/hvac/v1.html#Client.list_token_roles)[¶](#hvac.v1.Client.list_token_roles "Permalink to this definition")

Call to deprecated function ‘list\_token\_roles’. This method will be removed in version ‘1.0.0’ Please use the ‘list\_roles’ method on the ‘hvac.api.auth\_methods.token’ class moving forward.Docstring content from this method’s replacement copied below:

List available token roles.

Supported methods:LIST: /auth/{mount\_point}/roles.

Parameters

**mount\_point** (*str*) – The “path” the method/backend was mounted on.

Returns

The response of the list\_roles request.

Return type

requests.Response

`list_userpass`(*mount\_point='userpass'*)[[source]](_modules/hvac/v1.html#Client.list_userpass)[¶](#hvac.v1.Client.list_userpass "Permalink to this definition")

Call to deprecated function ‘list\_userpass’. This method will be removed in version ‘1.0.0’ Please use the ‘list\_user’ method on the ‘hvac.api.auth\_methods.userpass’ class moving forward.Docstring content from this method’s replacement copied below:

List existing users that have been created in the auth method

Supported methods:LIST: /auth/{mount\_point}/users. Produces: 200 application/json

Parameters

**mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the list\_groups request.

Return type

dict

`list_vault_ec2_certificate_configurations`(*mount\_point='aws-ec2'*)[[source]](_modules/hvac/v1.html#Client.list_vault_ec2_certificate_configurations)[¶](#hvac.v1.Client.list_vault_ec2_certificate_configurations "Permalink to this definition")

Call to deprecated function ‘list\_vault\_ec2\_certificate\_configurations’. This method will be removed in version ‘0.11.2’ Please use the ‘list\_certificate\_configurations’ method on the ‘hvac.api.auth\_methods.aws’ class moving forward.Docstring content from this method’s replacement copied below:

List AWS public certificates that are registered with the method.

Supported methodsLIST: /auth/{mount\_point}/config/certificates Produces: 200 application/json

Parameters

**mount\_point** (*str*) – The path the AWS auth method was mounted on.

Returns

The response of the request.

Return type

requests.Response

`login`(*url*, *use\_token=True*, *\*\*kwargs*)[[source]](_modules/hvac/v1.html#Client.login)[¶](#hvac.v1.Client.login "Permalink to this definition")

Perform a login request.

Associated request is typically to a path prefixed with “/v1/auth”) and optionally stores the client token sentin the resulting Vault response for use by the [`hvac.adapters.Adapter()`](index.html#hvac.adapters.Adapter "hvac.adapters.Adapter") instance under the \_adapater

Client attribute.

Parameters

* **url** (*str | unicode*) – Path to send the authentication request to.

* **use\_token** (*bool*) – if True, uses the token in the response received from the auth request to set the “token”

attribute on the the [`hvac.adapters.Adapter()`](index.html#hvac.adapters.Adapter "hvac.adapters.Adapter") instance under the \_adapater Client attribute.

* **kwargs** (*dict*) – Additional keyword arguments to include in the params sent with the request.

Returns

The response of the auth request.

Return type

requests.Response

`logout`(*revoke\_token=False*)[[source]](_modules/hvac/v1.html#Client.logout)[¶](#hvac.v1.Client.logout "Permalink to this definition")

Clears the token used for authentication, optionally revoking it before doing so.

Parameters

**revoke\_token** – 

Returns

Return type

`lookup_token`(*token=None*, *accessor=False*, *wrap\_ttl=None*)[[source]](_modules/hvac/v1.html#Client.lookup_token)[¶](#hvac.v1.Client.lookup_token "Permalink to this definition")

GET /auth/token/lookup/<token>

GET /auth/token/lookup-accessor/<token-accessor>

GET /auth/token/lookup-self

Parameters

* **token** (*str.*) –

* **accessor** (*str.*) –

* **wrap\_ttl** (*int.*) –

Returns

Return type

`read`(*path*, *wrap\_ttl=None*)[[source]](_modules/hvac/v1.html#Client.read)[¶](#hvac.v1.Client.read "Permalink to this definition")

GET /<path>

Parameters

* **path** –

* **wrap\_ttl** –

Returns

Return type

`read_lease`(*lease\_id*)[[source]](_modules/hvac/v1.html#Client.read_lease)[¶](#hvac.v1.Client.read_lease "Permalink to this definition")

Call to deprecated function ‘read\_lease’. This method will be removed in version ‘0.9.0’ Please use the ‘read\_lease’ method on the ‘hvac.api.system\_backend.lease’ class moving forward.Docstring content from this method’s replacement copied below:

Retrieve lease metadata.

Supported methods:PUT: /sys/leases/lookup. Produces: 200 application/json

Parameters

**lease\_id** (*str | unicode*) – the ID of the lease to lookup.

Returns

Parsed JSON response from the leases PUT request

Return type

dict.

`read_userpass`(*username*, *mount\_point='userpass'*)[[source]](_modules/hvac/v1.html#Client.read_userpass)[¶](#hvac.v1.Client.read_userpass "Permalink to this definition")

Call to deprecated function ‘read\_userpass’. This method will be removed in version ‘1.0.0’ Please use the ‘read\_user’ method on the ‘hvac.api.auth\_methods.userpass’ class moving forward.Docstring content from this method’s replacement copied below:

Read user in the auth method.

Supported methods:GET: /auth/{mount\_point}/users/{username}. Produces: 200 application/json

Parameters

* **username** – The username for the user.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the read\_group request.

Return type

dict

`rekey`(*key*, *nonce=None*)[[source]](_modules/hvac/v1.html#Client.rekey)[¶](#hvac.v1.Client.rekey "Permalink to this definition")

Call to deprecated function ‘rekey’. This method will be removed in version ‘0.9.0’ Please use the ‘rekey’ method on the ‘hvac.api.system\_backend.key’ class moving forward.Docstring content from this method’s replacement copied below:

Enter a single recovery key share to progress the rekey of the Vault.

If the threshold number of recovery key shares is reached, Vault will complete the rekey. Otherwise, this API

must be called multiple times until that threshold is met. The rekey nonce operation must be provided with each

call.

Supported methods:PUT: /sys/rekey/update. Produces: 200 application/json

PUT: /sys/rekey-recovery-key/update. Produces: 200 application/json

Parameters

* **key** (*str | unicode*) – Specifies a single recovery share key.

* **nonce** (*str | unicode*) – Specifies the nonce of the rekey operation.

* **recovery\_key** (*bool*) – If true, send requests to “rekey-recovery-key” instead of “rekey” api path.

Returns

The JSON response of the request.

Return type

dict

`rekey_multi`(*keys*, *nonce=None*)[[source]](_modules/hvac/v1.html#Client.rekey_multi)[¶](#hvac.v1.Client.rekey_multi "Permalink to this definition")

Call to deprecated function ‘rekey\_multi’. This method will be removed in version ‘0.9.0’ Please use the ‘rekey\_multi’ method on the ‘hvac.api.system\_backend.key’ class moving forward.Docstring content from this method’s replacement copied below:

Enter multiple recovery key shares to progress the rekey of the Vault.

If the threshold number of recovery key shares is reached, Vault will complete the rekey.

Parameters

* **keys** (*list*) – Specifies multiple recovery share keys.

* **nonce** (*str | unicode*) – Specifies the nonce of the rekey operation.

* **recovery\_key** (*bool*) – If true, send requests to “rekey-recovery-key” instead of “rekey” api path.

Returns

The last response of the rekey request.

Return type

response.Request

*property* `rekey_status`[¶](#hvac.v1.Client.rekey_status "Permalink to this definition")

`remount_secret_backend`(*from\_mount\_point*, *to\_mount\_point*)[[source]](_modules/hvac/v1.html#Client.remount_secret_backend)[¶](#hvac.v1.Client.remount_secret_backend "Permalink to this definition")

Call to deprecated function ‘remount\_secret\_backend’. This method will be removed in version ‘0.9.0’ Please use the ‘move\_backend’ method on the ‘hvac.api.system\_backend.mount’ class moving forward.Docstring content from this method’s replacement copied below:

Move an already-mounted backend to a new mount point.

Supported methods:POST: /sys/remount. Produces: 204 (empty body)

Parameters

* **from\_path** (*str | unicode*) – Specifies the previous mount point.

* **to\_path** (*str | unicode*) – Specifies the new destination mount point.

Returns

The response of the request.

Return type

requests.Response

`renew_secret`(*lease\_id*, *increment=None*)[[source]](_modules/hvac/v1.html#Client.renew_secret)[¶](#hvac.v1.Client.renew_secret "Permalink to this definition")

Call to deprecated function ‘renew\_secret’. This method will be removed in version ‘0.9.0’ Please use the ‘renew\_lease’ method on the ‘hvac.api.system\_backend.lease’ class moving forward.Docstring content from this method’s replacement copied below:

Renew a lease, requesting to extend the lease.

Supported methods:PUT: /sys/leases/renew. Produces: 200 application/json

Parameters

* **lease\_id** (*str | unicode*) – The ID of the lease to extend.

* **increment** (*int*) – The requested amount of time (in seconds) to extend the lease.

Returns

The JSON response of the request

Return type

dict

`renew_self_token`(*increment=None*, *wrap\_ttl=None*)[[source]](_modules/hvac/v1.html#Client.renew_self_token)[¶](#hvac.v1.Client.renew_self_token "Permalink to this definition")

Call to deprecated function ‘renew\_self\_token’. This method will be removed in version ‘1.0.0’ Please use the ‘renew\_self’ method on the ‘hvac.api.auth\_methods.token’ class moving forward.Docstring content from this method’s replacement copied below:

Renew a lease associated with the calling token.

This is used to prevent the expiration of a token, and the automatic revocation of it.

Token renewal is possible only if there is a lease associated with it.

Supported methods:POST: /auth/{mount\_point}/renew-self.

Parameters

* **increment** (*str*) – An optional requested lease increment can be

provided. This increment may be ignored.

* **wrap\_ttl** (*str*) – Specifies response wrapping token creation with duration. IE: ’15s’, ‘20m’, ‘25h’.

* **mount\_point** (*str*) – The “path” the method/backend was mounted on.

Returns

The response of the renew\_a\_self request.

Return type

requests.Response

`renew_token`(*token=None*, *increment=None*, *wrap\_ttl=None*)[[source]](_modules/hvac/v1.html#Client.renew_token)[¶](#hvac.v1.Client.renew_token "Permalink to this definition")

POST /auth/token/renew

POST /auth/token/renew-self

Parameters

* **token** –

* **increment** –

* **wrap\_ttl** –

Returns

Return type

For calls expecting to hit the renew-self endpoint please use the “renew\_self\_token” method instead

`revoke_secret`(*lease\_id*)[[source]](_modules/hvac/v1.html#Client.revoke_secret)[¶](#hvac.v1.Client.revoke_secret "Permalink to this definition")

Call to deprecated function ‘revoke\_secret’. This method will be removed in version ‘0.9.0’ Please use the ‘revoke\_lease’ method on the ‘hvac.api.system\_backend.lease’ class moving forward.Docstring content from this method’s replacement copied below:

Revoke a lease immediately.

Supported methods:PUT: /sys/leases/revoke. Produces: 204 (empty body)

Parameters

**lease\_id** (*str | unicode*) – Specifies the ID of the lease to revoke.

Returns

The response of the request.

Return type

requests.Response

`revoke_secret_prefix`(*path\_prefix*)[[source]](_modules/hvac/v1.html#Client.revoke_secret_prefix)[¶](#hvac.v1.Client.revoke_secret_prefix "Permalink to this definition")

Call to deprecated function ‘revoke\_secret\_prefix’. This method will be removed in version ‘0.9.0’ Please use the ‘revoke\_lease’ method on the ‘hvac.api.system\_backend.lease’ class moving forward.Docstring content from this method’s replacement copied below:

Revoke a lease immediately.

Supported methods:PUT: /sys/leases/revoke. Produces: 204 (empty body)

Parameters

**lease\_id** (*str | unicode*) – Specifies the ID of the lease to revoke.

Returns

The response of the request.

Return type

requests.Response

`revoke_self_token`()[[source]](_modules/hvac/v1.html#Client.revoke_self_token)[¶](#hvac.v1.Client.revoke_self_token "Permalink to this definition")

Call to deprecated function ‘revoke\_self\_token’. This method will be removed in version ‘1.0.0’ Please use the ‘revoke\_self’ method on the ‘hvac.api.auth\_methods.token’ class moving forward.Docstring content from this method’s replacement copied below:

Revoke the token used to call it and all child tokens.

When the token is revoked, all dynamic secrets generated with it are also revoked.

Supported methods:POST: /auth/{mount\_point}/revoke-self.

Parameters

**mount\_point** (*str*) – The “path” the method/backend was mounted on.

Returns

The response of the revoke\_a\_self request.

Return type

requests.Response

`revoke_token`(*token*, *orphan=False*, *accessor=False*)[[source]](_modules/hvac/v1.html#Client.revoke_token)[¶](#hvac.v1.Client.revoke_token "Permalink to this definition")

POST /auth/token/revoke

POST /auth/token/revoke-orphan

POST /auth/token/revoke-accessor

Parameters

* **token** –

* **orphan** –

* **accessor** –

Returns

Return type

`revoke_token_prefix`(*prefix*)[[source]](_modules/hvac/v1.html#Client.revoke_token_prefix)[¶](#hvac.v1.Client.revoke_token_prefix "Permalink to this definition")

Call to deprecated function ‘revoke\_token\_prefix’. This method will be removed in version ‘1.0.0’

`rotate`()[[source]](_modules/hvac/v1.html#Client.rotate)[¶](#hvac.v1.Client.rotate "Permalink to this definition")

Call to deprecated function ‘rotate’. This method will be removed in version ‘0.9.0’ Please use the ‘rotate\_encryption\_key’ method on the ‘hvac.api.system\_backend.key’ class moving forward.Docstring content from this method’s replacement copied below:

Trigger a rotation of the backend encryption key.

This is the key that is used to encrypt data written to the storage backend, and is not provided to operators.

This operation is done online. Future values are encrypted with the new key, while old values are decrypted with

previous encryption keys.

This path requires sudo capability in addition to update.

Supported methods:PUT: /sys/rorate. Produces: 204 (empty body)

Returns

The response of the request.

Return type

requests.Response

`seal`()[[source]](_modules/hvac/v1.html#Client.seal)[¶](#hvac.v1.Client.seal "Permalink to this definition")

Call to deprecated function ‘seal’. This method will be removed in version ‘0.9.0’ Please use the ‘seal’ method on the ‘hvac.api.system\_backend.seal’ class moving forward.Docstring content from this method’s replacement copied below:

Seal the Vault.

In HA mode, only an active node can be sealed. Standby nodes should be restarted to get the same effect.

Requires a token with root policy or sudo capability on the path.

Supported methods:PUT: /sys/seal. Produces: 204 (empty body)

Returns

The response of the request.

Return type

requests.Response

*property* `seal_status`[¶](#hvac.v1.Client.seal_status "Permalink to this definition")

Read the seal status of the Vault.

This is an unauthenticated endpoint.

Supported methods:GET: /sys/seal-status. Produces: 200 application/json

Returns

The JSON response of the request.

Return type

dict

*property* `secrets`[¶](#hvac.v1.Client.secrets "Permalink to this definition")

Accessor for the Client instance’s secrets engines. Provided via the [`hvac.api.SecretsEngines`](index.html#hvac.api.SecretsEngines "hvac.api.SecretsEngines") class.

Returns

This Client instance’s associated SecretsEngines instance.

Return type

[hvac.api.SecretsEngines](index.html#hvac.api.SecretsEngines "hvac.api.SecretsEngines")

*property* `session`[¶](#hvac.v1.Client.session "Permalink to this definition")

`set_policy`(*name*, *rules*)[[source]](_modules/hvac/v1.html#Client.set_policy)[¶](#hvac.v1.Client.set_policy "Permalink to this definition")

Call to deprecated function ‘set\_policy’. This method will be removed in version ‘0.9.0’ Please use the ‘create\_or\_update\_policy’ method on the ‘hvac.api.system\_backend.policy’ class moving forward.Docstring content from this method’s replacement copied below:

Add a new or update an existing policy.

Once a policy is updated, it takes effect immediately to all associated users.

Supported methods:PUT: /sys/policy/{name}. Produces: 204 (empty body)

Parameters

* **name** (*str | unicode*) – Specifies the name of the policy to create.

* **policy** (*str | unicode | dict*) – Specifies the policy document.

* **pretty\_print** (*bool*) – If True, and provided a dict for the policy argument, send the policy JSON to Vault with

“pretty” formatting.

Returns

The response of the request.

Return type

requests.Response

`set_role_id`(*role\_name*, *role\_id*, *mount\_point='approle'*)[[source]](_modules/hvac/v1.html#Client.set_role_id)[¶](#hvac.v1.Client.set_role_id "Permalink to this definition")

Call to deprecated function ‘set\_role\_id’. This method will be removed in version ‘0.12.0’ Please use the ‘update\_role\_id’ method on the ‘hvac.api.auth\_methods.approle’ class moving forward.Docstring content from this method’s replacement copied below:

Updates the Role ID of a role in the auth method.

Supported methods:POST: /auth/{mount\_point}/role/{role\_name}/role-id. Produces: 200 application/json

Parameters

* **role\_name** (*str | unicode*) – The name for the role.

* **role\_id** (*str | unicode*) – New value for the Role ID.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the read\_role\_id request.

Return type

dict

`start_generate_root`(*key*, *otp=False*)[[source]](_modules/hvac/v1.html#Client.start_generate_root)[¶](#hvac.v1.Client.start_generate_root "Permalink to this definition")

Call to deprecated function ‘start\_generate\_root’. This method will be removed in version ‘0.9.0’ Please use the ‘start\_root\_token\_generation’ method on the ‘hvac.api.system\_backend.key’ class moving forward.Docstring content from this method’s replacement copied below:

Initialize a new root generation attempt.

Only a single root generation attempt can take place at a time. One (and only one) of otp or pgp\_key are

required.

Supported methods:PUT: /sys/generate-root/attempt. Produces: 200 application/json

Parameters

* **otp** (*str | unicode*) – Specifies a base64-encoded 16-byte value. The raw bytes of the token will be XOR’d with this value

before being returned to the final unseal key provider.

* **pgp\_key** (*str | unicode*) – Specifies a base64-encoded PGP public key. The raw bytes of the token will be encrypted with

this value before being returned to the final unseal key provider.

Returns

The JSON response of the request.

Return type

dict

`start_rekey`(*secret\_shares=5*, *secret\_threshold=3*, *pgp\_keys=None*, *backup=False*)[[source]](_modules/hvac/v1.html#Client.start_rekey)[¶](#hvac.v1.Client.start_rekey "Permalink to this definition")

Call to deprecated function ‘start\_rekey’. This method will be removed in version ‘0.9.0’ Please use the ‘start\_rekey’ method on the ‘hvac.api.system\_backend.key’ class moving forward.Docstring content from this method’s replacement copied below:

Initializes a new rekey attempt.

Only a single recovery key rekeyattempt can take place at a time, and changing the parameters of a rekey

requires canceling and starting a new rekey, which will also provide a new nonce.

Supported methods:PUT: /sys/rekey/init. Produces: 204 (empty body)

PUT: /sys/rekey-recovery-key/init. Produces: 204 (empty body)

Parameters

* **secret\_shares** (*int*) – Specifies the number of shares to split the master key into.

* **secret\_threshold** (*int*) – Specifies the number of shares required to reconstruct the master key. This must be

less than or equal to secret\_shares.

* **pgp\_keys** (*list*) – Specifies an array of PGP public keys used to encrypt the output unseal keys. Ordering is

preserved. The keys must be base64-encoded from their original binary representation. The size of this array

must be the same as secret\_shares.

* **backup** (*bool*) – Specifies if using PGP-encrypted keys, whether Vault should also store a plaintext backup of the

PGP-encrypted keys at core/unseal-keys-backup in the physical storage backend. These can then be retrieved

and removed via the sys/rekey/backup endpoint.

* **require\_verification** (*bool*) – This turns on verification functionality. When verification is turned on, after

successful authorization with the current unseal keys, the new unseal keys are returned but the master key

is not actually rotated. The new keys must be provided to authorize the actual rotation of the master key.

This ensures that the new keys have been successfully saved and protects against a risk of the keys being

lost after rotation but before they can be persisted. This can be used with without pgp\_keys, and when used

with it, it allows ensuring that the returned keys can be successfully decrypted before committing to the

new shares, which the backup functionality does not provide.

* **recovery\_key** (*bool*) – If true, send requests to “rekey-recovery-key” instead of “rekey” api path.

Returns

The JSON dict of the response.

Return type

dict | request.Response

*property* `sys`[¶](#hvac.v1.Client.sys "Permalink to this definition")

Accessor for the Client instance’s system backend methods.

Provided via the [`hvac.api.SystemBackend`](index.html#hvac.api.SystemBackend "hvac.api.SystemBackend") class.

Returns

This Client instance’s associated SystemBackend instance.

Return type

[hvac.api.SystemBackend](index.html#hvac.api.SystemBackend "hvac.api.SystemBackend")

*property* `token`[¶](#hvac.v1.Client.token "Permalink to this definition")

`token_role`(*role*)[[source]](_modules/hvac/v1.html#Client.token_role)[¶](#hvac.v1.Client.token_role "Permalink to this definition")

Call to deprecated function ‘token\_role’. This method will be removed in version ‘1.0.0’ Please use the ‘read\_role’ method on the ‘hvac.api.auth\_methods.token’ class moving forward.Docstring content from this method’s replacement copied below:

Read the named role configuration.

Supported methods:GET: /auth/{mount\_point}/roles/{role\_name}.

Parameters

* **role\_name** (*str*) – The name of the token role.

* **mount\_point** (*str*) – The “path” the method/backend was mounted on.

Returns

The response of the read\_role request.

Return type

requests.Response

`transit_create_key`(*name*, *convergent\_encryption=None*, *derived=None*, *exportable=None*, *key\_type=None*, *mount\_point='transit'*)[[source]](_modules/hvac/v1.html#Client.transit_create_key)[¶](#hvac.v1.Client.transit_create_key "Permalink to this definition")

Call to deprecated function ‘transit\_create\_key’. This method will be removed in version ‘0.9.0’ Please use the ‘create\_key’ method on the ‘hvac.api.secrets\_engines.transit’ class moving forward.Docstring content from this method’s replacement copied below:

Create a new named encryption key of the specified type.

The values set here cannot be changed after key creation.

Supported methods:POST: /{mount\_point}/keys/{name}. Produces: 204 (empty body)

Parameters

* **name** (*str | unicode*) – Specifies the name of the encryption key to create. This is specified as part of the URL.

* **convergent\_encryption** (*bool*) – If enabled, the key will support convergent encryption, where the same plaintext

creates the same ciphertext. This requires derived to be set to true. When enabled, each

encryption(/decryption/rewrap/datakey) operation will derive a nonce value rather than randomly generate it.

* **derived** (*bool*) – Specifies if key derivation is to be used. If enabled, all encrypt/decrypt requests to this

named key must provide a context which is used for key derivation.

* **exportable** (*bool*) – Enables keys to be exportable. This allows for all the valid keys in the key ring to be

exported. Once set, this cannot be disabled.

* **allow\_plaintext\_backup** (*bool*) – If set, enables taking backup of named key in the plaintext format. Once set,

this cannot be disabled.

* **key\_type** (*str | unicode*) – Specifies the type of key to create. The currently-supported types are:

	+ **aes256-gcm96**: AES-256 wrapped with GCM using a 96-bit nonce size AEAD

	+ **chacha20-poly1305**: ChaCha20-Poly1305 AEAD (symmetric, supports derivation and convergent encryption)

	+ **ed25519**: ED25519 (asymmetric, supports derivation).

	+ **ecdsa-p256**: ECDSA using the P-256 elliptic curve (asymmetric)

	+ **ecdsa-p384**: ECDSA using the P-384 elliptic curve (asymmetric)

	+ **ecdsa-p521**: ECDSA using the P-521 elliptic curve (asymmetric)

	+ **rsa-2048**: RSA with bit size of 2048 (asymmetric)

	+ **rsa-3072**: RSA with bit size of 3072 (asymmetric)

	+ **rsa-4096**: RSA with bit size of 4096 (asymmetric)

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the request.

Return type

requests.Response

`transit_decrypt_data`(*name*, *ciphertext*, *context=None*, *nonce=None*, *batch\_input=None*, *mount\_point='transit'*)[[source]](_modules/hvac/v1.html#Client.transit_decrypt_data)[¶](#hvac.v1.Client.transit_decrypt_data "Permalink to this definition")

Call to deprecated function ‘transit\_decrypt\_data’. This method will be removed in version ‘0.9.0’ Please use the ‘decrypt\_data’ method on the ‘hvac.api.secrets\_engines.transit’ class moving forward.Docstring content from this method’s replacement copied below:

Decrypt the provided ciphertext using the named key.

Supported methods:POST: /{mount\_point}/decrypt/{name}. Produces: 200 application/json

Parameters

* **name** (*str | unicode*) – Specifies the name of the encryption key to decrypt against. This is specified as part of the URL.

* **ciphertext** (*str | unicode*) – the ciphertext to decrypt.

* **context** (*str | unicode*) – Specifies the base64 encoded context for key derivation. This is required if key derivation is

enabled.

* **nonce** (*str | unicode*) – Specifies a base64 encoded nonce value used during encryption. Must be provided if convergent

encryption is enabled for this key and the key was generated with Vault 0.6.1. Not required for keys created

in 0.6.2+.

* **batch\_input** (*List**[**dict**]*) – Specifies a list of items to be decrypted in a single batch. When this parameter is set, if

the parameters ‘ciphertext’, ‘context’ and ‘nonce’ are also set, they will be ignored. Format for the input

goes like this: [dict(context=”b64\_context”, ciphertext=”b64\_plaintext”), …]

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

`transit_delete_key`(*name*, *mount\_point='transit'*)[[source]](_modules/hvac/v1.html#Client.transit_delete_key)[¶](#hvac.v1.Client.transit_delete_key "Permalink to this definition")

Call to deprecated function ‘transit\_delete\_key’. This method will be removed in version ‘0.9.0’ Please use the ‘delete\_key’ method on the ‘hvac.api.secrets\_engines.transit’ class moving forward.Docstring content from this method’s replacement copied below:

Delete a named encryption key.

It will no longer be possible to decrypt any data encrypted with the named key. Because this is a potentially

catastrophic operation, the deletion\_allowed tunable must be set in the key’s /config endpoint.

Supported methods:DELETE: /{mount\_point}/keys/{name}. Produces: 204 (empty body)

Parameters

* **name** (*str | unicode*) – Specifies the name of the encryption key to delete. This is specified as part of the URL.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the request.

Return type

requests.Response

`transit_encrypt_data`(*name*, *plaintext*, *context=None*, *key\_version=None*, *nonce=None*, *batch\_input=None*, *key\_type=None*, *convergent\_encryption=None*, *mount\_point='transit'*)[[source]](_modules/hvac/v1.html#Client.transit_encrypt_data)[¶](#hvac.v1.Client.transit_encrypt_data "Permalink to this definition")

Call to deprecated function ‘transit\_encrypt\_data’. This method will be removed in version ‘0.9.0’ Please use the ‘encrypt\_data’ method on the ‘hvac.api.secrets\_engines.transit’ class moving forward.Docstring content from this method’s replacement copied below:

Encrypt the provided plaintext using the named key.

This path supports the create and update policy capabilities as follows: if the user has the create capability

for this endpoint in their policies, and the key does not exist, it will be upserted with default values

(whether the key requires derivation depends on whether the context parameter is empty or not). If the user only

has update capability and the key does not exist, an error will be returned.

Supported methods:POST: /{mount\_point}/encrypt/{name}. Produces: 200 application/json

Parameters

* **name** (*str | unicode*) – Specifies the name of the encryption key to encrypt against. This is specified as part of the URL.

* **plaintext** (*str | unicode*) – Specifies base64 encoded plaintext to be encoded.

* **context** (*str | unicode*) – Specifies the base64 encoded context for key derivation. This is required if key derivation is

enabled for this key.

* **key\_version** (*int*) – Specifies the version of the key to use for encryption. If not set, uses the latest version.

Must be greater than or equal to the key’s min\_encryption\_version, if set.

* **nonce** (*str | unicode*) – Specifies the base64 encoded nonce value. This must be provided if convergent encryption is

enabled for this key and the key was generated with Vault 0.6.1. Not required for keys created in 0.6.2+.

The value must be exactly 96 bits (12 bytes) long and the user must ensure that for any given context (and

thus, any given encryption key) this nonce value is never reused.

* **batch\_input** (*List**[**dict**]*) – Specifies a list of items to be encrypted in a single batch. When this parameter is set, if

the parameters ‘plaintext’, ‘context’ and ‘nonce’ are also set, they will be ignored. The format for the

input is: [dict(context=”b64\_context”, plaintext=”b64\_plaintext”), …]

* **type** (*str | unicode*) – This parameter is required when encryption key is expected to be created. When performing an

upsert operation, the type of key to create.

* **convergent\_encryption** (*str | unicode*) – This parameter will only be used when a key is expected to be created. Whether to

support convergent encryption. This is only supported when using a key with key derivation enabled and will

require all requests to carry both a context and 96-bit (12-byte) nonce. The given nonce will be used in

place of a randomly generated nonce. As a result, when the same context and nonce are supplied, the same

ciphertext is generated. It is very important when using this mode that you ensure that all nonces are

unique for a given context. Failing to do so will severely impact the ciphertext’s security.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

`transit_export_key`(*name*, *key\_type*, *version=None*, *mount\_point='transit'*)[[source]](_modules/hvac/v1.html#Client.transit_export_key)[¶](#hvac.v1.Client.transit_export_key "Permalink to this definition")

Call to deprecated function ‘transit\_export\_key’. This method will be removed in version ‘0.9.0’ Please use the ‘export\_key’ method on the ‘hvac.api.secrets\_engines.transit’ class moving forward.Docstring content from this method’s replacement copied below:

Return the named key.

The keys object shows the value of the key for each version. If version is specified, the specific version will

be returned. If latest is provided as the version, the current key will be provided. Depending on the type of

key, different information may be returned. The key must be exportable to support this operation and the version

must still be valid.

Supported methods:GET: /{mount\_point}/export/{key\_type}/{name}(/{version}). Produces: 200 application/json

Parameters

* **name** (*str | unicode*) – Specifies the name of the key to read information about. This is specified as part of the URL.

* **key\_type** (*str | unicode*) – Specifies the type of the key to export. This is specified as part of the URL. Valid values are:

encryption-key

signing-key

hmac-key

* **version** (*str | unicode*) – Specifies the version of the key to read. If omitted, all versions of the key will be returned.

If the version is set to latest, the current key will be returned.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

`transit_generate_data_key`(*name*, *key\_type*, *context=None*, *nonce=None*, *bits=None*, *mount\_point='transit'*)[[source]](_modules/hvac/v1.html#Client.transit_generate_data_key)[¶](#hvac.v1.Client.transit_generate_data_key "Permalink to this definition")

Call to deprecated function ‘transit\_generate\_data\_key’. This method will be removed in version ‘0.9.0’ Please use the ‘generate\_data\_key’ method on the ‘hvac.api.secrets\_engines.transit’ class moving forward.Docstring content from this method’s replacement copied below:

Generates a new high-entropy key and the value encrypted with the named key.

Optionally return the plaintext of the key as well. Whether plaintext is returned depends on the path; as a

result, you can use Vault ACL policies to control whether a user is allowed to retrieve the plaintext value of a

key. This is useful if you want an untrusted user or operation to generate keys that are then made available to

trusted users.

Supported methods:POST: /{mount\_point}/datakey/{key\_type}/{name}. Produces: 200 application/json

Parameters

* **name** (*str | unicode*) – Specifies the name of the encryption key to use to encrypt the datakey. This is specified as part

of the URL.

* **key\_type** (*str | unicode*) – Specifies the type of key to generate. If plaintext, the plaintext key will be returned along

with the ciphertext. If wrapped, only the ciphertext value will be returned. This is specified as part of

the URL.

* **context** (*str | unicode*) – Specifies the key derivation context, provided as a base64-encoded string. This must be provided

if derivation is enabled.

* **nonce** (*str | unicode*) – Specifies a nonce value, provided as base64 encoded. Must be provided if convergent encryption is

enabled for this key and the key was generated with Vault 0.6.1. Not required for keys created in 0.6.2+.

The value must be exactly 96 bits (12 bytes) long and the user must ensure that for any given context (and

thus, any given encryption key) this nonce value is never reused.

* **bits** (*int*) – Specifies the number of bits in the desired key. Can be 128, 256, or 512.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

`transit_generate_hmac`(*name*, *hmac\_input*, *key\_version=None*, *algorithm=None*, *mount\_point='transit'*)[[source]](_modules/hvac/v1.html#Client.transit_generate_hmac)[¶](#hvac.v1.Client.transit_generate_hmac "Permalink to this definition")

Call to deprecated function ‘transit\_generate\_hmac’. This method will be removed in version ‘0.9.0’ Please use the ‘generate\_hmac’ method on the ‘hvac.api.secrets\_engines.transit’ class moving forward.Docstring content from this method’s replacement copied below:

Return the digest of given data using the specified hash algorithm and the named key.

The key can be of any type supported by transit; the raw key will be marshaled into bytes to be used for the

HMAC function. If the key is of a type that supports rotation, the latest (current) version will be used.

Supported methods:POST: /{mount\_point}/hmac/{name}(/{algorithm}). Produces: 200 application/json

Parameters

* **name** (*str | unicode*) – Specifies the name of the encryption key to generate hmac against. This is specified as part of the

URL.

* **hash\_input** – Specifies the base64 encoded input data.

* **key\_version** (*int*) – Specifies the version of the key to use for the operation. If not set, uses the latest

version. Must be greater than or equal to the key’s min\_encryption\_version, if set.

* **algorithm** (*str | unicode*) – Specifies the hash algorithm to use. This can also be specified as part of the URL.

Currently-supported algorithms are: sha2-224, sha2-256, sha2-384, sha2-512

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

`transit_generate_rand_bytes`(*data\_bytes=None*, *output\_format=None*, *mount\_point='transit'*)[[source]](_modules/hvac/v1.html#Client.transit_generate_rand_bytes)[¶](#hvac.v1.Client.transit_generate_rand_bytes "Permalink to this definition")

Call to deprecated function ‘transit\_generate\_rand\_bytes’. This method will be removed in version ‘0.9.0’ Please use the ‘generate\_random\_bytes’ method on the ‘hvac.api.secrets\_engines.transit’ class moving forward.Docstring content from this method’s replacement copied below:

Return high-quality random bytes of the specified length.

Supported methods:POST: /{mount\_point}/random(/{bytes}). Produces: 200 application/json

Parameters

* **n\_bytes** (*int*) – Specifies the number of bytes to return. This value can be specified either in the request body,

or as a part of the URL.

* **output\_format** (*str | unicode*) – Specifies the output encoding. Valid options are hex or base64.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

`transit_hash_data`(*hash\_input*, *algorithm=None*, *output\_format=None*, *mount\_point='transit'*)[[source]](_modules/hvac/v1.html#Client.transit_hash_data)[¶](#hvac.v1.Client.transit_hash_data "Permalink to this definition")

Call to deprecated function ‘transit\_hash\_data’. This method will be removed in version ‘0.9.0’ Please use the ‘hash\_data’ method on the ‘hvac.api.secrets\_engines.transit’ class moving forward.Docstring content from this method’s replacement copied below:

Return the cryptographic hash of given data using the specified algorithm.

Supported methods:POST: /{mount\_point}/hash(/{algorithm}). Produces: 200 application/json

Parameters

* **hash\_input** (*str | unicode*) – Specifies the base64 encoded input data.

* **algorithm** (*str | unicode*) – Specifies the hash algorithm to use. This can also be specified as part of the URL.

Currently-supported algorithms are: sha2-224, sha2-256, sha2-384, sha2-512

* **output\_format** (*str | unicode*) – Specifies the output encoding. This can be either hex or base64.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

`transit_list_keys`(*mount\_point='transit'*)[[source]](_modules/hvac/v1.html#Client.transit_list_keys)[¶](#hvac.v1.Client.transit_list_keys "Permalink to this definition")

Call to deprecated function ‘transit\_list\_keys’. This method will be removed in version ‘0.9.0’ Please use the ‘list\_keys’ method on the ‘hvac.api.secrets\_engines.transit’ class moving forward.Docstring content from this method’s replacement copied below:

List keys (if there are any).

Only the key names are returned (not the actual keys themselves).

An exception is thrown if there are no keys.

Supported methods:LIST: /{mount\_point}/keys. Produces: 200 application/json

Parameters

**mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

`transit_read_key`(*name*, *mount\_point='transit'*)[[source]](_modules/hvac/v1.html#Client.transit_read_key)[¶](#hvac.v1.Client.transit_read_key "Permalink to this definition")

Call to deprecated function ‘transit\_read\_key’. This method will be removed in version ‘0.9.0’ Please use the ‘read\_key’ method on the ‘hvac.api.secrets\_engines.transit’ class moving forward.Docstring content from this method’s replacement copied below:

Read information about a named encryption key.

The keys object shows the creation time of each key version; the values are not the keys themselves. Depending

on the type of key, different information may be returned, e.g. an asymmetric key will return its public key in

a standard format for the type.

Supported methods:GET: /{mount\_point}/keys/{name}. Produces: 200 application/json

Parameters

* **name** (*str | unicode*) – Specifies the name of the encryption key to read. This is specified as part of the URL.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the read\_key request.

Return type

dict

`transit_rewrap_data`(*name*, *ciphertext*, *context=None*, *key\_version=None*, *nonce=None*, *batch\_input=None*, *mount\_point='transit'*)[[source]](_modules/hvac/v1.html#Client.transit_rewrap_data)[¶](#hvac.v1.Client.transit_rewrap_data "Permalink to this definition")

Call to deprecated function ‘transit\_rewrap\_data’. This method will be removed in version ‘0.9.0’ Please use the ‘rewrap\_data’ method on the ‘hvac.api.secrets\_engines.transit’ class moving forward.Docstring content from this method’s replacement copied below:

Rewrap the provided ciphertext using the latest version of the named key.

Because this never returns plaintext, it is possible to delegate this functionality to untrusted users or scripts.

Supported methods:POST: /{mount\_point}/rewrap/{name}. Produces: 200 application/json

Parameters

* **name** (*str | unicode*) – Specifies the name of the encryption key to re-encrypt against. This is specified as part of the URL.

* **ciphertext** (*str | unicode*) – Specifies the ciphertext to re-encrypt.

* **context** (*str | unicode*) – Specifies the base64 encoded context for key derivation. This is required if key derivation is

enabled.

* **key\_version** (*int*) – Specifies the version of the key to use for the operation. If not set, uses the latest

version. Must be greater than or equal to the key’s min\_encryption\_version, if set.

* **nonce** (*str | unicode*) – Specifies a base64 encoded nonce value used during encryption. Must be provided if convergent

encryption is enabled for this key and the key was generated with Vault 0.6.1. Not required for keys created

in 0.6.2+.

* **batch\_input** (*List**[**dict**]*) – Specifies a list of items to be decrypted in a single batch. When this parameter is set, if

the parameters ‘ciphertext’, ‘context’ and ‘nonce’ are also set, they will be ignored. Format for the input

goes like this: [dict(context=”b64\_context”, ciphertext=”b64\_plaintext”), …]

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

`transit_rotate_key`(*name*, *mount\_point='transit'*)[[source]](_modules/hvac/v1.html#Client.transit_rotate_key)[¶](#hvac.v1.Client.transit_rotate_key "Permalink to this definition")

Call to deprecated function ‘transit\_rotate\_key’. This method will be removed in version ‘0.9.0’ Please use the ‘rotate\_key’ method on the ‘hvac.api.secrets\_engines.transit’ class moving forward.Docstring content from this method’s replacement copied below:

Rotate the version of the named key.

After rotation, new plaintext requests will be encrypted with the new version of the key. To upgrade ciphertext

to be encrypted with the latest version of the key, use the rewrap endpoint. This is only supported with keys

that support encryption and decryption operations.

Supported methods:POST: /{mount\_point}/keys/{name}/rotate. Produces: 204 (empty body)

Parameters

* **name** (*str | unicode*) – Specifies the name of the key to read information about. This is specified as part of the URL.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the request.

Return type

requests.Response

`transit_sign_data`(*name*, *input\_data*, *key\_version=None*, *algorithm=None*, *context=None*, *prehashed=None*, *mount\_point='transit'*, *signature\_algorithm='pss'*)[[source]](_modules/hvac/v1.html#Client.transit_sign_data)[¶](#hvac.v1.Client.transit_sign_data "Permalink to this definition")

Call to deprecated function ‘transit\_sign\_data’. This method will be removed in version ‘0.9.0’ Please use the ‘sign\_data’ method on the ‘hvac.api.secrets\_engines.transit’ class moving forward.Docstring content from this method’s replacement copied below:

Return the cryptographic signature of the given data using the named key and the specified hash algorithm.

The key must be of a type that supports signing.

Supported methods:POST: /{mount\_point}/sign/{name}(/{hash\_algorithm}). Produces: 200 application/json

Parameters

* **name** (*str | unicode*) – Specifies the name of the encryption key to use for signing. This is specified as part of the URL.

* **hash\_input** (*str | unicode*) – Specifies the base64 encoded input data.

* **key\_version** (*int*) – Specifies the version of the key to use for signing. If not set, uses the latest version.

Must be greater than or equal to the key’s min\_encryption\_version, if set.

* **hash\_algorithm** (*str | unicode*) – Specifies the hash algorithm to use for supporting key types (notably, not including

ed25519 which specifies its own hash algorithm). This can also be specified as part of the URL.

Currently-supported algorithms are: sha2-224, sha2-256, sha2-384, sha2-512

* **context** (*str | unicode*) – Base64 encoded context for key derivation. Required if key derivation is enabled; currently only

available with ed25519 keys.

* **prehashed** (*bool*) – Set to true when the input is already hashed. If the key type is rsa-2048 or rsa-4096, then

the algorithm used to hash the input should be indicated by the hash\_algorithm parameter. Just as the value

to sign should be the base64-encoded representation of the exact binary data you want signed, when set, input

is expected to be base64-encoded binary hashed data, not hex-formatted. (As an example, on the command line,

you could generate a suitable input via openssl dgst -sha256 -binary | base64.)

* **signature\_algorithm** (*str | unicode*) – When using a RSA key, specifies the RSA signature algorithm to use for signing.

Supported signature types are: pss, pkcs1v15

* **marshaling\_algorithm** (*str | unicode*) – Specifies the way in which the signature should be marshaled. This currently only applies to ECDSA keys.

Supported types are: asn1, jws

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

`transit_update_key`(*name*, *min\_decryption\_version=None*, *min\_encryption\_version=None*, *deletion\_allowed=None*, *mount\_point='transit'*)[[source]](_modules/hvac/v1.html#Client.transit_update_key)[¶](#hvac.v1.Client.transit_update_key "Permalink to this definition")

Call to deprecated function ‘transit\_update\_key’. This method will be removed in version ‘0.9.0’ Please use the ‘update\_key\_configuration’ method on the ‘hvac.api.secrets\_engines.transit’ class moving forward.Docstring content from this method’s replacement copied below:

Tune configuration values for a given key.

These values are returned during a read operation on the named key.

Supported methods:POST: /{mount\_point}/keys/{name}/config. Produces: 204 (empty body)

Parameters

* **name** (*str | unicode*) – Specifies the name of the encryption key to update configuration for.

* **min\_decryption\_version** (*int*) – Specifies the minimum version of ciphertext allowed to be decrypted. Adjusting

this as part of a key rotation policy can prevent old copies of ciphertext from being decrypted, should they

fall into the wrong hands. For signatures, this value controls the minimum version of signature that can be

verified against. For HMACs, this controls the minimum version of a key allowed to be used as the key for

verification.

* **min\_encryption\_version** (*int*) – Specifies the minimum version of the key that can be used to encrypt plaintext,

sign payloads, or generate HMACs. Must be 0 (which will use the latest version) or a value greater or equal

to min\_decryption\_version.

* **deletion\_allowed** (*bool*) – Specifies if the key is allowed to be deleted.

* **exportable** (*bool*) – Enables keys to be exportable. This allows for all the valid keys in the key ring to be

exported. Once set, this cannot be disabled.

* **allow\_plaintext\_backup** (*bool*) – If set, enables taking backup of named key in the plaintext format. Once set,

this cannot be disabled.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the request.

Return type

requests.Response

`transit_verify_signed_data`(*name*, *input\_data*, *algorithm=None*, *signature=None*, *hmac=None*, *context=None*, *prehashed=None*, *mount\_point='transit'*, *signature\_algorithm='pss'*)[[source]](_modules/hvac/v1.html#Client.transit_verify_signed_data)[¶](#hvac.v1.Client.transit_verify_signed_data "Permalink to this definition")

Call to deprecated function ‘transit\_verify\_signed\_data’. This method will be removed in version ‘0.9.0’ Please use the ‘verify\_signed\_data’ method on the ‘hvac.api.secrets\_engines.transit’ class moving forward.Docstring content from this method’s replacement copied below:

Return whether the provided signature is valid for the given data.

Supported methods:POST: /{mount\_point}/verify/{name}(/{hash\_algorithm}). Produces: 200 application/json

Parameters

* **name** (*str | unicode*) – Specifies the name of the encryption key that was used to generate the signature or HMAC.

* **hash\_input** – Specifies the base64 encoded input data.

* **signature** (*str | unicode*) – Specifies the signature output from the /transit/sign function. Either this must be supplied

or hmac must be supplied.

* **hmac** (*str | unicode*) – Specifies the signature output from the /transit/hmac function. Either this must be supplied or

signature must be supplied.

* **hash\_algorithm** (*str | unicode*) – Specifies the hash algorithm to use. This can also be specified as part of the URL.

Currently-supported algorithms are: sha2-224, sha2-256, sha2-384, sha2-512

* **context** (*str | unicode*) – Base64 encoded context for key derivation. Required if key derivation is enabled; currently only

available with ed25519 keys.

* **prehashed** (*bool*) – Set to true when the input is already hashed. If the key type is rsa-2048 or rsa-4096, then

the algorithm used to hash the input should be indicated by the hash\_algorithm parameter.

* **signature\_algorithm** (*str | unicode*) – When using a RSA key, specifies the RSA signature algorithm to use for signature

verification. Supported signature types are: pss, pkcs1v15

* **marshaling\_algorithm** (*str | unicode*) – Specifies the way in which the signature should be marshaled. This currently only applies to ECDSA keys.

Supported types are: asn1, jws

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

`tune_auth_backend`(*backend\_type*, *mount\_point=None*, *default\_lease\_ttl=None*, *max\_lease\_ttl=None*, *description=None*, *audit\_non\_hmac\_request\_keys=None*, *audit\_non\_hmac\_response\_keys=None*, *listing\_visibility=''*, *passthrough\_request\_headers=None*)[[source]](_modules/hvac/v1.html#Client.tune_auth_backend)[¶](#hvac.v1.Client.tune_auth_backend "Permalink to this definition")

Call to deprecated function ‘tune\_auth\_backend’. This method will be removed in version ‘0.9.0’ Please use the ‘tune\_auth\_method’ method on the ‘hvac.api.system\_backend.auth’ class moving forward.Docstring content from this method’s replacement copied below:

Tune configuration parameters for a given auth path.

This endpoint requires sudo capability on the final path, but the same functionality can be achieved without

sudo via sys/mounts/auth/[auth-path]/tune.

Supported methods:POST: /sys/auth/{path}/tune. Produces: 204 (empty body)

Parameters

* **path** (*str | unicode*) – The path the method was mounted on. If not provided, defaults to the value of the “method\_type”

argument.

* **default\_lease\_ttl** (*int*) – Specifies the default time-to-live. If set on a specific auth path, this overrides the

global default.

* **max\_lease\_ttl** (*int*) – The maximum time-to-live. If set on a specific auth path, this overrides the global

default.

* **description** (*str | unicode*) – Specifies the description of the mount. This overrides the current stored value, if any.

* **audit\_non\_hmac\_request\_keys** (*array*) – Specifies the list of keys that will not be HMAC’d by audit devices in the

request data object.

* **audit\_non\_hmac\_response\_keys** (*list*) – Specifies the list of keys that will not be HMAC’d by audit devices in the

response data object.

* **listing\_visibility** (*list*) – Specifies whether to show this mount in the UI-specific listing endpoint. Valid

values are “unauth” or “”.

* **passthrough\_request\_headers** (*list*) – List of headers to whitelist and pass from the request to the backend.

* **kwargs** (*dict*) – All dicts are accepted and passed to vault. See your specific secret engine for details on which

extra key-word arguments you might want to pass.

Returns

The response of the request.

Return type

requests.Response

`tune_secret_backend`(*backend\_type*, *mount\_point=None*, *default\_lease\_ttl=None*, *max\_lease\_ttl=None*, *description=None*, *audit\_non\_hmac\_request\_keys=None*, *audit\_non\_hmac\_response\_keys=None*, *listing\_visibility=None*, *passthrough\_request\_headers=None*)[[source]](_modules/hvac/v1.html#Client.tune_secret_backend)[¶](#hvac.v1.Client.tune_secret_backend "Permalink to this definition")

Call to deprecated function ‘tune\_secret\_backend’. This method will be removed in version ‘0.9.0’ Please use the ‘tune\_mount\_configuration’ method on the ‘hvac.api.system\_backend.mount’ class moving forward.Docstring content from this method’s replacement copied below:

Tune configuration parameters for a given mount point.

Supported methods:POST: /sys/mounts/{path}/tune. Produces: 204 (empty body)

Parameters

* **path** (*str | unicode*) – Specifies the path where the secrets engine will be mounted. This is specified as part of the URL.

* **mount\_point** (*str*) – The path the associated secret backend is mounted

* **description** (*str*) – Specifies the description of the mount. This overrides the current stored value, if any.

* **default\_lease\_ttl** (*int*) – Default time-to-live. This overrides the global default. A value of 0 is equivalent to

the system default TTL

* **max\_lease\_ttl** (*int*) – Maximum time-to-live. This overrides the global default. A value of 0 are equivalent and

set to the system max TTL.

* **audit\_non\_hmac\_request\_keys** (*list*) – Specifies the comma-separated list of keys that will not be HMAC’d by audit

devices in the request data object.

* **audit\_non\_hmac\_response\_keys** (*list*) – Specifies the comma-separated list of keys that will not be HMAC’d by audit

devices in the response data object.

* **listing\_visibility** (*str*) – Speficies whether to show this mount in the UI-specific listing endpoint. Valid

values are “unauth” or “”.

* **passthrough\_request\_headers** (*str*) – Comma-separated list of headers to whitelist and pass from the request

to the backend.

* **options** (*dict*) – Specifies mount type specific options that are passed to the backend.

	+ **version**: <KV> The version of the KV to mount. Set to “2” for mount KV v2.

* **force\_no\_cache** (*bool*) – Disable caching.

* **kwargs** (*dict*) – All dicts are accepted and passed to vault. See your specific secret engine for details on which

extra key-word arguments you might want to pass.

Returns

The response from the request.

Return type

request.Response

`unseal`(*key*)[[source]](_modules/hvac/v1.html#Client.unseal)[¶](#hvac.v1.Client.unseal "Permalink to this definition")

Call to deprecated function ‘unseal’. This method will be removed in version ‘0.9.0’ Please use the ‘submit\_unseal\_key’ method on the ‘hvac.api.system\_backend.seal’ class moving forward.Docstring content from this method’s replacement copied below:

Enter a single master key share to progress the unsealing of the Vault.

If the threshold number of master key shares is reached, Vault will attempt to unseal the Vault. Otherwise, this

API must be called multiple times until that threshold is met.

Either the key or reset parameter must be provided; if both are provided, reset takes precedence.

Supported methods:PUT: /sys/unseal. Produces: 200 application/json

Parameters

* **key** (*str | unicode*) – Specifies a single master key share. This is required unless reset is true.

* **reset** (*bool*) – Specifies if previously-provided unseal keys are discarded and the unseal process is reset.

* **migrate** – Available in 1.0 Beta - Used to migrate the seal from shamir to autoseal or autoseal to shamir.

Must be provided on all unseal key calls.

Type

migrate: bool

Returns

The JSON response of the request.

Return type

dict

`unseal_multi`(*keys*)[[source]](_modules/hvac/v1.html#Client.unseal_multi)[¶](#hvac.v1.Client.unseal_multi "Permalink to this definition")

Call to deprecated function ‘unseal\_multi’. This method will be removed in version ‘0.9.0’ Please use the ‘submit\_unseal\_keys’ method on the ‘hvac.api.system\_backend.seal’ class moving forward.Docstring content from this method’s replacement copied below:

Enter multiple master key share to progress the unsealing of the Vault.

Parameters

* **keys** (*List**[**str**]*) – List of master key shares.

* **migrate** – Available in 1.0 Beta - Used to migrate the seal from shamir to autoseal or autoseal to shamir.

Must be provided on all unseal key calls.

Type

migrate: bool

Returns

The JSON response of the last unseal request.

Return type

dict

`unseal_reset`()[[source]](_modules/hvac/v1.html#Client.unseal_reset)[¶](#hvac.v1.Client.unseal_reset "Permalink to this definition")

Call to deprecated function ‘unseal\_reset’. This method will be removed in version ‘0.9.0’ Please use the ‘submit\_unseal\_key’ method on the ‘hvac.api.system\_backend.seal’ class moving forward.Docstring content from this method’s replacement copied below:

Enter a single master key share to progress the unsealing of the Vault.

If the threshold number of master key shares is reached, Vault will attempt to unseal the Vault. Otherwise, this

API must be called multiple times until that threshold is met.

Either the key or reset parameter must be provided; if both are provided, reset takes precedence.

Supported methods:PUT: /sys/unseal. Produces: 200 application/json

Parameters

* **key** (*str | unicode*) – Specifies a single master key share. This is required unless reset is true.

* **reset** (*bool*) – Specifies if previously-provided unseal keys are discarded and the unseal process is reset.

* **migrate** – Available in 1.0 Beta - Used to migrate the seal from shamir to autoseal or autoseal to shamir.

Must be provided on all unseal key calls.

Type

migrate: bool

Returns

The JSON response of the request.

Return type

dict

`unwrap`(*token=None*)[[source]](_modules/hvac/v1.html#Client.unwrap)[¶](#hvac.v1.Client.unwrap "Permalink to this definition")

Call to deprecated function ‘unwrap’. This method will be removed in version ‘0.9.0’ Please use the ‘unwrap’ method on the ‘hvac.api.system\_backend.wrapping’ class moving forward.Docstring content from this method’s replacement copied below:

Return the original response inside the given wrapping token.

Unlike simply reading cubbyhole/response (which is deprecated), this endpoint provides additional validation

checks on the token, returns the original value on the wire rather than a JSON string representation of it, and

ensures that the response is properly audit-logged.

Supported methods:POST: /sys/wrapping/unwrap. Produces: 200 application/json

Parameters

**token** (*str | unicode*) – Specifies the wrapping token ID. This is required if the client token is not the wrapping token.

Do not use the wrapping token in both locations.

Returns

The JSON response of the request.

Return type

dict

`update_userpass_password`(*username*, *password*, *mount\_point='userpass'*)[[source]](_modules/hvac/v1.html#Client.update_userpass_password)[¶](#hvac.v1.Client.update_userpass_password "Permalink to this definition")

Call to deprecated function ‘update\_userpass\_password’. This method will be removed in version ‘1.0.0’ Please use the ‘update\_password\_on\_user’ method on the ‘hvac.api.auth\_methods.userpass’ class moving forward.Docstring content from this method’s replacement copied below:

update password for the user in userpass.

Supported methods:POST: /auth/{mount\_point}/users/{username}/password. Produces: 204 (empty body)

Parameters

* **username** (*str | unicode*) – The username for the user.

* **password** (*str | unicode*) – The password for the user. Only required when creating the user.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

`update_userpass_policies`(*username*, *policies*, *mount\_point='userpass'*)[[source]](_modules/hvac/v1.html#Client.update_userpass_policies)[¶](#hvac.v1.Client.update_userpass_policies "Permalink to this definition")

Call to deprecated function ‘update\_userpass\_policies’. This method will be removed in version ‘1.0.0’ Please use the ‘create\_or\_update\_user’ method on the ‘hvac.api.auth\_methods.userpass’ class moving forward.Docstring content from this method’s replacement copied below:

Create/update user in userpass.

Supported methods:POST: /auth/{mount\_point}/users/{username}. Produces: 204 (empty body)

Parameters

* **username** (*str | unicode*) – The username for the user.

* **password** (*str | unicode*) – The password for the user. Only required when creating the user.

* **policies** (*str | unicode*) – The list of policies to be set on username created.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

* **kwargs** (*dict*) – Additional arguments to pass along with the corresponding request to Vault.

*property* `url`[¶](#hvac.v1.Client.url "Permalink to this definition")

*static* `urljoin`(*\*args*, *\*\*kwargs*)[[source]](_modules/hvac/v1.html#Client.urljoin)[¶](#hvac.v1.Client.urljoin "Permalink to this definition")

Call to deprecated function ‘urljoin’. This method will be removed in version ‘0.8.0’ Please use the ‘urljoin’ method on the ‘hvac.adapters’ class moving forward.Docstring content from this method’s replacement copied below:

Joins given arguments into a url. Trailing and leading slashes are stripped for each argument.

Parameters

**args** (*str | unicode*) – Multiple parts of a URL to be combined into one string.

Returns

Full URL combining all provided arguments

Return type

str | unicode

`write`(*path*, *wrap\_ttl=None*, *\*\*kwargs*)[[source]](_modules/hvac/v1.html#Client.write)[¶](#hvac.v1.Client.write "Permalink to this definition")

POST /<path>

Parameters

* **path** –

* **wrap\_ttl** –

* **kwargs** –

Returns

Return type

### hvac.api[¶](#module-hvac.api "Permalink to this headline")

Collection of Vault API endpoint classes.

**Classes**

| [`AuthMethods`](#hvac.api.AuthMethods "hvac.api.AuthMethods")(adapter) | Auth Methods. |

| [`SecretsEngines`](#hvac.api.SecretsEngines "hvac.api.SecretsEngines")(adapter) | Secrets Engines. |

| [`SystemBackend`](#hvac.api.SystemBackend "hvac.api.SystemBackend")(adapter) |  |

| [`VaultApiBase`](#hvac.api.VaultApiBase "hvac.api.VaultApiBase")(adapter) | Base class for API endpoints. |

| [`VaultApiCategory`](#hvac.api.VaultApiCategory "hvac.api.VaultApiCategory")(adapter) | Base class for API categories. |

*class* `hvac.api.``AuthMethods`(*adapter*)[[source]](_modules/hvac/api/auth_methods.html#AuthMethods)[¶](#hvac.api.AuthMethods "Permalink to this definition")

Bases: `hvac.api.vault\_api\_category.VaultApiCategory`

Auth Methods.

**Attributes**

| [`implemented\_classes`](#hvac.api.AuthMethods.implemented_classes "hvac.api.AuthMethods.implemented_classes") | Built-in mutable sequence. |

| [`unimplemented\_classes`](#hvac.api.AuthMethods.unimplemented_classes "hvac.api.AuthMethods.unimplemented_classes") | Built-in mutable sequence. |

`implemented_classes` *= [<class 'hvac.api.auth\_methods.approle.AppRole'>, <class 'hvac.api.auth\_methods.azure.Azure'>, <class 'hvac.api.auth\_methods.github.Github'>, <class 'hvac.api.auth\_methods.gcp.Gcp'>, <class 'hvac.api.auth\_methods.jwt.JWT'>, <class 'hvac.api.auth\_methods.kubernetes.Kubernetes'>, <class 'hvac.api.auth\_methods.ldap.Ldap'>, <class 'hvac.api.auth\_methods.userpass.Userpass'>, <class 'hvac.api.auth\_methods.mfa.Mfa'>, <class 'hvac.api.auth\_methods.oidc.OIDC'>, <class 'hvac.api.auth\_methods.okta.Okta'>, <class 'hvac.api.auth\_methods.radius.Radius'>, <class 'hvac.api.auth\_methods.token.Token'>, <class 'hvac.api.auth\_methods.aws.Aws'>, <class 'hvac.api.auth\_methods.cert.Cert'>]*[¶](#hvac.api.AuthMethods.implemented_classes "Permalink to this definition")

`unimplemented_classes` *= ['AppId', 'AliCloud']*[¶](#hvac.api.AuthMethods.unimplemented_classes "Permalink to this definition")

*class* `hvac.api.``SecretsEngines`(*adapter*)[[source]](_modules/hvac/api/secrets_engines.html#SecretsEngines)[¶](#hvac.api.SecretsEngines "Permalink to this definition")

Bases: `hvac.api.vault\_api\_category.VaultApiCategory`

Secrets Engines.

**Attributes**

| [`implemented\_classes`](#hvac.api.SecretsEngines.implemented_classes "hvac.api.SecretsEngines.implemented_classes") | Built-in mutable sequence. |

| [`unimplemented\_classes`](#hvac.api.SecretsEngines.unimplemented_classes "hvac.api.SecretsEngines.unimplemented_classes") | Built-in mutable sequence. |

`implemented_classes` *= [<class 'hvac.api.secrets\_engines.aws.Aws'>, <class 'hvac.api.secrets\_engines.azure.Azure'>, <class 'hvac.api.secrets\_engines.gcp.Gcp'>, <class 'hvac.api.secrets\_engines.active\_directory.ActiveDirectory'>, <class 'hvac.api.secrets\_engines.identity.Identity'>, <class 'hvac.api.secrets\_engines.kv.Kv'>, <class 'hvac.api.secrets\_engines.pki.Pki'>, <class 'hvac.api.secrets\_engines.transform.Transform'>, <class 'hvac.api.secrets\_engines.transit.Transit'>, <class 'hvac.api.secrets\_engines.database.Database'>, <class 'hvac.api.secrets\_engines.consul.Consul'>, <class 'hvac.api.secrets\_engines.rabbitmq.RabbitMQ'>]*[¶](#hvac.api.SecretsEngines.implemented_classes "Permalink to this definition")

`unimplemented_classes` *= ['AliCloud', 'Azure', 'GcpKms', 'Nomad', 'Ssh', 'TOTP', 'Cassandra', 'MongoDb', 'Mssql', 'MySql', 'PostgreSql']*[¶](#hvac.api.SecretsEngines.unimplemented_classes "Permalink to this definition")

*class* `hvac.api.``SystemBackend`(*adapter*)[[source]](_modules/hvac/api/system_backend.html#SystemBackend)[¶](#hvac.api.SystemBackend "Permalink to this definition")

Bases: `hvac.api.vault\_api\_category.VaultApiCategory`, `hvac.api.system\_backend.audit.Audit`, `hvac.api.system\_backend.auth.Auth`, `hvac.api.system\_backend.capabilities.Capabilities`, `hvac.api.system\_backend.health.Health`, `hvac.api.system\_backend.init.Init`, `hvac.api.system\_backend.key.Key`, `hvac.api.system\_backend.leader.Leader`, `hvac.api.system\_backend.lease.Lease`, `hvac.api.system\_backend.mount.Mount`, `hvac.api.system\_backend.namespace.Namespace`, `hvac.api.system\_backend.policy.Policy`, `hvac.api.system\_backend.raft.Raft`, `hvac.api.system\_backend.seal.Seal`, `hvac.api.system\_backend.wrapping.Wrapping`

**Methods**

| [`\_\_init\_\_`](#hvac.api.SystemBackend.__init__ "hvac.api.SystemBackend.__init__")(adapter) | API Category class constructor. |

**Attributes**

| [`implemented\_classes`](#hvac.api.SystemBackend.implemented_classes "hvac.api.SystemBackend.implemented_classes") | Built-in mutable sequence. |

| [`unimplemented\_classes`](#hvac.api.SystemBackend.unimplemented_classes "hvac.api.SystemBackend.unimplemented_classes") | Built-in mutable sequence. |

`__init__`(*adapter*)[[source]](_modules/hvac/api/system_backend.html#SystemBackend.__init__)[¶](#hvac.api.SystemBackend.__init__ "Permalink to this definition")

API Category class constructor.

Parameters

**adapter** ([*hvac.adapters.Adapter*](index.html#hvac.adapters.Adapter "hvac.adapters.Adapter")) – Instance of [`hvac.adapters.Adapter`](index.html#hvac.adapters.Adapter "hvac.adapters.Adapter"); used for performing HTTP requests.

`implemented_classes` *= [<class 'hvac.api.system\_backend.audit.Audit'>, <class 'hvac.api.system\_backend.auth.Auth'>, <class 'hvac.api.system\_backend.capabilities.Capabilities'>, <class 'hvac.api.system\_backend.health.Health'>, <class 'hvac.api.system\_backend.init.Init'>, <class 'hvac.api.system\_backend.key.Key'>, <class 'hvac.api.system\_backend.leader.Leader'>, <class 'hvac.api.system\_backend.lease.Lease'>, <class 'hvac.api.system\_backend.mount.Mount'>, <class 'hvac.api.system\_backend.namespace.Namespace'>, <class 'hvac.api.system\_backend.policy.Policy'>, <class 'hvac.api.system\_backend.raft.Raft'>, <class 'hvac.api.system\_backend.seal.Seal'>, <class 'hvac.api.system\_backend.wrapping.Wrapping'>]*[¶](#hvac.api.SystemBackend.implemented_classes "Permalink to this definition")

`unimplemented_classes` *= []*[¶](#hvac.api.SystemBackend.unimplemented_classes "Permalink to this definition")

*class* `hvac.api.``VaultApiBase`(*adapter*)[[source]](_modules/hvac/api/vault_api_base.html#VaultApiBase)[¶](#hvac.api.VaultApiBase "Permalink to this definition")

Bases: `object`

Base class for API endpoints.

**Methods**

| [`\_\_init\_\_`](#hvac.api.VaultApiBase.__init__ "hvac.api.VaultApiBase.__init__")(adapter) | Default api class constructor. |

`__init__`(*adapter*)[[source]](_modules/hvac/api/vault_api_base.html#VaultApiBase.__init__)[¶](#hvac.api.VaultApiBase.__init__ "Permalink to this definition")

Default api class constructor.

Parameters

**adapter** ([*hvac.adapters.Adapter*](index.html#hvac.adapters.Adapter "hvac.adapters.Adapter")) – Instance of [`hvac.adapters.Adapter`](index.html#hvac.adapters.Adapter "hvac.adapters.Adapter"); used for performing HTTP requests.

*class* `hvac.api.``VaultApiCategory`(*adapter*)[[source]](_modules/hvac/api/vault_api_category.html#VaultApiCategory)[¶](#hvac.api.VaultApiCategory "Permalink to this definition")

Bases: `hvac.api.vault\_api\_base.VaultApiBase`

Base class for API categories.

**Methods**

| [`\_\_init\_\_`](#hvac.api.VaultApiCategory.__init__ "hvac.api.VaultApiCategory.__init__")(adapter) | API Category class constructor. |

| [`get\_private\_attr\_name`](#hvac.api.VaultApiCategory.get_private_attr_name "hvac.api.VaultApiCategory.get_private_attr_name")(class\_name) | Helper method to prepend a leading underscore to a provided class name. |

**Attributes**

| [`adapter`](#hvac.api.VaultApiCategory.adapter "hvac.api.VaultApiCategory.adapter") | Retrieve the adapter instance under the “\_adapter” property in use by this class. |

| [`implemented\_classes`](#hvac.api.VaultApiCategory.implemented_classes "hvac.api.VaultApiCategory.implemented_classes") | List of implemented classes under this category. |

| [`unimplemented\_classes`](#hvac.api.VaultApiCategory.unimplemented_classes "hvac.api.VaultApiCategory.unimplemented_classes") | List of known unimplemented classes under this category. |

`__init__`(*adapter*)[[source]](_modules/hvac/api/vault_api_category.html#VaultApiCategory.__init__)[¶](#hvac.api.VaultApiCategory.__init__ "Permalink to this definition")

API Category class constructor.

Parameters

**adapter** ([*hvac.adapters.Adapter*](index.html#hvac.adapters.Adapter "hvac.adapters.Adapter")) – Instance of [`hvac.adapters.Adapter`](index.html#hvac.adapters.Adapter "hvac.adapters.Adapter"); used for performing HTTP requests.

*property* `adapter`[¶](#hvac.api.VaultApiCategory.adapter "Permalink to this definition")

Retrieve the adapter instance under the “\_adapter” property in use by this class.

Returns

The adapter instance in use by this class.

Return type

[hvac.adapters.Adapter](index.html#hvac.adapters.Adapter "hvac.adapters.Adapter")

*static* `get_private_attr_name`(*class\_name*)[[source]](_modules/hvac/api/vault_api_category.html#VaultApiCategory.get_private_attr_name)[¶](#hvac.api.VaultApiCategory.get_private_attr_name "Permalink to this definition")

Helper method to prepend a leading underscore to a provided class name.

Parameters

**class\_name** (*str|unicode*) – Name of a class under this category.

Returns

The private attribute label for the provided class.

Return type

str

*abstract property* `implemented_classes`[¶](#hvac.api.VaultApiCategory.implemented_classes "Permalink to this definition")

List of implemented classes under this category.

Returns

List of implemented classes under this category.

Return type

List[[hvac.api.VaultApiBase](index.html#hvac.api.VaultApiBase "hvac.api.VaultApiBase")]

*property* `unimplemented_classes`[¶](#hvac.api.VaultApiCategory.unimplemented_classes "Permalink to this definition")

List of known unimplemented classes under this category.

Returns

List of known unimplemented classes under this category.

Return type

List[str]

### hvac.api.auth\_methods[¶](#module-hvac.api.auth_methods "Permalink to this headline")

Collection of classes for various Vault auth methods.

**Classes**

| [`AuthMethods`](#hvac.api.auth_methods.AuthMethods "hvac.api.auth_methods.AuthMethods")(adapter) | Auth Methods. |

| [`AppRole`](#hvac.api.auth_methods.AppRole "hvac.api.auth_methods.AppRole")(adapter) | USERPASS Auth Method (API). |

| [`Azure`](#hvac.api.auth_methods.Azure "hvac.api.auth_methods.Azure")(adapter) | Azure Auth Method (API). |

| [`Gcp`](#hvac.api.auth_methods.Gcp "hvac.api.auth_methods.Gcp")(adapter) | Google Cloud Auth Method (API). |

| [`Github`](#hvac.api.auth_methods.Github "hvac.api.auth_methods.Github")(adapter) | GitHub Auth Method (API). |

| [`JWT`](#hvac.api.auth_methods.JWT "hvac.api.auth_methods.JWT")(adapter) | JWT auth method which can be used to authenticate with Vault by providing a JWT. |

| [`Kubernetes`](#hvac.api.auth_methods.Kubernetes "hvac.api.auth_methods.Kubernetes")(adapter) | Kubernetes Auth Method (API). |

| [`Ldap`](#hvac.api.auth_methods.Ldap "hvac.api.auth_methods.Ldap")(adapter) | LDAP Auth Method (API). |

| [`Userpass`](#hvac.api.auth_methods.Userpass "hvac.api.auth_methods.Userpass")(adapter) | USERPASS Auth Method (API). |

| [`Mfa`](#hvac.api.auth_methods.Mfa "hvac.api.auth_methods.Mfa")(adapter) | Multi-factor authentication Auth Method (API). |

| [`OIDC`](#hvac.api.auth_methods.OIDC "hvac.api.auth_methods.OIDC")(adapter) | OIDC auth method which can be used to authenticate with Vault using OIDC. |

| [`Okta`](#hvac.api.auth_methods.Okta "hvac.api.auth_methods.Okta")(adapter) | Okta Auth Method (API). |

| [`Radius`](#hvac.api.auth_methods.Radius "hvac.api.auth_methods.Radius")(adapter) | RADIUS Auth Method (API). |

| [`Token`](#hvac.api.auth_methods.Token "hvac.api.auth_methods.Token")(adapter) | Token Auth Method (API). |

| [`Aws`](#hvac.api.auth_methods.Aws "hvac.api.auth_methods.Aws")(adapter) | AWS Auth Method (API). |

| [`Cert`](#hvac.api.auth_methods.Cert "hvac.api.auth_methods.Cert")(adapter) | Cert Auth Method (API). |

*class* `hvac.api.auth_methods.``AppRole`(*adapter*)[[source]](_modules/hvac/api/auth_methods/approle.html#AppRole)[¶](#hvac.api.auth_methods.AppRole "Permalink to this definition")

Bases: `hvac.api.vault\_api\_base.VaultApiBase`

USERPASS Auth Method (API).

Reference: <https://www.vaultproject.io/api-docs/auth/approle/index.html>

**Methods**

| [`create\_custom\_secret\_id`](#hvac.api.auth_methods.AppRole.create_custom_secret_id "hvac.api.auth_methods.AppRole.create_custom_secret_id")(role\_name, secret\_id) | Generates and issues a new Secret ID on a role in the auth method. |

| [`create\_or\_update\_approle`](#hvac.api.auth_methods.AppRole.create_or_update_approle "hvac.api.auth_methods.AppRole.create_or_update_approle")(role\_name[, …]) | Create/update approle. |

| [`delete\_role`](#hvac.api.auth_methods.AppRole.delete_role "hvac.api.auth_methods.AppRole.delete_role")(role\_name[, mount\_point]) | Delete role in the auth method. |

| [`destroy\_secret\_id`](#hvac.api.auth_methods.AppRole.destroy_secret_id "hvac.api.auth_methods.AppRole.destroy_secret_id")(role\_name, secret\_id[, …]) | Destroys a Secret ID for a role in the auth method. |

| [`destroy\_secret\_id\_accessor`](#hvac.api.auth_methods.AppRole.destroy_secret_id_accessor "hvac.api.auth_methods.AppRole.destroy_secret_id_accessor")(role\_name, …[, …]) | Destroys a Secret ID for a role in the auth method. |

| [`generate\_secret\_id`](#hvac.api.auth_methods.AppRole.generate_secret_id "hvac.api.auth_methods.AppRole.generate_secret_id")(role\_name[, metadata, …]) | Generates and issues a new Secret ID on a role in the auth method. |

| [`list\_roles`](#hvac.api.auth_methods.AppRole.list_roles "hvac.api.auth_methods.AppRole.list_roles")([mount\_point]) | List existing roles created in the auth method. |

| [`list\_secret\_id\_accessors`](#hvac.api.auth_methods.AppRole.list_secret_id_accessors "hvac.api.auth_methods.AppRole.list_secret_id_accessors")(role\_name[, …]) | Lists accessors of all issued Secret IDs for a role in the auth method. |

| [`login`](#hvac.api.auth_methods.AppRole.login "hvac.api.auth_methods.AppRole.login")(role\_id[, secret\_id, use\_token, …]) | Login with APPROLE credentials. |

| [`read\_role`](#hvac.api.auth_methods.AppRole.read_role "hvac.api.auth_methods.AppRole.read_role")(role\_name[, mount\_point]) | Read role in the auth method. |

| [`read\_role\_id`](#hvac.api.auth_methods.AppRole.read_role_id "hvac.api.auth_methods.AppRole.read_role_id")(role\_name[, mount\_point]) | Reads the Role ID of a role in the auth method. |

| [`read\_secret\_id`](#hvac.api.auth_methods.AppRole.read_secret_id "hvac.api.auth_methods.AppRole.read_secret_id")(role\_name, secret\_id[, …]) | Read the properties of a Secret ID for a role in the auth method. |

| [`read\_secret\_id\_accessor`](#hvac.api.auth_methods.AppRole.read_secret_id_accessor "hvac.api.auth_methods.AppRole.read_secret_id_accessor")(role\_name, …[, …]) | Read the properties of a Secret ID for a role in the auth method. |

| [`update\_role\_id`](#hvac.api.auth_methods.AppRole.update_role_id "hvac.api.auth_methods.AppRole.update_role_id")(role\_name, role\_id[, mount\_point]) | Updates the Role ID of a role in the auth method. |

`create_custom_secret_id`(*role\_name*, *secret\_id*, *metadata=None*, *cidr\_list=None*, *token\_bound\_cidrs=None*, *mount\_point='approle'*)[[source]](_modules/hvac/api/auth_methods/approle.html#AppRole.create_custom_secret_id)[¶](#hvac.api.auth_methods.AppRole.create_custom_secret_id "Permalink to this definition")

Generates and issues a new Secret ID on a role in the auth method.

Supported methods:POST: /auth/{mount\_point}/role/{role\_name}/custom-secret-id. Produces: 200 application/json

Parameters

* **role\_name** (*str | unicode*) – The name for the role.

* **secret\_id** (*str | unicode*) – The Secret ID to read.

* **metadata** (*dict*) – Metadata to be tied to the Secret ID.

* **cidr\_list** (*list*) – Blocks of IP addresses which can perform login operations.

* **token\_bound\_cidrs** (*list*) – Blocks of IP addresses which can authenticate successfully.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the read\_role\_id request.

Return type

dict

`create_or_update_approle`(*role\_name*, *bind\_secret\_id=None*, *secret\_id\_bound\_cidrs=None*, *secret\_id\_num\_uses=None*, *secret\_id\_ttl=None*, *enable\_local\_secret\_ids=None*, *token\_ttl=None*, *token\_max\_ttl=None*, *token\_policies=None*, *token\_bound\_cidrs=None*, *token\_explicit\_max\_ttl=None*, *token\_no\_default\_policy=None*, *token\_num\_uses=None*, *token\_period=None*, *token\_type=None*, *mount\_point='approle'*)[[source]](_modules/hvac/api/auth_methods/approle.html#AppRole.create_or_update_approle)[¶](#hvac.api.auth_methods.AppRole.create_or_update_approle "Permalink to this definition")

Create/update approle.

Supported methods:POST: /auth/{mount\_point}/role/{role\_name}. Produces: 204 (empty body)

Parameters

* **role\_name** (*str | unicode*) – The name for the approle.

* **bind\_secret\_id** (*bool*) – Require secret\_id to be presented when logging in using this approle.

* **secret\_id\_bound\_cidrs** (*list*) – Blocks of IP addresses which can perform login operations.

* **secret\_id\_num\_uses** (*int*) – Number of times any secret\_id can be used to fetch a token.

A value of zero allows unlimited uses.

* **secret\_id\_ttl** (*str | unicode*) – Duration after which a secret\_id expires. This can be specified

as an integer number of seconds or as a duration value like “5m”.

* **enable\_local\_secret\_ids** (*bool*) – Secret IDs generated using role will be cluster local.

* **token\_ttl** (*str | unicode*) – Incremental lifetime for generated tokens. This can be specified

as an integer number of seconds or as a duration value like “5m”.

* **token\_max\_ttl** (*str | unicode*) – Maximum lifetime for generated tokens: This can be specified

as an integer number of seconds or as a duration value like “5m”.

* **token\_policies** (*list*) – List of policies to encode onto generated tokens.

* **token\_bound\_cidrs** (*list*) – Blocks of IP addresses which can authenticate successfully.

* **token\_explicit\_max\_ttl** (*str | unicode*) – If set, will encode an explicit max TTL onto the token. This can be specified

as an integer number of seconds or as a duration value like “5m”.

* **token\_no\_default\_policy** (*bool*) – Do not add the default policy to generated tokens, use only tokens

specified in token\_policies.

* **token\_num\_uses** (*int*) – Maximum number of times a generated token may be used. A value of zero

allows unlimited uses.

* **token\_period** (*str | unicode*) – The period, if any, to set on the token. This can be specified

as an integer number of seconds or as a duration value like “5m”.

* **token\_type** (*str | unicode*) – The type of token that should be generated, can be “service”, “batch”, or “default”.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

`delete_role`(*role\_name*, *mount\_point='approle'*)[[source]](_modules/hvac/api/auth_methods/approle.html#AppRole.delete_role)[¶](#hvac.api.auth_methods.AppRole.delete_role "Permalink to this definition")

Delete role in the auth method.

Supported methods:DELETE: /auth/{mount\_point}/role/{role\_name}. Produces: 204 (empty body)

Parameters

* **role\_name** (*str | unicode*) – The name for the role.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

`destroy_secret_id`(*role\_name*, *secret\_id*, *mount\_point='approle'*)[[source]](_modules/hvac/api/auth_methods/approle.html#AppRole.destroy_secret_id)[¶](#hvac.api.auth_methods.AppRole.destroy_secret_id "Permalink to this definition")

Destroys a Secret ID for a role in the auth method.

Supported methods:POST: /auth/{mount\_point}/role/{role\_name}/secret-id/destroy. Produces 204 (empty body)

Parameters

* **role\_name** (*str | unicode*) – The name for the role

* **secret\_id** (*str | unicode*) – The Secret ID to read.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

`destroy_secret_id_accessor`(*role\_name*, *secret\_id\_accessor*, *mount\_point='approle'*)[[source]](_modules/hvac/api/auth_methods/approle.html#AppRole.destroy_secret_id_accessor)[¶](#hvac.api.auth_methods.AppRole.destroy_secret_id_accessor "Permalink to this definition")

Destroys a Secret ID for a role in the auth method.

Supported methods:POST: /auth/{mount\_point}/role/{role\_name}/secret-id-accessor/destroy. Produces: 204 (empty body)

Parameters

* **role\_name** (*str | unicode*) – The name for the role

* **secret\_id\_accessor** (*str | unicode*) – The accessor for the Secret ID to read.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

`generate_secret_id`(*role\_name*, *metadata=None*, *cidr\_list=None*, *token\_bound\_cidrs=None*, *mount\_point='approle'*)[[source]](_modules/hvac/api/auth_methods/approle.html#AppRole.generate_secret_id)[¶](#hvac.api.auth_methods.AppRole.generate_secret_id "Permalink to this definition")

Generates and issues a new Secret ID on a role in the auth method.

Supported methods:POST: /auth/{mount\_point}/role/{role\_name}/secret-id. Produces: 200 application/json

Parameters

* **role\_name** (*str | unicode*) – The name for the role.

* **metadata** (*dict*) – Metadata to be tied to the Secret ID.

* **cidr\_list** (*list*) – Blocks of IP addresses which can perform login operations.

* **token\_bound\_cidrs** (*list*) – Blocks of IP addresses which can authenticate successfully.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the read\_role\_id request.

Return type

dict

`list_roles`(*mount\_point='approle'*)[[source]](_modules/hvac/api/auth_methods/approle.html#AppRole.list_roles)[¶](#hvac.api.auth_methods.AppRole.list_roles "Permalink to this definition")

List existing roles created in the auth method.

Supported methods:LIST: /auth/{mount\_point}/role. Produces: 200 application/json

Parameters

**mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the list\_roles request.

Return type

dict

`list_secret_id_accessors`(*role\_name*, *mount\_point='approle'*)[[source]](_modules/hvac/api/auth_methods/approle.html#AppRole.list_secret_id_accessors)[¶](#hvac.api.auth_methods.AppRole.list_secret_id_accessors "Permalink to this definition")

Lists accessors of all issued Secret IDs for a role in the auth method.

Supported methods:LIST: /auth/{mount\_point}/role/{role\_name}/secret-id. Produces: 200 application/json

Parameters

* **role\_name** (*str | unicode*) – The name for the role

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the read\_role\_id request.

Return type

dict

`login`(*role\_id*, *secret\_id=None*, *use\_token=True*, *mount\_point='approle'*)[[source]](_modules/hvac/api/auth_methods/approle.html#AppRole.login)[¶](#hvac.api.auth_methods.AppRole.login "Permalink to this definition")

Login with APPROLE credentials.

Supported methods:POST: /auth/{mount\_point}/login. Produces: 200 application/json

Parameters

* **role\_id** (*str | unicode*) – Role ID of the role.

* **secret\_id** (*str | unicode*) – Secret ID of the role.

* **use\_token** (*bool*) – if True, uses the token in the response received from the auth request to set the “token”

attribute on the the [`hvac.adapters.Adapter()`](index.html#hvac.adapters.Adapter "hvac.adapters.Adapter") instance under the \_adapater Client attribute.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the read\_role\_id request.

Return type

dict

`read_role`(*role\_name*, *mount\_point='approle'*)[[source]](_modules/hvac/api/auth_methods/approle.html#AppRole.read_role)[¶](#hvac.api.auth_methods.AppRole.read_role "Permalink to this definition")

Read role in the auth method.

Supported methods:GET: /auth/{mount\_point}/role/{role\_name}. Produces: 200 application/json

Parameters

* **role\_name** (*str | unicode*) – The name for the role.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the read\_role request.

Return type

dict

`read_role_id`(*role\_name*, *mount\_point='approle'*)[[source]](_modules/hvac/api/auth_methods/approle.html#AppRole.read_role_id)[¶](#hvac.api.auth_methods.AppRole.read_role_id "Permalink to this definition")

Reads the Role ID of a role in the auth method.

Supported methods:GET: /auth/{mount\_point}/role/{role\_name}/role-id. Produces: 200 application/json

Parameters

* **role\_name** (*str | unicode*) – The name for the role.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the read\_role\_id request.

Return type

dict

`read_secret_id`(*role\_name*, *secret\_id*, *mount\_point='approle'*)[[source]](_modules/hvac/api/auth_methods/approle.html#AppRole.read_secret_id)[¶](#hvac.api.auth_methods.AppRole.read_secret_id "Permalink to this definition")

Read the properties of a Secret ID for a role in the auth method.

Supported methods:POST: /auth/{mount\_point}/role/{role\_name}/secret-id/lookup. Produces: 200 application/json

Parameters

* **role\_name** (*str | unicode*) – The name for the role

* **secret\_id** (*str | unicode*) – The Secret ID to read.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the read\_role\_id request.

Return type

dict

`read_secret_id_accessor`(*role\_name*, *secret\_id\_accessor*, *mount\_point='approle'*)[[source]](_modules/hvac/api/auth_methods/approle.html#AppRole.read_secret_id_accessor)[¶](#hvac.api.auth_methods.AppRole.read_secret_id_accessor "Permalink to this definition")

Read the properties of a Secret ID for a role in the auth method.

Supported methods:POST: /auth/{mount\_point}/role/{role\_name}/secret-id-accessor/lookup. Produces: 200 application/json

Parameters

* **role\_name** (*str | unicode*) – The name for the role

* **secret\_id\_accessor** (*str | unicode*) – The accessor for the Secret ID to read.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the read\_role\_id request.

Return type

dict

`update_role_id`(*role\_name*, *role\_id*, *mount\_point='approle'*)[[source]](_modules/hvac/api/auth_methods/approle.html#AppRole.update_role_id)[¶](#hvac.api.auth_methods.AppRole.update_role_id "Permalink to this definition")

Updates the Role ID of a role in the auth method.

Supported methods:POST: /auth/{mount\_point}/role/{role\_name}/role-id. Produces: 200 application/json

Parameters

* **role\_name** (*str | unicode*) – The name for the role.

* **role\_id** (*str | unicode*) – New value for the Role ID.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the read\_role\_id request.

Return type

dict

*class* `hvac.api.auth_methods.``AuthMethods`(*adapter*)[[source]](_modules/hvac/api/auth_methods.html#AuthMethods)[¶](#hvac.api.auth_methods.AuthMethods "Permalink to this definition")

Bases: `hvac.api.vault\_api\_category.VaultApiCategory`

Auth Methods.

**Attributes**

| [`implemented\_classes`](#hvac.api.auth_methods.AuthMethods.implemented_classes "hvac.api.auth_methods.AuthMethods.implemented_classes") | Built-in mutable sequence. |

| [`unimplemented\_classes`](#hvac.api.auth_methods.AuthMethods.unimplemented_classes "hvac.api.auth_methods.AuthMethods.unimplemented_classes") | Built-in mutable sequence. |

`implemented_classes` *= [<class 'hvac.api.auth\_methods.approle.AppRole'>, <class 'hvac.api.auth\_methods.azure.Azure'>, <class 'hvac.api.auth\_methods.github.Github'>, <class 'hvac.api.auth\_methods.gcp.Gcp'>, <class 'hvac.api.auth\_methods.jwt.JWT'>, <class 'hvac.api.auth\_methods.kubernetes.Kubernetes'>, <class 'hvac.api.auth\_methods.ldap.Ldap'>, <class 'hvac.api.auth\_methods.userpass.Userpass'>, <class 'hvac.api.auth\_methods.mfa.Mfa'>, <class 'hvac.api.auth\_methods.oidc.OIDC'>, <class 'hvac.api.auth\_methods.okta.Okta'>, <class 'hvac.api.auth\_methods.radius.Radius'>, <class 'hvac.api.auth\_methods.token.Token'>, <class 'hvac.api.auth\_methods.aws.Aws'>, <class 'hvac.api.auth\_methods.cert.Cert'>]*[¶](#hvac.api.auth_methods.AuthMethods.implemented_classes "Permalink to this definition")

`unimplemented_classes` *= ['AppId', 'AliCloud']*[¶](#hvac.api.auth_methods.AuthMethods.unimplemented_classes "Permalink to this definition")

*class* `hvac.api.auth_methods.``Aws`(*adapter*)[[source]](_modules/hvac/api/auth_methods/aws.html#Aws)[¶](#hvac.api.auth_methods.Aws "Permalink to this definition")

Bases: `hvac.api.vault\_api\_base.VaultApiBase`

AWS Auth Method (API).

Reference: <https://www.vaultproject.io/api/auth/aws/index.html>

**Methods**

| [`configure`](#hvac.api.auth_methods.Aws.configure "hvac.api.auth_methods.Aws.configure")([max\_retries, access\_key, …]) | Configure the credentials required to perform API calls to AWS as well as custom endpoints to talk to AWS API. |

| [`configure\_identity\_integration`](#hvac.api.auth_methods.Aws.configure_identity_integration "hvac.api.auth_methods.Aws.configure_identity_integration")([iam\_alias, …]) | Configure the way that Vault interacts with the Identity store. |

| [`configure\_identity\_whitelist\_tidy`](#hvac.api.auth_methods.Aws.configure_identity_whitelist_tidy "hvac.api.auth_methods.Aws.configure_identity_whitelist_tidy")([…]) | Configure the periodic tidying operation of the whitelisted identity entries. |

| [`configure\_role\_tag\_blacklist\_tidy`](#hvac.api.auth_methods.Aws.configure_role_tag_blacklist_tidy "hvac.api.auth_methods.Aws.configure_role_tag_blacklist_tidy")([…]) | Configure the periodic tidying operation of the blacklisted role tag entries. |

| [`create\_certificate\_configuration`](#hvac.api.auth_methods.Aws.create_certificate_configuration "hvac.api.auth_methods.Aws.create_certificate_configuration")(cert\_name, …) | Register AWS public key to be used to verify the instance identity documents. |

| [`create\_role`](#hvac.api.auth_methods.Aws.create_role "hvac.api.auth_methods.Aws.create_role")(role[, auth\_type, bound\_ami\_id, …]) | Register a role in the method. |

| [`create\_role\_tags`](#hvac.api.auth_methods.Aws.create_role_tags "hvac.api.auth_methods.Aws.create_role_tags")(role[, policies, max\_ttl, …]) | Create a role tag on the role, which helps in restricting the capabilities that are set on the role. |

| [`create\_sts\_role`](#hvac.api.auth_methods.Aws.create_sts_role "hvac.api.auth_methods.Aws.create_sts_role")(account\_id, sts\_role[, …]) | Allow the explicit association of STS roles to satellite AWS accounts (i.e. |

| [`delete\_blacklist\_tags`](#hvac.api.auth_methods.Aws.delete_blacklist_tags "hvac.api.auth_methods.Aws.delete_blacklist_tags")(role\_tag[, mount\_point]) | Deletes a blacklisted role tag |

| [`delete\_certificate\_configuration`](#hvac.api.auth_methods.Aws.delete_certificate_configuration "hvac.api.auth_methods.Aws.delete_certificate_configuration")(cert\_name) | Remove previously configured AWS public key. |

| [`delete\_config`](#hvac.api.auth_methods.Aws.delete_config "hvac.api.auth_methods.Aws.delete_config")([mount\_point]) | Delete previously configured AWS access credentials, |

| [`delete\_identity\_whitelist\_entries`](#hvac.api.auth_methods.Aws.delete_identity_whitelist_entries "hvac.api.auth_methods.Aws.delete_identity_whitelist_entries")(instance\_id) | Deletes a cache of the successful login from an instance |

| [`delete\_identity\_whitelist\_tidy`](#hvac.api.auth_methods.Aws.delete_identity_whitelist_tidy "hvac.api.auth_methods.Aws.delete_identity_whitelist_tidy")([mount\_point]) | Delete previously configured periodic whitelist tidying settings. |

| [`delete\_role`](#hvac.api.auth_methods.Aws.delete_role "hvac.api.auth_methods.Aws.delete_role")(role[, mount\_point]) | Deletes the previously registered role |

| [`delete\_role\_tag\_blacklist\_tidy`](#hvac.api.auth_methods.Aws.delete_role_tag_blacklist_tidy "hvac.api.auth_methods.Aws.delete_role_tag_blacklist_tidy")([mount\_point]) | Delete previously configured periodic blacklist tidying settings. |

| [`delete\_sts\_role`](#hvac.api.auth_methods.Aws.delete_sts_role "hvac.api.auth_methods.Aws.delete_sts_role")(account\_id[, mount\_point]) | Delete a previously configured AWS account/STS role association. |

| [`ec2\_login`](#hvac.api.auth_methods.Aws.ec2_login "hvac.api.auth_methods.Aws.ec2_login")(pkcs7[, nonce, role, use\_token, …]) | Retrieve a Vault token using an AWS authentication method mount’s EC2 role. |

| [`iam\_login`](#hvac.api.auth_methods.Aws.iam_login "hvac.api.auth_methods.Aws.iam_login")(access\_key, secret\_key[, …]) | Fetch a token |

| [`list\_blacklist\_tags`](#hvac.api.auth_methods.Aws.list_blacklist_tags "hvac.api.auth_methods.Aws.list_blacklist_tags")([mount\_point]) | Lists all the role tags that are blacklisted |

| [`list\_certificate\_configurations`](#hvac.api.auth_methods.Aws.list_certificate_configurations "hvac.api.auth_methods.Aws.list_certificate_configurations")([mount\_point]) | List AWS public certificates that are registered with the method. |

| [`list\_identity\_whitelist`](#hvac.api.auth_methods.Aws.list_identity_whitelist "hvac.api.auth_methods.Aws.list_identity_whitelist")([mount\_point]) | Lists all the instance IDs that are in the whitelist of successful logins |

| [`list\_roles`](#hvac.api.auth_methods.Aws.list_roles "hvac.api.auth_methods.Aws.list_roles")([mount\_point]) | Lists all the roles that are registered with the method |

| [`list\_sts\_roles`](#hvac.api.auth_methods.Aws.list_sts_roles "hvac.api.auth_methods.Aws.list_sts_roles")([mount\_point]) | List AWS Account IDs for which an STS role is registered. |

| [`place\_role\_tags\_in\_blacklist`](#hvac.api.auth_methods.Aws.place_role_tags_in_blacklist "hvac.api.auth_methods.Aws.place_role_tags_in_blacklist")(role\_tag[, …]) | Places a valid role tag in a blacklist |

| [`read\_certificate\_configuration`](#hvac.api.auth_methods.Aws.read_certificate_configuration "hvac.api.auth_methods.Aws.read_certificate_configuration")(cert\_name[, …]) | Return previously configured AWS public key. |

| [`read\_config`](#hvac.api.auth_methods.Aws.read_config "hvac.api.auth_methods.Aws.read_config")([mount\_point]) | Read previously configured AWS access credentials. |

| [`read\_identity\_integration`](#hvac.api.auth_methods.Aws.read_identity_integration "hvac.api.auth_methods.Aws.read_identity_integration")([mount\_point]) | Return previously configured identity integration configuration. |

| [`read\_identity\_whitelist`](#hvac.api.auth_methods.Aws.read_identity_whitelist "hvac.api.auth_methods.Aws.read_identity_whitelist")(instance\_id[, …]) | Returns an entry in the whitelist. |

| [`read\_identity\_whitelist\_tidy`](#hvac.api.auth_methods.Aws.read_identity_whitelist_tidy "hvac.api.auth_methods.Aws.read_identity_whitelist_tidy")([mount\_point]) | Read previously configured periodic whitelist tidying settings. |

| [`read\_role`](#hvac.api.auth_methods.Aws.read_role "hvac.api.auth_methods.Aws.read_role")(role[, mount\_point]) | Returns the previously registered role configuration |

| [`read\_role\_tag\_blacklist`](#hvac.api.auth_methods.Aws.read_role_tag_blacklist "hvac.api.auth_methods.Aws.read_role_tag_blacklist")(role\_tag[, mount\_point]) | Returns the blacklist entry of a previously blacklisted role tag |

| [`read\_role\_tag\_blacklist\_tidy`](#hvac.api.auth_methods.Aws.read_role_tag_blacklist_tidy "hvac.api.auth_methods.Aws.read_role_tag_blacklist_tidy")([mount\_point]) | Read previously configured periodic blacklist tidying settings. |

| [`read\_sts\_role`](#hvac.api.auth_methods.Aws.read_sts_role "hvac.api.auth_methods.Aws.read_sts_role")(account\_id[, mount\_point]) | Return previously configured STS role. |

| [`tidy\_blacklist\_tags`](#hvac.api.auth_methods.Aws.tidy_blacklist_tags "hvac.api.auth_methods.Aws.tidy_blacklist_tags")([saftey\_buffer, mount\_point]) | Cleans up the entries in the blacklist based on expiration time on the entry and safety\_buffer |

| [`tidy\_identity\_whitelist\_entries`](#hvac.api.auth_methods.Aws.tidy_identity_whitelist_entries "hvac.api.auth_methods.Aws.tidy_identity_whitelist_entries")([…]) | Cleans up the entries in the whitelist based on expiration time and safety\_buffer |

`configure`(*max\_retries=None*, *access\_key=None*, *secret\_key=None*, *endpoint=None*, *iam\_endpoint=None*, *sts\_endpoint=None*, *iam\_server\_id\_header\_value=None*, *mount\_point='aws'*)[[source]](_modules/hvac/api/auth_methods/aws.html#Aws.configure)[¶](#hvac.api.auth_methods.Aws.configure "Permalink to this definition")

Configure the credentials required to perform API calls to AWS as well as custom endpoints to talk to AWS API.

The instance identity document fetched from the PKCS#7 signature will provide the EC2 instance ID.

The credentials configured using this endpoint will be used to query the status of the instances via

DescribeInstances API. If static credentials are not provided using this endpoint, then the credentials will be

retrieved from the environment variables AWS\_ACCESS\_KEY, AWS\_SECRET\_KEY and AWS\_REGION respectively.

If the credentials are still not found and if the method is configured on an EC2 instance with metadata querying

capabilities, the credentials are fetched automatically

Supported methods:POST: /auth/{mount\_point}/config Produces: 204 (empty body)

Parameters

* **max\_retries** (*int*) – Number of max retries the client should use for recoverable errors.

The default (-1) falls back to the AWS SDK’s default behavior

* **access\_key** (*str | unicode*) – AWS Access key with permissions to query AWS APIs. The permissions required depend on the

specific configurations. If using the iam auth method without inferencing, then no credentials are

necessary. If using the ec2 auth method or using the iam auth method with inferencing, then these

credentials need access to ec2:DescribeInstances. If additionally a bound\_iam\_role is specified, then

these credentials also need access to iam:GetInstanceProfile. If, however, an alternate sts configuration

is set for the target account, then the credentials must be permissioned to call sts:AssumeRole on the

configured role, and that role must have the permissions described here

* **secret\_key** (*str | unicode*) – AWS Secret key with permissions to query AWS APIs

* **endpoint** (*str | unicode*) – URL to override the default generated endpoint for making AWS EC2 API calls

* **iam\_endpoint** (*str | unicode*) – URL to override the default generated endpoint for making AWS IAM API calls

* **sts\_endpoint** (*str | unicode*) – URL to override the default generated endpoint for making AWS STS API calls

* **iam\_server\_id\_header\_value** (*str | unicode*) – The value to require in the X-Vault-AWS-IAM-Server-ID header as part of

GetCallerIdentity requests that are used in the iam auth method. If not set, then no value is required or

validated. If set, clients must include an X-Vault-AWS-IAM-Server-ID header in the headers of login

requests, and further this header must be among the signed headers validated by AWS. This is to protect

against different types of replay attacks, for example a signed request sent to a dev server being resent

to a production server

* **mount\_point** (*str | unicode*) – The path the AWS auth method was mounted on.

Returns

The response of the request.

Return type

requests.Response

`configure_identity_integration`(*iam\_alias=None*, *ec2\_alias=None*, *mount\_point='aws'*)[[source]](_modules/hvac/api/auth_methods/aws.html#Aws.configure_identity_integration)[¶](#hvac.api.auth_methods.Aws.configure_identity_integration "Permalink to this definition")

Configure the way that Vault interacts with the Identity store.

The default (as of Vault 1.0.3) is role\_id for both values.

Supported methods:POST: /auth/{mount\_point}/config/identity Produces: 204 (empty body)

Parameters

* **iam\_alias** (*str | unicode*) – How to generate the identity alias when using the iam auth method. Valid choices are role\_id,

unique\_id, and full\_arn When role\_id is selected, the randomly generated ID of the role is used. When

unique\_id is selected, the IAM Unique ID of the IAM principal (either the user or role) is used as the

identity alias name. When full\_arn is selected, the ARN returned by the sts:GetCallerIdentity call is used

as the alias name. This is either arn:aws:iam::<account\_id>:user/<optional\_path/><user\_name> or

arn:aws:sts::<account\_id>:assumed-role/<role\_name\_without\_path>/<role\_session\_name>. Note: if you

select full\_arn and then delete and recreate the IAM role, Vault won’t be aware and any identity aliases

set up for the role name will still be valid

* **ec2\_alias** (*str | unicode*) – Configures how to generate the identity alias when using the ec2 auth method. Valid choices

are role\_id, instance\_id, and image\_id. When role\_id is selected, the randomly generated ID of the role is

used. When instance\_id is selected, the instance identifier is used as the identity alias name. When

image\_id is selected, AMI ID of the instance is used as the identity alias name

* **mount\_point** (*str | unicode*) – The path the AWS auth method was mounted on.

Returns

The response of the request

Return type

request.Response

`configure_identity_whitelist_tidy`(*safety\_buffer=None*, *disable\_periodic\_tidy=None*, *mount\_point='aws'*)[[source]](_modules/hvac/api/auth_methods/aws.html#Aws.configure_identity_whitelist_tidy)[¶](#hvac.api.auth_methods.Aws.configure_identity_whitelist_tidy "Permalink to this definition")

Configure the periodic tidying operation of the whitelisted identity entries.

Parameters

* **safety\_buffer** (*str*) – The amount of extra time that must have passed beyond the roletag expiration, before

it is removed from the method storage.

* **disable\_periodic\_tidy** (*bool*) – If set to ‘true’, disables the periodic tidying of the identity-whitelist/<instance\_id> entries.

* **mount\_point** (*str*) – The path the AWS auth method was mounted on.

Returns

The response of the request.

Return type

requests.Response

`configure_role_tag_blacklist_tidy`(*safety\_buffer=None*, *disable\_periodic\_tidy=None*, *mount\_point='aws'*)[[source]](_modules/hvac/api/auth_methods/aws.html#Aws.configure_role_tag_blacklist_tidy)[¶](#hvac.api.auth_methods.Aws.configure_role_tag_blacklist_tidy "Permalink to this definition")

Configure the periodic tidying operation of the blacklisted role tag entries.

Parameters

* **safety\_buffer** (*str*) – The amount of extra time that must have passed beyond the roletag expiration, before

it is removed from the method storage.

* **disable\_periodic\_tidy** (*bool*) – If set to ‘true’, disables the periodic tidying of the roletag-blacklist/<instance\_id> entries.

* **mount\_point** (*str*) – The path the AWS auth method was mounted on.

Returns

The response of the request.

Return type

requests.Response

`create_certificate_configuration`(*cert\_name*, *aws\_public\_cert*, *document\_type=None*, *mount\_point='aws'*)[[source]](_modules/hvac/api/auth_methods/aws.html#Aws.create_certificate_configuration)[¶](#hvac.api.auth_methods.Aws.create_certificate_configuration "Permalink to this definition")

Register AWS public key to be used to verify the instance identity documents.

While the PKCS#7 signature of the identity documents have DSA digest, the identity signature will have RSA

digest, and hence the public keys for each type varies respectively. Indicate the type of the public key using

the “type” parameter

Supported methods:POST: /auth/{mount\_point}/config/certificate/:cert\_name Produces: 204 (empty body)

Parameters

* **cert\_name** (*string | unicode*) – Name of the certificate

* **aws\_public\_cert** – Base64 encoded AWS Public key required to verify PKCS7 signature of the EC2 instance

metadata

* **document\_type** (*string | unicode*) – Takes the value of either “pkcs7” or “identity”, indicating the type of document which can be

verified using the given certificate

* **mount\_point** (*str | unicode*) – The path the AWS auth method was mounted on.

Returns

The response of the request

Return type

request.Response

`create_role`(*role*, *auth\_type=None*, *bound\_ami\_id=None*, *bound\_account\_id=None*, *bound\_region=None*, *bound\_vpc\_id=None*, *bound\_subnet\_id=None*, *bound\_iam\_role\_arn=None*, *bound\_iam\_instance\_profile\_arn=None*, *bound\_ec2\_instance\_id=None*, *role\_tag=None*, *bound\_iam\_principal\_arn=None*, *inferred\_entity\_type=None*, *inferred\_aws\_region=None*, *resolve\_aws\_unique\_ids=None*, *ttl=None*, *max\_ttl=None*, *period=None*, *policies=None*, *allow\_instance\_migration=None*, *disallow\_reauthentication=None*, *mount\_point='aws'*)[[source]](_modules/hvac/api/auth_methods/aws.html#Aws.create_role)[¶](#hvac.api.auth_methods.Aws.create_role "Permalink to this definition")

Register a role in the method.

Parameters

* **role** –

* **auth\_type** –

* **bound\_ami\_id** –

* **bound\_account\_id** –

* **bound\_region** –

* **bound\_vpc\_id** –

* **bound\_subnet\_id** –

* **bound\_iam\_role\_arn** –

* **bound\_iam\_instance\_profile\_arn** –

* **bound\_ec2\_instance\_id** –

* **role\_tag** –

* **bound\_iam\_principal\_arn** –

* **inferred\_entity\_type** –

* **inferred\_aws\_region** –

* **resolve\_aws\_unique\_ids** –

* **ttl** –

* **max\_ttl** –

* **period** –

* **policies** –

* **allow\_instance\_migration** –

* **disallow\_reauthentication** –

* **mount\_point** (*str*) – The path the AWS auth method was mounted on.

Returns

The response of the request.

Return type

requests.Response

`create_role_tags`(*role*, *policies=None*, *max\_ttl=None*, *instance\_id=None*, *allow\_instance\_migration=None*, *disallow\_reauthentication=None*, *mount\_point='aws'*)[[source]](_modules/hvac/api/auth_methods/aws.html#Aws.create_role_tags)[¶](#hvac.api.auth_methods.Aws.create_role_tags "Permalink to this definition")

Create a role tag on the role, which helps in restricting the capabilities that are set on the role.

Role tags are not tied to any specific ec2 instance unless specified explicitly using the

instance\_id parameter. By default, role tags are designed to be used across all instances that

satisfies the constraints on the role. Regardless of which instances have role tags on them, capabilities

defined in a role tag must be a strict subset of the given role’s capabilities. Note that, since adding

and removing a tag is often a widely distributed privilege, care needs to be taken to ensure that the

instances are attached with correct tags to not let them gain more privileges than what were intended.

If a role tag is changed, the capabilities inherited by the instance will be those defined on the new role

tag. Since those must be a subset of the role capabilities, the role should never provide more capabilities

than any given instance can be allowed to gain in a worst-case scenario

Parameters

* **role** (*str*) – Name of the role.

* **policies** (*list*) – Policies to be associated with the tag. If set, must be a subset of the role’s policies. If

set, but set to an empty value, only the ‘default’ policy will be given to issued tokens.

* **max\_ttl** (*str*) – The maximum allowed lifetime of tokens issued using this role.

* **instance\_id** (*str*) – Instance ID for which this tag is intended for. If set, the created tag can only be used by

the instance with the given ID.

* **disallow\_reauthentication** (*bool*) – If set, only allows a single token to be granted per instance ID. This can be

cleared with the auth/aws/identity-whitelist endpoint. Defaults to ‘false’. Mutually exclusive with

allow\_instance\_migration.

* **allow\_instance\_migration** (*bool*) – If set, allows migration of the underlying instance where the client resides.

This keys off of pendingTime in the metadata document, so essentially, this disables the client nonce check

whenever the instance is migrated to a new host and pendingTime is newer than the previously-remembered

time. Use with caution. Defaults to ‘false’. Mutually exclusive with disallow\_reauthentication.

* **mount\_point** (*str*) – The path the AWS auth method was mounted on.

Returns

The create role tag response.

Return type

dict

`create_sts_role`(*account\_id*, *sts\_role*, *mount\_point='aws'*)[[source]](_modules/hvac/api/auth_methods/aws.html#Aws.create_sts_role)[¶](#hvac.api.auth_methods.Aws.create_sts_role "Permalink to this definition")

Allow the explicit association of STS roles to satellite AWS accounts (i.e. those which are not theaccount in which the Vault server is running.)

Vault will use credentials obtained by assuming these STS roles when validating IAM principals or EC2

instances in the particular AWS account

Supported methods:POST: /v1/auth/{mount\_point}/config/sts/:account\_id Produces: 204 (empty body)

Parameters

* **account\_id** (*str*) – AWS account ID to be associated with STS role.

If set, Vault will use assumed credentials to verify any login attempts from EC2 instances in this account.

* **sts\_role** (*str*) – AWS ARN for STS role to be assumed when interacting with the account specified.

The Vault server must have permissions to assume this role.

* **mount\_point** (*str*) – The path the AWS auth method was mounted on.

Returns

The response of the request.

Return type

requests.Response

`delete_blacklist_tags`(*role\_tag*, *mount\_point='aws'*)[[source]](_modules/hvac/api/auth_methods/aws.html#Aws.delete_blacklist_tags)[¶](#hvac.api.auth_methods.Aws.delete_blacklist_tags "Permalink to this definition")

Deletes a blacklisted role tag

Parameters

* **role\_tag** –

* **mount\_point** (*str*) – The path the AWS auth method was mounted on.

Returns

The response of the request.

Return type

requests.Response

`delete_certificate_configuration`(*cert\_name*, *mount\_point='aws'*)[[source]](_modules/hvac/api/auth_methods/aws.html#Aws.delete_certificate_configuration)[¶](#hvac.api.auth_methods.Aws.delete_certificate_configuration "Permalink to this definition")

Remove previously configured AWS public key.

Supported methods:DELETE: /auth/{mount\_point}/config/certificate/:cert\_name Produces: 204 (empty body)

Parameters

* **cert\_name** (*str | unicode*) – Name of the certificate

* **mount\_point** (*str | unicode*) – The path the AWS auth method was mounted on.

Returns

The response of the request

Return type

request.Response

`delete_config`(*mount\_point='aws'*)[[source]](_modules/hvac/api/auth_methods/aws.html#Aws.delete_config)[¶](#hvac.api.auth_methods.Aws.delete_config "Permalink to this definition")

Delete previously configured AWS access credentials,

Supported methods:DELETE: /auth/{mount\_point}/config Produces: 204 (empty body)

Parameters

**mount\_point** (*str | unicode*) – The path the AWS auth method was mounted on.

Returns

The response of the request.

Return type

requests.Response

`delete_identity_whitelist_entries`(*instance\_id*, *mount\_point='aws'*)[[source]](_modules/hvac/api/auth_methods/aws.html#Aws.delete_identity_whitelist_entries)[¶](#hvac.api.auth_methods.Aws.delete_identity_whitelist_entries "Permalink to this definition")

Deletes a cache of the successful login from an instance

Parameters

* **instance\_id** –

* **mount\_point** (*str*) – The path the AWS auth method was mounted on.

Returns

The response of the request.

Return type

requests.Response

`delete_identity_whitelist_tidy`(*mount\_point='aws'*)[[source]](_modules/hvac/api/auth_methods/aws.html#Aws.delete_identity_whitelist_tidy)[¶](#hvac.api.auth_methods.Aws.delete_identity_whitelist_tidy "Permalink to this definition")

Delete previously configured periodic whitelist tidying settings.

Parameters

**mount\_point** (*str*) – The path the AWS auth method was mounted on.

Returns

The response of the request.

Return type

requests.Response

`delete_role`(*role*, *mount\_point='aws'*)[[source]](_modules/hvac/api/auth_methods/aws.html#Aws.delete_role)[¶](#hvac.api.auth_methods.Aws.delete_role "Permalink to this definition")

Deletes the previously registered role

Parameters

* **role** –

* **mount\_point** (*str*) – The path the AWS auth method was mounted on.

Returns

The response of the request.

Return type

requests.Response

`delete_role_tag_blacklist_tidy`(*mount\_point='aws'*)[[source]](_modules/hvac/api/auth_methods/aws.html#Aws.delete_role_tag_blacklist_tidy)[¶](#hvac.api.auth_methods.Aws.delete_role_tag_blacklist_tidy "Permalink to this definition")

Delete previously configured periodic blacklist tidying settings.

Parameters

**mount\_point** (*str*) – The path the AWS auth method was mounted on.

Returns

The response of the request.

Return type

requests.Response

`delete_sts_role`(*account\_id*, *mount\_point='aws'*)[[source]](_modules/hvac/api/auth_methods/aws.html#Aws.delete_sts_role)[¶](#hvac.api.auth_methods.Aws.delete_sts_role "Permalink to this definition")

Delete a previously configured AWS account/STS role association.

Parameters

* **account\_id** –

* **mount\_point** (*str*) – The path the AWS auth method was mounted on.

Returns

The response of the request.

Return type

requests.Response

`ec2_login`(*pkcs7*, *nonce=None*, *role=None*, *use\_token=True*, *mount\_point='aws'*)[[source]](_modules/hvac/api/auth_methods/aws.html#Aws.ec2_login)[¶](#hvac.api.auth_methods.Aws.ec2_login "Permalink to this definition")

Retrieve a Vault token using an AWS authentication method mount’s EC2 role.

Parameters

* **pkcs7** (*str*) – PKCS7 signature of the identity document with all newline characters removed.

* **nonce** (*str*) – The nonce to be used for subsequent login requests.

* **role** (*str*) – Name of the role against which the login is being attempted.

* **use\_token** (*bool*) – if True, uses the token in the response received from the auth request to set the “token”

attribute on the the [`hvac.adapters.Adapter()`](index.html#hvac.adapters.Adapter "hvac.adapters.Adapter") instance under the \_adapater Client attribute.

* **mount\_point** (*str*) – The path the AWS auth method was mounted on.

Returns

The response of the request.

Return type

requests.Response

`iam_login`(*access\_key*, *secret\_key*, *session\_token=None*, *header\_value=None*, *role=None*, *use\_token=True*, *region='us-east-1'*, *mount\_point='aws'*)[[source]](_modules/hvac/api/auth_methods/aws.html#Aws.iam_login)[¶](#hvac.api.auth_methods.Aws.iam_login "Permalink to this definition")

Fetch a token

> 

> This endpoint verifies the pkcs7 signature of the instance identity document or the signature of the

> signed GetCallerIdentity request. With the ec2 auth method, or when inferring an EC2 instance,

> verifies that the instance is actually in a running state. Cross checks the constraints defined on the

> role with which the login is being performed. With the ec2 auth method, as an alternative to pkcs7

> signature, the identity document along with its RSA digest can be supplied to this endpoint

> 

> 

> 

Parameters

* **role** (*str*) – Name of the role against which the login is being attempted.

* **use\_token** (*bool*) – if True, uses the token in the response received from the auth request to set the “token”

attribute on the the [`hvac.adapters.Adapter()`](index.html#hvac.adapters.Adapter "hvac.adapters.Adapter") instance under the \_adapater Client attribute.

* **mount\_point** (*str*) – The path the AWS auth method was mounted on.

Returns

The response of the request.

Return type

requests.Response

`list_blacklist_tags`(*mount\_point='aws'*)[[source]](_modules/hvac/api/auth_methods/aws.html#Aws.list_blacklist_tags)[¶](#hvac.api.auth_methods.Aws.list_blacklist_tags "Permalink to this definition")

Lists all the role tags that are blacklisted

Parameters

**mount\_point** (*str*) – The path the AWS auth method was mounted on.

Returns

The response of the request.

Return type

requests.Response

`list_certificate_configurations`(*mount\_point='aws'*)[[source]](_modules/hvac/api/auth_methods/aws.html#Aws.list_certificate_configurations)[¶](#hvac.api.auth_methods.Aws.list_certificate_configurations "Permalink to this definition")

List AWS public certificates that are registered with the method.

Supported methodsLIST: /auth/{mount\_point}/config/certificates Produces: 200 application/json

Parameters

**mount\_point** (*str*) – The path the AWS auth method was mounted on.

Returns

The response of the request.

Return type

requests.Response

`list_identity_whitelist`(*mount\_point='aws'*)[[source]](_modules/hvac/api/auth_methods/aws.html#Aws.list_identity_whitelist)[¶](#hvac.api.auth_methods.Aws.list_identity_whitelist "Permalink to this definition")

Lists all the instance IDs that are in the whitelist of successful logins

Parameters

**mount\_point** (*str*) – The path the AWS auth method was mounted on.

Returns

The response of the request.

Return type

requests.Response

`list_roles`(*mount\_point='aws'*)[[source]](_modules/hvac/api/auth_methods/aws.html#Aws.list_roles)[¶](#hvac.api.auth_methods.Aws.list_roles "Permalink to this definition")

Lists all the roles that are registered with the method

Parameters

**mount\_point** (*str*) – The path the AWS auth method was mounted on.

Returns

The response of the request.

Return type

requests.Response

`list_sts_roles`(*mount\_point='aws'*)[[source]](_modules/hvac/api/auth_methods/aws.html#Aws.list_sts_roles)[¶](#hvac.api.auth_methods.Aws.list_sts_roles "Permalink to this definition")

List AWS Account IDs for which an STS role is registered.

Parameters

**mount\_point** (*str*) – The path the AWS auth method was mounted on.

Returns

The response of the request.

Return type

requests.Response

`place_role_tags_in_blacklist`(*role\_tag*, *mount\_point='aws'*)[[source]](_modules/hvac/api/auth_methods/aws.html#Aws.place_role_tags_in_blacklist)[¶](#hvac.api.auth_methods.Aws.place_role_tags_in_blacklist "Permalink to this definition")

Places a valid role tag in a blacklist

> 

> This ensures that the role tag cannot be used by any instance to perform a login operation again. Note

> that if the role tag was previously used to perform a successful login, placing the tag in the blacklist

> does not invalidate the already issued token

> 

> 

> 

Parameters

* **role\_tag** –

* **mount\_point** (*str*) – The path the AWS auth method was mounted on.

Returns

The response of the request.

Return type

requests.Response

`read_certificate_configuration`(*cert\_name*, *mount\_point='aws'*)[[source]](_modules/hvac/api/auth_methods/aws.html#Aws.read_certificate_configuration)[¶](#hvac.api.auth_methods.Aws.read_certificate_configuration "Permalink to this definition")

Return previously configured AWS public key.

Supported methods:GET: /v1/auth/{mount\_point}/config/certificate/:cert\_name Produces: 200 application/json

Parameters

* **cert\_name** (*str | unicode*) – Name of the certificate

* **mount\_point** – The path the AWS auth method was mounted on.

Returns

The data key from the JSON response of the request.

Return type

dict

`read_config`(*mount\_point='aws'*)[[source]](_modules/hvac/api/auth_methods/aws.html#Aws.read_config)[¶](#hvac.api.auth_methods.Aws.read_config "Permalink to this definition")

Read previously configured AWS access credentials.

Supported methods:GET: /auth/{mount\_point}/config. Produces: 200 application/json

Parameters

**mount\_point** (*str | unicode*) – The path the AWS auth method was mounted on.

Returns

The data key from the JSON response of the request.

Return type

dict

`read_identity_integration`(*mount\_point='aws'*)[[source]](_modules/hvac/api/auth_methods/aws.html#Aws.read_identity_integration)[¶](#hvac.api.auth_methods.Aws.read_identity_integration "Permalink to this definition")

Return previously configured identity integration configuration.

Supported methods:GET: /auth/{mount\_point}/config/identity. Produces: 200 application/json

Parameters

**mount\_point** (*str | unicode*) – The path the AWS auth method was mounted on.

Returns

The data key from the JSON response of the request.

Return type

dict

`read_identity_whitelist`(*instance\_id*, *mount\_point='aws'*)[[source]](_modules/hvac/api/auth_methods/aws.html#Aws.read_identity_whitelist)[¶](#hvac.api.auth_methods.Aws.read_identity_whitelist "Permalink to this definition")

Returns an entry in the whitelist. An entry will be created/updated by every successful login

Parameters

* **instance\_id** –

* **mount\_point** (*str*) – The path the AWS auth method was mounted on.

Returns

The response of the request.

Return type

requests.Response

`read_identity_whitelist_tidy`(*mount\_point='aws'*)[[source]](_modules/hvac/api/auth_methods/aws.html#Aws.read_identity_whitelist_tidy)[¶](#hvac.api.auth_methods.Aws.read_identity_whitelist_tidy "Permalink to this definition")

Read previously configured periodic whitelist tidying settings.

Parameters

**mount\_point** (*str*) – The path the AWS auth method was mounted on.

Returns

The response of the request.

Return type

requests.Response

`read_role`(*role*, *mount\_point='aws'*)[[source]](_modules/hvac/api/auth_methods/aws.html#Aws.read_role)[¶](#hvac.api.auth_methods.Aws.read_role "Permalink to this definition")

Returns the previously registered role configuration

Parameters

* **role** –

* **mount\_point** (*str*) – The path the AWS auth method was mounted on.

Returns

The response of the request.

Return type

requests.Response

`read_role_tag_blacklist`(*role\_tag*, *mount\_point='aws'*)[[source]](_modules/hvac/api/auth_methods/aws.html#Aws.read_role_tag_blacklist)[¶](#hvac.api.auth_methods.Aws.read_role_tag_blacklist "Permalink to this definition")

Returns the blacklist entry of a previously blacklisted role tag

Parameters

* **role\_tag** –

* **mount\_point** (*str*) – The path the AWS auth method was mounted on.

Returns

The response of the request.

Return type

requests.Response

`read_role_tag_blacklist_tidy`(*mount\_point='aws'*)[[source]](_modules/hvac/api/auth_methods/aws.html#Aws.read_role_tag_blacklist_tidy)[¶](#hvac.api.auth_methods.Aws.read_role_tag_blacklist_tidy "Permalink to this definition")

Read previously configured periodic blacklist tidying settings.

Parameters

**mount\_point** (*str*) – The path the AWS auth method was mounted on.

Returns

The response of the request.

Return type

requests.Response

`read_sts_role`(*account\_id*, *mount\_point='aws'*)[[source]](_modules/hvac/api/auth_methods/aws.html#Aws.read_sts_role)[¶](#hvac.api.auth_methods.Aws.read_sts_role "Permalink to this definition")

Return previously configured STS role.

Parameters

* **account\_id** (*str*) – AWS account ID that has been previously associated with STS role.

* **mount\_point** (*str*) – The path the AWS auth method was mounted on.

Returns

The response of the request.

Return type

requests.Response

`tidy_blacklist_tags`(*saftey\_buffer='72h'*, *mount\_point='aws'*)[[source]](_modules/hvac/api/auth_methods/aws.html#Aws.tidy_blacklist_tags)[¶](#hvac.api.auth_methods.Aws.tidy_blacklist_tags "Permalink to this definition")

Cleans up the entries in the blacklist based on expiration time on the entry and safety\_buffer

Parameters

* **saftey\_buffer** –

* **mount\_point** (*str*) – The path the AWS auth method was mounted on.

Returns

The response of the request.

Return type

requests.Response

`tidy_identity_whitelist_entries`(*saftey\_buffer='72h'*, *mount\_point='aws'*)[[source]](_modules/hvac/api/auth_methods/aws.html#Aws.tidy_identity_whitelist_entries)[¶](#hvac.api.auth_methods.Aws.tidy_identity_whitelist_entries "Permalink to this definition")

Cleans up the entries in the whitelist based on expiration time and safety\_buffer

Parameters

* **saftey\_buffer** –

* **mount\_point** (*str*) – The path the AWS auth method was mounted on.

Returns

The response of the request.

Return type

requests.Response

*class* `hvac.api.auth_methods.``Azure`(*adapter*)[[source]](_modules/hvac/api/auth_methods/azure.html#Azure)[¶](#hvac.api.auth_methods.Azure "Permalink to this definition")

Bases: `hvac.api.vault\_api\_base.VaultApiBase`

Azure Auth Method (API).

Reference: <https://www.vaultproject.io/api/auth/azure/index.html>

**Methods**

| [`configure`](#hvac.api.auth_methods.Azure.configure "hvac.api.auth_methods.Azure.configure")(tenant\_id, resource[, …]) | Configure the credentials required for the plugin to perform API calls to Azure. |

| [`create\_role`](#hvac.api.auth_methods.Azure.create_role "hvac.api.auth_methods.Azure.create_role")(name[, policies, ttl, max\_ttl, …]) | Create a role in the method. |

| [`delete\_config`](#hvac.api.auth_methods.Azure.delete_config "hvac.api.auth_methods.Azure.delete_config")([mount\_point]) | Delete the previously configured Azure config and credentials. |

| [`delete\_role`](#hvac.api.auth_methods.Azure.delete_role "hvac.api.auth_methods.Azure.delete_role")(name[, mount\_point]) | Delete the previously registered role. |

| [`list\_roles`](#hvac.api.auth_methods.Azure.list_roles "hvac.api.auth_methods.Azure.list_roles")([mount\_point]) | List all the roles that are registered with the plugin. |

| [`login`](#hvac.api.auth_methods.Azure.login "hvac.api.auth_methods.Azure.login")(role, jwt[, subscription\_id, …]) | Fetch a token. |

| [`read\_config`](#hvac.api.auth_methods.Azure.read_config "hvac.api.auth_methods.Azure.read_config")([mount\_point]) | Return the previously configured config, including credentials. |

| [`read\_role`](#hvac.api.auth_methods.Azure.read_role "hvac.api.auth_methods.Azure.read_role")(name[, mount\_point]) | Read the previously registered role configuration. |

`configure`(*tenant\_id*, *resource*, *environment=None*, *client\_id=None*, *client\_secret=None*, *mount\_point='azure'*)[[source]](_modules/hvac/api/auth_methods/azure.html#Azure.configure)[¶](#hvac.api.auth_methods.Azure.configure "Permalink to this definition")

Configure the credentials required for the plugin to perform API calls to Azure.

These credentials will be used to query the metadata about the virtual machine.

Supported methods:POST: /auth/{mount\_point}/config. Produces: 204 (empty body)

Parameters

* **tenant\_id** (*str | unicode*) – The tenant id for the Azure Active Directory organization.

* **resource** (*str | unicode*) – The configured URL for the application registered in Azure Active Directory.

* **environment** (*str | unicode*) – The Azure cloud environment. Valid values: AzurePublicCloud, AzureUSGovernmentCloud,

AzureChinaCloud, AzureGermanCloud.

* **client\_id** (*str | unicode*) – The client id for credentials to query the Azure APIs. Currently read permissions to query

compute resources are required.

* **client\_secret** (*str | unicode*) – The client secret for credentials to query the Azure APIs.

* **mount\_point** (*str | unicode*) – The “path” the azure auth method was mounted on.

Returns

The response of the request.

Return type

requests.Response

`create_role`(*name*, *policies=None*, *ttl=None*, *max\_ttl=None*, *period=None*, *bound\_service\_principal\_ids=None*, *bound\_group\_ids=None*, *bound\_locations=None*, *bound\_subscription\_ids=None*, *bound\_resource\_groups=None*, *bound\_scale\_sets=None*, *num\_uses=None*, *mount\_point='azure'*)[[source]](_modules/hvac/api/auth_methods/azure.html#Azure.create_role)[¶](#hvac.api.auth_methods.Azure.create_role "Permalink to this definition")

Create a role in the method.

Role types have specific entities that can perform login operations against this endpoint. Constraints specific

to the role type must be set on the role. These are applied to the authenticated entities attempting to login.

Supported methods:POST: /auth/{mount\_point}/role/{name}. Produces: 204 (empty body)

Parameters

* **name** (*str | unicode*) – Name of the role.

* **policies** (*str | list*) – Policies to be set on tokens issued using this role.

* **num\_uses** (*int*) – Number of uses to set on a token produced by this role.

* **ttl** (*str | unicode*) – The TTL period of tokens issued using this role in seconds.

* **max\_ttl** (*str | unicode*) – The maximum allowed lifetime of tokens issued in seconds using this role.

* **period** (*str | unicode*) – If set, indicates that the token generated using this role should never expire. The token should

be renewed within the duration specified by this value. At each renewal, the token’s TTL will be set to the

value of this parameter.

* **bound\_service\_principal\_ids** (*list*) – The list of Service Principal IDs that login is restricted to.

* **bound\_group\_ids** (*list*) – The list of group ids that login is restricted to.

* **bound\_locations** (*list*) – The list of locations that login is restricted to.

* **bound\_subscription\_ids** (*list*) – The list of subscription IDs that login is restricted to.

* **bound\_resource\_groups** (*list*) – The list of resource groups that login is restricted to.

* **bound\_scale\_sets** (*list*) – The list of scale set names that the login is restricted to.

* **mount\_point** (*str | unicode*) – The “path” the azure auth method was mounted on.

Returns

The response of the request.

Return type

requests.Response

`delete_config`(*mount\_point='azure'*)[[source]](_modules/hvac/api/auth_methods/azure.html#Azure.delete_config)[¶](#hvac.api.auth_methods.Azure.delete_config "Permalink to this definition")

Delete the previously configured Azure config and credentials.

Supported methods:DELETE: /auth/{mount\_point}/config. Produces: 204 (empty body)

Parameters

**mount\_point** (*str | unicode*) – The “path” the azure auth method was mounted on.

Returns

The response of the request.

Return type

requests.Response

`delete_role`(*name*, *mount\_point='azure'*)[[source]](_modules/hvac/api/auth_methods/azure.html#Azure.delete_role)[¶](#hvac.api.auth_methods.Azure.delete_role "Permalink to this definition")

Delete the previously registered role.

Supported methods:DELETE: /auth/{mount\_point}/role/{name}. Produces: 204 (empty body)

Parameters

* **name** (*str | unicode*) – Name of the role.

* **mount\_point** (*str | unicode*) – The “path” the azure auth method was mounted on.

Returns

The response of the request.

Return type

requests.Response

`list_roles`(*mount\_point='azure'*)[[source]](_modules/hvac/api/auth_methods/azure.html#Azure.list_roles)[¶](#hvac.api.auth_methods.Azure.list_roles "Permalink to this definition")

List all the roles that are registered with the plugin.

Supported methods:LIST: /auth/{mount\_point}/role. Produces: 200 application/json

Parameters

**mount\_point** (*str | unicode*) – The “path” the azure auth method was mounted on.

Returns

The “data” key from the JSON response of the request.

Return type

dict

`login`(*role*, *jwt*, *subscription\_id=None*, *resource\_group\_name=None*, *vm\_name=None*, *vmss\_name=None*, *use\_token=True*, *mount\_point='azure'*)[[source]](_modules/hvac/api/auth_methods/azure.html#Azure.login)[¶](#hvac.api.auth_methods.Azure.login "Permalink to this definition")

Fetch a token.

This endpoint takes a signed JSON Web Token (JWT) and a role name for some entity. It verifies the JWT signature

to authenticate that entity and then authorizes the entity for the given role.

Supported methods:POST: /auth/{mount\_point}/login. Produces: 200 application/json

Parameters

* **role** (*str | unicode*) – Name of the role against which the login is being attempted.

* **jwt** (*str | unicode*) – Signed JSON Web Token (JWT) from Azure MSI.

* **subscription\_id** (*str | unicode*) – The subscription ID for the machine that generated the MSI token. This information can

be obtained through instance metadata.

* **resource\_group\_name** (*str | unicode*) – The resource group for the machine that generated the MSI token. This information

can be obtained through instance metadata.

* **vm\_name** (*str | unicode*) – The virtual machine name for the machine that generated the MSI token. This information can be

obtained through instance metadata. If vmss\_name is provided, this value is ignored.

* **vmss\_name** (*str | unicode*) – The virtual machine scale set name for the machine that generated the MSI token. This

information can be obtained through instance metadata.

* **use\_token** (*bool*) – if True, uses the token in the response received from the auth request to set the “token”

attribute on the the [`hvac.adapters.Adapter()`](index.html#hvac.adapters.Adapter "hvac.adapters.Adapter") instance under the \_adapater Client attribute.

* **mount\_point** (*str | unicode*) – The “path” the azure auth method was mounted on.

Returns

The JSON response of the request.

Return type

dict

`read_config`(*mount\_point='azure'*)[[source]](_modules/hvac/api/auth_methods/azure.html#Azure.read_config)[¶](#hvac.api.auth_methods.Azure.read_config "Permalink to this definition")

Return the previously configured config, including credentials.

Supported methods:GET: /auth/{mount\_point}/config. Produces: 200 application/json

Parameters

**mount\_point** (*str | unicode*) – The “path” the azure auth method was mounted on.

Returns

The data key from the JSON response of the request.

Return type

dict

`read_role`(*name*, *mount\_point='azure'*)[[source]](_modules/hvac/api/auth_methods/azure.html#Azure.read_role)[¶](#hvac.api.auth_methods.Azure.read_role "Permalink to this definition")

Read the previously registered role configuration.

Supported methods:GET: /auth/{mount\_point}/role/{name}. Produces: 200 application/json

Parameters

* **name** (*str | unicode*) – Name of the role.

* **mount\_point** (*str | unicode*) – The “path” the azure auth method was mounted on.

Returns

The “data” key from the JSON response of the request.

Return type

dict

*class* `hvac.api.auth_methods.``Cert`(*adapter*)[[source]](_modules/hvac/api/auth_methods/cert.html#Cert)[¶](#hvac.api.auth_methods.Cert "Permalink to this definition")

Bases: `hvac.api.vault\_api\_base.VaultApiBase`

Cert Auth Method (API).

Reference: <https://www.vaultproject.io/api/auth/cert/index.html>

**Miscellaneous**

| [`CertificateAuthError`](#hvac.api.auth_methods.Cert.CertificateAuthError "hvac.api.auth_methods.Cert.CertificateAuthError") |  |

**Methods**

| [`configure\_tls\_certificate`](#hvac.api.auth_methods.Cert.configure_tls_certificate "hvac.api.auth_methods.Cert.configure_tls_certificate")([mount\_point, …]) | Configure options for the method. |

| [`create\_ca\_certificate\_role`](#hvac.api.auth_methods.Cert.create_ca_certificate_role "hvac.api.auth_methods.Cert.create_ca_certificate_role")(name, certificate) | Create CA Certificate Role. |

| [`delete\_certificate\_role`](#hvac.api.auth_methods.Cert.delete_certificate_role "hvac.api.auth_methods.Cert.delete_certificate_role")(name[, mount\_point]) | List existing LDAP existing groups that have been created in this auth method. |

| [`list\_certificate\_roles`](#hvac.api.auth_methods.Cert.list_certificate_roles "hvac.api.auth_methods.Cert.list_certificate_roles")([mount\_point]) | Lists configured certificate names. |

| [`login`](#hvac.api.auth_methods.Cert.login "hvac.api.auth_methods.Cert.login")([name, cacert, cert\_pem, key\_pem, …]) | Log in and fetch a token. |

| [`read\_ca\_certificate\_role`](#hvac.api.auth_methods.Cert.read_ca_certificate_role "hvac.api.auth_methods.Cert.read_ca_certificate_role")(name[, mount\_point]) | Gets information associated with the named role. |

*exception* `CertificateAuthError`[[source]](_modules/hvac/api/auth_methods/cert.html#Cert.CertificateAuthError)[¶](#hvac.api.auth_methods.Cert.CertificateAuthError "Permalink to this definition")

Bases: `Exception`

`configure_tls_certificate`(*mount\_point='cert'*, *disable\_binding=False*)[[source]](_modules/hvac/api/auth_methods/cert.html#Cert.configure_tls_certificate)[¶](#hvac.api.auth_methods.Cert.configure_tls_certificate "Permalink to this definition")

Configure options for the method.

Supported methods:POST: /auth/<mount point>/config. Produces: 204 (empty body)

Parameters

* **disable\_binding** (*bool*) – If set, during renewal, skips the matching of presented client identity with the client

identity used during login.

* **mount\_point** –

`create_ca_certificate_role`(*name*, *certificate*, *allowed\_common\_names=''*, *allowed\_dns\_sans=''*, *allowed\_email\_sans=''*, *allowed\_uri\_sans=''*, *allowed\_organizational\_units=''*, *required\_extensions=''*, *display\_name=''*, *token\_ttl=0*, *token\_max\_ttl=0*, *token\_policies=[]*, *token\_bound\_cidrs=[]*, *token\_explicit\_max\_ttl=0*, *token\_no\_default\_policy=False*, *token\_num\_uses=0*, *token\_period=0*, *token\_type=''*, *mount\_point='cert'*)[[source]](_modules/hvac/api/auth_methods/cert.html#Cert.create_ca_certificate_role)[¶](#hvac.api.auth_methods.Cert.create_ca_certificate_role "Permalink to this definition")

Create CA Certificate Role.

Sets a CA cert and associated parameters in a role name.

Supported methods:POST: /auth/<mount point>/certs/:name. Produces: 204 (empty body)

»Parameters

:param name: The name of the certificate role.

:type name: str

:param certificate: The PEM-format CA certificate.

:type certificate: str

:param allowed\_common\_names: Constrain the Common Names in the client certificate with a globbed pattern. Value

> 

> is a comma-separated list of patterns. Authentication requires at least one Name matching at least one

> pattern. If not set, defaults to allowing all names.

> 

> 

> 

Parameters

* **allowed\_dns\_sans** (*str | list*) – Constrain the Alternative Names in the client certificate with a globbed pattern. Value

is a comma-separated list of patterns. Authentication requires at least one DNS matching at least one pattern.

If not set, defaults to allowing all dns.

* **allowed\_email\_sans** (*str | list*) – Constrain the Alternative Names in the client certificate with a globbed pattern.

Value is a comma-separated list of patterns. Authentication requires at least one Email matching at least

one pattern. If not set, defaults to allowing all emails.

* **allowed\_uri\_sans** (*str | list*) – Constrain the Alternative Names in the client certificate with a globbed pattern.

Value is a comma-separated list of URI patterns. Authentication requires at least one URI matching at least

one pattern. If not set, defaults to allowing all URIs.

* **allowed\_organizational\_units** (*str | list*) – Constrain the Organizational Units (OU) in the client certificate with a

globbed pattern. Value is a comma-separated list of OU patterns. Authentication requires at least one OU

matching at least one pattern. If not set, defaults to allowing all OUs.

* **required\_extensions** (*str | list*) – Require specific Custom Extension OIDs to exist and match the pattern. Value is a

comma separated string or array of oid:value. Expects the extension value to be some type of ASN1 encoded

string. All conditions must be met. Supports globbing on value.

* **display\_name** (*str | unicode*) – The display\_name to set on tokens issued when authenticating against this CA certificate.

If not set, defaults to the name of the role.

* **token\_ttl** (*int | str*) – The incremental lifetime for generated tokens. This current value of this will be referenced

at renewal time.

* **token\_max\_ttl** (*int | str*) – The maximum lifetime for generated tokens. This current value of this will be referenced

at renewal time.

* **token\_policies** (*list | str*) – List of policies to encode onto generated tokens. Depending on the auth method, this list

may be supplemented by user/group/other values.

* **token\_bound\_cidrs** (*list | str*) – List of CIDR blocks; if set, specifies blocks of IP addresses which can authenticate

successfully, and ties the resulting token to these blocks as well.

* **token\_explicit\_max\_ttl** (*int | str*) – If set, will encode an explicit max TTL onto the token. This is a hard cap even

if token\_ttl and token\_max\_ttl would otherwise allow a renewal.

* **token\_no\_default\_policy** (*bool*) – If set, the default policy will not be set on generated tokens; otherwise it

will be added to the policies set in token\_policies.

* **token\_num\_uses** (*int*) – The maximum number of times a generated token may be used (within its lifetime); 0 means

unlimited. If you require the token to have the ability to create child tokens, you will need to set this value to 0.

* **token\_period** (*int | str*) – The period, if any, to set on the token.

* **token\_type** (*str*) – The type of token that should be generated. Can be service, batch, or default to use the

mount’s tuned default (which unless changed will be service tokens). For token store roles, there are two

additional possibilities: default-service and default-batch which specify the type to return unless the

client requests a different type at generation time.

* **mount\_point** –

`delete_certificate_role`(*name*, *mount\_point='cert'*)[[source]](_modules/hvac/api/auth_methods/cert.html#Cert.delete_certificate_role)[¶](#hvac.api.auth_methods.Cert.delete_certificate_role "Permalink to this definition")

List existing LDAP existing groups that have been created in this auth method.

Supported methods:DELETE: /auth/{mount\_point}/groups. Produces: 204 (empty body)

Parameters

* **name** (*str | unicode*) – The name of the certificate role.

* **mount\_point** –

`list_certificate_roles`(*mount\_point='cert'*)[[source]](_modules/hvac/api/auth_methods/cert.html#Cert.list_certificate_roles)[¶](#hvac.api.auth_methods.Cert.list_certificate_roles "Permalink to this definition")

Lists configured certificate names.

Supported methods:LIST: /auth/<mount point>/certs. Produces: 200 application/json

Parameters

**mount\_point** – 

Returns

The response of the list\_certificate request.

Return type

requests.Response

`login`(*name=''*, *cacert=False*, *cert\_pem=''*, *key\_pem=''*, *mount\_point='cert'*, *use\_token=True*)[[source]](_modules/hvac/api/auth_methods/cert.html#Cert.login)[¶](#hvac.api.auth_methods.Cert.login "Permalink to this definition")

Log in and fetch a token. If there is a valid chain to a CA configured in the method and all role constraintsare matched, a token will be issued. If the certificate has DNS SANs in it, each of those will be verified.

If Common Name is required to be verified, then it should be a fully qualified DNS domain name and must be

duplicated as a DNS SAN

Supported methods:POST: /auth/<mount point>/login Produces: 200 application/json

Parameters

* **name** (*str | unicode*) – Authenticate against only the named certificate role, returning its policy list if successful. If

not set, defaults to trying all certificate roles and returning any one that matches.

* **cacert** (*str | bool*) – The value used here is for the Vault TLS Listener CA certificate, not the CA that issued the

client authentication certificate. This can be omitted if the CA used to issue the Vault server certificate

is trusted by the local system executing this command.

* **cert\_pem** – Location of the cert.pem used to authenticate the host.

* **key\_pem** – Location of the public key.pem used to authenticate the host.

* **key\_pem** – str | unicode

* **mount\_point** –

* **use\_token** – If the returned token is stored in the client

* **use\_token** – bool

Tupe cert\_pem

str | unicode

Returns

The response of the login request.

Return type

requests.Response

`read_ca_certificate_role`(*name*, *mount\_point='cert'*)[[source]](_modules/hvac/api/auth_methods/cert.html#Cert.read_ca_certificate_role)[¶](#hvac.api.auth_methods.Cert.read_ca_certificate_role "Permalink to this definition")

Gets information associated with the named role.

Supported methods:GET: /auth/<mount point>/certs/{name}. Produces: 200 application/json

Parameters

* **name** (*str | unicode*) – The name of the certificate role

* **mount\_point** –

Returns

The JSON response of the read\_ca\_certificate\_role request.

Return type

dict

*class* `hvac.api.auth_methods.``Gcp`(*adapter*)[[source]](_modules/hvac/api/auth_methods/gcp.html#Gcp)[¶](#hvac.api.auth_methods.Gcp "Permalink to this definition")

Bases: `hvac.api.vault\_api\_base.VaultApiBase`

Google Cloud Auth Method (API).

Reference: <https://www.vaultproject.io/api/auth>/{mount\_point}/index.html

**Methods**

| [`configure`](#hvac.api.auth_methods.Gcp.configure "hvac.api.auth_methods.Gcp.configure")([credentials, …]) | Configure the credentials required for the GCP auth method to perform API calls to Google Cloud. |

| [`create\_role`](#hvac.api.auth_methods.Gcp.create_role "hvac.api.auth_methods.Gcp.create_role")(name, role\_type, project\_id[, …]) | Register a role in the GCP auth method. |

| [`delete\_config`](#hvac.api.auth_methods.Gcp.delete_config "hvac.api.auth_methods.Gcp.delete_config")([mount\_point]) | Delete all GCP configuration data. |

| [`delete\_role`](#hvac.api.auth_methods.Gcp.delete_role "hvac.api.auth_methods.Gcp.delete_role")(role[, mount\_point]) | Delete the previously registered role. |

| [`edit\_labels\_on\_gce\_role`](#hvac.api.auth_methods.Gcp.edit_labels_on_gce_role "hvac.api.auth_methods.Gcp.edit_labels_on_gce_role")(name[, add, remove, …]) | Edit labels for an existing GCE role in the backend. |

| [`edit\_service\_accounts\_on\_iam\_role`](#hvac.api.auth_methods.Gcp.edit_service_accounts_on_iam_role "hvac.api.auth_methods.Gcp.edit_service_accounts_on_iam_role")(name[, …]) | Edit service accounts for an existing IAM role in the GCP auth method. |

| [`list\_roles`](#hvac.api.auth_methods.Gcp.list_roles "hvac.api.auth_methods.Gcp.list_roles")([mount\_point]) | List all the roles that are registered with the plugin. |

| [`login`](#hvac.api.auth_methods.Gcp.login "hvac.api.auth_methods.Gcp.login")(role, jwt[, use\_token, mount\_point]) | Login to retrieve a Vault token via the GCP auth method. |

| [`read\_config`](#hvac.api.auth_methods.Gcp.read_config "hvac.api.auth_methods.Gcp.read_config")([mount\_point]) | Read the configuration, if any, including credentials. |

| [`read\_role`](#hvac.api.auth_methods.Gcp.read_role "hvac.api.auth_methods.Gcp.read_role")(name[, mount\_point]) | Read the previously registered role configuration. |

`configure`(*credentials=None*, *google\_certs\_endpoint='https://www.googleapis.com/oauth2/v3/certs'*, *mount\_point='gcp'*)[[source]](_modules/hvac/api/auth_methods/gcp.html#Gcp.configure)[¶](#hvac.api.auth_methods.Gcp.configure "Permalink to this definition")

Configure the credentials required for the GCP auth method to perform API calls to Google Cloud.

These credentials will be used to query the status of IAM entities and get service account or other Google

public certificates to confirm signed JWTs passed in during login.

Supported methods:POST: /auth/{mount\_point}/config. Produces: 204 (empty body)

Parameters

* **credentials** (*str | unicode*) – A JSON string containing the contents of a GCP credentials file. The credentials file must

have the following permissions: iam.serviceAccounts.get, iam.serviceAccountKeys.get.

If this value is empty, Vault will try to use Application Default Credentials from the machine on which the

Vault server is running. The project must have the iam.googleapis.com API enabled.

* **google\_certs\_endpoint** (*str | unicode*) – The Google OAuth2 endpoint from which to obtain public certificates. This is used

for testing and should generally not be set by end users.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the request.

Return type

requests.Response

`create_role`(*name*, *role\_type*, *project\_id*, *ttl=None*, *max\_ttl=None*, *period=None*, *policies=None*, *bound\_service\_accounts=None*, *max\_jwt\_exp=None*, *allow\_gce\_inference=None*, *bound\_zones=None*, *bound\_regions=None*, *bound\_instance\_groups=None*, *bound\_labels=None*, *mount\_point='gcp'*)[[source]](_modules/hvac/api/auth_methods/gcp.html#Gcp.create_role)[¶](#hvac.api.auth_methods.Gcp.create_role "Permalink to this definition")

Register a role in the GCP auth method.

Role types have specific entities that can perform login operations against this endpoint. Constraints specificto the role type must be set on the role. These are applied to the authenticated entities attempting to

login.

Supported methods:POST: /auth/{mount\_point}/role/{name}. Produces: 204 (empty body)

Parameters

* **name** (*str | unicode*) – The name of the role.

* **role\_type** (*str | unicode*) – The type of this role. Certain fields correspond to specific roles and will be rejected

otherwise.

* **project\_id** (*str | unicode*) – The GCP project ID. Only entities belonging to this project can authenticate with this role.

* **ttl** (*str | unicode*) – The TTL period of tokens issued using this role. This can be specified as an integer number of

seconds or as a duration value like “5m”.

* **max\_ttl** (*str | unicode*) – The maximum allowed lifetime of tokens issued in seconds using this role. This can be specified

as an integer number of seconds or as a duration value like “5m”.

* **period** (*str | unicode*) – If set, indicates that the token generated using this role should never expire. The token should

be renewed within the duration specified by this value. At each renewal, the token’s TTL will be set to the

value of this parameter. This can be specified as an integer number of seconds or as a duration value like

“5m”.

* **policies** (*list*) – The list of policies to be set on tokens issued using this role.

* **bound\_service\_accounts** (*list*) – <required for iam> A list of service account emails or IDs that login is

restricted to. If set to \*, all service accounts are allowed (role will still be bound by project). Will be

inferred from service account used to issue metadata token for GCE instances.

* **max\_jwt\_exp** (*str | unicode*) – <iam only> The number of seconds past the time of authentication that the login param JWT

must expire within. For example, if a user attempts to login with a token that expires within an hour and

this is set to 15 minutes, Vault will return an error prompting the user to create a new signed JWT with a

shorter exp. The GCE metadata tokens currently do not allow the exp claim to be customized.

* **allow\_gce\_inference** (*bool*) – <iam only> A flag to determine if this role should allow GCE instances to

authenticate by inferring service accounts from the GCE identity metadata token.

* **bound\_zones** (*list*) – <gce only> The list of zones that a GCE instance must belong to in order to be

authenticated. If bound\_instance\_groups is provided, it is assumed to be a zonal group and the group must

belong to this zone.

* **bound\_regions** (*list*) – <gce only> The list of regions that a GCE instance must belong to in order to be

authenticated. If bound\_instance\_groups is provided, it is assumed to be a regional group and the group

must belong to this region. If bound\_zones are provided, this attribute is ignored.

* **bound\_instance\_groups** (*list*) – <gce only> The instance groups that an authorized instance must belong to in

order to be authenticated. If specified, either bound\_zones or bound\_regions must be set too.

* **bound\_labels** (*list*) – <gce only> A list of GCP labels formatted as “key:value” strings that must be set on

authorized GCE instances. Because GCP labels are not currently ACL’d, we recommend that this be used in

conjunction with other restrictions.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The data key from the JSON response of the request.

Return type

requests.Response

`delete_config`(*mount\_point='gcp'*)[[source]](_modules/hvac/api/auth_methods/gcp.html#Gcp.delete_config)[¶](#hvac.api.auth_methods.Gcp.delete_config "Permalink to this definition")

Delete all GCP configuration data. This operation is idempotent.

Supported methods:DELETE: /auth/{mount\_point}/config. Produces: 204 (empty body)

Parameters

**mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the request.

Return type

requests.Response

`delete_role`(*role*, *mount\_point='gcp'*)[[source]](_modules/hvac/api/auth_methods/gcp.html#Gcp.delete_role)[¶](#hvac.api.auth_methods.Gcp.delete_role "Permalink to this definition")

Delete the previously registered role.

Supported methods:DELETE: /auth/{mount\_point}/role/{role}. Produces: 204 (empty body)

Parameters

* **role** (*str | unicode*) – The name of the role to delete.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the request.

Return type

requests.Response

`edit_labels_on_gce_role`(*name*, *add=None*, *remove=None*, *mount\_point='gcp'*)[[source]](_modules/hvac/api/auth_methods/gcp.html#Gcp.edit_labels_on_gce_role)[¶](#hvac.api.auth_methods.Gcp.edit_labels_on_gce_role "Permalink to this definition")

Edit labels for an existing GCE role in the backend.

This allows you to add or remove labels (keys, values, or both) from the list of keys on the role.

Supported methods:POST: /auth/{mount\_point}/role/{name}/labels. Produces: 204 (empty body)

Parameters

* **name** (*str | unicode*) – The name of an existing gce role. This will return an error if role is not a gce type role.

* **add** (*list*) – The list of key:value labels to add to the GCE role’s bound labels.

* **remove** (*list*) – The list of label keys to remove from the role’s bound labels. If any of the specified keys do

not exist, no error is returned (idempotent).

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the edit\_labels\_on\_gce\_role request.

Return type

requests.Response

`edit_service_accounts_on_iam_role`(*name*, *add=None*, *remove=None*, *mount\_point='gcp'*)[[source]](_modules/hvac/api/auth_methods/gcp.html#Gcp.edit_service_accounts_on_iam_role)[¶](#hvac.api.auth_methods.Gcp.edit_service_accounts_on_iam_role "Permalink to this definition")

Edit service accounts for an existing IAM role in the GCP auth method.

This allows you to add or remove service accounts from the list of service accounts on the role.

Supported methods:POST: /auth/{mount\_point}/role/{name}/service-accounts. Produces: 204 (empty body)

Parameters

* **name** (*str | unicode*) – The name of an existing iam type role. This will return an error if role is not an iam type role.

* **add** (*list*) – The list of service accounts to add to the role’s service accounts.

* **remove** (*list*) – The list of service accounts to remove from the role’s service accounts.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the request.

Return type

requests.Response

`list_roles`(*mount\_point='gcp'*)[[source]](_modules/hvac/api/auth_methods/gcp.html#Gcp.list_roles)[¶](#hvac.api.auth_methods.Gcp.list_roles "Permalink to this definition")

List all the roles that are registered with the plugin.

Supported methods:LIST: /auth/{mount\_point}/roles. Produces: 200 application/json

Parameters

**mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The data key from the JSON response of the request.

Return type

dict

`login`(*role*, *jwt*, *use\_token=True*, *mount\_point='gcp'*)[[source]](_modules/hvac/api/auth_methods/gcp.html#Gcp.login)[¶](#hvac.api.auth_methods.Gcp.login "Permalink to this definition")

Login to retrieve a Vault token via the GCP auth method.

This endpoint takes a signed JSON Web Token (JWT) and a role name for some entity. It verifies the JWTsignature with Google Cloud to authenticate that entity and then authorizes the entity for the given role.

Supported methods:POST: /auth/{mount\_point}/login. Produces: 200 application/json

Parameters

* **role** (*str | unicode*) – The name of the role against which the login is being attempted.

* **jwt** (*str | unicode*) – A signed JSON web token

* **use\_token** (*bool*) – if True, uses the token in the response received from the auth request to set the “token”

attribute on the the [`hvac.adapters.Adapter()`](index.html#hvac.adapters.Adapter "hvac.adapters.Adapter") instance under the \_adapater Client attribute.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

`read_config`(*mount\_point='gcp'*)[[source]](_modules/hvac/api/auth_methods/gcp.html#Gcp.read_config)[¶](#hvac.api.auth_methods.Gcp.read_config "Permalink to this definition")

Read the configuration, if any, including credentials.

Supported methods:GET: /auth/{mount\_point}/config. Produces: 200 application/json

Parameters

**mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The data key from the JSON response of the request.

Return type

dict

`read_role`(*name*, *mount\_point='gcp'*)[[source]](_modules/hvac/api/auth_methods/gcp.html#Gcp.read_role)[¶](#hvac.api.auth_methods.Gcp.read_role "Permalink to this definition")

Read the previously registered role configuration.

Supported methods:GET: /auth/{mount\_point}/role/{name}. Produces: 200 application/json

Parameters

* **name** (*str | unicode*) – The name of the role to read.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The data key from the JSON response of the read\_role request.

Return type

JSON

*class* `hvac.api.auth_methods.``Github`(*adapter*)[[source]](_modules/hvac/api/auth_methods/github.html#Github)[¶](#hvac.api.auth_methods.Github "Permalink to this definition")

Bases: `hvac.api.vault\_api\_base.VaultApiBase`

GitHub Auth Method (API).

Reference: <https://www.vaultproject.io/api/auth/github/index.html>

**Methods**

| [`configure`](#hvac.api.auth_methods.Github.configure "hvac.api.auth_methods.Github.configure")(organization[, base\_url, ttl, …]) | Configure the connection parameters for GitHub. |

| [`login`](#hvac.api.auth_methods.Github.login "hvac.api.auth_methods.Github.login")(token[, use\_token, mount\_point]) | Login using GitHub access token. |

| [`map\_team`](#hvac.api.auth_methods.Github.map_team "hvac.api.auth_methods.Github.map_team")(team\_name[, policies, mount\_point]) | Map a list of policies to a team that exists in the configured GitHub organization. |

| [`map\_user`](#hvac.api.auth_methods.Github.map_user "hvac.api.auth_methods.Github.map_user")(user\_name[, policies, mount\_point]) | Map a list of policies to a specific GitHub user exists in the configured organization. |

| [`read\_configuration`](#hvac.api.auth_methods.Github.read_configuration "hvac.api.auth_methods.Github.read_configuration")([mount\_point]) | Read the GitHub configuration. |

| [`read\_team\_mapping`](#hvac.api.auth_methods.Github.read_team_mapping "hvac.api.auth_methods.Github.read_team_mapping")(team\_name[, mount\_point]) | Read the GitHub team policy mapping. |

| [`read\_user\_mapping`](#hvac.api.auth_methods.Github.read_user_mapping "hvac.api.auth_methods.Github.read_user_mapping")(user\_name[, mount\_point]) | Read the GitHub user policy mapping. |

`configure`(*organization*, *base\_url=None*, *ttl=None*, *max\_ttl=None*, *mount\_point='github'*)[[source]](_modules/hvac/api/auth_methods/github.html#Github.configure)[¶](#hvac.api.auth_methods.Github.configure "Permalink to this definition")

Configure the connection parameters for GitHub.

This path honors the distinction between the create and update capabilities inside ACL policies.

Supported methods:POST: /auth/{mount\_point}/config. Produces: 204 (empty body)

Parameters

* **organization** (*str | unicode*) – The organization users must be part of.

* **base\_url** (*str | unicode*) – The API endpoint to use. Useful if you are running GitHub Enterprise or an API-compatible

authentication server.

* **ttl** (*str | unicode*) – Duration after which authentication will be expired.

* **max\_ttl** (*str | unicode*) – Maximum duration after which authentication will

be expired.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the configure\_method request.

Return type

requests.Response

`login`(*token*, *use\_token=True*, *mount\_point='github'*)[[source]](_modules/hvac/api/auth_methods/github.html#Github.login)[¶](#hvac.api.auth_methods.Github.login "Permalink to this definition")

Login using GitHub access token.

Supported methods:POST: /auth/{mount\_point}/login. Produces: 200 application/json

Parameters

* **token** (*str | unicode*) – GitHub personal API token.

* **use\_token** (*bool*) – if True, uses the token in the response received from the auth request to set the “token”

attribute on the the [`hvac.adapters.Adapter()`](index.html#hvac.adapters.Adapter "hvac.adapters.Adapter") instance under the \_adapater Client attribute.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the login request.

Return type

dict

`map_team`(*team\_name*, *policies=None*, *mount\_point='github'*)[[source]](_modules/hvac/api/auth_methods/github.html#Github.map_team)[¶](#hvac.api.auth_methods.Github.map_team "Permalink to this definition")

Map a list of policies to a team that exists in the configured GitHub organization.

Supported methods:POST: /auth/{mount\_point}/map/teams/{team\_name}. Produces: 204 (empty body)

Parameters

* **team\_name** (*str | unicode*) – GitHub team name in “slugified” format

* **policies** (*List**[**str**]*) – Comma separated list of policies to assign

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the map\_github\_teams request.

Return type

requests.Response

`map_user`(*user\_name*, *policies=None*, *mount\_point='github'*)[[source]](_modules/hvac/api/auth_methods/github.html#Github.map_user)[¶](#hvac.api.auth_methods.Github.map_user "Permalink to this definition")

Map a list of policies to a specific GitHub user exists in the configured organization.

Supported methods:POST: /auth/{mount\_point}/map/users/{user\_name}. Produces: 204 (empty body)

Parameters

* **user\_name** (*str | unicode*) – GitHub user name

* **policies** (*List**[**str**]*) – Comma separated list of policies to assign

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the map\_github\_users request.

Return type

requests.Response

`read_configuration`(*mount\_point='github'*)[[source]](_modules/hvac/api/auth_methods/github.html#Github.read_configuration)[¶](#hvac.api.auth_methods.Github.read_configuration "Permalink to this definition")

Read the GitHub configuration.

Supported methods:GET: /auth/{mount\_point}/config. Produces: 200 application/json

Parameters

**mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the read\_configuration request.

Return type

dict

`read_team_mapping`(*team\_name*, *mount\_point='github'*)[[source]](_modules/hvac/api/auth_methods/github.html#Github.read_team_mapping)[¶](#hvac.api.auth_methods.Github.read_team_mapping "Permalink to this definition")

Read the GitHub team policy mapping.

Supported methods:GET: /auth/{mount\_point}/map/teams/{team\_name}. Produces: 200 application/json

Parameters

* **team\_name** (*str | unicode*) – GitHub team name

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the read\_team\_mapping request.

Return type

dict

`read_user_mapping`(*user\_name*, *mount\_point='github'*)[[source]](_modules/hvac/api/auth_methods/github.html#Github.read_user_mapping)[¶](#hvac.api.auth_methods.Github.read_user_mapping "Permalink to this definition")

Read the GitHub user policy mapping.

Supported methods:GET: /auth/{mount\_point}/map/users/{user\_name}. Produces: 200 application/json

Parameters

* **user\_name** (*str | unicode*) – GitHub user name

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the read\_user\_mapping request.

Return type

dict

*class* `hvac.api.auth_methods.``JWT`(*adapter*)[[source]](_modules/hvac/api/auth_methods/jwt.html#JWT)[¶](#hvac.api.auth_methods.JWT "Permalink to this definition")

Bases: `hvac.api.vault\_api\_base.VaultApiBase`

JWT auth method which can be used to authenticate with Vault by providing a JWT.

The OIDC method allows authentication via a configured OIDC provider using the user’s web browser.

This method may be initiated from the Vault UI or the command line. Alternatively, a JWT can be provided directly.

The JWT is cryptographically verified using locally-provided keys, or, if configured, an OIDC Discovery service can

be used to fetch the appropriate keys. The choice of method is configured per role.

Reference: <https://www.vaultproject.io/api/auth/jwt>

**Attributes**

| [`DEFAULT\_PATH`](#hvac.api.auth_methods.JWT.DEFAULT_PATH "hvac.api.auth_methods.JWT.DEFAULT_PATH") | str(object=’’) -> str |

**Methods**

| [`configure`](#hvac.api.auth_methods.JWT.configure "hvac.api.auth_methods.JWT.configure")([oidc\_discovery\_url, …]) | Configure the validation information to be used globally across all roles. |

| [`create\_role`](#hvac.api.auth_methods.JWT.create_role "hvac.api.auth_methods.JWT.create_role")(name, user\_claim, …[, …]) | Register a role in the JWT method. |

| [`delete\_role`](#hvac.api.auth_methods.JWT.delete_role "hvac.api.auth_methods.JWT.delete_role")(name[, path]) | Delete the previously registered role. |

| [`jwt\_login`](#hvac.api.auth_methods.JWT.jwt_login "hvac.api.auth_methods.JWT.jwt_login")(role, jwt[, use\_token, path]) | Fetch a token. |

| [`list\_roles`](#hvac.api.auth_methods.JWT.list_roles "hvac.api.auth_methods.JWT.list_roles")([path]) | List all the roles that are registered with the plugin. |

| [`oidc\_authorization\_url\_request`](#hvac.api.auth_methods.JWT.oidc_authorization_url_request "hvac.api.auth_methods.JWT.oidc_authorization_url_request")(role, …[, path]) | Obtain an authorization URL from Vault to start an OIDC login flow. |

| [`oidc\_callback`](#hvac.api.auth_methods.JWT.oidc_callback "hvac.api.auth_methods.JWT.oidc_callback")(state, nonce, code[, path]) | Exchange an authorization code for an OIDC ID Token. |

| [`read\_config`](#hvac.api.auth_methods.JWT.read_config "hvac.api.auth_methods.JWT.read_config")([path]) | Read the previously configured config. |

| [`read\_role`](#hvac.api.auth_methods.JWT.read_role "hvac.api.auth_methods.JWT.read_role")(name[, path]) | Read the previously registered role configuration. |

| [`resolve\_path`](#hvac.api.auth_methods.JWT.resolve_path "hvac.api.auth_methods.JWT.resolve_path")(path) | Return the class’s default path if no explicit path is specified. |

`DEFAULT_PATH` *= 'jwt'*[¶](#hvac.api.auth_methods.JWT.DEFAULT_PATH "Permalink to this definition")

`configure`(*oidc\_discovery\_url=None*, *oidc\_discovery\_ca\_pem=None*, *oidc\_client\_id=None*, *oidc\_client\_secret=None*, *oidc\_response\_mode=None*, *oidc\_response\_types=None*, *jwks\_url=None*, *jwks\_ca\_pem=None*, *jwt\_validation\_pubkeys=None*, *bound\_issuer=None*, *jwt\_supported\_algs=None*, *default\_role=None*, *provider\_config=None*, *path=None*)[[source]](_modules/hvac/api/auth_methods/jwt.html#JWT.configure)[¶](#hvac.api.auth_methods.JWT.configure "Permalink to this definition")

Configure the validation information to be used globally across all roles.

One (and only one) of oidc\_discovery\_url and jwt\_validation\_pubkeys must be set.

Supported methods:POST: /auth/{path}/config.

Parameters

* **oidc\_discovery\_url** (*str | unicode*) – The OIDC Discovery URL, without any .well-known component (base path). Cannot be

used with “jwks\_url” or “jwt\_validation\_pubkeys”.

* **oidc\_discovery\_ca\_pem** (*str | unicode*) – The CA certificate or chain of certificates, in PEM format, to use to validate

connections to the OIDC Discovery URL. If not set, system certificates are used.

* **oidc\_client\_id** (*str | unicode*) – The OAuth Client ID from the provider for OIDC roles.

* **oidc\_client\_secret** (*str | unicode*) – The OAuth Client Secret from the provider for OIDC roles.

* **oidc\_response\_mode** (*str | unicode*) – The response mode to be used in the OAuth2 request. Allowed values are “query” and

form\_post”. Defaults to “query”.

* **oidc\_response\_types** (*str | unicode*) – The response types to request. Allowed values are “code” and “id\_token”. Defaults

to “code”. Note: “id\_token” may only be used if “oidc\_response\_mode” is set to “form\_post”.

* **jwks\_url** (*str | unicode*) – JWKS URL to use to authenticate signatures. Cannot be used with “oidc\_discovery\_url” or

“jwt\_validation\_pubkeys”.

* **jwks\_ca\_pem** (*str | unicode*) – The CA certificate or chain of certificates, in PEM format, to use to validate connections

to the JWKS URL. If not set, system certificates are used.

* **jwt\_validation\_pubkeys** (*str | unicode*) – A list of PEM-encoded public keys to use to authenticate signatures locally.

Cannot be used with “jwks\_url” or “oidc\_discovery\_url”.

* **bound\_issuer** (*str | unicode*) – in a JWT.

* **jwt\_supported\_algs** (*str | unicode*) – A list of supported signing algorithms. Defaults to [RS256].

* **default\_role** (*str | unicode*) – The default role to use if none is provided during login.

* **provider\_config** (*map*) – TypeError

* **path** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the configure request.

Return type

requests.Response

`create_role`(*name*, *user\_claim*, *allowed\_redirect\_uris*, *role\_type='jwt'*, *bound\_audiences=None*, *clock\_skew\_leeway=None*, *expiration\_leeway=None*, *not\_before\_leeway=None*, *bound\_subject=None*, *bound\_claims=None*, *groups\_claim=None*, *claim\_mappings=None*, *oidc\_scopes=None*, *bound\_claims\_type='string'*, *verbose\_oidc\_logging=False*, *token\_ttl=None*, *token\_max\_ttl=None*, *token\_policies=None*, *token\_bound\_cidrs=None*, *token\_explicit\_max\_ttl=None*, *token\_no\_default\_policy=None*, *token\_num\_uses=None*, *token\_period=None*, *token\_type=None*, *path=None*)[[source]](_modules/hvac/api/auth_methods/jwt.html#JWT.create_role)[¶](#hvac.api.auth_methods.JWT.create_role "Permalink to this definition")

Register a role in the JWT method.

Role types have specific entities that can perform login operations against this endpoint. Constraints

specific to the role type must be set on the role. These are applied to the authenticated entities

attempting to login. At least one of the bound values must be set.

Supported methods:POST: /auth/{path}/role/:name.

Parameters

* **name** (*str | unicode*) – Name of the role.

* **role\_type** (*str | unicode*) – Type of role, either “oidc” or “jwt” (default).

* **bound\_audiences** (*list*) – List of aud claims to match against. Any match is sufficient.

Required for “jwt” roles, optional for “oidc” roles.

* **user\_claim** (*str | unicode*) – The claim to use to uniquely identify the user; this will be used as the name for the

Identity entity alias created due to a successful login. The claim value must be a string.

* **clock\_skew\_leeway** (*int*) – Only applicable with “jwt” roles.

* **expiration\_leeway** (*int*) – Only applicable with “jwt” roles.

* **not\_before\_leeway** (*int*) – Only applicable with “jwt” roles.

* **bound\_subject** (*str | unicode*) – If set, requires that the sub claim matches this value.

* **bound\_claims** (*dict*) – If set, a dict of claims (keys) to match against respective claim values (values).

The expected value may be a single string or a list of strings. The interpretation of the bound claim

values is configured with bound\_claims\_type. Keys support JSON pointer syntax for referencing claims.

* **groups\_claim** (*str | unicode*) – The claim to use to uniquely identify the set of groups to which the user belongs; this

will be used as the names for the Identity group aliases created due to a successful login. The claim value

must be a list of strings. Supports JSON pointer syntax for referencing claims.

* **claim\_mappings** (*map*) – If set, a map of claims (keys) to be copied to specified metadata fields (values). Keys

support JSON pointer syntax for referencing claims.

* **oidc\_scopes** (*list*) – If set, a list of OIDC scopes to be used with an OIDC role.

The standard scope “openid” is automatically included and need not be specified.

* **allowed\_redirect\_uris** (*list*) – The list of allowed values for redirect\_uri

during OIDC logins.

* **bound\_claims\_type** (*str | unicode*) – Configures the interpretation of the bound\_claims values. If “string” (the default),

the values will treated as string literals and must match exactly. If set to “glob”, the values will be

interpreted as globs, with \* matching any number of characters.

* **verbose\_oidc\_logging** (*bool*) – Log received OIDC tokens and claims when debug-level

logging is active. Not recommended in production since sensitive information may be present

in OIDC responses.

* **token\_ttl** (*int | str*) – The incremental lifetime for generated tokens. This current value of this will be referenced

at renewal time.

* **token\_max\_ttl** (*int | str*) – The maximum lifetime for generated tokens. This current value of this will be referenced

at renewal time.

* **token\_policies** (*list**[**str**]*) – List of policies to encode onto generated tokens. Depending on the auth method, this

list may be supplemented by user/group/other values.

* **token\_bound\_cidrs** (*list**[**str**]*) – List of CIDR blocks; if set, specifies blocks of IP addresses which can authenticate

successfully, and ties the resulting token to these blocks as well.

* **token\_explicit\_max\_ttl** (*int | str*) – If set, will encode an explicit max TTL onto the token. This is a hard cap

even if token\_ttl and token\_max\_ttl would otherwise allow a renewal.

* **token\_no\_default\_policy** (*bool*) – If set, the default policy will not be set on generated tokens; otherwise it

will be added to the policies set in token\_policies.

* **token\_num\_uses** (*str | unicode*) – The maximum number of times a generated token may be used (within its lifetime); 0 means

unlimited. If you require the token to have the ability to create child tokens, you will need to set this

value to 0.

* **token\_period** (*int | str*) – The period, if any, to set on the token.

* **token\_type** (*str*) – The type of token that should be generated. Can be service, batch, or default.

* **path** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the create\_role request.

Return type

dict

`delete_role`(*name*, *path=None*)[[source]](_modules/hvac/api/auth_methods/jwt.html#JWT.delete_role)[¶](#hvac.api.auth_methods.JWT.delete_role "Permalink to this definition")

Delete the previously registered role.

Supported methods:DELETE: /auth/{path}/role/:name.

Parameters

* **name** (*str | unicode*) – Name of the role.

* **path** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the delete\_role request.

Return type

requests.Response

`jwt_login`(*role*, *jwt*, *use\_token=True*, *path=None*)[[source]](_modules/hvac/api/auth_methods/jwt.html#JWT.jwt_login)[¶](#hvac.api.auth_methods.JWT.jwt_login "Permalink to this definition")

Fetch a token.

This endpoint takes a signed JSON Web Token (JWT) and a role name for some entity.

It verifies the JWT signature to authenticate that entity and then authorizes the

entity for the given role.

Supported methods:POST: /auth/{path}/login.

Parameters

* **role** (*str | unicode*) – not provided.

* **jwt** (*str | unicode*) – Signed JSON Web Token (JWT).

* **path** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the jwt\_login request.

Return type

requests.Response

`list_roles`(*path=None*)[[source]](_modules/hvac/api/auth_methods/jwt.html#JWT.list_roles)[¶](#hvac.api.auth_methods.JWT.list_roles "Permalink to this definition")

List all the roles that are registered with the plugin.

Supported methods:LIST: /auth/{path}/role.

Parameters

**path** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the list\_roles request.

Return type

dict

`oidc_authorization_url_request`(*role*, *redirect\_uri*, *path=None*)[[source]](_modules/hvac/api/auth_methods/jwt.html#JWT.oidc_authorization_url_request)[¶](#hvac.api.auth_methods.JWT.oidc_authorization_url_request "Permalink to this definition")

Obtain an authorization URL from Vault to start an OIDC login flow.

Supported methods:POST: /auth/{path}/auth\_url.

Parameters

* **role** (*str | unicode*) – not provided.

* **redirect\_uri** (*str | unicode*) – more information.

* **path** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the \_authorization\_url\_request request.

Return type

requests.Response

`oidc_callback`(*state*, *nonce*, *code*, *path=None*)[[source]](_modules/hvac/api/auth_methods/jwt.html#JWT.oidc_callback)[¶](#hvac.api.auth_methods.JWT.oidc_callback "Permalink to this definition")

Exchange an authorization code for an OIDC ID Token.

The ID token will be further validated against any bound claims, and if valid a Vault token will be returned.

Supported methods:GET: /auth/{path}/callback.

Parameters

* **state** (*str | unicode*) – Opaque state ID that is part of the Authorization URL and will

be included in the the redirect following successful authentication on the provider.

* **nonce** (*str | unicode*) – Opaque nonce that is part of the Authorization URL and will

be included in the the redirect following successful authentication on the provider.

* **code** (*str | unicode*) – Provider-generated authorization code that Vault will exchange for

an ID token.

* **path** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the \_callback request.

Return type

requests.Response

`read_config`(*path=None*)[[source]](_modules/hvac/api/auth_methods/jwt.html#JWT.read_config)[¶](#hvac.api.auth_methods.JWT.read_config "Permalink to this definition")

Read the previously configured config.

Supported methods:GET: /auth/{path}/config.

Returns

The response of the read\_config request.

Return type

dict

`read_role`(*name*, *path=None*)[[source]](_modules/hvac/api/auth_methods/jwt.html#JWT.read_role)[¶](#hvac.api.auth_methods.JWT.read_role "Permalink to this definition")

Read the previously registered role configuration.

Supported methods:GET: /auth/{path}/role/:name.

Parameters

* **name** (*str | unicode*) – Name of the role.

* **path** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the read\_role request.

Return type

dict

`resolve_path`(*path*)[[source]](_modules/hvac/api/auth_methods/jwt.html#JWT.resolve_path)[¶](#hvac.api.auth_methods.JWT.resolve_path "Permalink to this definition")

Return the class’s default path if no explicit path is specified.

Parameters

**path** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The default path for this auth method if no explicit path is specified.

Return type

str

*class* `hvac.api.auth_methods.``Kubernetes`(*adapter*)[[source]](_modules/hvac/api/auth_methods/kubernetes.html#Kubernetes)[¶](#hvac.api.auth_methods.Kubernetes "Permalink to this definition")

Bases: `hvac.api.vault\_api\_base.VaultApiBase`

Kubernetes Auth Method (API).

Reference: <https://www.vaultproject.io/api/auth/kubernetes/index.html>

**Methods**

| [`configure`](#hvac.api.auth_methods.Kubernetes.configure "hvac.api.auth_methods.Kubernetes.configure")(kubernetes\_host[, …]) | Configure the connection parameters for Kubernetes. |

| [`create\_role`](#hvac.api.auth_methods.Kubernetes.create_role "hvac.api.auth_methods.Kubernetes.create_role")(name, …[, ttl, max\_ttl, …]) | Create a role in the method. |

| [`delete\_role`](#hvac.api.auth_methods.Kubernetes.delete_role "hvac.api.auth_methods.Kubernetes.delete_role")(name[, mount\_point]) | Delete the previously registered role. |

| [`list\_roles`](#hvac.api.auth_methods.Kubernetes.list_roles "hvac.api.auth_methods.Kubernetes.list_roles")([mount\_point]) | List all the roles that are registered with the plugin. |

| [`login`](#hvac.api.auth_methods.Kubernetes.login "hvac.api.auth_methods.Kubernetes.login")(role, jwt[, use\_token, mount\_point]) | Fetch a token. |

| [`read\_config`](#hvac.api.auth_methods.Kubernetes.read_config "hvac.api.auth_methods.Kubernetes.read_config")([mount\_point]) | Return the previously configured config, including credentials. |

| [`read\_role`](#hvac.api.auth_methods.Kubernetes.read_role "hvac.api.auth_methods.Kubernetes.read_role")(name[, mount\_point]) | Returns the previously registered role configuration. |

`configure`(*kubernetes\_host*, *kubernetes\_ca\_cert=None*, *token\_reviewer\_jwt=None*, *pem\_keys=None*, *issuer=None*, *mount\_point='kubernetes'*)[[source]](_modules/hvac/api/auth_methods/kubernetes.html#Kubernetes.configure)[¶](#hvac.api.auth_methods.Kubernetes.configure "Permalink to this definition")

Configure the connection parameters for Kubernetes.

This path honors the distinction between the create and update capabilities inside ACL policies.

Supported methods:POST: /auth/{mount\_point}/config. Produces: 204 (empty body)

Parameters

* **kubernetes\_host** (*str | unicode*) – Host must be a host string, a host:port pair, or a URL to the base of the

Kubernetes API server. Example: https://k8s.example.com:443

* **kubernetes\_ca\_cert** (*str | unicode*) – PEM encoded CA cert for use by the TLS client used to talk with the Kubernetes API.

NOTE: Every line must end with a newline:

* **token\_reviewer\_jwt** (*str | unicode*) – A service account JWT used to access the TokenReview API to validate other

JWTs during login. If not set the JWT used for login will be used to access the API.

* **pem\_keys** (*list*) – Optional list of PEM-formatted public keys or certificates used to verify the signatures of

Kubernetes service account JWTs. If a certificate is given, its public key will be extracted. Not every

installation of Kubernetes exposes these keys.

* **issuer** – Optional JWT issuer.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the configure\_method request.

Return type

requests.Response

`create_role`(*name*, *bound\_service\_account\_names*, *bound\_service\_account\_namespaces*, *ttl=None*, *max\_ttl=None*, *period=None*, *policies=None*, *token\_type=''*, *mount\_point='kubernetes'*)[[source]](_modules/hvac/api/auth_methods/kubernetes.html#Kubernetes.create_role)[¶](#hvac.api.auth_methods.Kubernetes.create_role "Permalink to this definition")

Create a role in the method.

Registers a role in the auth method. Role types have specific entities that can perform login operations

against this endpoint. Constraints specific to the role type must be set on the role. These are applied to

the authenticated entities attempting to login.

Supported methods:POST: /auth/{mount\_point}/role/{name}. Produces: 204 (empty body)

Parameters

* **name** (*str | unicode*) – Name of the role.

* **bound\_service\_account\_names** (*list | str | unicode*) – List of service account names able to access this role. If set to “\*”

all names are allowed.

* **bound\_service\_account\_namespaces** (*list | str | unicode*) – List of namespaces allowed to access this role. If set to “\*” all

namespaces are allowed.

* **ttl** (*str | unicode*) – The TTL period of tokens issued using this role in seconds.

* **max\_ttl** (*str | unicode*) – The maximum allowed lifetime of tokens issued in seconds using this role.

* **period** (*str | unicode*) – If set, indicates that the token generated using this role should never expire. The token should

be renewed within the duration specified by this value. At each renewal, the token’s TTL will be set to the

value of this parameter.

* **policies** (*list | str | unicode*) – Policies to be set on tokens issued using this role.

* **token\_type** (*str*) – The type of token that should be generated. Can be service, batch, or default to use the

mount’s tuned default (which unless changed will be service tokens). For token store roles, there are two

additional possibilities: default-service and default-batch which specify the type to return unless the

client requests a different type at generation time.

* **mount\_point** (*str | unicode*) – The “path” the azure auth method was mounted on.

Returns

The response of the request.

Return type

requests.Response

`delete_role`(*name*, *mount\_point='kubernetes'*)[[source]](_modules/hvac/api/auth_methods/kubernetes.html#Kubernetes.delete_role)[¶](#hvac.api.auth_methods.Kubernetes.delete_role "Permalink to this definition")

Delete the previously registered role.

Supported methods:DELETE: /auth/{mount\_point}/role/{name}. Produces: 204 (empty body)

Parameters

* **name** (*str | unicode*) – Name of the role.

* **mount\_point** (*str | unicode*) – The “path” the kubernetes auth method was mounted on.

Returns

The response of the request.

Return type

requests.Response

`list_roles`(*mount\_point='kubernetes'*)[[source]](_modules/hvac/api/auth_methods/kubernetes.html#Kubernetes.list_roles)[¶](#hvac.api.auth_methods.Kubernetes.list_roles "Permalink to this definition")

List all the roles that are registered with the plugin.

Supported methods:LIST: /auth/{mount\_point}/role. Produces: 200 application/json

Parameters

**mount\_point** (*str | unicode*) – The “path” the kubernetes auth method was mounted on.

Returns

The “data” key from the JSON response of the request.

Return type

dict

`login`(*role*, *jwt*, *use\_token=True*, *mount\_point='kubernetes'*)[[source]](_modules/hvac/api/auth_methods/kubernetes.html#Kubernetes.login)[¶](#hvac.api.auth_methods.Kubernetes.login "Permalink to this definition")

Fetch a token.

This endpoint takes a signed JSON Web Token (JWT) and a role name for some entity. It verifies the JWT signature

to authenticate that entity and then authorizes the entity for the given role.

Supported methods:POST: /auth/{mount\_point}/login. Produces: 200 application/json

Parameters

* **role** (*str | unicode*) – Name of the role against which the login is being attempted.

* **jwt** (*str | unicode*) – Signed JSON Web Token (JWT) from Azure MSI.

* **use\_token** (*bool*) – if True, uses the token in the response received from the auth request to set the “token”

attribute on the the [`hvac.adapters.Adapter()`](index.html#hvac.adapters.Adapter "hvac.adapters.Adapter") instance under the \_adapater Client attribute.

* **mount\_point** (*str | unicode*) – The “path” the azure auth method was mounted on.

Returns

The JSON response of the request.

Return type

dict

`read_config`(*mount\_point='kubernetes'*)[[source]](_modules/hvac/api/auth_methods/kubernetes.html#Kubernetes.read_config)[¶](#hvac.api.auth_methods.Kubernetes.read_config "Permalink to this definition")

Return the previously configured config, including credentials.

Supported methods:GET: /auth/{mount\_point}/config. Produces: 200 application/json

Parameters

**mount\_point** (*str | unicode*) – The “path” the kubernetes auth method was mounted on.

Returns

The data key from the JSON response of the request.

Return type

dict

`read_role`(*name*, *mount\_point='kubernetes'*)[[source]](_modules/hvac/api/auth_methods/kubernetes.html#Kubernetes.read_role)[¶](#hvac.api.auth_methods.Kubernetes.read_role "Permalink to this definition")

Returns the previously registered role configuration.

Supported methods:POST: /auth/{mount\_point}/role/{name}. Produces: 200 application/json

Parameters

* **name** (*str | unicode*) – Name of the role.

* **mount\_point** (*str | unicode*) – The “path” the kubernetes auth method was mounted on.

Returns

The “data” key from the JSON response of the request.

Return type

dict

*class* `hvac.api.auth_methods.``Ldap`(*adapter*)[[source]](_modules/hvac/api/auth_methods/ldap.html#Ldap)[¶](#hvac.api.auth_methods.Ldap "Permalink to this definition")

Bases: `hvac.api.vault\_api\_base.VaultApiBase`

LDAP Auth Method (API).

Reference: <https://www.vaultproject.io/api/auth/ldap/index.html>

**Methods**

| [`configure`](#hvac.api.auth_methods.Ldap.configure "hvac.api.auth_methods.Ldap.configure")([user\_dn, group\_dn, url, …]) | Configure the LDAP auth method. |

| [`create\_or\_update\_group`](#hvac.api.auth_methods.Ldap.create_or_update_group "hvac.api.auth_methods.Ldap.create_or_update_group")(name[, policies, …]) | Create or update LDAP group policies. |

| [`create\_or\_update\_user`](#hvac.api.auth_methods.Ldap.create_or_update_user "hvac.api.auth_methods.Ldap.create_or_update_user")(username[, policies, …]) | Create or update LDAP users policies and group associations. |

| [`delete\_group`](#hvac.api.auth_methods.Ldap.delete_group "hvac.api.auth_methods.Ldap.delete_group")(name[, mount\_point]) | Delete a LDAP group and policy association. |

| [`delete\_user`](#hvac.api.auth_methods.Ldap.delete_user "hvac.api.auth_methods.Ldap.delete_user")(username[, mount\_point]) | Delete a LDAP user and policy association. |

| [`list\_groups`](#hvac.api.auth_methods.Ldap.list_groups "hvac.api.auth_methods.Ldap.list_groups")([mount\_point]) | List existing LDAP existing groups that have been created in this auth method. |

| [`list\_users`](#hvac.api.auth_methods.Ldap.list_users "hvac.api.auth_methods.Ldap.list_users")([mount\_point]) | List existing users in the method. |

| [`login`](#hvac.api.auth_methods.Ldap.login "hvac.api.auth_methods.Ldap.login")(username, password[, use\_token, …]) | Log in with LDAP credentials. |

| [`read\_configuration`](#hvac.api.auth_methods.Ldap.read_configuration "hvac.api.auth_methods.Ldap.read_configuration")([mount\_point]) | Retrieve the LDAP configuration for the auth method. |

| [`read\_group`](#hvac.api.auth_methods.Ldap.read_group "hvac.api.auth_methods.Ldap.read_group")(name[, mount\_point]) | Read policies associated with a LDAP group. |

| [`read\_user`](#hvac.api.auth_methods.Ldap.read_user "hvac.api.auth_methods.Ldap.read_user")(username[, mount\_point]) | Read policies associated with a LDAP user. |

`configure`(*user\_dn=None*, *group\_dn=None*, *url=None*, *case\_sensitive\_names=None*, *starttls=None*, *tls\_min\_version=None*, *tls\_max\_version=None*, *insecure\_tls=None*, *certificate=None*, *bind\_dn=None*, *bind\_pass=None*, *user\_attr=None*, *discover\_dn=None*, *deny\_null\_bind=True*, *upn\_domain=None*, *group\_filter=None*, *group\_attr=None*, *use\_token\_groups=None*, *token\_ttl=None*, *token\_max\_ttl=None*, *mount\_point='ldap'*)[[source]](_modules/hvac/api/auth_methods/ldap.html#Ldap.configure)[¶](#hvac.api.auth_methods.Ldap.configure "Permalink to this definition")

Configure the LDAP auth method.

Supported methods:POST: /auth/{mount\_point}/config. Produces: 204 (empty body)

Parameters

* **user\_dn** (*str | unicode*) – Base DN under which to perform user search. Example: ou=Users,dc=example,dc=com

* **group\_dn** (*str | unicode*) – LDAP search base to use for group membership search. This can be the root containing either

groups or users. Example: ou=Groups,dc=example,dc=com

* **url** (*str | unicode*) – The LDAP server to connect to. Examples: <ldap://ldap.myorg.com>, ldaps://ldap.myorg.com:636.

Multiple URLs can be specified with commas, e.g. ldap://ldap.myorg.com,ldap://ldap2.myorg.com; these will be

tried in-order.

* **case\_sensitive\_names** (*bool*) – If set, user and group names assigned to policies within the backend will be case

sensitive. Otherwise, names will be normalized to lower case. Case will still be preserved when sending the

username to the LDAP server at login time; this is only for matching local user/group definitions.

* **starttls** (*bool*) – If true, issues a StartTLS command after establishing an unencrypted connection.

* **tls\_min\_version** (*str | unicode*) – Minimum TLS version to use. Accepted values are tls10, tls11 or tls12.

* **tls\_max\_version** (*str | unicode*) – Maximum TLS version to use. Accepted values are tls10, tls11 or tls12.

* **insecure\_tls** (*bool*) – If true, skips LDAP server SSL certificate verification - insecure, use with caution!

* **certificate** (*str | unicode*) – CA certificate to use when verifying LDAP server certificate, must be x509 PEM encoded.

* **bind\_dn** (*str | unicode*) – Distinguished name of object to bind when performing user search. Example:

cn=vault,ou=Users,dc=example,dc=com

* **bind\_pass** (*str | unicode*) – Password to use along with binddn when performing user search.

* **user\_attr** (*str | unicode*) – Attribute on user attribute object matching the username passed when authenticating. Examples:

sAMAccountName, cn, uid

* **discover\_dn** (*bool*) – Use anonymous bind to discover the bind DN of a user.

* **deny\_null\_bind** (*bool*) – This option prevents users from bypassing authentication when providing an empty password.

* **upn\_domain** (*str | unicode*) – The userPrincipalDomain used to construct the UPN string for the authenticating user. The

constructed UPN will appear as [username]@UPNDomain. Example: example.com, which will cause vault to bind as

[username@example.com](mailto:username%40example.com).

* **group\_filter** (*str | unicode*) – Go template used when constructing the group membership query. The template can access the

following context variables: [UserDN, Username]. The default is

(|(memberUid={{.Username}})(member={{.UserDN}})(uniqueMember={{.UserDN}})), which is compatible with several

common directory schemas. To support nested group resolution for Active Directory, instead use the following

query: (&(objectClass=group)(member:1.2.840.113556.1.4.1941:={{.UserDN}})).

* **group\_attr** (*str | unicode*) – LDAP attribute to follow on objects returned by groupfilter in order to enumerate user group

membership. Examples: for groupfilter queries returning group objects, use: cn. For queries returning user

objects, use: memberOf. The default is cn.

* **use\_token\_groups** (*bool*) – If true, groups are resolved through Active Directory tokens. This may speed up nested

group membership resolution in large directories.

* **token\_ttl** (*str | unicode*) – The incremental lifetime for generated tokens.

* **token\_max\_ttl** (*str | unicode*) – The maximum lifetime for generated tokens.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the configure request.

Return type

requests.Response

`create_or_update_group`(*name*, *policies=None*, *mount\_point='ldap'*)[[source]](_modules/hvac/api/auth_methods/ldap.html#Ldap.create_or_update_group)[¶](#hvac.api.auth_methods.Ldap.create_or_update_group "Permalink to this definition")

Create or update LDAP group policies.

Supported methods:POST: /auth/{mount\_point}/groups/{name}. Produces: 204 (empty body)

Parameters

* **name** (*str | unicode*) – The name of the LDAP group

* **policies** (*list*) – List of policies associated with the group. This parameter is transformed to a comma-delimited

string before being passed to Vault.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the create\_or\_update\_group request.

Return type

requests.Response

`create_or_update_user`(*username*, *policies=None*, *groups=None*, *mount\_point='ldap'*)[[source]](_modules/hvac/api/auth_methods/ldap.html#Ldap.create_or_update_user)[¶](#hvac.api.auth_methods.Ldap.create_or_update_user "Permalink to this definition")

Create or update LDAP users policies and group associations.

Supported methods:POST: /auth/{mount\_point}/users/{username}. Produces: 204 (empty body)

Parameters

* **username** (*str | unicode*) – The username of the LDAP user

* **policies** (*str | unicode*) – List of policies associated with the user. This parameter is transformed to a comma-delimited

string before being passed to Vault.

* **groups** (*str | unicode*) – List of groups associated with the user. This parameter is transformed to a comma-delimited

string before being passed to Vault.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the create\_or\_update\_user request.

Return type

requests.Response

`delete_group`(*name*, *mount\_point='ldap'*)[[source]](_modules/hvac/api/auth_methods/ldap.html#Ldap.delete_group)[¶](#hvac.api.auth_methods.Ldap.delete_group "Permalink to this definition")

Delete a LDAP group and policy association.

Supported methods:DELETE: /auth/{mount\_point}/groups/{name}. Produces: 204 (empty body)

Parameters

* **name** (*str | unicode*) – The name of the LDAP group

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the delete\_group request.

Return type

requests.Response

`delete_user`(*username*, *mount\_point='ldap'*)[[source]](_modules/hvac/api/auth_methods/ldap.html#Ldap.delete_user)[¶](#hvac.api.auth_methods.Ldap.delete_user "Permalink to this definition")

Delete a LDAP user and policy association.

Supported methods:DELETE: /auth/{mount\_point}/users/{username}. Produces: 204 (empty body)

Parameters

* **username** (*str | unicode*) – The username of the LDAP user

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the delete\_user request.

Return type

requests.Response

`list_groups`(*mount\_point='ldap'*)[[source]](_modules/hvac/api/auth_methods/ldap.html#Ldap.list_groups)[¶](#hvac.api.auth_methods.Ldap.list_groups "Permalink to this definition")

List existing LDAP existing groups that have been created in this auth method.

Supported methods:LIST: /auth/{mount\_point}/groups. Produces: 200 application/json

Parameters

**mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the list\_groups request.

Return type

dict

`list_users`(*mount\_point='ldap'*)[[source]](_modules/hvac/api/auth_methods/ldap.html#Ldap.list_users)[¶](#hvac.api.auth_methods.Ldap.list_users "Permalink to this definition")

List existing users in the method.

Supported methods:LIST: /auth/{mount\_point}/users. Produces: 200 application/json

Parameters

**mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the list\_users request.

Return type

dict

`login`(*username*, *password*, *use\_token=True*, *mount\_point='ldap'*)[[source]](_modules/hvac/api/auth_methods/ldap.html#Ldap.login)[¶](#hvac.api.auth_methods.Ldap.login "Permalink to this definition")

Log in with LDAP credentials.

Supported methods:POST: /auth/{mount\_point}/login/{username}. Produces: 200 application/json

Parameters

* **username** (*str | unicode*) – The username of the LDAP user

* **password** (*str | unicode*) – The password for the LDAP user

* **use\_token** (*bool*) – if True, uses the token in the response received from the auth request to set the “token”

attribute on the the [`hvac.adapters.Adapter()`](index.html#hvac.adapters.Adapter "hvac.adapters.Adapter") instance under the \_adapater Client attribute.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the login\_with\_user request.

Return type

requests.Response

`read_configuration`(*mount\_point='ldap'*)[[source]](_modules/hvac/api/auth_methods/ldap.html#Ldap.read_configuration)[¶](#hvac.api.auth_methods.Ldap.read_configuration "Permalink to this definition")

Retrieve the LDAP configuration for the auth method.

Supported methods:GET: /auth/{mount\_point}/config. Produces: 200 application/json

Parameters

**mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the read\_configuration request.

Return type

dict

`read_group`(*name*, *mount\_point='ldap'*)[[source]](_modules/hvac/api/auth_methods/ldap.html#Ldap.read_group)[¶](#hvac.api.auth_methods.Ldap.read_group "Permalink to this definition")

Read policies associated with a LDAP group.

Supported methods:GET: /auth/{mount\_point}/groups/{name}. Produces: 200 application/json

Parameters

* **name** (*str | unicode*) – The name of the LDAP group

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the read\_group request.

Return type

dict

`read_user`(*username*, *mount\_point='ldap'*)[[source]](_modules/hvac/api/auth_methods/ldap.html#Ldap.read_user)[¶](#hvac.api.auth_methods.Ldap.read_user "Permalink to this definition")

Read policies associated with a LDAP user.

Supported methods:GET: /auth/{mount\_point}/users/{username}. Produces: 200 application/json

Parameters

* **username** (*str | unicode*) – The username of the LDAP user

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the read\_user request.

Return type

dict

*class* `hvac.api.auth_methods.``Mfa`(*adapter*)[[source]](_modules/hvac/api/auth_methods/mfa.html#Mfa)[¶](#hvac.api.auth_methods.Mfa "Permalink to this definition")

Bases: `hvac.api.vault\_api\_base.VaultApiBase`

Multi-factor authentication Auth Method (API).

Warning

This class’s methods correspond to a legacy / unsupported set of Vault API routes. Please see the reference link

for additional context.

**Methods**

| [`configure`](#hvac.api.auth_methods.Mfa.configure "hvac.api.auth_methods.Mfa.configure")(mount\_point[, mfa\_type, force]) | Configure MFA for a supported method. |

| [`configure\_duo\_access`](#hvac.api.auth_methods.Mfa.configure_duo_access "hvac.api.auth_methods.Mfa.configure_duo_access")(mount\_point, host, …) | Configure the access keys and host for Duo API connections. |

| [`configure\_duo\_behavior`](#hvac.api.auth_methods.Mfa.configure_duo_behavior "hvac.api.auth_methods.Mfa.configure_duo_behavior")(mount\_point[, …]) | Configure Duo second factor behavior. |

| [`read\_configuration`](#hvac.api.auth_methods.Mfa.read_configuration "hvac.api.auth_methods.Mfa.read_configuration")(mount\_point) | Read the MFA configuration. |

| [`read\_duo\_behavior\_configuration`](#hvac.api.auth_methods.Mfa.read_duo_behavior_configuration "hvac.api.auth_methods.Mfa.read_duo_behavior_configuration")(mount\_point) | Read the Duo second factor behavior configuration. |

Reference: <https://www.vaultproject.io/docs/auth/mfa.html>

`configure`(*mount\_point*, *mfa\_type='duo'*, *force=False*)[[source]](_modules/hvac/api/auth_methods/mfa.html#Mfa.configure)[¶](#hvac.api.auth_methods.Mfa.configure "Permalink to this definition")

Configure MFA for a supported method.

This endpoint allows you to turn on multi-factor authentication with a given backend.

Currently only Duo is supported.

Supported methods:POST: /auth/{mount\_point}/mfa\_config. Produces: 204 (empty body)

Parameters

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

* **mfa\_type** (*str | unicode*) – Enables MFA with given backend (available: duo)

* **force** (*bool*) – If True, make the “mfa\_config” request regardless of circumstance. If False (the default), verify

the provided mount\_point is available and one of the types of methods supported by this feature.

Returns

The response of the configure MFA request.

Return type

requests.Response

`configure_duo_access`(*mount\_point*, *host*, *integration\_key*, *secret\_key*)[[source]](_modules/hvac/api/auth_methods/mfa.html#Mfa.configure_duo_access)[¶](#hvac.api.auth_methods.Mfa.configure_duo_access "Permalink to this definition")

Configure the access keys and host for Duo API connections.

To authenticate users with Duo, the backend needs to know what host to connect to and must authenticate with an

integration key and secret key. This endpoint is used to configure that information.

Supported methods:POST: /auth/{mount\_point}/duo/access. Produces: 204 (empty body)

Parameters

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

* **host** (*str | unicode*) – Duo API host

* **integration\_key** (*Duo secret key*) – Duo integration key

* **secret\_key** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the configure\_duo\_access request.

Return type

requests.Response

`configure_duo_behavior`(*mount\_point*, *push\_info=None*, *user\_agent=None*, *username\_format='%s'*)[[source]](_modules/hvac/api/auth_methods/mfa.html#Mfa.configure_duo_behavior)[¶](#hvac.api.auth_methods.Mfa.configure_duo_behavior "Permalink to this definition")

Configure Duo second factor behavior.

This endpoint allows you to configure how the original auth method username maps to the Duo username by

providing a template format string.

Supported methods:POST: /auth/{mount\_point}/duo/config. Produces: 204 (empty body)

Parameters

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

* **push\_info** (*str | unicode*) – A string of URL-encoded key/value pairs that provides additional context about the

authentication attempt in the Duo Mobile app

* **user\_agent** (*str | unicode*) – User agent to connect to Duo (default “”)

* **username\_format** (*str | unicode*) – Format string given auth method username as argument to create Duo username

(default ‘%s’)

Returns

The response of the configure\_duo\_behavior request.

Return type

requests.Response

`read_configuration`(*mount\_point*)[[source]](_modules/hvac/api/auth_methods/mfa.html#Mfa.read_configuration)[¶](#hvac.api.auth_methods.Mfa.read_configuration "Permalink to this definition")

Read the MFA configuration.

Supported methods:GET: /auth/{mount\_point}/mfa\_config. Produces: 200 application/json

Parameters

**mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the read\_configuration request.

Return type

dict

`read_duo_behavior_configuration`(*mount\_point*)[[source]](_modules/hvac/api/auth_methods/mfa.html#Mfa.read_duo_behavior_configuration)[¶](#hvac.api.auth_methods.Mfa.read_duo_behavior_configuration "Permalink to this definition")

Read the Duo second factor behavior configuration.

Supported methods:GET: /auth/{mount\_point}/duo/config. Produces: 200 application/json

Parameters

**mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the read\_duo\_behavior\_configuration request.

Return type

dict

*class* `hvac.api.auth_methods.``OIDC`(*adapter*)[[source]](_modules/hvac/api/auth_methods/oidc.html#OIDC)[¶](#hvac.api.auth_methods.OIDC "Permalink to this definition")

Bases: `hvac.api.auth\_methods.jwt.JWT`

OIDC auth method which can be used to authenticate with Vault using OIDC.

The OIDC method allows authentication via a configured OIDC provider using the user’s web browser.

This method may be initiated from the Vault UI or the command line. Alternatively, a JWT can be provided directly.

The JWT is cryptographically verified using locally-provided keys, or, if configured, an OIDC Discovery service can

be used to fetch the appropriate keys. The choice of method is configured per role.

Note: this class is duplicative of the JWT class (as both JWT and OIDC share the same family of Vault API routes).

Reference: <https://www.vaultproject.io/api/auth/jwt>

**Attributes**

| [`DEFAULT\_PATH`](#hvac.api.auth_methods.OIDC.DEFAULT_PATH "hvac.api.auth_methods.OIDC.DEFAULT_PATH") | str(object=’’) -> str |

**Methods**

| [`create\_role`](#hvac.api.auth_methods.OIDC.create_role "hvac.api.auth_methods.OIDC.create_role")(name, user\_claim, …[, …]) | Register a role in the OIDC method. |

`DEFAULT_PATH` *= 'oidc'*[¶](#hvac.api.auth_methods.OIDC.DEFAULT_PATH "Permalink to this definition")

`create_role`(*name*, *user\_claim*, *allowed\_redirect\_uris*, *role\_type='oidc'*, *bound\_audiences=None*, *clock\_skew\_leeway=None*, *expiration\_leeway=None*, *not\_before\_leeway=None*, *bound\_subject=None*, *bound\_claims=None*, *groups\_claim=None*, *claim\_mappings=None*, *oidc\_scopes=None*, *bound\_claims\_type='string'*, *verbose\_oidc\_logging=False*, *token\_ttl=None*, *token\_max\_ttl=None*, *token\_policies=None*, *token\_bound\_cidrs=None*, *token\_explicit\_max\_ttl=None*, *token\_no\_default\_policy=None*, *token\_num\_uses=None*, *token\_period=None*, *token\_type=None*, *path=None*)[[source]](_modules/hvac/api/auth_methods/oidc.html#OIDC.create_role)[¶](#hvac.api.auth_methods.OIDC.create_role "Permalink to this definition")

Register a role in the OIDC method.

Role types have specific entities that can perform login operations against this endpoint. Constraints

specific to the role type must be set on the role. These are applied to the authenticated entities

attempting to login. At least one of the bound values must be set.

Supported methods:POST: /auth/{path}/role/:name.

Parameters

* **name** (*str | unicode*) – Name of the role.

* **role\_type** (*str | unicode*) – Type of role, either “oidc” or “jwt” (default).

* **bound\_audiences** (*list*) – List of aud claims to match against. Any match is sufficient.

Required for “jwt” roles, optional for “oidc” roles.

* **user\_claim** (*str | unicode*) – The claim to use to uniquely identify the user; this will be used as the name for the

Identity entity alias created due to a successful login. The claim value must be a string.

* **clock\_skew\_leeway** (*int*) – Only applicable with “jwt” roles.

* **expiration\_leeway** (*int*) – Only applicable with “jwt” roles.

* **not\_before\_leeway** (*int*) – Only applicable with “jwt” roles.

* **bound\_subject** (*str | unicode*) – If set, requires that the sub claim matches this value.

* **bound\_claims** (*dict*) – If set, a dict of claims (keys) to match against respective claim values (values).

The expected value may be a single string or a list of strings. The interpretation of the bound claim

values is configured with bound\_claims\_type. Keys support JSON pointer syntax for referencing claims.

* **groups\_claim** (*str | unicode*) – The claim to use to uniquely identify the set of groups to which the user belongs; this

will be used as the names for the Identity group aliases created due to a successful login. The claim value

must be a list of strings. Supports JSON pointer syntax for referencing claims.

* **claim\_mappings** (*map*) – If set, a map of claims (keys) to be copied to specified metadata fields (values). Keys

support JSON pointer syntax for referencing claims.

* **oidc\_scopes** (*list*) – If set, a list of OIDC scopes to be used with an OIDC role.

The standard scope “openid” is automatically included and need not be specified.

* **allowed\_redirect\_uris** (*list*) – The list of allowed values for redirect\_uri

during OIDC logins.

* **bound\_claims\_type** (*str | unicode*) – Configures the interpretation of the bound\_claims values. If “string” (the default),

the values will treated as string literals and must match exactly. If set to “glob”, the values will be

interpreted as globs, with \* matching any number of characters.

* **verbose\_oidc\_logging** (*bool*) – Log received OIDC tokens and claims when debug-level

logging is active. Not recommended in production since sensitive information may be present

in OIDC responses.

* **token\_ttl** (*int | str*) – The incremental lifetime for generated tokens. This current value of this will be referenced

at renewal time.

* **token\_max\_ttl** (*int | str*) – The maximum lifetime for generated tokens. This current value of this will be referenced

at renewal time.

* **token\_policies** (*list**[**str**]*) – List of policies to encode onto generated tokens. Depending on the auth method, this

list may be supplemented by user/group/other values.

* **token\_bound\_cidrs** (*list**[**str**]*) – List of CIDR blocks; if set, specifies blocks of IP addresses which can authenticate

successfully, and ties the resulting token to these blocks as well.

* **token\_explicit\_max\_ttl** (*int | str*) – If set, will encode an explicit max TTL onto the token. This is a hard cap

even if token\_ttl and token\_max\_ttl would otherwise allow a renewal.

* **token\_no\_default\_policy** (*bool*) – If set, the default policy will not be set on generated tokens; otherwise it

will be added to the policies set in token\_policies.

* **token\_num\_uses** (*str | unicode*) – The maximum number of times a generated token may be used (within its lifetime); 0 means

unlimited. If you require the token to have the ability to create child tokens, you will need to set this

value to 0.

* **token\_period** (*int | str*) – The period, if any, to set on the token.

* **token\_type** (*str*) – The type of token that should be generated. Can be service, batch, or default.

* **path** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the create\_role request.

Return type

dict

*class* `hvac.api.auth_methods.``Okta`(*adapter*)[[source]](_modules/hvac/api/auth_methods/okta.html#Okta)[¶](#hvac.api.auth_methods.Okta "Permalink to this definition")

Bases: `hvac.api.vault\_api\_base.VaultApiBase`

Okta Auth Method (API).

Reference: <https://www.vaultproject.io/api/auth/okta/index.html>

**Methods**

| [`configure`](#hvac.api.auth_methods.Okta.configure "hvac.api.auth_methods.Okta.configure")(org\_name[, api\_token, base\_url, …]) | Configure the connection parameters for Okta. |

| [`delete\_group`](#hvac.api.auth_methods.Okta.delete_group "hvac.api.auth_methods.Okta.delete_group")(name[, mount\_point]) | Delete an existing group from the method. |

| [`delete\_user`](#hvac.api.auth_methods.Okta.delete_user "hvac.api.auth_methods.Okta.delete_user")(username[, mount\_point]) | Delete an existing username from the method. |

| [`list\_groups`](#hvac.api.auth_methods.Okta.list_groups "hvac.api.auth_methods.Okta.list_groups")([mount\_point]) | List the groups configured in the Okta method. |

| [`list\_users`](#hvac.api.auth_methods.Okta.list_users "hvac.api.auth_methods.Okta.list_users")([mount\_point]) | List the users configured in the Okta method. |

| [`login`](#hvac.api.auth_methods.Okta.login "hvac.api.auth_methods.Okta.login")(username, password[, use\_token, …]) | Login with the username and password. |

| [`read\_config`](#hvac.api.auth_methods.Okta.read_config "hvac.api.auth_methods.Okta.read_config")([mount\_point]) | Read the Okta configuration. |

| [`read\_group`](#hvac.api.auth_methods.Okta.read_group "hvac.api.auth_methods.Okta.read_group")(name[, mount\_point]) | Read the properties of an existing group. |

| [`read\_user`](#hvac.api.auth_methods.Okta.read_user "hvac.api.auth_methods.Okta.read_user")(username[, mount\_point]) | Read the properties of an existing username. |

| [`register\_group`](#hvac.api.auth_methods.Okta.register_group "hvac.api.auth_methods.Okta.register_group")(name[, policies, mount\_point]) | Register a new group and maps a set of policies to it. |

| [`register\_user`](#hvac.api.auth_methods.Okta.register_user "hvac.api.auth_methods.Okta.register_user")(username[, groups, policies, …]) | Register a new user and maps a set of policies to it. |

`configure`(*org\_name*, *api\_token=None*, *base\_url=None*, *ttl=None*, *max\_ttl=None*, *bypass\_okta\_mfa=None*, *mount\_point='okta'*)[[source]](_modules/hvac/api/auth_methods/okta.html#Okta.configure)[¶](#hvac.api.auth_methods.Okta.configure "Permalink to this definition")

Configure the connection parameters for Okta.

This path honors the distinction between the create and update capabilities inside ACL policies.

Supported methods:POST: /auth/{mount\_point}/config. Produces: 204 (empty body)

Parameters

* **org\_name** (*str | unicode*) – Name of the organization to be used in the Okta API.

* **api\_token** (*str | unicode*) – Okta API token. This is required to query Okta for user group membership. If this is not

supplied only locally configured groups will be enabled.

* **base\_url** (*str | unicode*) – If set, will be used as the base domain for API requests. Examples are okta.com,

oktapreview.com, and okta-emea.com.

* **ttl** (*str | unicode*) – Duration after which authentication will be expired.

* **max\_ttl** (*str | unicode*) – Maximum duration after which authentication will be expired.

* **bypass\_okta\_mfa** (*bool*) – Whether to bypass an Okta MFA request. Useful if using one of Vault’s built-in MFA

mechanisms, but this will also cause certain other statuses to be ignored, such as PASSWORD\_EXPIRED.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the request.

Return type

requests.Response

`delete_group`(*name*, *mount\_point='okta'*)[[source]](_modules/hvac/api/auth_methods/okta.html#Okta.delete_group)[¶](#hvac.api.auth_methods.Okta.delete_group "Permalink to this definition")

Delete an existing group from the method.

Supported methods:DELETE: /auth/{mount\_point}/groups/{name}. Produces: 204 (empty body)

Parameters

* **name** (*str | unicode*) – The name for the group.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the request.

Return type

requests.Response

`delete_user`(*username*, *mount\_point='okta'*)[[source]](_modules/hvac/api/auth_methods/okta.html#Okta.delete_user)[¶](#hvac.api.auth_methods.Okta.delete_user "Permalink to this definition")

Delete an existing username from the method.

Supported methods:DELETE: /auth/{mount\_point}/users/{username}. Produces: 204 (empty body)

Parameters

* **username** (*str | unicode*) – Username for this user.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the request.

Return type

requests.Response

`list_groups`(*mount\_point='okta'*)[[source]](_modules/hvac/api/auth_methods/okta.html#Okta.list_groups)[¶](#hvac.api.auth_methods.Okta.list_groups "Permalink to this definition")

List the groups configured in the Okta method.

Supported methods:LIST: /auth/{mount\_point}/groups. Produces: 200 application/json

Parameters

**mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

`list_users`(*mount\_point='okta'*)[[source]](_modules/hvac/api/auth_methods/okta.html#Okta.list_users)[¶](#hvac.api.auth_methods.Okta.list_users "Permalink to this definition")

List the users configured in the Okta method.

Supported methods:LIST: /auth/{mount\_point}/users. Produces: 200 application/json

Parameters

**mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

`login`(*username*, *password*, *use\_token=True*, *mount\_point='okta'*)[[source]](_modules/hvac/api/auth_methods/okta.html#Okta.login)[¶](#hvac.api.auth_methods.Okta.login "Permalink to this definition")

Login with the username and password.

Supported methods:POST: /auth/{mount\_point}/login/{username}. Produces: 200 application/json

Parameters

* **username** (*str | unicode*) – Username for this user.

* **password** (*str | unicode*) – Password for the authenticating user.

* **use\_token** (*bool*) – if True, uses the token in the response received from the auth request to set the “token”

attribute on the the [`hvac.adapters.Adapter()`](index.html#hvac.adapters.Adapter "hvac.adapters.Adapter") instance under the \_adapater Client attribute.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the login request.

Return type

dict

`read_config`(*mount\_point='okta'*)[[source]](_modules/hvac/api/auth_methods/okta.html#Okta.read_config)[¶](#hvac.api.auth_methods.Okta.read_config "Permalink to this definition")

Read the Okta configuration.

Supported methods:GET: /auth/{mount\_point}/config. Produces: 200 application/json

Parameters

**mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

`read_group`(*name*, *mount\_point='okta'*)[[source]](_modules/hvac/api/auth_methods/okta.html#Okta.read_group)[¶](#hvac.api.auth_methods.Okta.read_group "Permalink to this definition")

Read the properties of an existing group.

Supported methods:GET: /auth/{mount\_point}/groups/{name}. Produces: 200 application/json

Parameters

* **name** (*str | unicode*) – The name for the group.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

`read_user`(*username*, *mount\_point='okta'*)[[source]](_modules/hvac/api/auth_methods/okta.html#Okta.read_user)[¶](#hvac.api.auth_methods.Okta.read_user "Permalink to this definition")

Read the properties of an existing username.

Supported methods:GET: /auth/{mount\_point}/users/{username}. Produces: 200 application/json

Parameters

* **username** (*str | unicode*) – Username for this user.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

`register_group`(*name*, *policies=None*, *mount\_point='okta'*)[[source]](_modules/hvac/api/auth_methods/okta.html#Okta.register_group)[¶](#hvac.api.auth_methods.Okta.register_group "Permalink to this definition")

Register a new group and maps a set of policies to it.

Supported methods:POST: /auth/{mount\_point}/groups/{name}. Produces: 204 (empty body)

Parameters

* **name** (*str | unicode*) – The name of the group.

* **policies** (*list*) – The list or comma-separated string of policies associated with the group.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the request.

Return type

requests.Response

`register_user`(*username*, *groups=None*, *policies=None*, *mount\_point='okta'*)[[source]](_modules/hvac/api/auth_methods/okta.html#Okta.register_user)[¶](#hvac.api.auth_methods.Okta.register_user "Permalink to this definition")

Register a new user and maps a set of policies to it.

Supported methods:POST: /auth/{mount\_point}/users/{username}. Produces: 204 (empty body)

Parameters

* **username** (*str | unicode*) – Name of the user.

* **groups** (*list*) – List or comma-separated string of groups associated with the user.

* **policies** (*list*) – List or comma-separated string of policies associated with the user.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the request.

Return type

requests.Response

*class* `hvac.api.auth_methods.``Radius`(*adapter*)[[source]](_modules/hvac/api/auth_methods/radius.html#Radius)[¶](#hvac.api.auth_methods.Radius "Permalink to this definition")

Bases: `hvac.api.vault\_api\_base.VaultApiBase`

RADIUS Auth Method (API).

Reference: <https://www.vaultproject.io/docs/auth/radius.html>

**Methods**

| [`configure`](#hvac.api.auth_methods.Radius.configure "hvac.api.auth_methods.Radius.configure")(host, secret[, port, …]) | Configure the RADIUS auth method. |

| [`delete\_user`](#hvac.api.auth_methods.Radius.delete_user "hvac.api.auth_methods.Radius.delete_user")(username[, mount\_point]) | Delete a RADIUS user and policy association. |

| [`list\_users`](#hvac.api.auth_methods.Radius.list_users "hvac.api.auth_methods.Radius.list_users")([mount\_point]) | List existing users in the method. |

| [`login`](#hvac.api.auth_methods.Radius.login "hvac.api.auth_methods.Radius.login")(username, password[, use\_token, …]) | Log in with RADIUS credentials. |

| [`read\_configuration`](#hvac.api.auth_methods.Radius.read_configuration "hvac.api.auth_methods.Radius.read_configuration")([mount\_point]) | Retrieve the RADIUS configuration for the auth method. |

| [`read\_user`](#hvac.api.auth_methods.Radius.read_user "hvac.api.auth_methods.Radius.read_user")(username[, mount\_point]) | Read policies associated with a RADIUS user. |

| [`register\_user`](#hvac.api.auth_methods.Radius.register_user "hvac.api.auth_methods.Radius.register_user")(username[, policies, mount\_point]) | Create or update RADIUS user with a set of policies. |

`configure`(*host*, *secret*, *port=None*, *unregistered\_user\_policies=None*, *dial\_timeout=None*, *nas\_port=None*, *mount\_point='radius'*)[[source]](_modules/hvac/api/auth_methods/radius.html#Radius.configure)[¶](#hvac.api.auth_methods.Radius.configure "Permalink to this definition")

Configure the RADIUS auth method.

Supported methods:POST: /auth/{mount\_point}/config. Produces: 204 (empty body)

Parameters

* **host** (*str | unicode*) – The RADIUS server to connect to. Examples: radius.myorg.com, 127.0.0.1

* **secret** (*str | unicode*) – The RADIUS shared secret.

* **port** (*int*) – The UDP port where the RADIUS server is listening on. Defaults is 1812.

* **unregistered\_user\_policies** (*list*) – A comma-separated list of policies to be granted to unregistered users.

* **dial\_timeout** (*int*) – Number of second to wait for a backend connection before timing out. Default is 10.

* **nas\_port** (*int*) – The NAS-Port attribute of the RADIUS request. Defaults is 10.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the configure request.

Return type

requests.Response

`delete_user`(*username*, *mount\_point='radius'*)[[source]](_modules/hvac/api/auth_methods/radius.html#Radius.delete_user)[¶](#hvac.api.auth_methods.Radius.delete_user "Permalink to this definition")

Delete a RADIUS user and policy association.

Supported methods:DELETE: /auth/{mount\_point}/users/{username}. Produces: 204 (empty body)

Parameters

* **username** (*str | unicode*) – The username of the RADIUS user

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the delete\_user request.

Return type

requests.Response

`list_users`(*mount\_point='radius'*)[[source]](_modules/hvac/api/auth_methods/radius.html#Radius.list_users)[¶](#hvac.api.auth_methods.Radius.list_users "Permalink to this definition")

List existing users in the method.

Supported methods:LIST: /auth/{mount\_point}/users. Produces: 200 application/json

Parameters

**mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the list\_users request.

Return type

dict

`login`(*username*, *password*, *use\_token=True*, *mount\_point='radius'*)[[source]](_modules/hvac/api/auth_methods/radius.html#Radius.login)[¶](#hvac.api.auth_methods.Radius.login "Permalink to this definition")

Log in with RADIUS credentials.

Supported methods:POST: /auth/{mount\_point}/login/{username}. Produces: 200 application/json

Parameters

* **username** (*str | unicode*) – The username of the RADIUS user

* **password** (*str | unicode*) – The password for the RADIUS user

* **use\_token** (*bool*) – if True, uses the token in the response received from the auth request to set the “token”

attribute on the the [`hvac.adapters.Adapter()`](index.html#hvac.adapters.Adapter "hvac.adapters.Adapter") instance under the \_adapater Client attribute.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the login\_with\_user request.

Return type

requests.Response

`read_configuration`(*mount\_point='radius'*)[[source]](_modules/hvac/api/auth_methods/radius.html#Radius.read_configuration)[¶](#hvac.api.auth_methods.Radius.read_configuration "Permalink to this definition")

Retrieve the RADIUS configuration for the auth method.

Supported methods:GET: /auth/{mount\_point}/config. Produces: 200 application/json

Parameters

**mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the read\_configuration request.

Return type

dict

`read_user`(*username*, *mount\_point='radius'*)[[source]](_modules/hvac/api/auth_methods/radius.html#Radius.read_user)[¶](#hvac.api.auth_methods.Radius.read_user "Permalink to this definition")

Read policies associated with a RADIUS user.

Supported methods:GET: /auth/{mount\_point}/users/{username}. Produces: 200 application/json

Parameters

* **username** (*str | unicode*) – The username of the RADIUS user

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the read\_user request.

Return type

dict

`register_user`(*username*, *policies=None*, *mount\_point='radius'*)[[source]](_modules/hvac/api/auth_methods/radius.html#Radius.register_user)[¶](#hvac.api.auth_methods.Radius.register_user "Permalink to this definition")

Create or update RADIUS user with a set of policies.

Supported methods:POST: /auth/{mount\_point}/users/{username}. Produces: 204 (empty body)

Parameters

* **username** (*str | unicode*) – Username for this RADIUS user.

* **policies** (*list*) – List of policies associated with the user. This parameter is transformed to a comma-delimited

string before being passed to Vault.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the register\_user request.

Return type

requests.Response

*class* `hvac.api.auth_methods.``Token`(*adapter*)[[source]](_modules/hvac/api/auth_methods/token.html#Token)[¶](#hvac.api.auth_methods.Token "Permalink to this definition")

Bases: `hvac.api.vault\_api\_base.VaultApiBase`

Token Auth Method (API).

Reference: <http://localhost:3000/api-docs/auth/token>

**Methods**

| [`create`](#hvac.api.auth_methods.Token.create "hvac.api.auth_methods.Token.create")([id, role\_name, policies, meta, …]) | Create a new token. |

| [`create\_or\_update\_role`](#hvac.api.auth_methods.Token.create_or_update_role "hvac.api.auth_methods.Token.create_or_update_role")(role\_name[, …]) | Create (or replace) the named role. |

| [`delete\_role`](#hvac.api.auth_methods.Token.delete_role "hvac.api.auth_methods.Token.delete_role")(role\_name[, mount\_point]) | Delete the named token role. |

| [`list\_accessors`](#hvac.api.auth_methods.Token.list_accessors "hvac.api.auth_methods.Token.list_accessors")([mount\_point]) | List token accessors. |

| [`list\_roles`](#hvac.api.auth_methods.Token.list_roles "hvac.api.auth_methods.Token.list_roles")([mount\_point]) | List available token roles. |

| [`lookup`](#hvac.api.auth_methods.Token.lookup "hvac.api.auth_methods.Token.lookup")(token[, mount\_point]) | Retrieve information about the client token. |

| [`lookup\_accessor`](#hvac.api.auth_methods.Token.lookup_accessor "hvac.api.auth_methods.Token.lookup_accessor")(accessor[, mount\_point]) | Retrieve information about the client token from its accessor. |

| [`lookup\_self`](#hvac.api.auth_methods.Token.lookup_self "hvac.api.auth_methods.Token.lookup_self")([mount\_point]) | Retrieve information about the current client token. |

| [`read\_role`](#hvac.api.auth_methods.Token.read_role "hvac.api.auth_methods.Token.read_role")(role\_name[, mount\_point]) | Read the named role configuration. |

| [`renew`](#hvac.api.auth_methods.Token.renew "hvac.api.auth_methods.Token.renew")(token[, increment, wrap\_ttl, mount\_point]) | Renew a lease associated with a token. |

| [`renew\_accessor`](#hvac.api.auth_methods.Token.renew_accessor "hvac.api.auth_methods.Token.renew_accessor")(accessor[, increment, …]) | Renew a lease associated with a token using its accessor. |

| [`renew\_self`](#hvac.api.auth_methods.Token.renew_self "hvac.api.auth_methods.Token.renew_self")([increment, wrap\_ttl, mount\_point]) | Renew a lease associated with the calling token. |

| [`revoke`](#hvac.api.auth_methods.Token.revoke "hvac.api.auth_methods.Token.revoke")(token[, mount\_point]) | Revoke a token and all child tokens. |

| [`revoke\_accessor`](#hvac.api.auth_methods.Token.revoke_accessor "hvac.api.auth_methods.Token.revoke_accessor")(accessor[, mount\_point]) | Revoke the token associated with the accessor and all the child tokens. |

| [`revoke\_and\_orphan\_children`](#hvac.api.auth_methods.Token.revoke_and_orphan_children "hvac.api.auth_methods.Token.revoke_and_orphan_children")(token[, mount\_point]) | Revoke a token but not its child tokens. |

| [`revoke\_self`](#hvac.api.auth_methods.Token.revoke_self "hvac.api.auth_methods.Token.revoke_self")([mount\_point]) | Revoke the token used to call it and all child tokens. |

| [`tidy`](#hvac.api.auth_methods.Token.tidy "hvac.api.auth_methods.Token.tidy")([mount\_point]) | Perform some maintenance tasks to clean up invalid entries that may remain in the token store. |

`create`(*id=None*, *role\_name=None*, *policies=None*, *meta=None*, *no\_parent=False*, *no\_default\_policy=False*, *renewable=True*, *ttl=None*, *type=None*, *explicit\_max\_ttl=None*, *display\_name='token'*, *num\_uses=0*, *period=None*, *entity\_alias=None*, *wrap\_ttl=None*, *mount\_point='token'*)[[source]](_modules/hvac/api/auth_methods/token.html#Token.create)[¶](#hvac.api.auth_methods.Token.create "Permalink to this definition")

Create a new token.

Certain options are only available when called by a root token. If used

via the /auth/token/create-orphan endpoint, a root token is not required

to create an orphan token (otherwise set with the no\_parent option). If

used with a role name in the path, the token will be created against the

specified role name; this may override options set during this call.

Parameters

* **id** (*str*) – The ID of the client token. Can only be specified by a root token.

The ID provided may not contain a . character. Otherwise, the

token ID is a randomly generated value.

* **role\_name** (*str*) – The name of the token role.

* **policies** (*list*) – A list of policies for the token. This must be a

subset of the policies belonging to the token making the request, unless root.

If not specified, defaults to all the policies of the calling token.

* **meta** (*map*) – A map of string to string valued metadata. This is

passed through to the audit devices.

* **no\_parent** (*bool*) – This argument only has effect if used by a root or sudo caller.

When set to True, the token created will not have a parent.

* **no\_default\_policy** (*bool*) – If True the default policy will not be contained in this token’s policy set.

* **renewable** (*bool*) – Set to false to disable the ability of the token to be renewed past its initial TTL.

Setting the value to true will allow the token to be renewable up to the system/mount maximum TTL.

* **ttl** (*str*) – The TTL period of the token, provided as “1h”, where hour is the largest suffix. If not provided,

the token is valid for the default lease TTL, or indefinitely if the root policy is used.

* **type** (*str*) – The token type. Can be “batch” or “service”. Defaults to the type

specified by the role configuration named by role\_name.

* **explicit\_max\_ttl** (*str*) – If set, the token will have an explicit max TTL set upon it.

This maximum token TTL cannot be changed later, and unlike with normal tokens, updates to the system/mount

max TTL value will have no effect at renewal time – the token will never be able to be renewed or used past

the value set at issue time.

* **display\_name** (*str*) – The display name of the token.

* **num\_uses** (*int*) – The maximum uses for the given token. This can be

used to create a one-time-token or limited use token. The value of 0 has no

limit to the number of uses.

* **period** (*str*) – If specified, the token will be periodic; it will have

no maximum TTL (unless an “explicit-max-ttl” is also set) but every renewal

will use the given period. Requires a root token or one with the sudo capability.

* **entity\_alias** (*str*) – Name of the entity alias to associate with during token creation.

Only works in combination with role\_name argument and used entity alias must be listed in

allowed\_entity\_aliases. If this has been specified, the entity will not be inherited from the parent.

* **wrap\_ttl** (*str*) – Specifies response wrapping token creation with duration. IE: ’15s’, ‘20m’, ‘25h’.

* **mount\_point** (*str*) – The “path” the method/backend was mounted on.

Returns

The response of the create request.

Return type

requests.Response

`create_or_update_role`(*role\_name*, *allowed\_policies=None*, *disallowed\_policies=None*, *orphan=False*, *renewable=True*, *path\_suffix=None*, *allowed\_entity\_aliases=None*, *mount\_point='token'*)[[source]](_modules/hvac/api/auth_methods/token.html#Token.create_or_update_role)[¶](#hvac.api.auth_methods.Token.create_or_update_role "Permalink to this definition")

Create (or replace) the named role.

Roles enforce specific behavior when creating tokens that allow token functionality that is otherwise not

available or would require sudo/root privileges to access. Role parameters, when set, override any provided

options to the create endpoints. The role name is also included in the token path, allowing all tokens created

against a role to be revoked using the /sys/leases/revoke-prefix endpoint.

Supported methods:POST: /auth/{mount\_point}/roles/{role\_name}.

Parameters

* **role\_name** (*str*) – The name of the token role.

* **allowed\_policies** (*list*) – will be added to the created

token automatically.

* **disallowed\_policies** (*list*) – being added automatically to created

tokens.

* **orphan** (*bool*) – tokens created against this policy will

be orphan tokens (they will have no parent). As such, they will not be

automatically revoked by the revocation of any other token.

* **renewable** (*bool*) – allow

the token to be renewable up to the system/mount maximum TTL.

* **path\_suffix** (*str*) –

* **allowed\_entity\_aliases** (*str*) – not case sensitive.

* **mount\_point** (*str*) – The “path” the method/backend was mounted on.

Returns

The response of the create\_or\_update\_role request.

Return type

requests.Response

`delete_role`(*role\_name*, *mount\_point='token'*)[[source]](_modules/hvac/api/auth_methods/token.html#Token.delete_role)[¶](#hvac.api.auth_methods.Token.delete_role "Permalink to this definition")

Delete the named token role.

Supported methods:DELETE: /auth/{mount\_point}/roles/{role\_name}.

Parameters

* **role\_name** (*str*) – The name of the token role.

* **mount\_point** (*str*) – The “path” the method/backend was mounted on.

Returns

The response of the delete\_role request.

Return type

requests.Response

`list_accessors`(*mount\_point='token'*)[[source]](_modules/hvac/api/auth_methods/token.html#Token.list_accessors)[¶](#hvac.api.auth_methods.Token.list_accessors "Permalink to this definition")

List token accessors.

This requires sudo capability, and access to it should be tightly controlled

as the accessors can be used to revoke very large numbers of tokens and their associated leases at once.

Supported methods:LIST: /auth/{mount\_point}/accessors.

Parameters

**mount\_point** (*str*) – The “path” the method/backend was mounted on.

Returns

The response of the list\_accessors request.

Return type

requests.Response

`list_roles`(*mount\_point='token'*)[[source]](_modules/hvac/api/auth_methods/token.html#Token.list_roles)[¶](#hvac.api.auth_methods.Token.list_roles "Permalink to this definition")

List available token roles.

Supported methods:LIST: /auth/{mount\_point}/roles.

Parameters

**mount\_point** (*str*) – The “path” the method/backend was mounted on.

Returns

The response of the list\_roles request.

Return type

requests.Response

`lookup`(*token*, *mount\_point='token'*)[[source]](_modules/hvac/api/auth_methods/token.html#Token.lookup)[¶](#hvac.api.auth_methods.Token.lookup "Permalink to this definition")

Retrieve information about the client token.

Supported methods:POST: /auth/{mount\_point}/lookup.

Parameters

* **token** (*str*) – Token to lookup.

* **mount\_point** (*str*) – The “path” the method/backend was mounted on.

Returns

The response of the lookup\_a request.

Return type

requests.Response

`lookup_accessor`(*accessor*, *mount\_point='token'*)[[source]](_modules/hvac/api/auth_methods/token.html#Token.lookup_accessor)[¶](#hvac.api.auth_methods.Token.lookup_accessor "Permalink to this definition")

Retrieve information about the client token from its accessor.

Supported methods:POST: /auth/{mount\_point}/lookup-accessor.

Parameters

* **accessor** (*str*) – Token accessor to lookup.

* **mount\_point** (*str*) – The “path” the method/backend was mounted on.

Returns

The response of the lookup\_accessor request.

Return type

requests.Response

`lookup_self`(*mount\_point='token'*)[[source]](_modules/hvac/api/auth_methods/token.html#Token.lookup_self)[¶](#hvac.api.auth_methods.Token.lookup_self "Permalink to this definition")

Retrieve information about the current client token.

Supported methods:GET: /auth/{mount\_point}/lookup-self.

Parameters

**mount\_point** (*str*) – The “path” the method/backend was mounted on.

Returns

The response of the lookup\_a\_self request.

Return type

requests.Response

`read_role`(*role\_name*, *mount\_point='token'*)[[source]](_modules/hvac/api/auth_methods/token.html#Token.read_role)[¶](#hvac.api.auth_methods.Token.read_role "Permalink to this definition")

Read the named role configuration.

Supported methods:GET: /auth/{mount\_point}/roles/{role\_name}.

Parameters

* **role\_name** (*str*) – The name of the token role.

* **mount\_point** (*str*) – The “path” the method/backend was mounted on.

Returns

The response of the read\_role request.

Return type

requests.Response

`renew`(*token*, *increment=None*, *wrap\_ttl=None*, *mount\_point='token'*)[[source]](_modules/hvac/api/auth_methods/token.html#Token.renew)[¶](#hvac.api.auth_methods.Token.renew "Permalink to this definition")

Renew a lease associated with a token.

This is used to prevent the expiration of a token, and the automatic revocation of it.

Token renewal is possible only if there is a lease associated with it.

Supported methods:POST: /auth/{mount\_point}/renew.

Parameters

* **token** (*str*) – Token to renew. This can be part of the URL or the body.

* **increment** (*str*) – An optional requested lease increment can be provided.

This increment may be ignored.

* **wrap\_ttl** (*str*) – Specifies response wrapping token creation with duration. IE: ’15s’, ‘20m’, ‘25h’.

* **mount\_point** (*str*) – The “path” the method/backend was mounted on.

Returns

The response of the renew\_a request.

Return type

requests.Response

`renew_accessor`(*accessor*, *increment=None*, *wrap\_ttl=None*, *mount\_point='token'*)[[source]](_modules/hvac/api/auth_methods/token.html#Token.renew_accessor)[¶](#hvac.api.auth_methods.Token.renew_accessor "Permalink to this definition")

Renew a lease associated with a token using its accessor.

This is used to prevent the expiration of a token, and the automatic revocation of it.

Token renewal is possible only if there is a lease associated with it.

Supported methods:POST: /auth/{mount\_point}/renew-accessor.

Parameters

* **accessor** (*str*) – Accessor associated with the token to

renew.

* **increment** (*str*) – An optional requested lease increment can be

provided. This increment may be ignored.

* **wrap\_ttl** (*str*) – Specifies response wrapping token creation with duration. IE: ’15s’, ‘20m’, ‘25h’.

* **mount\_point** (*str*) – The “path” the method/backend was mounted on.

Returns

The response of the renew\_a\_accessor request.

Return type

requests.Response

`renew_self`(*increment=None*, *wrap\_ttl=None*, *mount\_point='token'*)[[source]](_modules/hvac/api/auth_methods/token.html#Token.renew_self)[¶](#hvac.api.auth_methods.Token.renew_self "Permalink to this definition")

Renew a lease associated with the calling token.

This is used to prevent the expiration of a token, and the automatic revocation of it.

Token renewal is possible only if there is a lease associated with it.

Supported methods:POST: /auth/{mount\_point}/renew-self.

Parameters

* **increment** (*str*) – An optional requested lease increment can be

provided. This increment may be ignored.

* **wrap\_ttl** (*str*) – Specifies response wrapping token creation with duration. IE: ’15s’, ‘20m’, ‘25h’.

* **mount\_point** (*str*) – The “path” the method/backend was mounted on.

Returns

The response of the renew\_a\_self request.

Return type

requests.Response

`revoke`(*token*, *mount\_point='token'*)[[source]](_modules/hvac/api/auth_methods/token.html#Token.revoke)[¶](#hvac.api.auth_methods.Token.revoke "Permalink to this definition")

Revoke a token and all child tokens.

When the token is revoked, all dynamic secrets generated with it are also revoked.

Supported methods:POST: /auth/{mount\_point}/revoke.

Parameters

* **token** (*str*) – Token to revoke.

* **mount\_point** (*str*) – The “path” the method/backend was mounted on.

Returns

The response of the revoke\_a request.

Return type

requests.Response

`revoke_accessor`(*accessor*, *mount\_point='token'*)[[source]](_modules/hvac/api/auth_methods/token.html#Token.revoke_accessor)[¶](#hvac.api.auth_methods.Token.revoke_accessor "Permalink to this definition")

Revoke the token associated with the accessor and all the child tokens.

This is meant for purposes where there is no access to token ID but there is need to

revoke a token and its children.

Supported methods:POST: /auth/{mount\_point}/revoke-accessor.

Parameters

* **accessor** (*str*) – Accessor of the token.

* **mount\_point** (*str*) – The “path” the method/backend was mounted on.

Returns

The response of the revoke\_a\_accessor request.

Return type

requests.Response

`revoke_and_orphan_children`(*token*, *mount\_point='token'*)[[source]](_modules/hvac/api/auth_methods/token.html#Token.revoke_and_orphan_children)[¶](#hvac.api.auth_methods.Token.revoke_and_orphan_children "Permalink to this definition")

Revoke a token but not its child tokens.

When the token is revoked, all secrets generated with it are also revoked.

All child tokens are orphaned, but can be revoked sub-sequently using /auth/token/revoke/.

This is a root-protected endpoint.

Supported methods:POST: /auth/{mount\_point}/revoke-orphan.

Parameters

* **token** (*str*) – Token to revoke.

* **mount\_point** (*str*) – The “path” the method/backend was mounted on.

Returns

The response of the revoke\_and\_orphan\_children request.

Return type

requests.Response

`revoke_self`(*mount\_point='token'*)[[source]](_modules/hvac/api/auth_methods/token.html#Token.revoke_self)[¶](#hvac.api.auth_methods.Token.revoke_self "Permalink to this definition")

Revoke the token used to call it and all child tokens.

When the token is revoked, all dynamic secrets generated with it are also revoked.

Supported methods:POST: /auth/{mount\_point}/revoke-self.

Parameters

**mount\_point** (*str*) – The “path” the method/backend was mounted on.

Returns

The response of the revoke\_a\_self request.

Return type

requests.Response

`tidy`(*mount\_point='token'*)[[source]](_modules/hvac/api/auth_methods/token.html#Token.tidy)[¶](#hvac.api.auth_methods.Token.tidy "Permalink to this definition")

Perform some maintenance tasks to clean up invalid entries that may remain in the token store.

On Enterprise, Tidy will only impact the tokens in the specified namespace, or the root namespace if unspecified.

Supported methods:POST: /auth/{mount\_point}/tidy.

Parameters

**mount\_point** (*str*) – The “path” the method/backend was mounted on.

Returns

The response of the tidy\_s request.

Return type

requests.Response

*class* `hvac.api.auth_methods.``Userpass`(*adapter*)[[source]](_modules/hvac/api/auth_methods/userpass.html#Userpass)[¶](#hvac.api.auth_methods.Userpass "Permalink to this definition")

Bases: `hvac.api.vault\_api\_base.VaultApiBase`

USERPASS Auth Method (API).

Reference: <https://www.vaultproject.io/api/auth/userpass/index.html>

**Methods**

| [`create\_or\_update\_user`](#hvac.api.auth_methods.Userpass.create_or_update_user "hvac.api.auth_methods.Userpass.create_or_update_user")(username[, password, …]) | Create/update user in userpass. |

| [`delete\_user`](#hvac.api.auth_methods.Userpass.delete_user "hvac.api.auth_methods.Userpass.delete_user")(username[, mount\_point]) | Delete user in the auth method. |

| [`list\_user`](#hvac.api.auth_methods.Userpass.list_user "hvac.api.auth_methods.Userpass.list_user")([mount\_point]) | List existing users that have been created in the auth method |

| [`login`](#hvac.api.auth_methods.Userpass.login "hvac.api.auth_methods.Userpass.login")(username, password[, use\_token, …]) | Log in with USERPASS credentials. |

| [`read\_user`](#hvac.api.auth_methods.Userpass.read_user "hvac.api.auth_methods.Userpass.read_user")(username[, mount\_point]) | Read user in the auth method. |

| [`update\_password\_on\_user`](#hvac.api.auth_methods.Userpass.update_password_on_user "hvac.api.auth_methods.Userpass.update_password_on_user")(username, password) | update password for the user in userpass. |

`create_or_update_user`(*username*, *password=None*, *policies=None*, *mount\_point='userpass'*, *\*\*kwargs*)[[source]](_modules/hvac/api/auth_methods/userpass.html#Userpass.create_or_update_user)[¶](#hvac.api.auth_methods.Userpass.create_or_update_user "Permalink to this definition")

Create/update user in userpass.

Supported methods:POST: /auth/{mount\_point}/users/{username}. Produces: 204 (empty body)

Parameters

* **username** (*str | unicode*) – The username for the user.

* **password** (*str | unicode*) – The password for the user. Only required when creating the user.

* **policies** (*str | unicode*) – The list of policies to be set on username created.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

* **kwargs** (*dict*) – Additional arguments to pass along with the corresponding request to Vault.

`delete_user`(*username*, *mount\_point='userpass'*)[[source]](_modules/hvac/api/auth_methods/userpass.html#Userpass.delete_user)[¶](#hvac.api.auth_methods.Userpass.delete_user "Permalink to this definition")

Delete user in the auth method.

Supported methods:GET: /auth/{mount\_point}/users/{username}. Produces: 200 application/json

Parameters

* **username** – The username for the user.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the read\_group request.

Return type

dict

`list_user`(*mount\_point='userpass'*)[[source]](_modules/hvac/api/auth_methods/userpass.html#Userpass.list_user)[¶](#hvac.api.auth_methods.Userpass.list_user "Permalink to this definition")

List existing users that have been created in the auth method

Supported methods:LIST: /auth/{mount\_point}/users. Produces: 200 application/json

Parameters

**mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the list\_groups request.

Return type

dict

`login`(*username*, *password*, *use\_token=True*, *mount\_point='userpass'*)[[source]](_modules/hvac/api/auth_methods/userpass.html#Userpass.login)[¶](#hvac.api.auth_methods.Userpass.login "Permalink to this definition")

Log in with USERPASS credentials.

Supported methods:POST: /auth/{mount\_point}/login/{username}. Produces: 200 application/json

Parameters

* **username** (*str | unicode*) – The username for the user.

* **password** (*str | unicode*) – The password for the user. Only required when creating the user.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

`read_user`(*username*, *mount\_point='userpass'*)[[source]](_modules/hvac/api/auth_methods/userpass.html#Userpass.read_user)[¶](#hvac.api.auth_methods.Userpass.read_user "Permalink to this definition")

Read user in the auth method.

Supported methods:GET: /auth/{mount\_point}/users/{username}. Produces: 200 application/json

Parameters

* **username** – The username for the user.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the read\_group request.

Return type

dict

`update_password_on_user`(*username*, *password*, *mount\_point='userpass'*)[[source]](_modules/hvac/api/auth_methods/userpass.html#Userpass.update_password_on_user)[¶](#hvac.api.auth_methods.Userpass.update_password_on_user "Permalink to this definition")

update password for the user in userpass.

Supported methods:POST: /auth/{mount\_point}/users/{username}/password. Produces: 204 (empty body)

Parameters

* **username** (*str | unicode*) – The username for the user.

* **password** (*str | unicode*) – The password for the user. Only required when creating the user.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

### hvac.api.secrets\_engines[¶](#module-hvac.api.secrets_engines "Permalink to this headline")

Vault secrets engines endpoints

**Classes**

| [`Aws`](#hvac.api.secrets_engines.Aws "hvac.api.secrets_engines.Aws")(adapter) | AWS Secrets Engine (API). |

| [`Azure`](#hvac.api.secrets_engines.Azure "hvac.api.secrets_engines.Azure")(adapter) | Azure Secrets Engine (API). |

| [`Gcp`](#hvac.api.secrets_engines.Gcp "hvac.api.secrets_engines.Gcp")(adapter) | Google Cloud Secrets Engine (API). |

| [`ActiveDirectory`](#hvac.api.secrets_engines.ActiveDirectory "hvac.api.secrets_engines.ActiveDirectory")(adapter) | Active Directory Secrets Engine (API). |

| [`Identity`](#hvac.api.secrets_engines.Identity "hvac.api.secrets_engines.Identity")(adapter) | Identity Secrets Engine (API). |

| [`Kv`](#hvac.api.secrets_engines.Kv "hvac.api.secrets_engines.Kv")(adapter[, default\_kv\_version]) | Class containing methods for the key/value secrets\_engines backend API routes. |

| [`KvV1`](#hvac.api.secrets_engines.KvV1 "hvac.api.secrets_engines.KvV1")(adapter) | KV Secrets Engine - Version 1 (API). |

| [`KvV2`](#hvac.api.secrets_engines.KvV2 "hvac.api.secrets_engines.KvV2")(adapter) | KV Secrets Engine - Version 2 (API). |

| [`Pki`](#hvac.api.secrets_engines.Pki "hvac.api.secrets_engines.Pki")(adapter) | Pki Secrets Engine (API). |

| [`Transform`](#hvac.api.secrets_engines.Transform "hvac.api.secrets_engines.Transform")(adapter) | Transform Secrets Engine (API). |

| [`Transit`](#hvac.api.secrets_engines.Transit "hvac.api.secrets_engines.Transit")(adapter) | Transit Secrets Engine (API). |

| [`SecretsEngines`](#hvac.api.secrets_engines.SecretsEngines "hvac.api.secrets_engines.SecretsEngines")(adapter) | Secrets Engines. |

| [`Database`](#hvac.api.secrets_engines.Database "hvac.api.secrets_engines.Database")(adapter) | Database Secrets Engine (API). |

| [`RabbitMQ`](#hvac.api.secrets_engines.RabbitMQ "hvac.api.secrets_engines.RabbitMQ")(adapter) | RabbitMQ Secrets Engine (API). |

*class* `hvac.api.secrets_engines.``ActiveDirectory`(*adapter*)[[source]](_modules/hvac/api/secrets_engines/active_directory.html#ActiveDirectory)[¶](#hvac.api.secrets_engines.ActiveDirectory "Permalink to this definition")

Bases: `hvac.api.vault\_api\_base.VaultApiBase`

Active Directory Secrets Engine (API).

Reference: <https://www.vaultproject.io/api/secret/ad/index.html>

**Methods**

| [`configure`](#hvac.api.secrets_engines.ActiveDirectory.configure "hvac.api.secrets_engines.ActiveDirectory.configure")([binddn, bindpass, url, userdn, …]) | Configure shared information for the ad secrets engine. |

| [`create\_or\_update\_role`](#hvac.api.secrets_engines.ActiveDirectory.create_or_update_role "hvac.api.secrets_engines.ActiveDirectory.create_or_update_role")(name[, …]) | This endpoint creates or updates the ad role definition. |

| [`delete\_role`](#hvac.api.secrets_engines.ActiveDirectory.delete_role "hvac.api.secrets_engines.ActiveDirectory.delete_role")(name[, mount\_point]) | This endpoint deletes a ad role with the given name. |

| [`generate\_credentials`](#hvac.api.secrets_engines.ActiveDirectory.generate_credentials "hvac.api.secrets_engines.ActiveDirectory.generate_credentials")(name[, mount\_point]) | This endpoint retrieves the previous and current LDAP password for |

| [`list\_roles`](#hvac.api.secrets_engines.ActiveDirectory.list_roles "hvac.api.secrets_engines.ActiveDirectory.list_roles")([mount\_point]) | This endpoint lists all existing roles in the secrets engine. |

| [`read\_config`](#hvac.api.secrets_engines.ActiveDirectory.read_config "hvac.api.secrets_engines.ActiveDirectory.read_config")([mount\_point]) | Read the configured shared information for the ad secrets engine. |

| [`read\_role`](#hvac.api.secrets_engines.ActiveDirectory.read_role "hvac.api.secrets_engines.ActiveDirectory.read_role")(name[, mount\_point]) | This endpoint queries for information about a ad role with the given name. |

`configure`(*binddn=None*, *bindpass=None*, *url=None*, *userdn=None*, *upndomain=None*, *ttl=None*, *max\_ttl=None*, *mount\_point='ad'*, *\*args*, *\*\*kwargs*)[[source]](_modules/hvac/api/secrets_engines/active_directory.html#ActiveDirectory.configure)[¶](#hvac.api.secrets_engines.ActiveDirectory.configure "Permalink to this definition")

Configure shared information for the ad secrets engine.

Supported methods:POST: /{mount\_point}/config. Produces: 204 (empty body)

Parameters

* **binddn** (*str | unicode*) – Distinguished name of object to bind when performing user and group search.

* **bindpass** (*str | unicode*) – Password to use along with binddn when performing user search.

* **url** (*str | unicode*) – Base DN under which to perform user search.

* **userdn** (*str | unicode*) – Base DN under which to perform user search.

* **upndomain** (*str | unicode*) – userPrincipalDomain used to construct the UPN string for the authenticating user.

* **ttl** (*int | str*) – – The default password time-to-live in seconds. Once the ttl has passed, a password will be rotated the next time it’s requested.

* **max\_ttl** (*int | str*) – The maximum password time-to-live in seconds. No role will be allowed to set a custom ttl greater than the max\_ttl

integer number of seconds or Go duration format string.\*\*

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the request.

Return type

requests.Response

`create_or_update_role`(*name*, *service\_account\_name=None*, *ttl=None*, *mount\_point='ad'*)[[source]](_modules/hvac/api/secrets_engines/active_directory.html#ActiveDirectory.create_or_update_role)[¶](#hvac.api.secrets_engines.ActiveDirectory.create_or_update_role "Permalink to this definition")

This endpoint creates or updates the ad role definition.

Parameters

* **name** (*str | unicode*) – Specifies the name of an existing role against which to create this ad credential.

* **service\_account\_name** (*str | unicode*) – The name of a pre-existing service account in Active Directory that maps to this role.

This value is required on create and optional on update.

* **ttl** (*str | unicode*) – Specifies the TTL for this role.

This is provided as a string duration with a time suffix like “30s” or “1h” or as seconds.

If not provided, the default Vault TTL is used.

* **mount\_point** (*str | unicode*) – Specifies the place where the secrets engine will be accessible (default: ad).

Returns

The response of the request.

Return type

requests.Response

`delete_role`(*name*, *mount\_point='ad'*)[[source]](_modules/hvac/api/secrets_engines/active_directory.html#ActiveDirectory.delete_role)[¶](#hvac.api.secrets_engines.ActiveDirectory.delete_role "Permalink to this definition")

This endpoint deletes a ad role with the given name.

Even if the role does not exist, this endpoint will still return a successful response.

:param name: Specifies the name of the role to delete.

:type name: str | unicode

:param mount\_point: Specifies the place where the secrets engine will be accessible (default: ad).

:type mount\_point: str | unicode

:return: The response of the request.

:rtype: requests.Response

`generate_credentials`(*name*, *mount\_point='ad'*)[[source]](_modules/hvac/api/secrets_engines/active_directory.html#ActiveDirectory.generate_credentials)[¶](#hvac.api.secrets_engines.ActiveDirectory.generate_credentials "Permalink to this definition")

This endpoint retrieves the previous and current LDAP password forthe associated account (or rotate if required)

Parameters

* **name** (*str | unicode*) – Specifies the name of the role to request credentials from.

* **mount\_point** (*str | unicode*) – Specifies the place where the secrets engine will be accessible (default: ad).

Returns

The response of the request.

Return type

requests.Response

`list_roles`(*mount\_point='ad'*)[[source]](_modules/hvac/api/secrets_engines/active_directory.html#ActiveDirectory.list_roles)[¶](#hvac.api.secrets_engines.ActiveDirectory.list_roles "Permalink to this definition")

This endpoint lists all existing roles in the secrets engine.

:return: The response of the request.

:rtype: requests.Response

`read_config`(*mount\_point='ad'*)[[source]](_modules/hvac/api/secrets_engines/active_directory.html#ActiveDirectory.read_config)[¶](#hvac.api.secrets_engines.ActiveDirectory.read_config "Permalink to this definition")

Read the configured shared information for the ad secrets engine.

Credentials will be omitted from returned data.

Supported methods:GET: /{mount\_point}/config. Produces: 200 application/json

Parameters

**mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

`read_role`(*name*, *mount\_point='ad'*)[[source]](_modules/hvac/api/secrets_engines/active_directory.html#ActiveDirectory.read_role)[¶](#hvac.api.secrets_engines.ActiveDirectory.read_role "Permalink to this definition")

This endpoint queries for information about a ad role with the given name.

If no role exists with that name, a 404 is returned.

:param name: Specifies the name of the role to query.

:type name: str | unicode

:param mount\_point: Specifies the place where the secrets engine will be accessible (default: ad).

:type mount\_point: str | unicode

:return: The response of the request.

:rtype: requests.Response

*class* `hvac.api.secrets_engines.``Aws`(*adapter*)[[source]](_modules/hvac/api/secrets_engines/aws.html#Aws)[¶](#hvac.api.secrets_engines.Aws "Permalink to this definition")

Bases: `hvac.api.vault\_api\_base.VaultApiBase`

AWS Secrets Engine (API).

Reference: <https://www.vaultproject.io/api/secret/aws/index.html>

**Methods**

| [`configure\_lease`](#hvac.api.secrets_engines.Aws.configure_lease "hvac.api.secrets_engines.Aws.configure_lease")(lease, lease\_max[, mount\_point]) | Configure lease settings for the AWS secrets engine. |

| [`configure\_root\_iam\_credentials`](#hvac.api.secrets_engines.Aws.configure_root_iam_credentials "hvac.api.secrets_engines.Aws.configure_root_iam_credentials")(access\_key, …) | Configure the root IAM credentials to communicate with AWS. |

| [`create\_or\_update\_role`](#hvac.api.secrets_engines.Aws.create_or_update_role "hvac.api.secrets_engines.Aws.create_or_update_role")(name, credential\_type) | Create or update the role with the given name. |

| [`delete\_role`](#hvac.api.secrets_engines.Aws.delete_role "hvac.api.secrets_engines.Aws.delete_role")(name[, mount\_point]) | Delete an existing role by the given name. |

| [`generate\_credentials`](#hvac.api.secrets_engines.Aws.generate_credentials "hvac.api.secrets_engines.Aws.generate_credentials")(name[, role\_arn, ttl, …]) | Generates credential based on the named role. |

| [`list\_roles`](#hvac.api.secrets_engines.Aws.list_roles "hvac.api.secrets_engines.Aws.list_roles")([mount\_point]) | List all existing roles in the secrets engine. |

| [`read\_lease\_config`](#hvac.api.secrets_engines.Aws.read_lease_config "hvac.api.secrets_engines.Aws.read_lease_config")([mount\_point]) | Read the current lease settings for the AWS secrets engine. |

| [`read\_role`](#hvac.api.secrets_engines.Aws.read_role "hvac.api.secrets_engines.Aws.read_role")(name[, mount\_point]) | Query an existing role by the given name. |

| [`rotate\_root\_iam\_credentials`](#hvac.api.secrets_engines.Aws.rotate_root_iam_credentials "hvac.api.secrets_engines.Aws.rotate_root_iam_credentials")([mount\_point]) | Rotate static root IAM credentials. |

`configure_lease`(*lease*, *lease\_max*, *mount\_point='aws'*)[[source]](_modules/hvac/api/secrets_engines/aws.html#Aws.configure_lease)[¶](#hvac.api.secrets_engines.Aws.configure_lease "Permalink to this definition")

Configure lease settings for the AWS secrets engine.

It is optional, as there are default values for lease and lease\_max.

Supported methods:POST: /{mount\_point}/config/lease. Produces: 204 (empty body)

Parameters

* **lease** (*str | unicode*) – Specifies the lease value provided as a string duration with time suffix. “h” (hour) is the

largest suffix.

* **lease\_max** (*str | unicode*) – Specifies the maximum lease value provided as a string duration with time suffix. “h” (hour)

is the largest suffix.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the request.

Return type

requests.Response

`configure_root_iam_credentials`(*access\_key*, *secret\_key*, *region=None*, *iam\_endpoint=None*, *sts\_endpoint=None*, *max\_retries=None*, *mount\_point='aws'*)[[source]](_modules/hvac/api/secrets_engines/aws.html#Aws.configure_root_iam_credentials)[¶](#hvac.api.secrets_engines.Aws.configure_root_iam_credentials "Permalink to this definition")

Configure the root IAM credentials to communicate with AWS.

There are multiple ways to pass root IAM credentials to the Vault server, specified below with the highest

precedence first. If credentials already exist, this will overwrite them.

The official AWS SDK is used for sourcing credentials from env vars, shared files, or IAM/ECS instances.

> 

> * Static credentials provided to the API as a payload

> * Credentials in the AWS\_ACCESS\_KEY, AWS\_SECRET\_KEY, and AWS\_REGION environment variables on the server

> * Shared credentials files

> * Assigned IAM role or ECS task role credentials

> 

> 

> 

At present, this endpoint does not confirm that the provided AWS credentials are valid AWS credentials with

proper permissions.

Supported methods:POST: /{mount\_point}/config/root. Produces: 204 (empty body)

Parameters

* **access\_key** (*str | unicode*) – Specifies the AWS access key ID.

* **secret\_key** (*str | unicode*) – Specifies the AWS secret access key.

* **region** (*str | unicode*) – Specifies the AWS region. If not set it will use the AWS\_REGION env var, AWS\_DEFAULT\_REGION env

var, or us-east-1 in that order.

* **iam\_endpoint** (*str | unicode*) – Specifies a custom HTTP IAM endpoint to use.

* **sts\_endpoint** (*str | unicode*) – Specifies a custom HTTP STS endpoint to use.

* **max\_retries** (*int*) – Number of max retries the client should use for recoverable errors. The default (-1) falls

back to the AWS SDK’s default behavior.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the request.

Return type

requests.Response

`create_or_update_role`(*name*, *credential\_type*, *policy\_document=None*, *default\_sts\_ttl=None*, *max\_sts\_ttl=None*, *role\_arns=None*, *policy\_arns=None*, *legacy\_params=False*, *iam\_tags=None*, *mount\_point='aws'*)[[source]](_modules/hvac/api/secrets_engines/aws.html#Aws.create_or_update_role)[¶](#hvac.api.secrets_engines.Aws.create_or_update_role "Permalink to this definition")

Create or update the role with the given name.

If a role with the name does not exist, it will be created. If the role exists, it will be updated with the new

attributes.

Supported methods:POST: /{mount\_point}/roles/{name}. Produces: 204 (empty body)

Parameters

* **name** (*str | unicode*) – Specifies the name of the role to create. This is part of the request URL.

* **credential\_type** (*str | unicode*) – Specifies the type of credential to be used when retrieving credentials from the role.

Must be one of iam\_user, assumed\_role, or federation\_token.

* **policy\_document** (*dict | str | unicode*) – The IAM policy document for the role. The behavior depends on the credential type. With

iam\_user, the policy document will be attached to the IAM user generated and augment the permissions the IAM

user has. With assumed\_role and federation\_token, the policy document will act as a filter on what the

credentials can do.

* **default\_sts\_ttl** (*str | unicode*) – The default TTL for STS credentials. When a TTL is not specified when STS credentials

are requested, and a default TTL is specified on the role, then this default TTL will be used. Valid only

when credential\_type is one of assumed\_role or federation\_token.

* **max\_sts\_ttl** (*str | unicode*) – The max allowed TTL for STS credentials (credentials TTL are capped to max\_sts\_ttl). Valid

only when credential\_type is one of assumed\_role or federation\_token.

* **role\_arns** (*list | str | unicode*) – Specifies the ARNs of the AWS roles this Vault role is allowed to assume. Required when

credential\_type is assumed\_role and prohibited otherwise. This is a comma-separated string or JSON array.

String types supported for Vault legacy parameters.

* **policy\_arns** (*list*) – Specifies the ARNs of the AWS managed policies to be attached to IAM users when they are

requested. Valid only when credential\_type is iam\_user. When credential\_type is iam\_user, at least one of

policy\_arns or policy\_document must be specified. This is a comma-separated string or JSON array.

* **legacy\_params** (*bool*) – Flag to send legacy (Vault versions < 0.11.0) parameters in the request. When this is set

to True, policy\_document and policy\_arns are the only parameters used from this method.

* **iam\_tags** (*list*) – A list of strings representing a key/value pair to be used for any IAM user that is created by

this role. Format is a key and value separated by an =.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the request.

Return type

requests.Response

`delete_role`(*name*, *mount\_point='aws'*)[[source]](_modules/hvac/api/secrets_engines/aws.html#Aws.delete_role)[¶](#hvac.api.secrets_engines.Aws.delete_role "Permalink to this definition")

Delete an existing role by the given name.

If the role does not exist, a 404 is returned.

Supported methods:DELETE: /{mount\_point}/roles/{name}. Produces: 204 (empty body)

Parameters

* **name** (*str | unicode*) – the name of the role to delete. This

is part of the request URL.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the request.

Return type

requests.Response

`generate_credentials`(*name*, *role\_arn=None*, *ttl=None*, *endpoint='creds'*, *mount\_point='aws'*)[[source]](_modules/hvac/api/secrets_engines/aws.html#Aws.generate_credentials)[¶](#hvac.api.secrets_engines.Aws.generate_credentials "Permalink to this definition")

Generates credential based on the named role.

This role must be created before queried.

The /aws/creds and /aws/sts endpoints are almost identical. The exception is when retrieving credentials for a

role that was specified with the legacy arn or policy parameter. In this case, credentials retrieved through

/aws/sts must be of either the assumed\_role or federation\_token types, and credentials retrieved through

/aws/creds must be of the iam\_user type.

Parameters

* **name** (*str | unicode*) – Specifies the name of the role to generate credentials against. This is part of the request URL.

* **role\_arn** (*str | unicode*) – The ARN of the role to assume if credential\_type on the Vault role is assumed\_role. Must match

one of the allowed role ARNs in the Vault role. Optional if the Vault role only allows a single AWS role

ARN; required otherwise.

* **ttl** (*str | unicode*) – Specifies the TTL for the use of the STS token. This is specified as a string with a duration

suffix. Valid only when credential\_type is assumed\_role or federation\_token. When not specified, the default

sts\_ttl set for the role will be used. If that is also not set, then the default value of 3600s will be

used. AWS places limits on the maximum TTL allowed. See the AWS documentation on the DurationSeconds

parameter for AssumeRole (for assumed\_role credential types) and GetFederationToken (for federation\_token

credential types) for more details.

* **endpoint** (*str | unicode*) – Supported endpoints:

GET: /{mount\_point}/creds/{name}. Produces: 200 application/json

PUT: /{mount\_point}/sts/{name}. Produces: 200 application/json

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

`list_roles`(*mount\_point='aws'*)[[source]](_modules/hvac/api/secrets_engines/aws.html#Aws.list_roles)[¶](#hvac.api.secrets_engines.Aws.list_roles "Permalink to this definition")

List all existing roles in the secrets engine.

Supported methods:LIST: /{mount\_point}/roles. Produces: 200 application/json

Parameters

**mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

`read_lease_config`(*mount\_point='aws'*)[[source]](_modules/hvac/api/secrets_engines/aws.html#Aws.read_lease_config)[¶](#hvac.api.secrets_engines.Aws.read_lease_config "Permalink to this definition")

Read the current lease settings for the AWS secrets engine.

Supported methods:GET: /{mount\_point}/config/lease. Produces: 200 application/json

Parameters

**mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

`read_role`(*name*, *mount\_point='aws'*)[[source]](_modules/hvac/api/secrets_engines/aws.html#Aws.read_role)[¶](#hvac.api.secrets_engines.Aws.read_role "Permalink to this definition")

Query an existing role by the given name.

If the role does not exist, a 404 is returned.

Supported methods:GET: /{mount\_point}/roles/{name}. Produces: 200 application/json

Parameters

* **name** (*str | unicode*) – Specifies the name of the role to read. This is part of the request URL.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

`rotate_root_iam_credentials`(*mount\_point='aws'*)[[source]](_modules/hvac/api/secrets_engines/aws.html#Aws.rotate_root_iam_credentials)[¶](#hvac.api.secrets_engines.Aws.rotate_root_iam_credentials "Permalink to this definition")

Rotate static root IAM credentials.

When you have configured Vault with static credentials, you can use this endpoint to have Vault rotate the

access key it used. Note that, due to AWS eventual consistency, after calling this endpoint, subsequent calls

from Vault to AWS may fail for a few seconds until AWS becomes consistent again.

In order to call this endpoint, Vault’s AWS access key MUST be the only access key on the IAM user; otherwise,

generation of a new access key will fail. Once this method is called, Vault will now be the only entity that

knows the AWS secret key is used to access AWS.

Supported methods:POST: /{mount\_point}/config/rotate-root. Produces: 200 application/json

Returns

The JSON response of the request.

Return type

dict

*class* `hvac.api.secrets_engines.``Azure`(*adapter*)[[source]](_modules/hvac/api/secrets_engines/azure.html#Azure)[¶](#hvac.api.secrets_engines.Azure "Permalink to this definition")

Bases: `hvac.api.vault\_api\_base.VaultApiBase`

Azure Secrets Engine (API).

Reference: <https://www.vaultproject.io/api/secret/azure/index.html>

**Methods**

| [`configure`](#hvac.api.secrets_engines.Azure.configure "hvac.api.secrets_engines.Azure.configure")(subscription\_id, tenant\_id[, …]) | Configure the credentials required for the plugin to perform API calls to Azure. |

| [`create\_or\_update\_role`](#hvac.api.secrets_engines.Azure.create_or_update_role "hvac.api.secrets_engines.Azure.create_or_update_role")(name, azure\_roles[, …]) | Create or update a Vault role. |

| [`delete\_config`](#hvac.api.secrets_engines.Azure.delete_config "hvac.api.secrets_engines.Azure.delete_config")([mount\_point]) | Delete the stored Azure configuration and credentials. |

| [`generate\_credentials`](#hvac.api.secrets_engines.Azure.generate_credentials "hvac.api.secrets_engines.Azure.generate_credentials")(name[, mount\_point]) | Generate a new service principal based on the named role. |

| [`list\_roles`](#hvac.api.secrets_engines.Azure.list_roles "hvac.api.secrets_engines.Azure.list_roles")([mount\_point]) | List all of the roles that are registered with the plugin. |

| [`read\_config`](#hvac.api.secrets_engines.Azure.read_config "hvac.api.secrets_engines.Azure.read_config")([mount\_point]) | Read the stored configuration, omitting client\_secret. |

`configure`(*subscription\_id*, *tenant\_id*, *client\_id=None*, *client\_secret=None*, *environment=None*, *mount\_point='azure'*)[[source]](_modules/hvac/api/secrets_engines/azure.html#Azure.configure)[¶](#hvac.api.secrets_engines.Azure.configure "Permalink to this definition")

Configure the credentials required for the plugin to perform API calls to Azure.

These credentials will be used to query roles and create/delete service principals. Environment variables will

override any parameters set in the config.

Supported methods:POST: /{mount\_point}/config. Produces: 204 (empty body)

Parameters

* **subscription\_id** (*str | unicode*) – The subscription id for the Azure Active Directory

* **tenant\_id** (*str | unicode*) – The tenant id for the Azure Active Directory.

* **client\_id** (*str | unicode*) – The OAuth2 client id to connect to Azure.

* **client\_secret** (*str | unicode*) – The OAuth2 client secret to connect to Azure.

* **environment** (*str | unicode*) – The Azure environment. If not specified, Vault will use Azure Public Cloud.

* **mount\_point** (*str | unicode*) – The OAuth2 client secret to connect to Azure.

Returns

The response of the request.

Return type

requests.Response

`create_or_update_role`(*name*, *azure\_roles*, *ttl=None*, *max\_ttl=None*, *mount\_point='azure'*)[[source]](_modules/hvac/api/secrets_engines/azure.html#Azure.create_or_update_role)[¶](#hvac.api.secrets_engines.Azure.create_or_update_role "Permalink to this definition")

Create or update a Vault role.

The provided Azure roles must exist for this call to succeed. See the Azure secrets roles docs for more

information about roles.

Supported methods:POST: /{mount\_point}/roles/{name}. Produces: 204 (empty body)

Parameters

* **name** (*str | unicode*) – Name of the role.

* **azure\_roles** (*list**(**dict**)*) – List of Azure roles to be assigned to the generated service principal.

* **ttl** (*str | unicode*) – Specifies the default TTL for service principals generated using this role. Accepts time suffixed

strings (“1h”) or an integer number of seconds. Defaults to the system/engine default TTL time.

* **max\_ttl** (*str | unicode*) – Specifies the maximum TTL for service principals generated using this role. Accepts time

suffixed strings (“1h”) or an integer number of seconds. Defaults to the system/engine max TTL time.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the request.

Return type

requests.Response

`delete_config`(*mount\_point='azure'*)[[source]](_modules/hvac/api/secrets_engines/azure.html#Azure.delete_config)[¶](#hvac.api.secrets_engines.Azure.delete_config "Permalink to this definition")

Delete the stored Azure configuration and credentials.

Supported methods:DELETE: /auth/{mount\_point}/config. Produces: 204 (empty body)

Parameters

**mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the request.

Return type

requests.Response

`generate_credentials`(*name*, *mount\_point='azure'*)[[source]](_modules/hvac/api/secrets_engines/azure.html#Azure.generate_credentials)[¶](#hvac.api.secrets_engines.Azure.generate_credentials "Permalink to this definition")

Generate a new service principal based on the named role.

Supported methods:GET: /{mount\_point}/creds/{name}. Produces: 200 application/json

Parameters

* **name** (*str | unicode*) – Specifies the name of the role to create credentials against.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The data key from the JSON response of the request.

Return type

dict

`list_roles`(*mount\_point='azure'*)[[source]](_modules/hvac/api/secrets_engines/azure.html#Azure.list_roles)[¶](#hvac.api.secrets_engines.Azure.list_roles "Permalink to this definition")

List all of the roles that are registered with the plugin.

Supported methods:LIST: /{mount\_point}/roles. Produces: 200 application/json

Parameters

**mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The data key from the JSON response of the request.

Return type

dict

`read_config`(*mount\_point='azure'*)[[source]](_modules/hvac/api/secrets_engines/azure.html#Azure.read_config)[¶](#hvac.api.secrets_engines.Azure.read_config "Permalink to this definition")

Read the stored configuration, omitting client\_secret.

Supported methods:GET: /{mount\_point}/config. Produces: 200 application/json

Parameters

**mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The data key from the JSON response of the request.

Return type

dict

*class* `hvac.api.secrets_engines.``Database`(*adapter*)[[source]](_modules/hvac/api/secrets_engines/database.html#Database)[¶](#hvac.api.secrets_engines.Database "Permalink to this definition")

Bases: `hvac.api.vault\_api\_base.VaultApiBase`

Database Secrets Engine (API).

Reference: <https://www.vaultproject.io/api/secret/databases/index.html>

**Methods**

| [`configure`](#hvac.api.secrets_engines.Database.configure "hvac.api.secrets_engines.Database.configure")(name, plugin\_name[, …]) | This endpoint configures the connection string used to communicate with the desired database. |

| [`create\_role`](#hvac.api.secrets_engines.Database.create_role "hvac.api.secrets_engines.Database.create_role")(name, db\_name, creation\_statements) | This endpoint creates or updates a role definition. |

| [`create\_static\_role`](#hvac.api.secrets_engines.Database.create_static_role "hvac.api.secrets_engines.Database.create_static_role")(name, db\_name, username, …) | This endpoint creates or updates a static role definition. |

| [`delete\_connection`](#hvac.api.secrets_engines.Database.delete_connection "hvac.api.secrets_engines.Database.delete_connection")(name[, mount\_point]) | This endpoint deletes a connection. |

| [`delete\_role`](#hvac.api.secrets_engines.Database.delete_role "hvac.api.secrets_engines.Database.delete_role")(name[, mount\_point]) | This endpoint deletes the role definition. |

| [`delete\_static\_role`](#hvac.api.secrets_engines.Database.delete_static_role "hvac.api.secrets_engines.Database.delete_static_role")(name[, mount\_point]) | This endpoint deletes the static role definition. |

| [`generate\_credentials`](#hvac.api.secrets_engines.Database.generate_credentials "hvac.api.secrets_engines.Database.generate_credentials")(name[, mount\_point]) | This endpoint generates a new set of dynamic credentials based on the named role. |

| [`get\_static\_credentials`](#hvac.api.secrets_engines.Database.get_static_credentials "hvac.api.secrets_engines.Database.get_static_credentials")(name[, mount\_point]) | This endpoint returns the current credentials based on the named static role. |

| [`list\_connections`](#hvac.api.secrets_engines.Database.list_connections "hvac.api.secrets_engines.Database.list_connections")([mount\_point]) | This endpoint returns a list of available connections. |

| [`list\_roles`](#hvac.api.secrets_engines.Database.list_roles "hvac.api.secrets_engines.Database.list_roles")([mount\_point]) | This endpoint returns a list of available roles. |

| [`list\_static\_roles`](#hvac.api.secrets_engines.Database.list_static_roles "hvac.api.secrets_engines.Database.list_static_roles")([mount\_point]) | This endpoint returns a list of available static roles. |

| [`read\_connection`](#hvac.api.secrets_engines.Database.read_connection "hvac.api.secrets_engines.Database.read_connection")(name[, mount\_point]) | This endpoint returns the configuration settings for a connection. |

| [`read\_role`](#hvac.api.secrets_engines.Database.read_role "hvac.api.secrets_engines.Database.read_role")(name[, mount\_point]) | This endpoint queries the role definition. |

| [`reset\_connection`](#hvac.api.secrets_engines.Database.reset_connection "hvac.api.secrets_engines.Database.reset_connection")(name[, mount\_point]) | This endpoint closes a connection and it’s underlying plugin and restarts it with the configuration stored in the barrier. |

| [`rotate\_root\_credentials`](#hvac.api.secrets_engines.Database.rotate_root_credentials "hvac.api.secrets_engines.Database.rotate_root_credentials")(name[, mount\_point]) | This endpoint is used to rotate the root superuser credentials stored for the database connection. |

`configure`(*name*, *plugin\_name*, *verify\_connection=None*, *allowed\_roles=None*, *root\_rotation\_statements=None*, *mount\_point='database'*, *\*args*, *\*\*kwargs*)[[source]](_modules/hvac/api/secrets_engines/database.html#Database.configure)[¶](#hvac.api.secrets_engines.Database.configure "Permalink to this definition")

This endpoint configures the connection string used to communicate with the desired database.

In addition to the parameters listed here, each Database plugin has additional,

database plugin specific, parameters for this endpoint.

Please read the HTTP API for the plugin you’d wish to configure to see the full list of additional parameters.

Parameters

* **name** (*str | unicode*) – Specifies the name for this database connection. This is specified as part of the URL.

* **plugin\_name** (*str | unicode*) – Specifies the name of the plugin to use for this connection.

* **verify\_connection** (*bool*) – Specifies if the connection is verified during initial configuration.

* **allowed\_roles** (*list*) – List of the roles allowed to use this connection. Defaults to empty (no roles),

if contains a “\*” any role can use this connection.

* **root\_rotation\_statements** (*list*) – Specifies the database statements to be executed to rotate

the root user’s credentials.

Returns

The response of the request.

Return type

requests.Response

`create_role`(*name*, *db\_name*, *creation\_statements*, *default\_ttl=None*, *max\_ttl=None*, *revocation\_statements=None*, *rollback\_statements=None*, *renew\_statements=None*, *mount\_point='database'*)[[source]](_modules/hvac/api/secrets_engines/database.html#Database.create_role)[¶](#hvac.api.secrets_engines.Database.create_role "Permalink to this definition")

This endpoint creates or updates a role definition.

Parameters

* **name** (*str | unicode*) – Specifies the database role to manage.

* **db\_name** (*str | unicode*) – The name of the database connection to use for this role.

* **creation\_statements** (*list*) – Specifies the database statements executed to create and configure a user.

* **default\_ttl** (*int*) – Specifies the TTL for the leases associated with this role.

* **max\_ttl** (*int*) – Specifies the maximum TTL for the leases associated with this role.

* **revocation\_statements** (*list*) – Specifies the database statements to be executed to revoke a user.

* **rollback\_statements** (*list*) – Specifies the database statements to be executed to rollback

a create operation in the event of an error.

* **renew\_statements** (*list*) – Specifies the database statements to be executed to renew a user.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the request.

Return type

requests.Response

`create_static_role`(*name*, *db\_name*, *username*, *rotation\_statements*, *rotation\_period=86400*, *mount\_point='database'*)[[source]](_modules/hvac/api/secrets_engines/database.html#Database.create_static_role)[¶](#hvac.api.secrets_engines.Database.create_static_role "Permalink to this definition")

This endpoint creates or updates a static role definition.

Parameters

* **name** (*str | unicode*) – Specifies the name of the role to create.

* **db\_name** (*str | unicode*) – The name of the database connection to use for this role.

* **username** (*str | unicode*) – Specifies the database username that the Vault role name above corresponds to.

* **rotation\_statements** (*list*) – Specifies the database statements to be executed to rotate the password for the configured database user.

Not every plugin type will support this functionality. See the plugin’s API page for more information on support and

formatting for this parameter.

* **rotation\_period** (*int*) – Specifies the amount of time Vault should wait before rotating the password. The minimum is 5 seconds.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the request.

Return type

requests.Response

`delete_connection`(*name*, *mount\_point='database'*)[[source]](_modules/hvac/api/secrets_engines/database.html#Database.delete_connection)[¶](#hvac.api.secrets_engines.Database.delete_connection "Permalink to this definition")

This endpoint deletes a connection.

Parameters

**name** (*str | unicode*) – Specifies the name of the connection to delete.

Returns

The response of the request.

Return type

requests.Response

`delete_role`(*name*, *mount\_point='database'*)[[source]](_modules/hvac/api/secrets_engines/database.html#Database.delete_role)[¶](#hvac.api.secrets_engines.Database.delete_role "Permalink to this definition")

This endpoint deletes the role definition.

Parameters

* **name** (*str | unicode*) – Specifies the name of the role to delete.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the request.

Return type

requests.Response

`delete_static_role`(*name*, *mount\_point='database'*)[[source]](_modules/hvac/api/secrets_engines/database.html#Database.delete_static_role)[¶](#hvac.api.secrets_engines.Database.delete_static_role "Permalink to this definition")

This endpoint deletes the static role definition.

Parameters

* **name** (*str | unicode*) – Specifies the name of the role to delete.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the request.

Return type

requests.Response

`generate_credentials`(*name*, *mount\_point='database'*)[[source]](_modules/hvac/api/secrets_engines/database.html#Database.generate_credentials)[¶](#hvac.api.secrets_engines.Database.generate_credentials "Permalink to this definition")

This endpoint generates a new set of dynamic credentials based on the named role.

Parameters

* **name** (*str | unicode*) – Specifies the name of the role to create credentials against

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the request.

Return type

requests.Response

`get_static_credentials`(*name*, *mount\_point='database'*)[[source]](_modules/hvac/api/secrets_engines/database.html#Database.get_static_credentials)[¶](#hvac.api.secrets_engines.Database.get_static_credentials "Permalink to this definition")

This endpoint returns the current credentials based on the named static role.

Parameters

* **name** (*str | unicode*) – Specifies the name of the role to create credentials against

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the request.

Return type

requests.Response

`list_connections`(*mount\_point='database'*)[[source]](_modules/hvac/api/secrets_engines/database.html#Database.list_connections)[¶](#hvac.api.secrets_engines.Database.list_connections "Permalink to this definition")

This endpoint returns a list of available connections.

Returns

The response of the request.

Return type

requests.Response

`list_roles`(*mount\_point='database'*)[[source]](_modules/hvac/api/secrets_engines/database.html#Database.list_roles)[¶](#hvac.api.secrets_engines.Database.list_roles "Permalink to this definition")

This endpoint returns a list of available roles.

Parameters

**mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the request.

Return type

requests.Response

`list_static_roles`(*mount\_point='database'*)[[source]](_modules/hvac/api/secrets_engines/database.html#Database.list_static_roles)[¶](#hvac.api.secrets_engines.Database.list_static_roles "Permalink to this definition")

This endpoint returns a list of available static roles.

Parameters

**mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the request.

Return type

requests.Response

`read_connection`(*name*, *mount\_point='database'*)[[source]](_modules/hvac/api/secrets_engines/database.html#Database.read_connection)[¶](#hvac.api.secrets_engines.Database.read_connection "Permalink to this definition")

This endpoint returns the configuration settings for a connection.

Parameters

**name** (*str | unicode*) – Specifies the name of the connection to read.

Returns

The response of the request.

Return type

requests.Response

`read_role`(*name*, *mount\_point='database'*)[[source]](_modules/hvac/api/secrets_engines/database.html#Database.read_role)[¶](#hvac.api.secrets_engines.Database.read_role "Permalink to this definition")

This endpoint queries the role definition.

Parameters

* **name** (*str | unicode*) – Specifies the name of the role to read.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the request.

Return type

requests.Response

`reset_connection`(*name*, *mount\_point='database'*)[[source]](_modules/hvac/api/secrets_engines/database.html#Database.reset_connection)[¶](#hvac.api.secrets_engines.Database.reset_connection "Permalink to this definition")

This endpoint closes a connection and it’s underlying plugin and

restarts it with the configuration stored in the barrier.

Parameters

**name** (*str | unicode*) – Specifies the name of the connection to reset.

Returns

The response of the request.

Return type

requests.Response

`rotate_root_credentials`(*name*, *mount\_point='database'*)[[source]](_modules/hvac/api/secrets_engines/database.html#Database.rotate_root_credentials)[¶](#hvac.api.secrets_engines.Database.rotate_root_credentials "Permalink to this definition")

This endpoint is used to rotate the root superuser credentials stored for the database connection.

This user must have permissions to update its own password.

Parameters

**name** (*str | unicode*) – Specifies the name of the connection to rotate.

Returns

The response of the request.

Return type

requests.Response

*class* `hvac.api.secrets_engines.``Gcp`(*adapter*)[[source]](_modules/hvac/api/secrets_engines/gcp.html#Gcp)[¶](#hvac.api.secrets_engines.Gcp "Permalink to this definition")

Bases: `hvac.api.vault\_api\_base.VaultApiBase`

Google Cloud Secrets Engine (API).

Reference: <https://www.vaultproject.io/api/secret/gcp/index.html>

**Methods**

| [`configure`](#hvac.api.secrets_engines.Gcp.configure "hvac.api.secrets_engines.Gcp.configure")([credentials, ttl, max\_ttl, …]) | Configure shared information for the Gcp secrets engine. |

| [`create\_or\_update\_roleset`](#hvac.api.secrets_engines.Gcp.create_or_update_roleset "hvac.api.secrets_engines.Gcp.create_or_update_roleset")(name, project, bindings) | Create a roleset or update an existing roleset. |

| [`delete\_roleset`](#hvac.api.secrets_engines.Gcp.delete_roleset "hvac.api.secrets_engines.Gcp.delete_roleset")(name[, mount\_point]) | Delete an existing roleset by the given name. |

| [`generate\_oauth2\_access\_token`](#hvac.api.secrets_engines.Gcp.generate_oauth2_access_token "hvac.api.secrets_engines.Gcp.generate_oauth2_access_token")(roleset[, …]) | Generate an OAuth2 token with the scopes defined on the roleset. |

| [`generate\_service\_account\_key`](#hvac.api.secrets_engines.Gcp.generate_service_account_key "hvac.api.secrets_engines.Gcp.generate_service_account_key")(roleset[, …]) | Generate Secret (IAM Service Account Creds): Service Account Key |

| [`list\_rolesets`](#hvac.api.secrets_engines.Gcp.list_rolesets "hvac.api.secrets_engines.Gcp.list_rolesets")([mount\_point]) | List configured rolesets. |

| [`read\_config`](#hvac.api.secrets_engines.Gcp.read_config "hvac.api.secrets_engines.Gcp.read_config")([mount\_point]) | Read the configured shared information for the Gcp secrets engine. |

| [`read\_roleset`](#hvac.api.secrets_engines.Gcp.read_roleset "hvac.api.secrets_engines.Gcp.read_roleset")(name[, mount\_point]) | Read a roleset. |

| [`rotate\_roleset\_account`](#hvac.api.secrets_engines.Gcp.rotate_roleset_account "hvac.api.secrets_engines.Gcp.rotate_roleset_account")(name[, mount\_point]) | Rotate the service account this roleset uses to generate secrets. |

| [`rotate\_roleset\_account\_key`](#hvac.api.secrets_engines.Gcp.rotate_roleset_account_key "hvac.api.secrets_engines.Gcp.rotate_roleset_account_key")(name[, mount\_point]) | Rotate the service account key this roleset uses to generate access tokens. |

`configure`(*credentials=None*, *ttl=None*, *max\_ttl=None*, *mount\_point='gcp'*)[[source]](_modules/hvac/api/secrets_engines/gcp.html#Gcp.configure)[¶](#hvac.api.secrets_engines.Gcp.configure "Permalink to this definition")

Configure shared information for the Gcp secrets engine.

Supported methods:POST: /{mount\_point}/config. Produces: 204 (empty body)

Parameters

* **credentials** (*str | unicode*) – JSON credentials (either file contents or [‘@path/to/file](mailto:'%40path/to/file)’) See docs for alternative ways to

pass in to this parameter, as well as the required permissions.

* **ttl** (*int | str*) – – Specifies default config TTL for long-lived credentials (i.e. service account keys). Accepts

integer number of seconds or Go duration format string.

* **max\_ttl** (*int | str*) – Specifies the maximum config TTL for long-lived credentials (i.e. service account keys). Accepts

integer number of seconds or Go duration format string.\*\*

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the request.

Return type

requests.Response

`create_or_update_roleset`(*name*, *project*, *bindings*, *secret\_type=None*, *token\_scopes=None*, *mount\_point='gcp'*)[[source]](_modules/hvac/api/secrets_engines/gcp.html#Gcp.create_or_update_roleset)[¶](#hvac.api.secrets_engines.Gcp.create_or_update_roleset "Permalink to this definition")

Create a roleset or update an existing roleset.

See roleset docs for the GCP secrets backend to learn more about what happens when you create or update aroleset.

Supported methods:POST: /{mount\_point}/roleset/{name}. Produces: 204 (empty body)

Parameters

* **name** (*str | unicode*) – Name of the role. Cannot be updated.

* **project** (*str | unicode*) – Name of the GCP project that this roleset’s service account will belong to. Cannot be updated.

* **bindings** (*str | unicode*) – Bindings configuration string (expects HCL or JSON format in raw or base64-encoded string)

* **secret\_type** (*str | unicode*) – Cannot be updated.

* **token\_scopes** (*list**[**str**]*) – List of OAuth scopes to assign to access\_token secrets generated under this role set

(access\_token role sets only)

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the request.

Return type

requests.Response

`delete_roleset`(*name*, *mount\_point='gcp'*)[[source]](_modules/hvac/api/secrets_engines/gcp.html#Gcp.delete_roleset)[¶](#hvac.api.secrets_engines.Gcp.delete_roleset "Permalink to this definition")

Delete an existing roleset by the given name.

Supported methods:DELETE: /{mount\_point}/roleset/{name} Produces: 200 application/json

Parameters

* **name** (*str | unicode*) – Name of the role.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the request.

Return type

requests.Response

`generate_oauth2_access_token`(*roleset*, *mount\_point='gcp'*)[[source]](_modules/hvac/api/secrets_engines/gcp.html#Gcp.generate_oauth2_access_token)[¶](#hvac.api.secrets_engines.Gcp.generate_oauth2_access_token "Permalink to this definition")

Generate an OAuth2 token with the scopes defined on the roleset.

This OAuth access token can be used in GCP API calls, e.g. curl -H “Authorization: Bearer $TOKEN” …

Supported methods:GET: /{mount\_point}/token/{roleset}. Produces: 200 application/json

Parameters

* **roleset** (*str | unicode*) – Name of an roleset with secret type access\_token to generate access\_token under.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

`generate_service_account_key`(*roleset*, *key\_algorithm='KEY\_ALG\_RSA\_2048'*, *key\_type='TYPE\_GOOGLE\_CREDENTIALS\_FILE'*, *method='POST'*, *mount\_point='gcp'*)[[source]](_modules/hvac/api/secrets_engines/gcp.html#Gcp.generate_service_account_key)[¶](#hvac.api.secrets_engines.Gcp.generate_service_account_key "Permalink to this definition")

Generate Secret (IAM Service Account Creds): Service Account Key

If using GET (‘read’), the optional parameters will be set to their defaults. Use POST if you want to specifydifferent values for these params.

Parameters

* **roleset** (*str | unicode*) – Name of an roleset with secret type service\_account\_key to generate key under.

* **key\_algorithm** (*str | unicode*) – Key algorithm used to generate key. Defaults to 2k RSA key You probably should not choose

other values (i.e. 1k),

* **key\_type** (*str | unicode*) – Private key type to generate. Defaults to JSON credentials file.

* **method** (*str | unicode*) – Supported methods:

POST: /{mount\_point}/key/{roleset}. Produces: 200 application/json

GET: /{mount\_point}/key/{roleset}. Produces: 200 application/json

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

`list_rolesets`(*mount\_point='gcp'*)[[source]](_modules/hvac/api/secrets_engines/gcp.html#Gcp.list_rolesets)[¶](#hvac.api.secrets_engines.Gcp.list_rolesets "Permalink to this definition")

List configured rolesets.

Supported methods:LIST: /{mount\_point}/rolesets. Produces: 200 application/json

Parameters

**mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

`read_config`(*mount\_point='gcp'*)[[source]](_modules/hvac/api/secrets_engines/gcp.html#Gcp.read_config)[¶](#hvac.api.secrets_engines.Gcp.read_config "Permalink to this definition")

Read the configured shared information for the Gcp secrets engine.

Credentials will be omitted from returned data.

Supported methods:GET: /{mount\_point}/config. Produces: 200 application/json

Parameters

**mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

`read_roleset`(*name*, *mount\_point='gcp'*)[[source]](_modules/hvac/api/secrets_engines/gcp.html#Gcp.read_roleset)[¶](#hvac.api.secrets_engines.Gcp.read_roleset "Permalink to this definition")

Read a roleset.

Supported methods:GET: /{mount\_point}/roleset/{name}. Produces: 200 application/json

Parameters

* **name** (*str | unicode*) – Name of the role.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

`rotate_roleset_account`(*name*, *mount\_point='gcp'*)[[source]](_modules/hvac/api/secrets_engines/gcp.html#Gcp.rotate_roleset_account)[¶](#hvac.api.secrets_engines.Gcp.rotate_roleset_account "Permalink to this definition")

Rotate the service account this roleset uses to generate secrets.

This also replaces the key access\_token roleset. This can be used to invalidate old secrets generated by theroleset or fix issues if a roleset’s service account (and/or keys) was changed outside of Vault (i.e.

through GCP APIs/cloud console).

Supported methods:POST: /{mount\_point}/roleset/{name}/rotate. Produces: 204 (empty body)

Parameters

* **name** (*str | unicode*) – Name of the role.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the request.

Return type

requests.Response

`rotate_roleset_account_key`(*name*, *mount\_point='gcp'*)[[source]](_modules/hvac/api/secrets_engines/gcp.html#Gcp.rotate_roleset_account_key)[¶](#hvac.api.secrets_engines.Gcp.rotate_roleset_account_key "Permalink to this definition")

Rotate the service account key this roleset uses to generate access tokens.

This does not recreate the roleset service account.

Supported methods:POST: /{mount\_point}/roleset/{name}/rotate-key. Produces: 204 (empty body)

Parameters

* **name** (*str | unicode*) – Name of the role.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the request.

Return type

requests.Response

*class* `hvac.api.secrets_engines.``Identity`(*adapter*)[[source]](_modules/hvac/api/secrets_engines/identity.html#Identity)[¶](#hvac.api.secrets_engines.Identity "Permalink to this definition")

Bases: `hvac.api.vault\_api\_base.VaultApiBase`

Identity Secrets Engine (API).

Reference: <https://www.vaultproject.io/api/secret/identity/entity.html>

**Methods**

| [`configure\_tokens\_backend`](#hvac.api.secrets_engines.Identity.configure_tokens_backend "hvac.api.secrets_engines.Identity.configure_tokens_backend")([issuer, mount\_point]) | Update configurations for OIDC-compliant identity tokens issued by Vault. |

| [`create\_named\_key`](#hvac.api.secrets_engines.Identity.create_named_key "hvac.api.secrets_engines.Identity.create_named_key")(name[, rotation\_period, …]) | Create or update a named key which is used by a role to sign tokens. |

| [`create\_or\_update\_entity`](#hvac.api.secrets_engines.Identity.create_or_update_entity "hvac.api.secrets_engines.Identity.create_or_update_entity")(name[, entity\_id, …]) | Create or update an Entity. |

| [`create\_or\_update\_entity\_alias`](#hvac.api.secrets_engines.Identity.create_or_update_entity_alias "hvac.api.secrets_engines.Identity.create_or_update_entity_alias")(name, …[, …]) | Create a new alias for an entity. |

| [`create\_or\_update\_entity\_by\_name`](#hvac.api.secrets_engines.Identity.create_or_update_entity_by_name "hvac.api.secrets_engines.Identity.create_or_update_entity_by_name")(name[, …]) | Create or update an entity by a given name. |

| [`create\_or\_update\_group`](#hvac.api.secrets_engines.Identity.create_or_update_group "hvac.api.secrets_engines.Identity.create_or_update_group")(name[, group\_id, …]) | Create or update a Group. |

| [`create\_or\_update\_group\_alias`](#hvac.api.secrets_engines.Identity.create_or_update_group_alias "hvac.api.secrets_engines.Identity.create_or_update_group_alias")(name[, …]) | Creates or update a group alias. |

| [`create\_or\_update\_group\_by\_name`](#hvac.api.secrets_engines.Identity.create_or_update_group_by_name "hvac.api.secrets_engines.Identity.create_or_update_group_by_name")(name[, …]) | Create or update a group by its name. |

| [`create\_or\_update\_role`](#hvac.api.secrets_engines.Identity.create_or_update_role "hvac.api.secrets_engines.Identity.create_or_update_role")(name, key[, template, …]) | Create or update a role. |

| [`delete\_entity`](#hvac.api.secrets_engines.Identity.delete_entity "hvac.api.secrets_engines.Identity.delete_entity")(entity\_id[, mount\_point]) | Delete an entity and all its associated aliases. |

| [`delete\_entity\_alias`](#hvac.api.secrets_engines.Identity.delete_entity_alias "hvac.api.secrets_engines.Identity.delete_entity_alias")(alias\_id[, mount\_point]) | Delete a entity alias. |

| [`delete\_entity\_by\_name`](#hvac.api.secrets_engines.Identity.delete_entity_by_name "hvac.api.secrets_engines.Identity.delete_entity_by_name")(name[, mount\_point]) | Delete an entity and all its associated aliases, given the entity name. |

| [`delete\_group`](#hvac.api.secrets_engines.Identity.delete_group "hvac.api.secrets_engines.Identity.delete_group")(group\_id[, mount\_point]) | Delete a group. |

| [`delete\_group\_alias`](#hvac.api.secrets_engines.Identity.delete_group_alias "hvac.api.secrets_engines.Identity.delete_group_alias")(entity\_id[, mount\_point]) | Delete a group alias. |

| [`delete\_group\_by\_name`](#hvac.api.secrets_engines.Identity.delete_group_by_name "hvac.api.secrets_engines.Identity.delete_group_by_name")(name[, mount\_point]) | Delete a group, given its name. |

| [`delete\_named\_key`](#hvac.api.secrets_engines.Identity.delete_named_key "hvac.api.secrets_engines.Identity.delete_named_key")(name[, mount\_point]) | Delete a named key. |

| [`delete\_role`](#hvac.api.secrets_engines.Identity.delete_role "hvac.api.secrets_engines.Identity.delete_role")(name[, mount\_point]) | Deletes a role. |

| [`generate\_signed\_id\_token`](#hvac.api.secrets_engines.Identity.generate_signed_id_token "hvac.api.secrets_engines.Identity.generate_signed_id_token")(name[, mount\_point]) | Generate a signed ID (OIDC) token. |

| [`introspect\_signed\_id\_token`](#hvac.api.secrets_engines.Identity.introspect_signed_id_token "hvac.api.secrets_engines.Identity.introspect_signed_id_token")(token[, …]) | Verify the authenticity and active state of a signed ID token. |

| [`list\_entities`](#hvac.api.secrets_engines.Identity.list_entities "hvac.api.secrets_engines.Identity.list_entities")([method, mount\_point]) | List available entities entities by their identifiers. |

| [`list\_entities\_by\_name`](#hvac.api.secrets_engines.Identity.list_entities_by_name "hvac.api.secrets_engines.Identity.list_entities_by_name")([method, mount\_point]) | List available entities by their names. |

| [`list\_entity\_aliases`](#hvac.api.secrets_engines.Identity.list_entity_aliases "hvac.api.secrets_engines.Identity.list_entity_aliases")([method, mount\_point]) | List available entity aliases by their identifiers. |

| [`list\_group\_aliases`](#hvac.api.secrets_engines.Identity.list_group_aliases "hvac.api.secrets_engines.Identity.list_group_aliases")([method, mount\_point]) | List available group aliases by their identifiers. |

| [`list\_groups`](#hvac.api.secrets_engines.Identity.list_groups "hvac.api.secrets_engines.Identity.list_groups")([method, mount\_point]) | List available groups by their identifiers. |

| [`list\_groups\_by\_name`](#hvac.api.secrets_engines.Identity.list_groups_by_name "hvac.api.secrets_engines.Identity.list_groups_by_name")([method, mount\_point]) | List available groups by their names. |

| [`list\_named\_keys`](#hvac.api.secrets_engines.Identity.list_named_keys "hvac.api.secrets_engines.Identity.list_named_keys")([mount\_point]) | List all named keys. |

| [`list\_roles`](#hvac.api.secrets_engines.Identity.list_roles "hvac.api.secrets_engines.Identity.list_roles")([mount\_point]) | This endpoint will list all signing keys. |

| [`lookup\_entity`](#hvac.api.secrets_engines.Identity.lookup_entity "hvac.api.secrets_engines.Identity.lookup_entity")([name, entity\_id, alias\_id, …]) | Query an entity based on the given criteria. |

| [`lookup\_group`](#hvac.api.secrets_engines.Identity.lookup_group "hvac.api.secrets_engines.Identity.lookup_group")([name, group\_id, alias\_id, …]) | Query a group based on the given criteria. |

| [`merge\_entities`](#hvac.api.secrets_engines.Identity.merge_entities "hvac.api.secrets_engines.Identity.merge_entities")(from\_entity\_ids, to\_entity\_id) | Merge many entities into one entity. |

| [`read\_active\_public\_keys`](#hvac.api.secrets_engines.Identity.read_active_public_keys "hvac.api.secrets_engines.Identity.read_active_public_keys")([mount\_point]) | Retrieve the public portion of named keys. |

| [`read\_entity`](#hvac.api.secrets_engines.Identity.read_entity "hvac.api.secrets_engines.Identity.read_entity")(entity\_id[, mount\_point]) | Query an entity by its identifier. |

| [`read\_entity\_alias`](#hvac.api.secrets_engines.Identity.read_entity_alias "hvac.api.secrets_engines.Identity.read_entity_alias")(alias\_id[, mount\_point]) | Query the entity alias by its identifier. |

| [`read\_entity\_by\_name`](#hvac.api.secrets_engines.Identity.read_entity_by_name "hvac.api.secrets_engines.Identity.read_entity_by_name")(name[, mount\_point]) | Query an entity by its name. |

| [`read\_group`](#hvac.api.secrets_engines.Identity.read_group "hvac.api.secrets_engines.Identity.read_group")(group\_id[, mount\_point]) | Query the group by its identifier. |

| [`read\_group\_alias`](#hvac.api.secrets_engines.Identity.read_group_alias "hvac.api.secrets_engines.Identity.read_group_alias")(alias\_id[, mount\_point]) | Query the group alias by its identifier. |

| [`read\_group\_by\_name`](#hvac.api.secrets_engines.Identity.read_group_by_name "hvac.api.secrets_engines.Identity.read_group_by_name")(name[, mount\_point]) | Query a group by its name. |

| [`read\_named\_key`](#hvac.api.secrets_engines.Identity.read_named_key "hvac.api.secrets_engines.Identity.read_named_key")(name[, mount\_point]) | Query a named key and returns its configurations. |

| [`read\_role`](#hvac.api.secrets_engines.Identity.read_role "hvac.api.secrets_engines.Identity.read_role")(name[, mount\_point]) | Query a role and returns its configuration. |

| [`read\_tokens\_backend\_configuration`](#hvac.api.secrets_engines.Identity.read_tokens_backend_configuration "hvac.api.secrets_engines.Identity.read_tokens_backend_configuration")([mount\_point]) | Query vault identity tokens configurations. |

| [`read\_well\_known\_configurations`](#hvac.api.secrets_engines.Identity.read_well_known_configurations "hvac.api.secrets_engines.Identity.read_well_known_configurations")([mount\_point]) | Retrieve a set of claims about the identity tokens’ configuration. |

| [`rotate\_named\_key`](#hvac.api.secrets_engines.Identity.rotate_named_key "hvac.api.secrets_engines.Identity.rotate_named_key")(name, verification\_ttl[, …]) | Rotate a named key. |

| [`update\_entity`](#hvac.api.secrets_engines.Identity.update_entity "hvac.api.secrets_engines.Identity.update_entity")(entity\_id[, name, metadata, …]) | Update an existing entity. |

| [`update\_entity\_alias`](#hvac.api.secrets_engines.Identity.update_entity_alias "hvac.api.secrets_engines.Identity.update_entity_alias")(alias\_id, name, …[, …]) | Update an existing entity alias. |

| [`update\_group`](#hvac.api.secrets_engines.Identity.update_group "hvac.api.secrets_engines.Identity.update_group")(group\_id, name[, group\_type, …]) | Update an existing group. |

| [`update\_group\_alias`](#hvac.api.secrets_engines.Identity.update_group_alias "hvac.api.secrets_engines.Identity.update_group_alias")(entity\_id, name[, …]) | Update an existing group alias. |

| [`validate\_member\_id\_params\_for\_group\_type`](#hvac.api.secrets_engines.Identity.validate_member_id_params_for_group_type "hvac.api.secrets_engines.Identity.validate_member_id_params_for_group_type")(…) | Determine whether member ID parameters can be sent with a group create / update request. |

`configure_tokens_backend`(*issuer=None*, *mount\_point='identity'*)[[source]](_modules/hvac/api/secrets_engines/identity.html#Identity.configure_tokens_backend)[¶](#hvac.api.secrets_engines.Identity.configure_tokens_backend "Permalink to this definition")

Update configurations for OIDC-compliant identity tokens issued by Vault.

Supported methods:POST: {mount\_point}/oidc/config.

Parameters

* **issuer** (*str | unicode*) – Issuer URL to be used in the iss claim of the token. If not set, Vault’s api\_addr will be used.

The issuer is a case sensitive URL using the https scheme that contains scheme, host, and optionally, port

number and path components, but no query or fragment components.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The a dict or the response of the configure\_tokens\_backend request. dict returned when messages

are included in the response body.

Return type

requests.Response

`create_named_key`(*name*, *rotation\_period='24h'*, *verification\_ttl='24h'*, *allowed\_client\_ids=None*, *algorithm='RS256'*, *mount\_point='identity'*)[[source]](_modules/hvac/api/secrets_engines/identity.html#Identity.create_named_key)[¶](#hvac.api.secrets_engines.Identity.create_named_key "Permalink to this definition")

Create or update a named key which is used by a role to sign tokens.

Supported methods:POST: {mount\_point}/oidc/key/:name.

Parameters

* **name** (*str | unicode*) – Name of the named key.

* **rotation\_period** (*str | unicode*) – How often to generate a new signing key. Can be specified as a number of seconds or as

a time string like “30m” or “6h”.

* **verification\_ttl** (*str | unicode*) – Controls how long the public portion of a signing key will be available for

verification after being rotated.

* **allowed\_client\_ids** (*list*) – List of role client ids allowed to use this key for signing.

If empty, no roles are allowed. If “\*”, all roles are allowed.

* **algorithm** (*str | unicode*) – Signing algorithm to use. Allowed values are: RS256 (default), RS384, RS512, ES256, ES384,

ES512, EdDSA.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the create\_a\_named\_key request.

Return type

dict

`create_or_update_entity`(*name*, *entity\_id=None*, *metadata=None*, *policies=None*, *disabled=None*, *mount\_point='identity'*)[[source]](_modules/hvac/api/secrets_engines/identity.html#Identity.create_or_update_entity)[¶](#hvac.api.secrets_engines.Identity.create_or_update_entity "Permalink to this definition")

Create or update an Entity.

Supported methods:POST: /{mount\_point}/entity. Produces: 200 application/json

Parameters

* **entity\_id** (*str | unicode*) – ID of the entity. If set, updates the corresponding existing entity.

* **name** (*str | unicode*) – Name of the entity.

* **metadata** (*dict*) – Metadata to be associated with the entity.

* **policies** (*str | unicode*) – Policies to be tied to the entity.

* **disabled** (*bool*) – Whether the entity is disabled. Disabled entities’ associated tokens cannot be used, but are

not revoked.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response for creates, the generic response object for updates, of the request.

Return type

dict | requests.Response

`create_or_update_entity_alias`(*name*, *canonical\_id*, *mount\_accessor*, *alias\_id=None*, *mount\_point='identity'*)[[source]](_modules/hvac/api/secrets_engines/identity.html#Identity.create_or_update_entity_alias)[¶](#hvac.api.secrets_engines.Identity.create_or_update_entity_alias "Permalink to this definition")

Create a new alias for an entity.

Supported methods:POST: /{mount\_point}/entity-alias. Produces: 200 application/json

Parameters

* **name** (*str | unicode*) – Name of the alias. Name should be the identifier of the client in the authentication source. For

example, if the alias belongs to userpass backend, the name should be a valid username within userpass

backend. If alias belongs to GitHub, it should be the GitHub username.

* **alias\_id** (*str | unicode*) – ID of the entity alias. If set, updates the corresponding entity alias.

* **canonical\_id** (*str | unicode*) – Entity ID to which this alias belongs to.

* **mount\_accessor** (*str | unicode*) – Accessor of the mount to which the alias should belong to.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

requests.Response

`create_or_update_entity_by_name`(*name*, *metadata=None*, *policies=None*, *disabled=None*, *mount\_point='identity'*)[[source]](_modules/hvac/api/secrets_engines/identity.html#Identity.create_or_update_entity_by_name)[¶](#hvac.api.secrets_engines.Identity.create_or_update_entity_by_name "Permalink to this definition")

Create or update an entity by a given name.

Supported methods:POST: /{mount\_point}/entity/name/{name}. Produces: 200 application/json

Parameters

* **name** (*str | unicode*) – Name of the entity.

* **metadata** (*dict*) – Metadata to be associated with the entity.

* **policies** (*str | unicode*) – Policies to be tied to the entity.

* **disabled** (*bool*) – Whether the entity is disabled. Disabled

entities’ associated tokens cannot be used, but are not revoked.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response for creates, the generic response of the request for updates.

Return type

requests.Response | dict

`create_or_update_group`(*name*, *group\_id=None*, *group\_type='internal'*, *metadata=None*, *policies=None*, *member\_group\_ids=None*, *member\_entity\_ids=None*, *mount\_point='identity'*)[[source]](_modules/hvac/api/secrets_engines/identity.html#Identity.create_or_update_group)[¶](#hvac.api.secrets_engines.Identity.create_or_update_group "Permalink to this definition")

Create or update a Group.

Supported methods:POST: /{mount\_point}/group. Produces: 200 application/json

Parameters

* **name** (*str | unicode*) – Name of the group.

* **group\_id** (*str | unicode*) – ID of the group. If set, updates the corresponding existing group.

* **group\_type** (*str | unicode*) – Type of the group, internal or external. Defaults to internal.

* **metadata** (*dict*) – Metadata to be associated with the group.

* **policies** (*str | unicode*) – Policies to be tied to the group.

* **member\_group\_ids** (*str | unicode*) – Group IDs to be assigned as group members.

* **member\_entity\_ids** (*str | unicode*) – Entity IDs to be assigned as group members.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response where available, otherwise the generic response object, of the request.

Return type

dict | requests.Response

`create_or_update_group_alias`(*name*, *alias\_id=None*, *mount\_accessor=None*, *canonical\_id=None*, *mount\_point='identity'*)[[source]](_modules/hvac/api/secrets_engines/identity.html#Identity.create_or_update_group_alias)[¶](#hvac.api.secrets_engines.Identity.create_or_update_group_alias "Permalink to this definition")

Creates or update a group alias.

Supported methods:POST: /{mount\_point}/group-alias. Produces: 200 application/json

Parameters

* **alias\_id** (*str | unicode*) – ID of the group alias. If set, updates the corresponding existing group alias.

* **name** (*str | unicode*) – Name of the group alias.

* **mount\_accessor** (*str | unicode*) – Mount accessor to which this alias belongs to

* **canonical\_id** (*str | unicode*) – ID of the group to which this is an alias.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

requests.Response

`create_or_update_group_by_name`(*name*, *group\_type='internal'*, *metadata=None*, *policies=None*, *member\_group\_ids=None*, *member\_entity\_ids=None*, *mount\_point='identity'*)[[source]](_modules/hvac/api/secrets_engines/identity.html#Identity.create_or_update_group_by_name)[¶](#hvac.api.secrets_engines.Identity.create_or_update_group_by_name "Permalink to this definition")

Create or update a group by its name.

Supported methods:POST: /{mount\_point}/group/name/{name}. Produces: 200 application/json

Parameters

* **name** (*str | unicode*) – Name of the group.

* **group\_type** (*str | unicode*) – Type of the group, internal or external. Defaults to internal.

* **metadata** (*dict*) – Metadata to be associated with the group.

* **policies** (*str | unicode*) – Policies to be tied to the group.

* **member\_group\_ids** (*str | unicode*) – Group IDs to be assigned as group members.

* **member\_entity\_ids** (*str | unicode*) – Entity IDs to be assigned as group members.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the request.

Return type

requests.Response

`create_or_update_role`(*name*, *key*, *template=None*, *client\_id=None*, *ttl='24h'*, *mount\_point='identity'*)[[source]](_modules/hvac/api/secrets_engines/identity.html#Identity.create_or_update_role)[¶](#hvac.api.secrets_engines.Identity.create_or_update_role "Permalink to this definition")

Create or update a role.

ID tokens are generated against a role and signed against a named key.

Supported methods:POST: {mount\_point}/oidc/role/:name.

Parameters

* **name** (*str | unicode*) – Name of the role.

* **key** (*str | unicode*) – A configured named key, the key must already exist.

* **template** (*str | unicode*) – The template string to use for generating tokens. This may be in stringified JSON or

base64 format.

* **client\_id** (*str | unicode*) – Optional client ID. A random ID will be generated if left unset.

* **ttl** (*str | unicode*) – TTL of the tokens generated against the role. Can be specified as a number of seconds or as a time

string like “30m” or “6h”.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the create\_or\_update\_a\_role request.

Return type

dict

`delete_entity`(*entity\_id*, *mount\_point='identity'*)[[source]](_modules/hvac/api/secrets_engines/identity.html#Identity.delete_entity)[¶](#hvac.api.secrets_engines.Identity.delete_entity "Permalink to this definition")

Delete an entity and all its associated aliases.

Supported methods:DELETE: /{mount\_point}/entity/id/:id. Produces: 204 (empty body)

Parameters

* **entity\_id** (*str*) – Identifier of the entity.

* **mount\_point** (*str | unicode*) – The “path” the secret engine was mounted on.

Returns

The response of the request.

Return type

requests.Response

`delete_entity_alias`(*alias\_id*, *mount\_point='identity'*)[[source]](_modules/hvac/api/secrets_engines/identity.html#Identity.delete_entity_alias)[¶](#hvac.api.secrets_engines.Identity.delete_entity_alias "Permalink to this definition")

Delete a entity alias.

Supported methods:DELETE: /{mount\_point}/entity-alias/id/{alias\_id}. Produces: 204 (empty body)

Parameters

* **alias\_id** (*str | unicode*) – Identifier of the entity.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the request.

Return type

requests.Response

`delete_entity_by_name`(*name*, *mount\_point='identity'*)[[source]](_modules/hvac/api/secrets_engines/identity.html#Identity.delete_entity_by_name)[¶](#hvac.api.secrets_engines.Identity.delete_entity_by_name "Permalink to this definition")

Delete an entity and all its associated aliases, given the entity name.

Supported methods:DELETE: /{mount\_point}/entity/name/{name}. Produces: 204 (empty body)

Parameters

* **name** (*str | unicode*) – Name of the entity.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the request.

Return type

requests.Response

`delete_group`(*group\_id*, *mount\_point='identity'*)[[source]](_modules/hvac/api/secrets_engines/identity.html#Identity.delete_group)[¶](#hvac.api.secrets_engines.Identity.delete_group "Permalink to this definition")

Delete a group.

Supported methods:DELETE: /{mount\_point}/group/id/{id}. Produces: 204 (empty body)

Parameters

* **group\_id** (*str | unicode*) – Identifier of the entity.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the request.

Return type

requests.Response

`delete_group_alias`(*entity\_id*, *mount\_point='identity'*)[[source]](_modules/hvac/api/secrets_engines/identity.html#Identity.delete_group_alias)[¶](#hvac.api.secrets_engines.Identity.delete_group_alias "Permalink to this definition")

Delete a group alias.

Supported methods:DELETE: /{mount\_point}/group-alias/id/{id}. Produces: 204 (empty body)

Parameters

* **entity\_id** (*str | unicode*) – ID of the group alias.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the request.

Return type

requests.Response

`delete_group_by_name`(*name*, *mount\_point='identity'*)[[source]](_modules/hvac/api/secrets_engines/identity.html#Identity.delete_group_by_name)[¶](#hvac.api.secrets_engines.Identity.delete_group_by_name "Permalink to this definition")

Delete a group, given its name.

Supported methods:DELETE: /{mount\_point}/group/name/{name}. Produces: 204 (empty body)

Parameters

* **name** (*str | unicode*) – Name of the group.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the request.

Return type

requests.Response

`delete_named_key`(*name*, *mount\_point='identity'*)[[source]](_modules/hvac/api/secrets_engines/identity.html#Identity.delete_named_key)[¶](#hvac.api.secrets_engines.Identity.delete_named_key "Permalink to this definition")

Delete a named key.

Supported methods:DELETE: {mount\_point}/oidc/key/:name.

Parameters

* **name** (*str | unicode*) – Name of the key.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the delete\_a\_named\_key request.

Return type

dict

`delete_role`(*name*, *mount\_point='identity'*)[[source]](_modules/hvac/api/secrets_engines/identity.html#Identity.delete_role)[¶](#hvac.api.secrets_engines.Identity.delete_role "Permalink to this definition")

Deletes a role.

Supported methods:DELETE: {mount\_point}/oidc/role/:name.

Parameters

* **name** (*str | unicode*) – Name of the role.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the delete\_a\_role request.

Return type

dict

`generate_signed_id_token`(*name*, *mount\_point='identity'*)[[source]](_modules/hvac/api/secrets_engines/identity.html#Identity.generate_signed_id_token)[¶](#hvac.api.secrets_engines.Identity.generate_signed_id_token "Permalink to this definition")

Generate a signed ID (OIDC) token.

Supported methods:GET: {mount\_point}/oidc/token/:name.

Parameters

* **name** (*str | unicode*) – The name of the role against which to generate a signed ID token

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the generate\_a\_signed\_id\_token request.

Return type

dict

`introspect_signed_id_token`(*token*, *client\_id=None*, *mount\_point='identity'*)[[source]](_modules/hvac/api/secrets_engines/identity.html#Identity.introspect_signed_id_token)[¶](#hvac.api.secrets_engines.Identity.introspect_signed_id_token "Permalink to this definition")

Verify the authenticity and active state of a signed ID token.

Supported methods:POST: {mount\_point}/oidc/introspect.

Parameters

* **token** (*str | unicode*) – A signed OIDC compliant ID token

* **client\_id** (*str | unicode*) – Specifying the client ID optimizes validation time

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the introspect\_a\_signed\_id\_token request.

Return type

dict

`list_entities`(*method='LIST'*, *mount\_point='identity'*)[[source]](_modules/hvac/api/secrets_engines/identity.html#Identity.list_entities)[¶](#hvac.api.secrets_engines.Identity.list_entities "Permalink to this definition")

List available entities entities by their identifiers.

Parameters

* **method** (*str | unicode*) – Supported methods:

LIST: /{mount\_point}/entity/id. Produces: 200 application/json

GET: /{mount\_point}/entity/id?list=true. Produces: 200 application/json

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

`list_entities_by_name`(*method='LIST'*, *mount\_point='identity'*)[[source]](_modules/hvac/api/secrets_engines/identity.html#Identity.list_entities_by_name)[¶](#hvac.api.secrets_engines.Identity.list_entities_by_name "Permalink to this definition")

List available entities by their names.

Parameters

* **method** (*str | unicode*) – Supported methods:

LIST: /{mount\_point}/entity/name. Produces: 200 application/json

GET: /{mount\_point}/entity/name?list=true. Produces: 200 application/json

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

`list_entity_aliases`(*method='LIST'*, *mount\_point='identity'*)[[source]](_modules/hvac/api/secrets_engines/identity.html#Identity.list_entity_aliases)[¶](#hvac.api.secrets_engines.Identity.list_entity_aliases "Permalink to this definition")

List available entity aliases by their identifiers.

Parameters

* **method** (*str | unicode*) – Supported methods:

LIST: /{mount\_point}/entity-alias/id. Produces: 200 application/json

GET: /{mount\_point}/entity-alias/id?list=true. Produces: 200 application/json

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The the JSON response of the request.

Return type

dict

`list_group_aliases`(*method='LIST'*, *mount\_point='identity'*)[[source]](_modules/hvac/api/secrets_engines/identity.html#Identity.list_group_aliases)[¶](#hvac.api.secrets_engines.Identity.list_group_aliases "Permalink to this definition")

List available group aliases by their identifiers.

Parameters

* **method** (*str | unicode*) – Supported methods:

LIST: /{mount\_point}/group-alias/id. Produces: 200 application/json

GET: /{mount\_point}/group-alias/id?list=true. Produces: 200 application/json

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The “data” key from the JSON response of the request.

Return type

dict

`list_groups`(*method='LIST'*, *mount\_point='identity'*)[[source]](_modules/hvac/api/secrets_engines/identity.html#Identity.list_groups)[¶](#hvac.api.secrets_engines.Identity.list_groups "Permalink to this definition")

List available groups by their identifiers.

Parameters

* **method** (*str | unicode*) – Supported methods:

LIST: /{mount\_point}/group/id. Produces: 200 application/json

GET: /{mount\_point}/group/id?list=true. Produces: 200 application/json

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

`list_groups_by_name`(*method='LIST'*, *mount\_point='identity'*)[[source]](_modules/hvac/api/secrets_engines/identity.html#Identity.list_groups_by_name)[¶](#hvac.api.secrets_engines.Identity.list_groups_by_name "Permalink to this definition")

List available groups by their names.

Parameters

* **method** (*str | unicode*) – Supported methods:

LIST: /{mount\_point}/group/name. Produces: 200 application/json

GET: /{mount\_point}/group/name?list=true. Produces: 200 application/json

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

`list_named_keys`(*mount\_point='identity'*)[[source]](_modules/hvac/api/secrets_engines/identity.html#Identity.list_named_keys)[¶](#hvac.api.secrets_engines.Identity.list_named_keys "Permalink to this definition")

List all named keys.

Supported methods:LIST: {mount\_point}/oidc/key.

Parameters

**mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the list\_named\_keys request.

Return type

dict

`list_roles`(*mount\_point='identity'*)[[source]](_modules/hvac/api/secrets_engines/identity.html#Identity.list_roles)[¶](#hvac.api.secrets_engines.Identity.list_roles "Permalink to this definition")

This endpoint will list all signing keys.

Supported methods:LIST: {mount\_point}/oidc/role.

Parameters

**mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the list\_roles request.

Return type

dict

`lookup_entity`(*name=None*, *entity\_id=None*, *alias\_id=None*, *alias\_name=None*, *alias\_mount\_accessor=None*, *mount\_point='identity'*)[[source]](_modules/hvac/api/secrets_engines/identity.html#Identity.lookup_entity)[¶](#hvac.api.secrets_engines.Identity.lookup_entity "Permalink to this definition")

Query an entity based on the given criteria.

The criteria can be name, id, alias\_id, or a combination of alias\_name and alias\_mount\_accessor.

Supported methods:POST: /{mount\_point}/lookup/entity. Produces: 200 application/json

Parameters

* **name** (*str | unicode*) – Name of the entity.

* **entity\_id** (*str | unicode*) – ID of the entity.

* **alias\_id** (*str | unicode*) – ID of the alias.

* **alias\_name** (*str | unicode*) – Name of the alias. This should be supplied in conjunction with alias\_mount\_accessor.

* **alias\_mount\_accessor** (*str | unicode*) – Accessor of the mount to which the alias belongs to. This should be supplied in conjunction with alias\_name.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request if a entity / entity alias is found in the lookup, None otherwise.

Return type

dict | None

`lookup_group`(*name=None*, *group\_id=None*, *alias\_id=None*, *alias\_name=None*, *alias\_mount\_accessor=None*, *mount\_point='identity'*)[[source]](_modules/hvac/api/secrets_engines/identity.html#Identity.lookup_group)[¶](#hvac.api.secrets_engines.Identity.lookup_group "Permalink to this definition")

Query a group based on the given criteria.

The criteria can be name, id, alias\_id, or a combination of alias\_name and alias\_mount\_accessor.

Supported methods:POST: /{mount\_point}/lookup/group. Produces: 200 application/json

Parameters

* **name** (*str | unicode*) – Name of the group.

* **group\_id** (*str | unicode*) – ID of the group.

* **alias\_id** (*str | unicode*) – ID of the alias.

* **alias\_name** (*str | unicode*) – Name of the alias. This should be supplied in conjunction with alias\_mount\_accessor.

* **alias\_mount\_accessor** (*str | unicode*) – Accessor of the mount to which the alias belongs to. This should be supplied in conjunction with alias\_name.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request if a group / group alias is found in the lookup, None otherwise.

Return type

dict | None

`merge_entities`(*from\_entity\_ids*, *to\_entity\_id*, *force=None*, *mount\_point='identity'*)[[source]](_modules/hvac/api/secrets_engines/identity.html#Identity.merge_entities)[¶](#hvac.api.secrets_engines.Identity.merge_entities "Permalink to this definition")

Merge many entities into one entity.

Supported methods:POST: /{mount\_point}/entity/merge. Produces: 204 (empty body)

Parameters

* **from\_entity\_ids** (*array*) – Entity IDs which needs to get merged.

* **to\_entity\_id** (*str | unicode*) – Entity ID into which all the other entities need to get merged.

* **force** (*bool*) – Setting this will follow the ‘mine’ strategy for merging MFA secrets. If there are secrets of the

same type both in entities that are merged from and in entity into which all others are getting merged,

secrets in the destination will be unaltered. If not set, this API will throw an error containing all the

conflicts.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the request.

Return type

requests.Response

`read_active_public_keys`(*mount\_point='identity'*)[[source]](_modules/hvac/api/secrets_engines/identity.html#Identity.read_active_public_keys)[¶](#hvac.api.secrets_engines.Identity.read_active_public_keys "Permalink to this definition")

Retrieve the public portion of named keys.

Clients can use this to validate the authenticity of an identity token.

Supported methods:GET: {mount\_point}/oidc/.well-known/openid-configuration.

Parameters

**mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the read\_active\_public\_keys request.

Return type

dict

`read_entity`(*entity\_id*, *mount\_point='identity'*)[[source]](_modules/hvac/api/secrets_engines/identity.html#Identity.read_entity)[¶](#hvac.api.secrets_engines.Identity.read_entity "Permalink to this definition")

Query an entity by its identifier.

Supported methods:GET: /auth/{mount\_point}/entity/id/{id}. Produces: 200 application/json

Parameters

* **entity\_id** (*str*) – Identifier of the entity.

* **mount\_point** (*str | unicode*) – The “path” the secret engine was mounted on.

Returns

The JSON response of the request.

Return type

dict

`read_entity_alias`(*alias\_id*, *mount\_point='identity'*)[[source]](_modules/hvac/api/secrets_engines/identity.html#Identity.read_entity_alias)[¶](#hvac.api.secrets_engines.Identity.read_entity_alias "Permalink to this definition")

Query the entity alias by its identifier.

Supported methods:GET: /{mount\_point}/entity-alias/id/{id}. Produces: 200 application/json

Parameters

* **alias\_id** (*str | unicode*) – Identifier of entity alias.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

`read_entity_by_name`(*name*, *mount\_point='identity'*)[[source]](_modules/hvac/api/secrets_engines/identity.html#Identity.read_entity_by_name)[¶](#hvac.api.secrets_engines.Identity.read_entity_by_name "Permalink to this definition")

Query an entity by its name.

Supported methods:GET: /{mount\_point}/entity/name/{name}. Produces: 200 application/json

Parameters

* **name** (*str | unicode*) – Name of the entity.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

requests.Response

`read_group`(*group\_id*, *mount\_point='identity'*)[[source]](_modules/hvac/api/secrets_engines/identity.html#Identity.read_group)[¶](#hvac.api.secrets_engines.Identity.read_group "Permalink to this definition")

Query the group by its identifier.

Supported methods:GET: /{mount\_point}/group/id/{id}. Produces: 200 application/json

Parameters

* **group\_id** (*str | unicode*) – Identifier of the group.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

requests.Response

`read_group_alias`(*alias\_id*, *mount\_point='identity'*)[[source]](_modules/hvac/api/secrets_engines/identity.html#Identity.read_group_alias)[¶](#hvac.api.secrets_engines.Identity.read_group_alias "Permalink to this definition")

Query the group alias by its identifier.

Supported methods:GET: /{mount\_point}/group-alias/id/:id. Produces: 200 application/json

Parameters

* **alias\_id** (*str | unicode*) – ID of the group alias.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

`read_group_by_name`(*name*, *mount\_point='identity'*)[[source]](_modules/hvac/api/secrets_engines/identity.html#Identity.read_group_by_name)[¶](#hvac.api.secrets_engines.Identity.read_group_by_name "Permalink to this definition")

Query a group by its name.

Supported methods:GET: /{mount\_point}/group/name/{name}. Produces: 200 application/json

Parameters

* **name** (*str | unicode*) – Name of the group.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

`read_named_key`(*name*, *mount\_point='identity'*)[[source]](_modules/hvac/api/secrets_engines/identity.html#Identity.read_named_key)[¶](#hvac.api.secrets_engines.Identity.read_named_key "Permalink to this definition")

Query a named key and returns its configurations.

Supported methods:GET: {mount\_point}/oidc/key/:name.

Parameters

* **name** (*str | unicode*) – Name of the key.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the read\_a\_named\_key request.

Return type

dict

`read_role`(*name*, *mount\_point='identity'*)[[source]](_modules/hvac/api/secrets_engines/identity.html#Identity.read_role)[¶](#hvac.api.secrets_engines.Identity.read_role "Permalink to this definition")

Query a role and returns its configuration.

Supported methods:GET: {mount\_point}/oidc/role/:name.

Parameters

* **name** (*str | unicode*) – Name of the role.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the read\_a\_role request.

Return type

dict

`read_tokens_backend_configuration`(*mount\_point='identity'*)[[source]](_modules/hvac/api/secrets_engines/identity.html#Identity.read_tokens_backend_configuration)[¶](#hvac.api.secrets_engines.Identity.read_tokens_backend_configuration "Permalink to this definition")

Query vault identity tokens configurations.

Supported methods:GET: {mount\_point}/oidc/config.

Returns

The response of the read\_tokens\_backend\_configuration request.

Return type

dict

`read_well_known_configurations`(*mount\_point='identity'*)[[source]](_modules/hvac/api/secrets_engines/identity.html#Identity.read_well_known_configurations)[¶](#hvac.api.secrets_engines.Identity.read_well_known_configurations "Permalink to this definition")

Retrieve a set of claims about the identity tokens’ configuration.

The response is a compliant OpenID Provider Configuration Response.

Supported methods:GET: {mount\_point}/oidc/.well-known/openid-configuration.

Parameters

**mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the read\_well\_known\_configurations request.

Return type

dict

`rotate_named_key`(*name*, *verification\_ttl*, *mount\_point='identity'*)[[source]](_modules/hvac/api/secrets_engines/identity.html#Identity.rotate_named_key)[¶](#hvac.api.secrets_engines.Identity.rotate_named_key "Permalink to this definition")

Rotate a named key.

Supported methods:POST: {mount\_point}/oidc/key/:name/rotate.

Parameters

* **name** (*str | unicode*) – Name of the key to be rotated.

* **verification\_ttl** (*str | unicode*) – Controls how long the public portion of the key will be available for verification after being rotated.

Setting verification\_ttl here will override the verification\_ttl set on the key.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the rotate\_a\_named\_key request.

Return type

dict

`update_entity`(*entity\_id*, *name=None*, *metadata=None*, *policies=None*, *disabled=None*, *mount\_point='identity'*)[[source]](_modules/hvac/api/secrets_engines/identity.html#Identity.update_entity)[¶](#hvac.api.secrets_engines.Identity.update_entity "Permalink to this definition")

Update an existing entity.

Supported methods:POST: /{mount\_point}/entity/id/{id}. Produces: 200 application/json

Parameters

* **entity\_id** (*str | unicode*) – Identifier of the entity.

* **name** (*str | unicode*) – Name of the entity.

* **metadata** (*dict*) – Metadata to be associated with the entity.

* **policies** (*str | unicode*) – Policies to be tied to the entity.

* **disabled** (*bool*) – Whether the entity is disabled. Disabled entities’ associated tokens cannot be used, but

are not revoked.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response where available, otherwise the generic response object, of the request.

Return type

dict | requests.Response

`update_entity_alias`(*alias\_id*, *name*, *canonical\_id*, *mount\_accessor*, *mount\_point='identity'*)[[source]](_modules/hvac/api/secrets_engines/identity.html#Identity.update_entity_alias)[¶](#hvac.api.secrets_engines.Identity.update_entity_alias "Permalink to this definition")

Update an existing entity alias.

Supported methods:POST: /{mount\_point}/entity-alias/id/{id}. Produces: 200 application/json

Parameters

* **alias\_id** (*str | unicode*) – Identifier of the entity alias.

* **name** (*str | unicode*) – Name of the alias. Name should be the identifier of the client in the authentication source. For

example, if the alias belongs to userpass backend, the name should be a valid username within userpass

backend. If alias belongs to GitHub, it should be the GitHub username.

* **canonical\_id** (*str | unicode*) – Entity ID to which this alias belongs to.

* **mount\_accessor** (*str | unicode*) – Accessor of the mount to which the alias should belong to.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response where available, otherwise the generic response object, of the request.

Return type

dict | requests.Response

`update_group`(*group\_id*, *name*, *group\_type='internal'*, *metadata=None*, *policies=None*, *member\_group\_ids=None*, *member\_entity\_ids=None*, *mount\_point='identity'*)[[source]](_modules/hvac/api/secrets_engines/identity.html#Identity.update_group)[¶](#hvac.api.secrets_engines.Identity.update_group "Permalink to this definition")

Update an existing group.

Supported methods:POST: /{mount\_point}/group/id/{id}. Produces: 200 application/json

Parameters

* **group\_id** (*str | unicode*) – Identifier of the entity.

* **name** (*str | unicode*) – Name of the group.

* **group\_type** (*str | unicode*) – Type of the group, internal or external. Defaults to internal.

* **metadata** (*dict*) – Metadata to be associated with the group.

* **policies** (*str | unicode*) – Policies to be tied to the group.

* **member\_group\_ids** (*str | unicode*) – Group IDs to be assigned as group members.

* **member\_entity\_ids** (*str | unicode*) – Entity IDs to be assigned as group members.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response where available, otherwise the generic response object, of the request.

Return type

dict | requests.Response

`update_group_alias`(*entity\_id*, *name*, *mount\_accessor=None*, *canonical\_id=None*, *mount\_point='identity'*)[[source]](_modules/hvac/api/secrets_engines/identity.html#Identity.update_group_alias)[¶](#hvac.api.secrets_engines.Identity.update_group_alias "Permalink to this definition")

Update an existing group alias.

Supported methods:POST: /{mount\_point}/group-alias/id/{id}. Produces: 200 application/json

Parameters

* **entity\_id** (*str | unicode*) – ID of the group alias.

* **name** (*str | unicode*) – Name of the group alias.

* **mount\_accessor** (*str | unicode*) – Mount accessor to which this alias belongs

toMount accessor to which this alias belongs to.

* **canonical\_id** (*str | unicode*) – ID of the group to which this is an alias.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the request.

Return type

requests.Response

*static* `validate_member_id_params_for_group_type`(*group\_type*, *params*, *member\_group\_ids*, *member\_entity\_ids*)[[source]](_modules/hvac/api/secrets_engines/identity.html#Identity.validate_member_id_params_for_group_type)[¶](#hvac.api.secrets_engines.Identity.validate_member_id_params_for_group_type "Permalink to this definition")

Determine whether member ID parameters can be sent with a group create / update request.

These parameters are only allowed for the internal group type. If they’re set for an external group type, Vault

returns a “error” response.

Parameters

* **group\_type** (*str | unicode*) – Type of the group, internal or external

* **params** (*dict*) – Params dict to conditionally add the member entity/group ID’s to.

* **member\_group\_ids** (*str | unicode*) – Group IDs to be assigned as group members.

* **member\_entity\_ids** (*str | unicode*) – Entity IDs to be assigned as group members.

Returns

Params dict with conditionally added member entity/group ID’s.

Return type

dict

*class* `hvac.api.secrets_engines.``Kv`(*adapter*, *default\_kv\_version='2'*)[[source]](_modules/hvac/api/secrets_engines/kv.html#Kv)[¶](#hvac.api.secrets_engines.Kv "Permalink to this definition")

Bases: `hvac.api.vault\_api\_base.VaultApiBase`

Class containing methods for the key/value secrets\_engines backend API routes.

Reference: <https://www.vaultproject.io/docs/secrets/kv/index.html>

**Methods**

| [`\_\_init\_\_`](#hvac.api.secrets_engines.Kv.__init__ "hvac.api.secrets_engines.Kv.__init__")(adapter[, default\_kv\_version]) | Create a new Kv instance. |

**Attributes**

| [`allowed\_kv\_versions`](#hvac.api.secrets_engines.Kv.allowed_kv_versions "hvac.api.secrets_engines.Kv.allowed_kv_versions") | Built-in mutable sequence. |

| [`default\_kv\_version`](#hvac.api.secrets_engines.Kv.default_kv_version "hvac.api.secrets_engines.Kv.default_kv_version") |  |

| [`v1`](#hvac.api.secrets_engines.Kv.v1 "hvac.api.secrets_engines.Kv.v1") | Accessor for kv version 1 class / method. |

| [`v2`](#hvac.api.secrets_engines.Kv.v2 "hvac.api.secrets_engines.Kv.v2") | Accessor for kv version 2 class / method. |

`__init__`(*adapter*, *default\_kv\_version='2'*)[[source]](_modules/hvac/api/secrets_engines/kv.html#Kv.__init__)[¶](#hvac.api.secrets_engines.Kv.__init__ "Permalink to this definition")

Create a new Kv instance.

Parameters

* **adapter** ([*hvac.adapters.Adapter*](index.html#hvac.adapters.Adapter "hvac.adapters.Adapter")) – Instance of [`hvac.adapters.Adapter`](index.html#hvac.adapters.Adapter "hvac.adapters.Adapter"); used for performing HTTP requests.

* **default\_kv\_version** (*str | unicode*) – KV version number (e.g., ‘1’) to use as the default when accessing attributes/methods

under this class.

`allowed_kv_versions` *= ['1', '2']*[¶](#hvac.api.secrets_engines.Kv.allowed_kv_versions "Permalink to this definition")

*property* `default_kv_version`[¶](#hvac.api.secrets_engines.Kv.default_kv_version "Permalink to this definition")

*property* `v1`[¶](#hvac.api.secrets_engines.Kv.v1 "Permalink to this definition")

Accessor for kv version 1 class / method. Provided via the `hvac.api.secrets\_engines.kv\_v1.KvV1` class.

Returns

This Kv instance’s associated KvV1 instance.

Return type

hvac.api.secrets\_engines.kv\_v1.KvV1

*property* `v2`[¶](#hvac.api.secrets_engines.Kv.v2 "Permalink to this definition")

Accessor for kv version 2 class / method. Provided via the `hvac.api.secrets\_engines.kv\_v2.KvV2` class.

Returns

This Kv instance’s associated KvV2 instance.

Return type

hvac.api.secrets\_engines.kv\_v2.KvV2

*class* `hvac.api.secrets_engines.``KvV1`(*adapter*)[[source]](_modules/hvac/api/secrets_engines/kv_v1.html#KvV1)[¶](#hvac.api.secrets_engines.KvV1 "Permalink to this definition")

Bases: `hvac.api.vault\_api\_base.VaultApiBase`

KV Secrets Engine - Version 1 (API).

Reference: <https://www.vaultproject.io/api/secrets/kv/kv-v1.html>

**Methods**

| [`create\_or\_update\_secret`](#hvac.api.secrets_engines.KvV1.create_or_update_secret "hvac.api.secrets_engines.KvV1.create_or_update_secret")(path, secret[, …]) | Store a secret at the specified location. |

| [`delete\_secret`](#hvac.api.secrets_engines.KvV1.delete_secret "hvac.api.secrets_engines.KvV1.delete_secret")(path[, mount\_point]) | Delete the secret at the specified location. |

| [`list\_secrets`](#hvac.api.secrets_engines.KvV1.list_secrets "hvac.api.secrets_engines.KvV1.list_secrets")(path[, mount\_point]) | Return a list of key names at the specified location. |

| [`read\_secret`](#hvac.api.secrets_engines.KvV1.read_secret "hvac.api.secrets_engines.KvV1.read_secret")(path[, mount\_point]) | Retrieve the secret at the specified location. |

`create_or_update_secret`(*path*, *secret*, *method=None*, *mount\_point='secret'*)[[source]](_modules/hvac/api/secrets_engines/kv_v1.html#KvV1.create_or_update_secret)[¶](#hvac.api.secrets_engines.KvV1.create_or_update_secret "Permalink to this definition")

Store a secret at the specified location.

If the value does not yet exist, the calling token must have an ACL policy granting the create capability.

If the value already exists, the calling token must have an ACL policy granting the update capability.

Supported methods:POST: /{mount\_point}/{path}. Produces: 204 (empty body)

PUT: /{mount\_point}/{path}. Produces: 204 (empty body)

Parameters

* **path** (*str | unicode*) – Specifies the path of the secrets to create/update. This is specified as part of the URL.

* **secret** (*dict*) – Specifies keys, paired with associated values, to be held at the given location. Multiple

key/value pairs can be specified, and all will be returned on a read operation. A key called ttl will

trigger some special behavior. See the Vault KV secrets engine documentation for details.

* **method** (*str | unicode*) – Optional parameter to explicitly request a POST (create) or PUT (update) request to the selected

kv secret engine. If no argument is provided for this parameter, hvac attempts to intelligently determine

which method is appropriate.

* **mount\_point** (*str | unicode*) – The “path” the secret engine was mounted on.

Returns

The response of the create\_or\_update\_secret request.

Return type

requests.Response

`delete_secret`(*path*, *mount\_point='secret'*)[[source]](_modules/hvac/api/secrets_engines/kv_v1.html#KvV1.delete_secret)[¶](#hvac.api.secrets_engines.KvV1.delete_secret "Permalink to this definition")

Delete the secret at the specified location.

Supported methods:DELETE: /{mount\_point}/{path}. Produces: 204 (empty body)

Parameters

* **path** (*str | unicode*) – Specifies the path of the secret to delete.

This is specified as part of the URL.

* **mount\_point** (*str | unicode*) – The “path” the secret engine was mounted on.

Returns

The response of the delete\_secret request.

Return type

requests.Response

`list_secrets`(*path*, *mount\_point='secret'*)[[source]](_modules/hvac/api/secrets_engines/kv_v1.html#KvV1.list_secrets)[¶](#hvac.api.secrets_engines.KvV1.list_secrets "Permalink to this definition")

Return a list of key names at the specified location.

Folders are suffixed with /. The input must be a folder; list on a file will not return a value. Note that no

policy-based filtering is performed on keys; do not encode sensitive information in key names. The values

themselves are not accessible via this command.

Supported methods:LIST: /{mount\_point}/{path}. Produces: 200 application/json

Parameters

* **path** (*str | unicode*) – Specifies the path of the secrets to list.

This is specified as part of the URL.

* **mount\_point** (*str | unicode*) – The “path” the secret engine was mounted on.

Returns

The JSON response of the list\_secrets request.

Return type

dict

`read_secret`(*path*, *mount\_point='secret'*)[[source]](_modules/hvac/api/secrets_engines/kv_v1.html#KvV1.read_secret)[¶](#hvac.api.secrets_engines.KvV1.read_secret "Permalink to this definition")

Retrieve the secret at the specified location.

Supported methods:GET: /{mount\_point}/{path}. Produces: 200 application/json

Parameters

* **path** (*str | unicode*) – Specifies the path of the secret to read. This is specified as part of the URL.

* **mount\_point** (*str | unicode*) – The “path” the secret engine was mounted on.

Returns

The JSON response of the read\_secret request.

Return type

dict

*class* `hvac.api.secrets_engines.``KvV2`(*adapter*)[[source]](_modules/hvac/api/secrets_engines/kv_v2.html#KvV2)[¶](#hvac.api.secrets_engines.KvV2 "Permalink to this definition")

Bases: `hvac.api.vault\_api\_base.VaultApiBase`

KV Secrets Engine - Version 2 (API).

Reference: <https://www.vaultproject.io/api/secret/kv/kv-v2.html>

**Methods**

| [`configure`](#hvac.api.secrets_engines.KvV2.configure "hvac.api.secrets_engines.KvV2.configure")([max\_versions, cas\_required, …]) | Configure backend level settings that are applied to every key in the key-value store. |

| [`create\_or\_update\_secret`](#hvac.api.secrets_engines.KvV2.create_or_update_secret "hvac.api.secrets_engines.KvV2.create_or_update_secret")(path, secret[, cas, …]) | Create a new version of a secret at the specified location. |

| [`delete\_latest\_version\_of\_secret`](#hvac.api.secrets_engines.KvV2.delete_latest_version_of_secret "hvac.api.secrets_engines.KvV2.delete_latest_version_of_secret")(path[, …]) | Issue a soft delete of the secret’s latest version at the specified location. |

| [`delete\_metadata\_and\_all\_versions`](#hvac.api.secrets_engines.KvV2.delete_metadata_and_all_versions "hvac.api.secrets_engines.KvV2.delete_metadata_and_all_versions")(path[, …]) | Delete (permanently) the key metadata and all version data for the specified key. |

| [`delete\_secret\_versions`](#hvac.api.secrets_engines.KvV2.delete_secret_versions "hvac.api.secrets_engines.KvV2.delete_secret_versions")(path, versions[, …]) | Issue a soft delete of the specified versions of the secret. |

| [`destroy\_secret\_versions`](#hvac.api.secrets_engines.KvV2.destroy_secret_versions "hvac.api.secrets_engines.KvV2.destroy_secret_versions")(path, versions[, …]) | Permanently remove the specified version data and numbers for the provided path from the key-value store. |

| [`list\_secrets`](#hvac.api.secrets_engines.KvV2.list_secrets "hvac.api.secrets_engines.KvV2.list_secrets")(path[, mount\_point]) | Return a list of key names at the specified location. |

| [`patch`](#hvac.api.secrets_engines.KvV2.patch "hvac.api.secrets_engines.KvV2.patch")(path, secret[, mount\_point]) | Set or update data in the KV store without overwriting. |

| [`read\_configuration`](#hvac.api.secrets_engines.KvV2.read_configuration "hvac.api.secrets_engines.KvV2.read_configuration")([mount\_point]) | Read the KV Version 2 configuration. |

| [`read\_secret`](#hvac.api.secrets_engines.KvV2.read_secret "hvac.api.secrets_engines.KvV2.read_secret")(path[, mount\_point]) |  |

| [`read\_secret\_metadata`](#hvac.api.secrets_engines.KvV2.read_secret_metadata "hvac.api.secrets_engines.KvV2.read_secret_metadata")(path[, mount\_point]) | Retrieve the metadata and versions for the secret at the specified path. |

| [`read\_secret\_version`](#hvac.api.secrets_engines.KvV2.read_secret_version "hvac.api.secrets_engines.KvV2.read_secret_version")(path[, version, mount\_point]) | Retrieve the secret at the specified location. |

| [`undelete\_secret\_versions`](#hvac.api.secrets_engines.KvV2.undelete_secret_versions "hvac.api.secrets_engines.KvV2.undelete_secret_versions")(path, versions[, …]) | Undelete the data for the provided version and path in the key-value store. |

| [`update\_metadata`](#hvac.api.secrets_engines.KvV2.update_metadata "hvac.api.secrets_engines.KvV2.update_metadata")(path[, max\_versions, …]) | Updates the max\_versions of cas\_required setting on an existing path. |

`configure`(*max\_versions=10*, *cas\_required=None*, *delete\_version\_after='0s'*, *mount\_point='secret'*)[[source]](_modules/hvac/api/secrets_engines/kv_v2.html#KvV2.configure)[¶](#hvac.api.secrets_engines.KvV2.configure "Permalink to this definition")

Configure backend level settings that are applied to every key in the key-value store.

Supported methods:POST: /{mount\_point}/config. Produces: 204 (empty body)

Parameters

* **max\_versions** (*int*) – The number of versions to keep per key. This value applies to all keys, but a key’s

metadata setting can overwrite this value. Once a key has more than the configured allowed versions the

oldest version will be permanently deleted. Defaults to 10.

* **cas\_required** (*bool*) – If true all keys will require the cas parameter to be set on all write requests.

* **mount\_point** (*str | unicode*) – The “path” the secret engine was mounted on.

* **delete\_version\_after** (*str*) – Specifies the length of time before a version is deleted. Accepts Go duration format string.

Defaults to “0s” (i.e., disabled).

Returns

The response of the request.

Return type

requests.Response

`create_or_update_secret`(*path*, *secret*, *cas=None*, *mount\_point='secret'*)[[source]](_modules/hvac/api/secrets_engines/kv_v2.html#KvV2.create_or_update_secret)[¶](#hvac.api.secrets_engines.KvV2.create_or_update_secret "Permalink to this definition")

Create a new version of a secret at the specified location.

If the value does not yet exist, the calling token must have an ACL policy granting the create capability. If

the value already exists, the calling token must have an ACL policy granting the update capability.

Supported methods:POST: /{mount\_point}/data/{path}. Produces: 200 application/json

Parameters

* **path** (*str | unicode*) – Path

* **cas** (*int*) – Set the “cas” value to use a Check-And-Set operation. If not set the write will be allowed. If set

to 0 a write will only be allowed if the key doesn’t exist. If the index is non-zero the write will only be

allowed if the key’s current version matches the version specified in the cas parameter.

* **secret** (*dict*) – The contents of the “secret” dict will be stored and returned on read.

* **mount\_point** (*str | unicode*) – The “path” the secret engine was mounted on.

Returns

The JSON response of the request.

Return type

dict

`delete_latest_version_of_secret`(*path*, *mount\_point='secret'*)[[source]](_modules/hvac/api/secrets_engines/kv_v2.html#KvV2.delete_latest_version_of_secret)[¶](#hvac.api.secrets_engines.KvV2.delete_latest_version_of_secret "Permalink to this definition")

Issue a soft delete of the secret’s latest version at the specified location.

This marks the version as deleted and will stop it from being returned from reads, but the underlying data will

not be removed. A delete can be undone using the undelete path.

Supported methods:DELETE: /{mount\_point}/data/{path}. Produces: 204 (empty body)

Parameters

* **path** (*str | unicode*) – Specifies the path of the secret to delete. This is specified as part of the URL.

* **mount\_point** (*str | unicode*) – The “path” the secret engine was mounted on.

Returns

The response of the request.

Return type

requests.Response

`delete_metadata_and_all_versions`(*path*, *mount\_point='secret'*)[[source]](_modules/hvac/api/secrets_engines/kv_v2.html#KvV2.delete_metadata_and_all_versions)[¶](#hvac.api.secrets_engines.KvV2.delete_metadata_and_all_versions "Permalink to this definition")

Delete (permanently) the key metadata and all version data for the specified key.

All version history will be removed.

Supported methods:DELETE: /{mount\_point}/metadata/{path}. Produces: 204 (empty body)

Parameters

* **path** (*str | unicode*) – Specifies the path of the secret to delete. This is specified as part of the URL.

* **mount\_point** (*str | unicode*) – The “path” the secret engine was mounted on.

Returns

The response of the request.

Return type

requests.Response

`delete_secret_versions`(*path*, *versions*, *mount\_point='secret'*)[[source]](_modules/hvac/api/secrets_engines/kv_v2.html#KvV2.delete_secret_versions)[¶](#hvac.api.secrets_engines.KvV2.delete_secret_versions "Permalink to this definition")

Issue a soft delete of the specified versions of the secret.

This marks the versions as deleted and will stop them from being returned from reads,

but the underlying data will not be removed. A delete can be undone using the

undelete path.

Supported methods:POST: /{mount\_point}/delete/{path}. Produces: 204 (empty body)

Parameters

* **path** (*str | unicode*) – Specifies the path of the secret to delete. This is specified as part of the URL.

* **versions** (*int*) – The versions to be deleted. The versioned data will not be deleted, but it will no longer be

returned in normal get requests.

* **mount\_point** (*str | unicode*) – The “path” the secret engine was mounted on.

Returns

The response of the request.

Return type

requests.Response

`destroy_secret_versions`(*path*, *versions*, *mount\_point='secret'*)[[source]](_modules/hvac/api/secrets_engines/kv_v2.html#KvV2.destroy_secret_versions)[¶](#hvac.api.secrets_engines.KvV2.destroy_secret_versions "Permalink to this definition")

Permanently remove the specified version data and numbers for the provided path from the key-value store.

Supported methods:POST: /{mount\_point}/destroy/{path}. Produces: 204 (empty body)

Parameters

* **path** (*str | unicode*) – Specifies the path of the secret to destroy.

This is specified as part of the URL.

* **versions** (*list of int*) – The versions to destroy. Their data will be

permanently deleted.

* **mount\_point** (*str | unicode*) – The “path” the secret engine was mounted on.

Returns

The response of the request.

Return type

requests.Response

`list_secrets`(*path*, *mount\_point='secret'*)[[source]](_modules/hvac/api/secrets_engines/kv_v2.html#KvV2.list_secrets)[¶](#hvac.api.secrets_engines.KvV2.list_secrets "Permalink to this definition")

Return a list of key names at the specified location.

Folders are suffixed with /. The input must be a folder; list on a file will not return a value. Note that no

policy-based filtering is performed on keys; do not encode sensitive information in key names. The values

themselves are not accessible via this command.

Supported methods:LIST: /{mount\_point}/metadata/{path}. Produces: 200 application/json

Parameters

* **path** (*str | unicode*) – Specifies the path of the secrets to list. This is specified as part of the URL.

* **mount\_point** (*str | unicode*) – The “path” the secret engine was mounted on.

Returns

The JSON response of the request.

Return type

dict

`patch`(*path*, *secret*, *mount\_point='secret'*)[[source]](_modules/hvac/api/secrets_engines/kv_v2.html#KvV2.patch)[¶](#hvac.api.secrets_engines.KvV2.patch "Permalink to this definition")

Set or update data in the KV store without overwriting.

Parameters

* **path** (*str | unicode*) – Path

* **secret** (*dict*) – The contents of the “secret” dict will be stored and returned on read.

* **mount\_point** (*str | unicode*) – The “path” the secret engine was mounted on.

Returns

The JSON response of the create\_or\_update\_secret request.

Return type

dict

`read_configuration`(*mount\_point='secret'*)[[source]](_modules/hvac/api/secrets_engines/kv_v2.html#KvV2.read_configuration)[¶](#hvac.api.secrets_engines.KvV2.read_configuration "Permalink to this definition")

Read the KV Version 2 configuration.

Supported methods:GET: /auth/{mount\_point}/config. Produces: 200 application/json

Parameters

**mount\_point** (*str | unicode*) – The “path” the secret engine was mounted on.

Returns

The JSON response of the request.

Return type

dict

`read_secret`(*path*, *mount\_point='secret'*)[[source]](_modules/hvac/api/secrets_engines/kv_v2.html#KvV2.read_secret)[¶](#hvac.api.secrets_engines.KvV2.read_secret "Permalink to this definition")

`read_secret_metadata`(*path*, *mount\_point='secret'*)[[source]](_modules/hvac/api/secrets_engines/kv_v2.html#KvV2.read_secret_metadata)[¶](#hvac.api.secrets_engines.KvV2.read_secret_metadata "Permalink to this definition")

Retrieve the metadata and versions for the secret at the specified path.

Supported methods:GET: /{mount\_point}/metadata/{path}. Produces: 200 application/json

Parameters

* **path** (*str | unicode*) – Specifies the path of the secret to read. This is specified as part of the URL.

* **mount\_point** (*str | unicode*) – The “path” the secret engine was mounted on.

Returns

The JSON response of the request.

Return type

dict

`read_secret_version`(*path*, *version=None*, *mount\_point='secret'*)[[source]](_modules/hvac/api/secrets_engines/kv_v2.html#KvV2.read_secret_version)[¶](#hvac.api.secrets_engines.KvV2.read_secret_version "Permalink to this definition")

Retrieve the secret at the specified location.

Supported methods:GET: /{mount\_point}/data/{path}. Produces: 200 application/json

Parameters

* **path** (*str | unicode*) – Specifies the path of the secret to read. This is specified as part of the URL.

* **version** (*int*) – Specifies the version to return. If not set the latest version is returned.

* **mount\_point** (*str | unicode*) – The “path” the secret engine was mounted on.

Returns

The JSON response of the request.

Return type

dict

`undelete_secret_versions`(*path*, *versions*, *mount\_point='secret'*)[[source]](_modules/hvac/api/secrets_engines/kv_v2.html#KvV2.undelete_secret_versions)[¶](#hvac.api.secrets_engines.KvV2.undelete_secret_versions "Permalink to this definition")

Undelete the data for the provided version and path in the key-value store.

This restores the data, allowing it to be returned on get requests.

Supported methods:POST: /{mount\_point}/undelete/{path}. Produces: 204 (empty body)

Parameters

* **path** (*str | unicode*) – Specifies the path of the secret to undelete. This is specified as part of the URL.

* **versions** (*list of int*) – The versions to undelete. The versions will be restored and their data will be returned on

normal get requests.

* **mount\_point** (*str | unicode*) – The “path” the secret engine was mounted on.

Returns

The response of the request.

Return type

requests.Response

`update_metadata`(*path*, *max\_versions=None*, *cas\_required=None*, *delete\_version\_after='0s'*, *mount\_point='secret'*)[[source]](_modules/hvac/api/secrets_engines/kv_v2.html#KvV2.update_metadata)[¶](#hvac.api.secrets_engines.KvV2.update_metadata "Permalink to this definition")

Updates the max\_versions of cas\_required setting on an existing path.

Supported methods:POST: /{mount\_point}/metadata/{path}. Produces: 204 (empty body)

Parameters

* **path** (*str | unicode*) – Path

* **max\_versions** (*int*) – The number of versions to keep per key. If not set, the backend’s configured max version is

used. Once a key has more than the configured allowed versions the oldest version will be permanently

deleted.

* **cas\_required** (*bool*) – If true the key will require the cas parameter to be set on all write requests. If false,

the backend’s configuration will be used.

* **delete\_version\_after** (*str*) – Specifies the length of time before a version is deleted. Accepts Go duration format string.

Defaults to “0s” (i.e., disabled).

* **mount\_point** (*str | unicode*) – The “path” the secret engine was mounted on.

Returns

The response of the request.

Return type

requests.Response

*class* `hvac.api.secrets_engines.``Pki`(*adapter*)[[source]](_modules/hvac/api/secrets_engines/pki.html#Pki)[¶](#hvac.api.secrets_engines.Pki "Permalink to this definition")

Bases: `hvac.api.vault\_api\_base.VaultApiBase`

Pki Secrets Engine (API).

Reference: <https://www.vaultproject.io/api/secret/pki/index.html>

**Methods**

| [`create\_or\_update\_role`](#hvac.api.secrets_engines.Pki.create_or_update_role "hvac.api.secrets_engines.Pki.create_or_update_role")(name[, extra\_params, …]) | Create/Update Role. |

| [`delete\_role`](#hvac.api.secrets_engines.Pki.delete_role "hvac.api.secrets_engines.Pki.delete_role")(name[, mount\_point]) | Delete Role. |

| [`delete\_root`](#hvac.api.secrets_engines.Pki.delete_root "hvac.api.secrets_engines.Pki.delete_root")([mount\_point]) | Delete Root. |

| [`generate\_certificate`](#hvac.api.secrets_engines.Pki.generate_certificate "hvac.api.secrets_engines.Pki.generate_certificate")(name, common\_name[, …]) | Generate Certificate. |

| [`generate\_intermediate`](#hvac.api.secrets_engines.Pki.generate_intermediate "hvac.api.secrets_engines.Pki.generate_intermediate")(type, common\_name[, …]) | Generate Intermediate. |

| [`generate\_root`](#hvac.api.secrets_engines.Pki.generate_root "hvac.api.secrets_engines.Pki.generate_root")(type, common\_name[, …]) | Generate Root. |

| [`list\_certificates`](#hvac.api.secrets_engines.Pki.list_certificates "hvac.api.secrets_engines.Pki.list_certificates")([mount\_point]) | List Certificates. |

| [`list\_roles`](#hvac.api.secrets_engines.Pki.list_roles "hvac.api.secrets_engines.Pki.list_roles")([mount\_point]) | List Roles. |

| [`read\_ca\_certificate`](#hvac.api.secrets_engines.Pki.read_ca_certificate "hvac.api.secrets_engines.Pki.read_ca_certificate")([mount\_point]) | Read CA Certificate. |

| [`read\_ca\_certificate\_chain`](#hvac.api.secrets_engines.Pki.read_ca_certificate_chain "hvac.api.secrets_engines.Pki.read_ca_certificate_chain")([mount\_point]) | Read CA Certificate Chain. |

| [`read\_certificate`](#hvac.api.secrets_engines.Pki.read_certificate "hvac.api.secrets_engines.Pki.read_certificate")(serial[, mount\_point]) | Read Certificate. |

| [`read\_crl`](#hvac.api.secrets_engines.Pki.read_crl "hvac.api.secrets_engines.Pki.read_crl")([mount\_point]) | Read CRL. |

| [`read\_crl\_configuration`](#hvac.api.secrets_engines.Pki.read_crl_configuration "hvac.api.secrets_engines.Pki.read_crl_configuration")([mount\_point]) | Read CRL Configuration. |

| [`read\_role`](#hvac.api.secrets_engines.Pki.read_role "hvac.api.secrets_engines.Pki.read_role")(name[, mount\_point]) | Read Role. |

| [`read\_urls`](#hvac.api.secrets_engines.Pki.read_urls "hvac.api.secrets_engines.Pki.read_urls")([mount\_point]) | Read URLs. |

| [`revoke\_certificate`](#hvac.api.secrets_engines.Pki.revoke_certificate "hvac.api.secrets_engines.Pki.revoke_certificate")(serial\_number[, mount\_point]) | Revoke Certificate. |

| [`rotate\_crl`](#hvac.api.secrets_engines.Pki.rotate_crl "hvac.api.secrets_engines.Pki.rotate_crl")([mount\_point]) | Rotate CRLs. |

| [`set\_crl\_configuration`](#hvac.api.secrets_engines.Pki.set_crl_configuration "hvac.api.secrets_engines.Pki.set_crl_configuration")([expiry, disable, …]) | Set CRL Configuration. |

| [`set\_signed\_intermediate`](#hvac.api.secrets_engines.Pki.set_signed_intermediate "hvac.api.secrets_engines.Pki.set_signed_intermediate")(certificate[, …]) | Set Signed Intermediate. |

| [`set\_urls`](#hvac.api.secrets_engines.Pki.set_urls "hvac.api.secrets_engines.Pki.set_urls")(params[, mount\_point]) | Set URLs. |

| [`sign\_certificate`](#hvac.api.secrets_engines.Pki.sign_certificate "hvac.api.secrets_engines.Pki.sign_certificate")(name, csr, common\_name[, …]) | Sign Certificate. |

| [`sign\_intermediate`](#hvac.api.secrets_engines.Pki.sign_intermediate "hvac.api.secrets_engines.Pki.sign_intermediate")(csr, common\_name[, …]) | Sign Intermediate. |

| [`sign\_self\_issued`](#hvac.api.secrets_engines.Pki.sign_self_issued "hvac.api.secrets_engines.Pki.sign_self_issued")(certificate[, mount\_point]) | Sign Self-Issued. |

| [`sign\_verbatim`](#hvac.api.secrets_engines.Pki.sign_verbatim "hvac.api.secrets_engines.Pki.sign_verbatim")(csr[, name, extra\_params, …]) | Sign Verbatim. |

| [`submit\_ca\_information`](#hvac.api.secrets_engines.Pki.submit_ca_information "hvac.api.secrets_engines.Pki.submit_ca_information")(pem\_bundle[, mount\_point]) | Submit CA Information. |

| [`tidy`](#hvac.api.secrets_engines.Pki.tidy "hvac.api.secrets_engines.Pki.tidy")([extra\_params, mount\_point]) | Tidy. |

`create_or_update_role`(*name*, *extra\_params=None*, *mount\_point='pki'*)[[source]](_modules/hvac/api/secrets_engines/pki.html#Pki.create_or_update_role)[¶](#hvac.api.secrets_engines.Pki.create_or_update_role "Permalink to this definition")

Create/Update Role.

Creates or updates the role definition.

Supported methods:POST: /{mount\_point}/roles/{name}. Produces: 200 application/json

Parameters

* **name** – The name of the role to create.

* **extra\_params** – A dictionary with extra parameters.

* **mount\_point** – The “path” the method/backend was mounted on.

Name name

str | unicode

Name extra\_params

dict

Name mount\_point

str | unicode

Returns

The JSON response of the request.

Rname

requests.Response

`delete_role`(*name*, *mount\_point='pki'*)[[source]](_modules/hvac/api/secrets_engines/pki.html#Pki.delete_role)[¶](#hvac.api.secrets_engines.Pki.delete_role "Permalink to this definition")

Delete Role.

Deletes the role definition.

Supported methods:DELETE: /{mount\_point}/roles/{name}. Produces: 200 application/json

Parameters

* **name** – The name of the role to delete.

* **mount\_point** – The “path” the method/backend was mounted on.

Name name

str | unicode

Name mount\_point

str | unicode

Returns

The JSON response of the request.

Return type

requests.Response

`delete_root`(*mount\_point='pki'*)[[source]](_modules/hvac/api/secrets_engines/pki.html#Pki.delete_root)[¶](#hvac.api.secrets_engines.Pki.delete_root "Permalink to this definition")

Delete Root.

Deletes the current CA key.

Supported methods:DELETE: /{mount\_point}/root. Produces: 200 application/json

Parameters

**mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

requests.Response

`generate_certificate`(*name*, *common\_name*, *extra\_params=None*, *mount\_point='pki'*, *wrap\_ttl=None*)[[source]](_modules/hvac/api/secrets_engines/pki.html#Pki.generate_certificate)[¶](#hvac.api.secrets_engines.Pki.generate_certificate "Permalink to this definition")

Generate Certificate.

Generates a new set of credentials (private key and certificate) based on the role named in the endpoint.

Supported methods:POST: /{mount\_point}/issue/{name}. Produces: 200 application/json

Parameters

* **name** – The name of the role to create the certificate against.

* **common\_name** – The requested CN for the certificate.

* **extra\_params** – A dictionary with extra parameters.

* **mount\_point** – The “path” the method/backend was mounted on.

* **wrap\_ttl** (*str | unicode*) – Specifies response wrapping token creation with duration. IE: ’15s’, ‘20m’, ‘25h’.

Name name

str | unicode

Name common\_name

str | unicode

Name extra\_params

dict

Name mount\_point

str | unicode

Returns

The JSON response of the request.

Return type

requests.Response

`generate_intermediate`(*type*, *common\_name*, *extra\_params=None*, *mount\_point='pki'*, *wrap\_ttl=None*)[[source]](_modules/hvac/api/secrets_engines/pki.html#Pki.generate_intermediate)[¶](#hvac.api.secrets_engines.Pki.generate_intermediate "Permalink to this definition")

Generate Intermediate.

Generates a new private key and a CSR for signing.

Supported methods:POST: /{mount\_point}/intermediate/generate/{type}. Produces: 200 application/json

Parameters

* **type** (*str | unicode*) – Specifies the type to create. exported (private key also exported) or internal.

* **common\_name** (*str | unicode*) – Specifies the requested CN for the certificate.

* **extra\_params** (*dict*) – Dictionary with extra parameters.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

* **wrap\_ttl** (*str | unicode*) – Specifies response wrapping token creation with duration. IE: ’15s’, ‘20m’, ‘25h’.

Returns

The JSON response of the request.

Return type

requests.Response

`generate_root`(*type*, *common\_name*, *extra\_params=None*, *mount\_point='pki'*, *wrap\_ttl=None*)[[source]](_modules/hvac/api/secrets_engines/pki.html#Pki.generate_root)[¶](#hvac.api.secrets_engines.Pki.generate_root "Permalink to this definition")

Generate Root.

Generates a new self-signed CA certificate and private key.

Supported methods:POST: /{mount\_point}/root/generate/{type}. Produces: 200 application/json

Parameters

* **type** (*str | unicode*) – Specifies the type to create. exported (private key also exported) or internal.

* **common\_name** (*str | unicode*) – The requested CN for the certificate.

* **extra\_params** (*dict*) – A dictionary with extra parameters.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

* **wrap\_ttl** (*str | unicode*) – Specifies response wrapping token creation with duration. IE: ’15s’, ‘20m’, ‘25h’.

Returns

The JSON response of the request.

Return type

requests.Response

`list_certificates`(*mount\_point='pki'*)[[source]](_modules/hvac/api/secrets_engines/pki.html#Pki.list_certificates)[¶](#hvac.api.secrets_engines.Pki.list_certificates "Permalink to this definition")

List Certificates.

The list of the current certificates by serial number only.

Supported methods:LIST: /{mount\_point}/certs. Produces: 200 application/json

Parameters

**mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

`list_roles`(*mount\_point='pki'*)[[source]](_modules/hvac/api/secrets_engines/pki.html#Pki.list_roles)[¶](#hvac.api.secrets_engines.Pki.list_roles "Permalink to this definition")

List Roles.

Get a list of available roles.

Supported methods:LIST: /{mount\_point}/roles. Produces: 200 application/json

Parameters

**mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

`read_ca_certificate`(*mount\_point='pki'*)[[source]](_modules/hvac/api/secrets_engines/pki.html#Pki.read_ca_certificate)[¶](#hvac.api.secrets_engines.Pki.read_ca_certificate "Permalink to this definition")

Read CA Certificate.

Retrieves the CA certificate in raw DER-encoded form.

Supported methods:GET: /{mount\_point}/ca/pem. Produces: String

Parameters

**mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The certificate as pem.

Return type

str

`read_ca_certificate_chain`(*mount\_point='pki'*)[[source]](_modules/hvac/api/secrets_engines/pki.html#Pki.read_ca_certificate_chain)[¶](#hvac.api.secrets_engines.Pki.read_ca_certificate_chain "Permalink to this definition")

Read CA Certificate Chain.

Retrieves the CA certificate chain, including the CA in PEM format.

Supported methods:GET: /{mount\_point}/ca\_chain. Produces: String

Parameters

**mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The certificate chain as pem.

Return type

str

`read_certificate`(*serial*, *mount\_point='pki'*)[[source]](_modules/hvac/api/secrets_engines/pki.html#Pki.read_certificate)[¶](#hvac.api.secrets_engines.Pki.read_certificate "Permalink to this definition")

Read Certificate.

Retrieves one of a selection of certificates.

Supported methods:GET: /{mount\_point}/cert/{serial}. Produces: 200 application/json

Parameters

* **serial** (*str | unicode*) – the serial of the key to read.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

`read_crl`(*mount\_point='pki'*)[[source]](_modules/hvac/api/secrets_engines/pki.html#Pki.read_crl)[¶](#hvac.api.secrets_engines.Pki.read_crl "Permalink to this definition")

Read CRL.

Retrieves the current CRL in PEM format.

This endpoint is an unauthenticated.

Supported methods:GET: /{mount\_point}/crl/pem. Produces: 200 application/pkix-crl

Parameters

**mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The content of the request e.g. CRL string representation.

Return type

str

`read_crl_configuration`(*mount\_point='pki'*)[[source]](_modules/hvac/api/secrets_engines/pki.html#Pki.read_crl_configuration)[¶](#hvac.api.secrets_engines.Pki.read_crl_configuration "Permalink to this definition")

Read CRL Configuration.

Getting the duration for which the generated CRL should be marked valid.

Supported methods:GET: /{mount\_point}/config/crl. Produces: 200 application/json

Parameters

**mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

`read_role`(*name*, *mount\_point='pki'*)[[source]](_modules/hvac/api/secrets_engines/pki.html#Pki.read_role)[¶](#hvac.api.secrets_engines.Pki.read_role "Permalink to this definition")

Read Role.

Queries the role definition.

Supported methods:GET: /{mount\_point}/roles/{name}. Produces: 200 application/json

Parameters

* **name** (*str | unicode*) – The name of the role to read.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

`read_urls`(*mount\_point='pki'*)[[source]](_modules/hvac/api/secrets_engines/pki.html#Pki.read_urls)[¶](#hvac.api.secrets_engines.Pki.read_urls "Permalink to this definition")

Read URLs.

Fetches the URLs to be encoded in generated certificates.

Supported methods:GET: /{mount\_point}/config/urls. Produces: 200 application/json

Parameters

**mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

`revoke_certificate`(*serial\_number*, *mount\_point='pki'*)[[source]](_modules/hvac/api/secrets_engines/pki.html#Pki.revoke_certificate)[¶](#hvac.api.secrets_engines.Pki.revoke_certificate "Permalink to this definition")

Revoke Certificate.

Revokes a certificate using its serial number.

Supported methods:POST: /{mount\_point}/revoke. Produces: 200 application/json

Parameters

* **serial\_number** – The serial number of the certificate to revoke.

* **mount\_point** – The “path” the method/backend was mounted on.

Name serial\_number

str | unicode

Name mount\_point

str | unicode

Returns

The JSON response of the request.

Return type

requests.Response

`rotate_crl`(*mount\_point='pki'*)[[source]](_modules/hvac/api/secrets_engines/pki.html#Pki.rotate_crl)[¶](#hvac.api.secrets_engines.Pki.rotate_crl "Permalink to this definition")

Rotate CRLs.

Forces a rotation of the CRL.

Supported methods:GET: /{mount\_point}/crl/rotate. Produces: 200 application/json

Parameters

**mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

`set_crl_configuration`(*expiry=None*, *disable=None*, *extra\_params=None*, *mount\_point='pki'*)[[source]](_modules/hvac/api/secrets_engines/pki.html#Pki.set_crl_configuration)[¶](#hvac.api.secrets_engines.Pki.set_crl_configuration "Permalink to this definition")

Set CRL Configuration.

Setting the duration for which the generated CRL should be marked valid.

If the CRL is disabled, it will return a signed but zero-length CRL for any

request. If enabled, it will re-build the CRL.

Supported methods:POST: /{mount\_point}/config/crl. Produces: 200 application/json

Parameters

**mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

requests.Response

`set_signed_intermediate`(*certificate*, *mount\_point='pki'*)[[source]](_modules/hvac/api/secrets_engines/pki.html#Pki.set_signed_intermediate)[¶](#hvac.api.secrets_engines.Pki.set_signed_intermediate "Permalink to this definition")

Set Signed Intermediate.

Allows submitting the signed CA certificate corresponding to a private key generated via “Generate Intermediate”

Supported methods:POST: /{mount\_point}/intermediate/set-signed. Produces: 200 application/json

Parameters

* **certificate** (*str | unicode*) – Specifies the certificate in PEM format.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

requests.Response

`set_urls`(*params*, *mount\_point='pki'*)[[source]](_modules/hvac/api/secrets_engines/pki.html#Pki.set_urls)[¶](#hvac.api.secrets_engines.Pki.set_urls "Permalink to this definition")

Set URLs.

Setting the issuing certificate endpoints, CRL distribution points, and OCSP server endpoints that will be

encoded into issued certificates. You can update any of the values at any time without affecting the other

existing values. To remove the values, simply use a blank string as the parameter.

Supported methods:POST: /{mount\_point}/config/urls. Produces: 200 application/json

Parameters

**mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

requests.Response

`sign_certificate`(*name*, *csr*, *common\_name*, *extra\_params=None*, *mount\_point='pki'*)[[source]](_modules/hvac/api/secrets_engines/pki.html#Pki.sign_certificate)[¶](#hvac.api.secrets_engines.Pki.sign_certificate "Permalink to this definition")

Sign Certificate.

Signs a new certificate based upon the provided CSR and the supplied parameters.

Supported methods:POST: /{mount\_point}/sign/{name}. Produces: 200 application/json

Parameters

* **name** (*str | unicode*) – The role to sign the certificate.

* **csr** (*str | unicode*) – The PEM-encoded CSR.

* **common\_name** (*str | unicode*) – The requested CN for the certificate. If the CN is allowed by role policy, it will be issued.

* **extra\_params** (*dict*) – A dictionary with extra parameters.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

requests.Response

`sign_intermediate`(*csr*, *common\_name*, *extra\_params=None*, *mount\_point='pki'*)[[source]](_modules/hvac/api/secrets_engines/pki.html#Pki.sign_intermediate)[¶](#hvac.api.secrets_engines.Pki.sign_intermediate "Permalink to this definition")

Sign Intermediate.

Issue a certificate with appropriate values for acting as an intermediate CA.

Supported methods:POST: /{mount\_point}/root/sign-intermediate. Produces: 200 application/json

Parameters

* **csr** (*str | unicode*) – The PEM-encoded CSR.

* **common\_name** (*str | unicode*) – The requested CN for the certificate.

* **extra\_params** (*dict*) – Dictionary with extra parameters.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

requests.Response

`sign_self_issued`(*certificate*, *mount\_point='pki'*)[[source]](_modules/hvac/api/secrets_engines/pki.html#Pki.sign_self_issued)[¶](#hvac.api.secrets_engines.Pki.sign_self_issued "Permalink to this definition")

Sign Self-Issued.

Sign a self-issued certificate.

Supported methods:POST: /{mount\_point}/root/sign-self-issued. Produces: 200 application/json

Parameters

* **certificate** (*str | unicode*) – The PEM-encoded self-issued certificate.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

requests.Response

`sign_verbatim`(*csr*, *name=False*, *extra\_params=None*, *mount\_point='pki'*)[[source]](_modules/hvac/api/secrets_engines/pki.html#Pki.sign_verbatim)[¶](#hvac.api.secrets_engines.Pki.sign_verbatim "Permalink to this definition")

Sign Verbatim.

Signs a new certificate based upon the provided CSR.

Supported methods:POST: /{mount\_point}/sign-verbatim. Produces: 200 application/json

Parameters

* **csr** (*str | unicode*) – The PEM-encoded CSR.

* **name** (*str | unicode*) – Specifies a role.

* **extra\_params** (*dict*) – A dictionary with extra parameters.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

requests.Response

`submit_ca_information`(*pem\_bundle*, *mount\_point='pki'*)[[source]](_modules/hvac/api/secrets_engines/pki.html#Pki.submit_ca_information)[¶](#hvac.api.secrets_engines.Pki.submit_ca_information "Permalink to this definition")

Submit CA Information.

Submitting the CA information for the backend.

Supported methods:POST: /{mount\_point}/config/ca. Produces: 200 application/json

Parameters

**mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

requests.Response

`tidy`(*extra\_params=None*, *mount\_point='pki'*)[[source]](_modules/hvac/api/secrets_engines/pki.html#Pki.tidy)[¶](#hvac.api.secrets_engines.Pki.tidy "Permalink to this definition")

Tidy.

Allows tidying up the storage backend and/or CRL by removing certificates that have

expired and are past a certain buffer period beyond their expiration time.

Supported methods:POST: /{mount\_point}/tidy. Produces: 200 application/json

Parameters

* **extra\_params** (*dict*) – A dictionary with extra parameters.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

requests.Response

*class* `hvac.api.secrets_engines.``RabbitMQ`(*adapter*)[[source]](_modules/hvac/api/secrets_engines/rabbitmq.html#RabbitMQ)[¶](#hvac.api.secrets_engines.RabbitMQ "Permalink to this definition")

Bases: `hvac.api.vault\_api\_base.VaultApiBase`

RabbitMQ Secrets Engine (API).

Reference: <https://www.vaultproject.io/api/secret/rabbitmq/index.html>

**Methods**

| [`configure`](#hvac.api.secrets_engines.RabbitMQ.configure "hvac.api.secrets_engines.RabbitMQ.configure")([connection\_uri, username, …]) | Configure shared information for the rabbitmq secrets engine. |

| [`configure\_lease`](#hvac.api.secrets_engines.RabbitMQ.configure_lease "hvac.api.secrets_engines.RabbitMQ.configure_lease")(ttl, max\_ttl[, mount\_point]) | This endpoint configures the lease settings for generated credentials. |

| [`create\_role`](#hvac.api.secrets_engines.RabbitMQ.create_role "hvac.api.secrets_engines.RabbitMQ.create_role")(name[, tags, vhosts, …]) | This endpoint creates or updates the role definition. |

| [`delete\_role`](#hvac.api.secrets_engines.RabbitMQ.delete_role "hvac.api.secrets_engines.RabbitMQ.delete_role")(name[, mount\_point]) | This endpoint deletes the role definition. |

| [`generate\_credentials`](#hvac.api.secrets_engines.RabbitMQ.generate_credentials "hvac.api.secrets_engines.RabbitMQ.generate_credentials")(name[, mount\_point]) | This endpoint generates a new set of dynamic credentials based on the named role. |

| [`read\_role`](#hvac.api.secrets_engines.RabbitMQ.read_role "hvac.api.secrets_engines.RabbitMQ.read_role")(name[, mount\_point]) | This endpoint queries the role definition. |

`configure`(*connection\_uri=''*, *username=''*, *password=''*, *verify\_connection=True*, *mount\_point='rabbitmq'*)[[source]](_modules/hvac/api/secrets_engines/rabbitmq.html#RabbitMQ.configure)[¶](#hvac.api.secrets_engines.RabbitMQ.configure "Permalink to this definition")

Configure shared information for the rabbitmq secrets engine.

Supported methods:POST: /{mount\_point}/config/connection. Produces: 204 (empty body)

Parameters

* **connection\_uri** (*str | unicode*) – Specifies the RabbitMQ connection URI.

* **username** (*str | unicode*) – Specifies the RabbitMQ management administrator username.

* **mount\_point** (*str | unicode*) – Specifies the place where the secrets engine will be accessible (default: rabbitmq).

Password

Specifies the RabbitMQ management administrator password.

Verify\_connection

Specifies whether to verify connection URI, username, and password.

Returns

The response of the request.

Return type

requests.Response

`configure_lease`(*ttl*, *max\_ttl*, *mount\_point='rabbitmq'*)[[source]](_modules/hvac/api/secrets_engines/rabbitmq.html#RabbitMQ.configure_lease)[¶](#hvac.api.secrets_engines.RabbitMQ.configure_lease "Permalink to this definition")

This endpoint configures the lease settings for generated credentials.

Parameters

* **ttl** (*int*) – Specifies the lease ttl provided in seconds.

* **max\_ttl** (*int*) – Specifies the maximum ttl provided in seconds.

* **mount\_point** (*str | unicode*) – Specifies the place where the secrets engine will be accessible (default: rabbitmq).

Returns

The JSON response of the request.

Return type

requests.Response

`create_role`(*name*, *tags=''*, *vhosts=''*, *vhost\_topics=''*, *mount\_point='rabbitmq'*)[[source]](_modules/hvac/api/secrets_engines/rabbitmq.html#RabbitMQ.create_role)[¶](#hvac.api.secrets_engines.RabbitMQ.create_role "Permalink to this definition")

This endpoint creates or updates the role definition.

Parameters

* **name** (*str | unicode*) – Specifies the name of the role to create.

* **tags** (*str | unicode*) – Specifies a comma-separated RabbitMQ management tags.

* **vhosts** (*str | unicode*) – pecifies a map of virtual hosts to permissions.

* **vhost\_topics** (*str | unicode*) – Specifies a map of virtual hosts and exchanges to topic permissions.

* **mount\_point** (*str | unicode*) – Specifies the place where the secrets engine will be accessible (default: rabbitmq).

Returns

The JSON response of the request.

Return type

requests.Response

`delete_role`(*name*, *mount\_point='rabbitmq'*)[[source]](_modules/hvac/api/secrets_engines/rabbitmq.html#RabbitMQ.delete_role)[¶](#hvac.api.secrets_engines.RabbitMQ.delete_role "Permalink to this definition")

This endpoint deletes the role definition.

Even if the role does not exist, this endpoint will still return a successful response.

Parameters

* **name** (*str | unicode*) – Specifies the name of the role to delete.

* **mount\_point** (*str | unicode*) – Specifies the place where the secrets engine will be accessible (default: rabbitmq).

Returns

The response of the request.

Return type

requests.Response

`generate_credentials`(*name*, *mount\_point='rabbitmq'*)[[source]](_modules/hvac/api/secrets_engines/rabbitmq.html#RabbitMQ.generate_credentials)[¶](#hvac.api.secrets_engines.RabbitMQ.generate_credentials "Permalink to this definition")

This endpoint generates a new set of dynamic credentials based on the named role.

Parameters

* **name** (*str | unicode*) – Specifies the name of the role to create credentials against.

* **mount\_point** (*str | unicode*) – Specifies the place where the secrets engine will be accessible (default: rabbitmq).

Returns

The response of the request.

Return type

requests.Response

`read_role`(*name*, *mount\_point='rabbitmq'*)[[source]](_modules/hvac/api/secrets_engines/rabbitmq.html#RabbitMQ.read_role)[¶](#hvac.api.secrets_engines.RabbitMQ.read_role "Permalink to this definition")

This endpoint queries the role definition.

Parameters

* **name** (*str | unicode*) – Specifies the name of the role to read.

* **mount\_point** (*str | unicode*) – Specifies the place where the secrets engine will be accessible (default: rabbitmq).

Returns

The JSON response of the request.

Return type

requests.Response

*class* `hvac.api.secrets_engines.``SecretsEngines`(*adapter*)[[source]](_modules/hvac/api/secrets_engines.html#SecretsEngines)[¶](#hvac.api.secrets_engines.SecretsEngines "Permalink to this definition")

Bases: `hvac.api.vault\_api\_category.VaultApiCategory`

Secrets Engines.

**Attributes**

| [`implemented\_classes`](#hvac.api.secrets_engines.SecretsEngines.implemented_classes "hvac.api.secrets_engines.SecretsEngines.implemented_classes") | Built-in mutable sequence. |

| [`unimplemented\_classes`](#hvac.api.secrets_engines.SecretsEngines.unimplemented_classes "hvac.api.secrets_engines.SecretsEngines.unimplemented_classes") | Built-in mutable sequence. |

`implemented_classes` *= [<class 'hvac.api.secrets\_engines.aws.Aws'>, <class 'hvac.api.secrets\_engines.azure.Azure'>, <class 'hvac.api.secrets\_engines.gcp.Gcp'>, <class 'hvac.api.secrets\_engines.active\_directory.ActiveDirectory'>, <class 'hvac.api.secrets\_engines.identity.Identity'>, <class 'hvac.api.secrets\_engines.kv.Kv'>, <class 'hvac.api.secrets\_engines.pki.Pki'>, <class 'hvac.api.secrets\_engines.transform.Transform'>, <class 'hvac.api.secrets\_engines.transit.Transit'>, <class 'hvac.api.secrets\_engines.database.Database'>, <class 'hvac.api.secrets\_engines.consul.Consul'>, <class 'hvac.api.secrets\_engines.rabbitmq.RabbitMQ'>]*[¶](#hvac.api.secrets_engines.SecretsEngines.implemented_classes "Permalink to this definition")

`unimplemented_classes` *= ['AliCloud', 'Azure', 'GcpKms', 'Nomad', 'Ssh', 'TOTP', 'Cassandra', 'MongoDb', 'Mssql', 'MySql', 'PostgreSql']*[¶](#hvac.api.secrets_engines.SecretsEngines.unimplemented_classes "Permalink to this definition")

*class* `hvac.api.secrets_engines.``Transform`(*adapter*)[[source]](_modules/hvac/api/secrets_engines/transform.html#Transform)[¶](#hvac.api.secrets_engines.Transform "Permalink to this definition")

Bases: `hvac.api.vault\_api\_base.VaultApiBase`

Transform Secrets Engine (API).

Reference: <https://www.vaultproject.io/api-docs/secret/transform>

**Methods**

| [`check\_tokenization`](#hvac.api.secrets_engines.Transform.check_tokenization "hvac.api.secrets_engines.Transform.check_tokenization")(role\_name, value, …[, …]) | Determine if a provided plaintext value has an valid, unexpired tokenized value. |

| [`create\_or\_update\_alphabet`](#hvac.api.secrets_engines.Transform.create_or_update_alphabet "hvac.api.secrets_engines.Transform.create_or_update_alphabet")(name, alphabet[, …]) | Create or update an alphabet with the given name. |

| [`create\_or\_update\_fpe\_transformation`](#hvac.api.secrets_engines.Transform.create_or_update_fpe_transformation "hvac.api.secrets_engines.Transform.create_or_update_fpe_transformation")(name, …) | Creates or update an FPE transformation with the given name. |

| [`create\_or\_update\_masking\_transformation`](#hvac.api.secrets_engines.Transform.create_or_update_masking_transformation "hvac.api.secrets_engines.Transform.create_or_update_masking_transformation")(…) | Creates or update a masking transformation with the given name. |

| [`create\_or\_update\_role`](#hvac.api.secrets_engines.Transform.create_or_update_role "hvac.api.secrets_engines.Transform.create_or_update_role")(name, transformations) | Creates or update the role with the given name. |

| [`create\_or\_update\_template`](#hvac.api.secrets_engines.Transform.create_or_update_template "hvac.api.secrets_engines.Transform.create_or_update_template")(name, …[, …]) | Creates or update a template with the given name. |

| [`create\_or\_update\_tokenization\_store`](#hvac.api.secrets_engines.Transform.create_or_update_tokenization_store "hvac.api.secrets_engines.Transform.create_or_update_tokenization_store")(name, …) | Create or update a storage configuration for use with tokenization. |

| [`create\_or\_update\_tokenization\_transformation`](#hvac.api.secrets_engines.Transform.create_or_update_tokenization_transformation "hvac.api.secrets_engines.Transform.create_or_update_tokenization_transformation")(name) | This endpoint creates or updates a tokenization transformation with the given name. |

| [`create\_or\_update\_transformation`](#hvac.api.secrets_engines.Transform.create_or_update_transformation "hvac.api.secrets_engines.Transform.create_or_update_transformation")(name, …[, …]) | Create or update a transformation with the given name. |

| [`decode`](#hvac.api.secrets_engines.Transform.decode "hvac.api.secrets_engines.Transform.decode")(role\_name[, value, transformation, …]) | Decode the provided value using a named role. |

| [`delete\_alphabet`](#hvac.api.secrets_engines.Transform.delete_alphabet "hvac.api.secrets_engines.Transform.delete_alphabet")(name[, mount\_point]) | Delete an existing alphabet by the given name. |

| [`delete\_role`](#hvac.api.secrets_engines.Transform.delete_role "hvac.api.secrets_engines.Transform.delete_role")(name[, mount\_point]) | Delete an existing role by the given name. |

| [`delete\_template`](#hvac.api.secrets_engines.Transform.delete_template "hvac.api.secrets_engines.Transform.delete_template")(name[, mount\_point]) | Delete an existing template by the given name. |

| [`delete\_transformation`](#hvac.api.secrets_engines.Transform.delete_transformation "hvac.api.secrets_engines.Transform.delete_transformation")(name[, mount\_point]) | Delete an existing transformation by the given name. |

| [`encode`](#hvac.api.secrets_engines.Transform.encode "hvac.api.secrets_engines.Transform.encode")(role\_name[, value, transformation, …]) | Encode the provided value using a named role. |

| [`export\_decoded\_tokenization\_state`](#hvac.api.secrets_engines.Transform.export_decoded_tokenization_state "hvac.api.secrets_engines.Transform.export_decoded_tokenization_state")(name[, …]) | Start or continue retrieving an export of tokenization state, including the tokens and their decoded values. |

| [`list\_alphabets`](#hvac.api.secrets_engines.Transform.list_alphabets "hvac.api.secrets_engines.Transform.list_alphabets")([mount\_point]) | List all existing alphabets in the secrets engine. |

| [`list\_roles`](#hvac.api.secrets_engines.Transform.list_roles "hvac.api.secrets_engines.Transform.list_roles")([mount\_point]) | List all existing roles in the secrets engine. |

| [`list\_templates`](#hvac.api.secrets_engines.Transform.list_templates "hvac.api.secrets_engines.Transform.list_templates")([mount\_point]) | List all existing templates in the secrets engine. |

| [`list\_tokenization\_key\_configuration`](#hvac.api.secrets_engines.Transform.list_tokenization_key_configuration "hvac.api.secrets_engines.Transform.list_tokenization_key_configuration")([…]) | List all tokenization keys. |

| [`list\_transformations`](#hvac.api.secrets_engines.Transform.list_transformations "hvac.api.secrets_engines.Transform.list_transformations")([mount\_point]) | List all existing transformations in the secrets engine. |

| [`read\_alphabet`](#hvac.api.secrets_engines.Transform.read_alphabet "hvac.api.secrets_engines.Transform.read_alphabet")(name[, mount\_point]) | Queries an existing alphabet by the given name. |

| [`read\_role`](#hvac.api.secrets_engines.Transform.read_role "hvac.api.secrets_engines.Transform.read_role")(name[, mount\_point]) | Query an existing role by the given name. |

| [`read\_template`](#hvac.api.secrets_engines.Transform.read_template "hvac.api.secrets_engines.Transform.read_template")(name[, mount\_point]) | Query an existing template by the given name. |

| [`read\_tokenization\_key\_configuration`](#hvac.api.secrets_engines.Transform.read_tokenization_key_configuration "hvac.api.secrets_engines.Transform.read_tokenization_key_configuration")(…[, …]) | Read tokenization key configuration for a particular transform. |

| [`read\_transformation`](#hvac.api.secrets_engines.Transform.read_transformation "hvac.api.secrets_engines.Transform.read_transformation")(name[, mount\_point]) | Query an existing transformation by the given name. |

| [`restore\_tokenization\_state`](#hvac.api.secrets_engines.Transform.restore_tokenization_state "hvac.api.secrets_engines.Transform.restore_tokenization_state")(name, values[, …]) | This endpoint restores previously snapshotted tokenization state values to the underlying store(s) of a tokenization transform. |

| [`retrieve\_token\_metadata`](#hvac.api.secrets_engines.Transform.retrieve_token_metadata "hvac.api.secrets_engines.Transform.retrieve_token_metadata")(role\_name, value, …) | This endpoint retrieves metadata for a tokenized value using a named role. |

| [`rotate\_tokenization\_key`](#hvac.api.secrets_engines.Transform.rotate_tokenization_key "hvac.api.secrets_engines.Transform.rotate_tokenization_key")(transform\_name[, …]) | Rotate the version of the named key. |

| [`snapshot\_tokenization\_state`](#hvac.api.secrets_engines.Transform.snapshot_tokenization_state "hvac.api.secrets_engines.Transform.snapshot_tokenization_state")(name[, limit, …]) | This endpoint starts or continues retrieving a snapshot of the stored state of a tokenization transform. |

| [`trim\_tokenization\_key\_version`](#hvac.api.secrets_engines.Transform.trim_tokenization_key_version "hvac.api.secrets_engines.Transform.trim_tokenization_key_version")(…[, mount\_point]) | Trim older key versions setting a minimum version for the keyring. |

| [`update\_tokenization\_key\_config`](#hvac.api.secrets_engines.Transform.update_tokenization_key_config "hvac.api.secrets_engines.Transform.update_tokenization_key_config")(…[, …]) | Allow the minimum key version to be set for decode operations. |

| [`validate\_token`](#hvac.api.secrets_engines.Transform.validate_token "hvac.api.secrets_engines.Transform.validate_token")(role\_name, value, transformation) | Determine if a provided tokenized value is valid and unexpired. |

`check_tokenization`(*role\_name*, *value*, *transformation*, *batch\_input=None*, *mount\_point='transform'*)[[source]](_modules/hvac/api/secrets_engines/transform.html#Transform.check_tokenization)[¶](#hvac.api.secrets_engines.Transform.check_tokenization "Permalink to this definition")

Determine if a provided plaintext value has an valid, unexpired tokenized value.

Note that this cannot return the token, just confirm that a

tokenized value exists. This endpoint is only valid for tokenization

transformations.

Supported methods:POST: /{mount\_point}/tokenized/:role\_name.

Parameters

* **role\_name** (*str*) – the role name to use for this operation. This is specified as part

of the URL.

* **value** (*str*) – the token to test for whether it has a valid tokenization.

* **transformation** (*str*) – the transformation within the role that should be used for this

decode operation. If a single transformation exists for role, this parameter

may be skipped and will be inferred. If multiple transformations exist, one

must be specified.

* **batch\_input** (*list*) – a list of items to be decoded in a single batch. When this

parameter is set, the ‘value’ parameter is

ignored. Instead, the aforementioned parameters should be provided within

each object in the list.

* **mount\_point** (*str*) – The “path” the method/backend was mounted on.

Returns

The response of the check\_tokenization request.

Return type

requests.Response

`create_or_update_alphabet`(*name*, *alphabet*, *mount\_point='transform'*)[[source]](_modules/hvac/api/secrets_engines/transform.html#Transform.create_or_update_alphabet)[¶](#hvac.api.secrets_engines.Transform.create_or_update_alphabet "Permalink to this definition")

Create or update an alphabet with the given name.

If an alphabet with the name does not exist, it will be created. If the

alphabet exists, it will be updated with the new attributes.

Supported methods:POST: /{mount\_point}/alphabet/:name.

Parameters

* **name** (*str | unicode*) – Specifies the name of the transformation alphabet to create.

* **alphabet** (*str | unicode*) – the set of characters that can exist within the provided value

and the encoded or decoded value for a FPE transformation.

* **mount\_point** (*str | unicode*) – The “path” the secrets engine was mounted on.

Returns

The response of the create\_or\_update\_alphabet request.

Return type

requests.Response

`create_or_update_fpe_transformation`(*name*, *template*, *tweak\_source='supplied'*, *allowed\_roles=None*, *mount\_point='transform'*)[[source]](_modules/hvac/api/secrets_engines/transform.html#Transform.create_or_update_fpe_transformation)[¶](#hvac.api.secrets_engines.Transform.create_or_update_fpe_transformation "Permalink to this definition")

Creates or update an FPE transformation with the given name.

If a transformation with the name does not exist, it will be created. If the transformation exists, it will be

updated with the new attributes.

Supported methods:POST: /{mount\_point}/transformations/fpe/:name.

Parameters

* **name** (*str*) – The name of the transformation to create or update. This is part of

the request URL.

* **template** (*str*) – The template name to use for matching value on encode and decode

operations when using this transformation.

* **tweak\_source** (*str*) – Specifies the source of where the tweak value comes from. Valid sources are:

supplied, generated, and internal.

* **allowed\_roles** (*list*) – A list of allowed roles that this transformation can be assigned to.

A role using this transformation must exist in this list in order for

encode and decode operations to properly function.

* **mount\_point** (*str*) – The “path” the method/backend was mounted on.

Returns

The response of the create\_or\_update\_fpe\_transformation request.

Return type

requests.Response

`create_or_update_masking_transformation`(*name*, *template*, *masking\_character='\*'*, *allowed\_roles=None*, *mount\_point='transform'*)[[source]](_modules/hvac/api/secrets_engines/transform.html#Transform.create_or_update_masking_transformation)[¶](#hvac.api.secrets_engines.Transform.create_or_update_masking_transformation "Permalink to this definition")

Creates or update a masking transformation with the given name. If a

transformation with the name does not exist, it will be created. If the

transformation exists, it will be updated with the new attributes.

Supported methods:POST: /{mount\_point}/transformations/masking/:name.

Parameters

* **name** (*str*) – The name of the transformation to create or update. This is part of

the request URL.

* **template** (*str*) – The template name to use for matching value on encode and decode

operations when using this transformation.

* **masking\_character** (*str*) – The character to use for masking. If multiple characters are

provided, only the first one is used and the rest is ignored. Only used when

the type is masking.

* **allowed\_roles** (*list*) – A list of allowed roles that this transformation can be assigned to.

A role using this transformation must exist in this list in order for

encode and decode operations to properly function.

* **mount\_point** (*str*) – The “path” the method/backend was mounted on.

Returns

The response of the create\_or\_update\_masking\_transformation request.

Return type

requests.Response

`create_or_update_role`(*name*, *transformations*, *mount\_point='transform'*)[[source]](_modules/hvac/api/secrets_engines/transform.html#Transform.create_or_update_role)[¶](#hvac.api.secrets_engines.Transform.create_or_update_role "Permalink to this definition")

Creates or update the role with the given name.

If a role with the name does not exist, it will be created. If the role exists, it will be

updated with the new attributes.

Supported methods:POST: /{mount\_point}/role/:name.

Parameters

* **name** (*str | unicode*) – the name of the role to create. This is part of the request URL.

* **transformations** (*list*) – Specifies the transformations that can be used with this role.

At least one transformation is required.

* **mount\_point** (*str | unicode*) – The “path” the secrets engine was mounted on.

Returns

The response of the create\_or\_update\_role request.

Return type

requests.Response

`create_or_update_template`(*name*, *template\_type*, *pattern*, *alphabet*, *mount\_point='transform'*)[[source]](_modules/hvac/api/secrets_engines/transform.html#Transform.create_or_update_template)[¶](#hvac.api.secrets_engines.Transform.create_or_update_template "Permalink to this definition")

Creates or update a template with the given name.

If a template with the name does not exist, it will be created. If the

template exists, it will be updated with the new attributes.

Supported methods:POST: /{mount\_point}/template/:name.

Parameters

* **name** (*str | unicode*) – the name of the template to create.

* **template\_type** (*str | unicode*) – Specifies the type of pattern matching to perform.

The ony type currently supported by this backend is regex.

* **pattern** (*str | unicode*) – the pattern used to match a particular value. For regex type

matching, capture group determines the set of character that should be matched

against. Any matches outside of capture groups are retained

post-transformation.

* **alphabet** (*str | unicode*) – the name of the alphabet to use when this template is used for FPE

encoding and decoding operations.

* **mount\_point** (*str | unicode*) – The “path” the secrets engine was mounted on.

Returns

The response of the create\_or\_update\_template request.

Return type

requests.Response

`create_or_update_tokenization_store`(*name*, *driver*, *connection\_string*, *username=None*, *password=None*, *type='sql'*, *supported\_transformations=None*, *schema='public'*, *max\_open\_connections=4*, *max\_idle\_connections=4*, *max\_connection\_lifetime=0*, *mount\_point='transform'*)[[source]](_modules/hvac/api/secrets_engines/transform.html#Transform.create_or_update_tokenization_store)[¶](#hvac.api.secrets_engines.Transform.create_or_update_tokenization_store "Permalink to this definition")

Create or update a storage configuration for use with tokenization.

The database user configured here should only have permission to SELECT, INSERT, and UPDATE rows in the tables.

Supported methods:POST: /{mount\_point}/store/:name.

Parameters

* **name** (*str*) – The name of the store to create or update.

* **type** (*str*) – Specifies the type of store. Currently only sql is supported.

* **driver** (*str*) – Specifies the database driver to use, and thus which SQL database type.

Currently the supported options are postgres or mysql

* **supported\_transformations** (*list**(**str**)*) – The types of transformations this store can host. Currently only tokenization is supported.

* **connection\_string** (*str*) – database connection string with template slots for username and password that

Vault will use for locating and connecting to a database. Each

database driver type has a different syntax for its connection strings.

* **username** (*str*) – username value to use when connecting to the database.

* **password** (*str*) – password value to use when connecting to the database.

* **schema** (*str*) – schema within the database to expect tokenization state tables.

* **max\_open\_connections** (*int*) – maximum number of connections to the database at any given time.

* **max\_idle\_connections** (*int*) – maximum number of idle connections to the database at any given time.

* **max\_connection\_lifetime** (*duration*) – means no limit.

* **mount\_point** (*str*) – The “path” the method/backend was mounted on.

Returns

The response of the create\_or\_update\_tokenization\_store request.

Return type

requests.Response

`create_or_update_tokenization_transformation`(*name*, *max\_ttl=0*, *mapping\_mode='default'*, *allowed\_roles=None*, *stores=None*, *mount\_point='transform'*)[[source]](_modules/hvac/api/secrets_engines/transform.html#Transform.create_or_update_tokenization_transformation)[¶](#hvac.api.secrets_engines.Transform.create_or_update_tokenization_transformation "Permalink to this definition")

This endpoint creates or updates a tokenization transformation with the given name. If a

transformation with the name does not exist, it will be created. If the

transformation exists, it will be updated with the new attributes.

Supported methods:POST: /{mount\_point}/transformations/tokenization/:name.

Parameters

* **max\_ttl** (*str*) – The maximum TTL of a token. If 0 or unspecified, tokens may have no expiration.

* **mapping\_mode** (*str*) – Specifies the mapping mode for stored tokenization values.

	+ default is strongly recommended for highest security

	+ exportable exportable allows for all plaintexts to be decoded via the export-decoded endpoint in an emergency.

* **allowed\_roles** (*list*) – aAlist of allowed roles that this transformation can be assigned to.

A role using this transformation must exist in this list in order for

encode and decode operations to properly function.

* **stores** (*list*) – list of tokenization stores to use for tokenization state. Vault’s

internal storage is used by default.

* **mount\_point** (*str*) – The “path” the method/backend was mounted on.

Returns

The response of the create\_or\_update\_tokenization\_transformation request.

Return type

requests.Response

`create_or_update_transformation`(*name*, *transform\_type*, *template*, *tweak\_source='supplied'*, *masking\_character='\*'*, *allowed\_roles=None*, *mount\_point='transform'*)[[source]](_modules/hvac/api/secrets_engines/transform.html#Transform.create_or_update_transformation)[¶](#hvac.api.secrets_engines.Transform.create_or_update_transformation "Permalink to this definition")

Create or update a transformation with the given name.

If a transformation with the name does not exist, it will be created. If the

transformation exists, it will be updated with the new attributes.

Supported methods:POST: /{mount\_point}/transformation/:name.

Parameters

* **name** (*str | unicode*) – the name of the transformation to create or update. This is part of

the request URL.

* **transform\_type** (*str | unicode*) – Specifies the type of transformation to perform.

The types currently supported by this backend are fpe and masking.

This value cannot be modified by an update operation after creation.

* **template** (*str | unicode*) – the template name to use for matching value on encode and decode

operations when using this transformation.

* **tweak\_source** (*str | unicode*) – Only used when the type is FPE.

* **masking\_character** (*str | unicode*) – the character to use for masking. If multiple characters are

provided, only the first one is used and the rest is ignored. Only used when

the type is masking.

* **allowed\_roles** (*list*) – a list of allowed roles that this transformation can be assigned to.

A role using this transformation must exist in this list in order for

encode and decode operations to properly function.

* **mount\_point** (*str | unicode*) – The “path” the secrets engine was mounted on.

Returns

The response of the create\_or\_update\_ation request.

Return type

requests.Response

`decode`(*role\_name*, *value=None*, *transformation=None*, *tweak=None*, *batch\_input=None*, *mount\_point='transform'*)[[source]](_modules/hvac/api/secrets_engines/transform.html#Transform.decode)[¶](#hvac.api.secrets_engines.Transform.decode "Permalink to this definition")

Decode the provided value using a named role.

Supported methods:POST: /{mount\_point}/decode/:role\_name.

Parameters

* **role\_name** (*str | unicode*) – the role name to use for this operation. This is specified as part

of the URL.

* **value** (*str | unicode*) – the value to be decoded.

* **transformation** (*str | unicode*) – the transformation within the role that should be used for this

decode operation. If a single transformation exists for role, this parameter

may be skipped and will be inferred. If multiple transformations exist, one

must be specified.

* **tweak** (*str | unicode*) – the tweak source.

* **batch\_input** (*array<object>*) – a list of items to be decoded in a single batch. When this

parameter is set, the ‘value’, ‘transformation’ and ‘tweak’ parameters are

ignored. Instead, the aforementioned parameters should be provided within

each object in the list.

* **mount\_point** (*str | unicode*) – The “path” the secrets engine was mounted on.

Returns

The response of the decode request.

Return type

requests.Response

`delete_alphabet`(*name*, *mount\_point='transform'*)[[source]](_modules/hvac/api/secrets_engines/transform.html#Transform.delete_alphabet)[¶](#hvac.api.secrets_engines.Transform.delete_alphabet "Permalink to this definition")

Delete an existing alphabet by the given name.

Supported methods:DELETE: /{mount\_point}/alphabet/:name.

Parameters

* **name** (*str | unicode*) – the name of the alphabet to delete. This is part of the request URL.

* **mount\_point** (*str | unicode*) – The “path” the secrets engine was mounted on.

Returns

The response of the delete\_alphabet request.

Return type

requests.Response

`delete_role`(*name*, *mount\_point='transform'*)[[source]](_modules/hvac/api/secrets_engines/transform.html#Transform.delete_role)[¶](#hvac.api.secrets_engines.Transform.delete_role "Permalink to this definition")

Delete an existing role by the given name.

Supported methods:DELETE: /{mount\_point}/role/:name.

Parameters

* **name** (*str | unicode*) – the name of the role to delete. This is part of the request URL.

* **mount\_point** (*str | unicode*) – The “path” the secrets engine was mounted on.

Returns

The response of the delete\_role request.

Return type

requests.Response

`delete_template`(*name*, *mount\_point='transform'*)[[source]](_modules/hvac/api/secrets_engines/transform.html#Transform.delete_template)[¶](#hvac.api.secrets_engines.Transform.delete_template "Permalink to this definition")

Delete an existing template by the given name.

Supported methods:DELETE: /{mount\_point}/template/:name.

Parameters

* **name** (*str | unicode*) – the name of the template to delete. This is part of the

request URL.

* **mount\_point** (*str | unicode*) – The “path” the secrets engine was mounted on.

Returns

The response of the delete\_template request.

Return type

requests.Response

`delete_transformation`(*name*, *mount\_point='transform'*)[[source]](_modules/hvac/api/secrets_engines/transform.html#Transform.delete_transformation)[¶](#hvac.api.secrets_engines.Transform.delete_transformation "Permalink to this definition")

Delete an existing transformation by the given name.

Supported methods:DELETE: /{mount\_point}/transformation/:name.

Parameters

* **name** (*str | unicode*) – the name of the transformation to delete. This is part of the

request URL.

* **mount\_point** (*str | unicode*) – The “path” the secrets engine was mounted on.

Returns

The response of the delete\_ation request.

Return type

requests.Response

`encode`(*role\_name*, *value=None*, *transformation=None*, *tweak=None*, *batch\_input=None*, *mount\_point='transform'*)[[source]](_modules/hvac/api/secrets_engines/transform.html#Transform.encode)[¶](#hvac.api.secrets_engines.Transform.encode "Permalink to this definition")

Encode the provided value using a named role.

Supported methods:POST: /{mount\_point}/encode/:role\_name.

Parameters

* **role\_name** (*str | unicode*) – the role name to use for this operation. This is specified as part

of the URL.

* **value** (*str | unicode*) – the value to be encoded.

* **transformation** (*str | unicode*) – the transformation within the role that should be used for this

encode operation. If a single transformation exists for role, this parameter

may be skipped and will be inferred. If multiple transformations exist, one

must be specified.

* **tweak** (*str | unicode*) – the tweak source.

* **batch\_input** (*list*) – a list of items to be encoded in a single batch. When this

parameter is set, the ‘value’, ‘transformation’ and ‘tweak’ parameters are

ignored. Instead, the aforementioned parameters should be provided within

each object in the list.

* **mount\_point** (*str | unicode*) – The “path” the secrets engine was mounted on.

Returns

The response of the encode request.

Return type

requests.Response

`export_decoded_tokenization_state`(*name*, *limit=1000*, *continuation=''*, *mount\_point='transform'*)[[source]](_modules/hvac/api/secrets_engines/transform.html#Transform.export_decoded_tokenization_state)[¶](#hvac.api.secrets_engines.Transform.export_decoded_tokenization_state "Permalink to this definition")

Start or continue retrieving an export of tokenization state, including the tokens and their decoded values.

This call is only supported on tokenization stores configured with the exportable mapping mode.

Refer to the Tokenization documentation for when to use the exportable mapping mode.

Decoded values are in Base64 representation.

Supported methods:POST: /{mount\_point}/transformations/tokenization/export-decoded/:name.

Parameters

* **name** (*str*) – the name of the transformation to export.

* **limit** (*int*) – maximum number of tokenized value states to return on this call.

* **continuation** (*str*) – absent or empty, a new export is started. If present, the

export should continue at the next available value.

* **mount\_point** (*str*) – The “path” the method/backend was mounted on.

Returns

The response of the export\_decoded\_tokenization\_state request.

Return type

requests.Response

`list_alphabets`(*mount\_point='transform'*)[[source]](_modules/hvac/api/secrets_engines/transform.html#Transform.list_alphabets)[¶](#hvac.api.secrets_engines.Transform.list_alphabets "Permalink to this definition")

List all existing alphabets in the secrets engine.

Supported methods:LIST: /{mount\_point}/alphabet.

Parameters

**mount\_point** (*str | unicode*) – The “path” the secrets engine was mounted on.

Returns

The response of the list\_alphabets request.

Return type

requests.Response

`list_roles`(*mount\_point='transform'*)[[source]](_modules/hvac/api/secrets_engines/transform.html#Transform.list_roles)[¶](#hvac.api.secrets_engines.Transform.list_roles "Permalink to this definition")

List all existing roles in the secrets engine.

Supported methods:LIST: /{mount\_point}/role.

Parameters

**mount\_point** (*str | unicode*) – The “path” the secrets engine was mounted on.

Returns

The response of the list\_roles request.

Return type

requests.Response

`list_templates`(*mount\_point='transform'*)[[source]](_modules/hvac/api/secrets_engines/transform.html#Transform.list_templates)[¶](#hvac.api.secrets_engines.Transform.list_templates "Permalink to this definition")

List all existing templates in the secrets engine.

Supported methods:LIST: /{mount\_point}/transformation.

Parameters

**mount\_point** (*str | unicode*) – The “path” the secrets engine was mounted on.

Returns

The response of the list\_template request.

Return type

requests.Response

`list_tokenization_key_configuration`(*mount\_point='transform'*)[[source]](_modules/hvac/api/secrets_engines/transform.html#Transform.list_tokenization_key_configuration)[¶](#hvac.api.secrets_engines.Transform.list_tokenization_key_configuration "Permalink to this definition")

List all tokenization keys.

Only valid for tokenization transformations.

Supported methods:LIST: /{mount\_point}/tokenization/keys/.

Parameters

**mount\_point** (*str*) – The “path” the method/backend was mounted on.

Returns

The response of the list\_tokenization\_key\_configuration request.

Return type

requests.Response

`list_transformations`(*mount\_point='transform'*)[[source]](_modules/hvac/api/secrets_engines/transform.html#Transform.list_transformations)[¶](#hvac.api.secrets_engines.Transform.list_transformations "Permalink to this definition")

List all existing transformations in the secrets engine.

Supported methods:LIST: /{mount\_point}/transformation.

Parameters

**mount\_point** (*str | unicode*) – The “path” the secrets engine was mounted on.

Returns

The response of the list\_ation request.

Return type

requests.Response

`read_alphabet`(*name*, *mount\_point='transform'*)[[source]](_modules/hvac/api/secrets_engines/transform.html#Transform.read_alphabet)[¶](#hvac.api.secrets_engines.Transform.read_alphabet "Permalink to this definition")

Queries an existing alphabet by the given name.

Supported methods:GET: /{mount\_point}/alphabet/:name.

Parameters

* **name** (*str | unicode*) – the name of the alphabet to delete. This is part of the request URL.

* **mount\_point** (*str | unicode*) – The “path” the secrets engine was mounted on.

Returns

The response of the read\_alphabet request.

Return type

requests.Response

`read_role`(*name*, *mount\_point='transform'*)[[source]](_modules/hvac/api/secrets_engines/transform.html#Transform.read_role)[¶](#hvac.api.secrets_engines.Transform.read_role "Permalink to this definition")

Query an existing role by the given name.

Supported methods:GET: /{mount\_point}/role/:name.

Parameters

* **name** (*str | unicode*) – the name of the role to read. This is part of the request URL.

* **mount\_point** (*str | unicode*) – The “path” the secrets engine was mounted on.

Returns

The response of the read\_role request.

Return type

requests.Response

`read_template`(*name*, *mount\_point='transform'*)[[source]](_modules/hvac/api/secrets_engines/transform.html#Transform.read_template)[¶](#hvac.api.secrets_engines.Transform.read_template "Permalink to this definition")

Query an existing template by the given name.

Supported methods:GET: /{mount\_point}/template/:name.

Parameters

* **name** (*str | unicode*) – Specifies the name of the role to read.

* **mount\_point** (*str | unicode*) – The “path” the secrets engine was mounted on.

Returns

The response of the read\_template request.

Return type

requests.Response

`read_tokenization_key_configuration`(*transform\_name*, *mount\_point='transform'*)[[source]](_modules/hvac/api/secrets_engines/transform.html#Transform.read_tokenization_key_configuration)[¶](#hvac.api.secrets_engines.Transform.read_tokenization_key_configuration "Permalink to this definition")

Read tokenization key configuration for a particular transform.

Only valid for tokenization transformations.

Supported methods:GET: /{mount\_point}/tokenization/keys/:{mount\_point}\_name.

Parameters

* **transform\_name** (*str*) – the transform name to use for this operation. This is specified as part

of the URL.

* **mount\_point** (*str*) – The “path” the method/backend was mounted on.

Returns

The response of the read\_tokenization\_key\_configuration request.

Return type

requests.Response

`read_transformation`(*name*, *mount\_point='transform'*)[[source]](_modules/hvac/api/secrets_engines/transform.html#Transform.read_transformation)[¶](#hvac.api.secrets_engines.Transform.read_transformation "Permalink to this definition")

Query an existing transformation by the given name.

Supported methods:GET: /{mount\_point}/transformation/:name.

Parameters

* **name** (*str | unicode*) – Specifies the name of the role to read.

* **mount\_point** (*str | unicode*) – The “path” the secrets engine was mounted on.

Returns

The response of the read\_ation request.

Return type

requests.Response

`restore_tokenization_state`(*name*, *values*, *mount\_point='transform'*)[[source]](_modules/hvac/api/secrets_engines/transform.html#Transform.restore_tokenization_state)[¶](#hvac.api.secrets_engines.Transform.restore_tokenization_state "Permalink to this definition")

This endpoint restores previously snapshotted tokenization state values

to the underlying store(s) of a tokenization transform. Calls to this

endpoint are idempotent, so multiple outputs from a snapshot run can

be applied via restore in any order and duplicates will not cause a problem.

Supported methods:POST: /{mount\_point}/transformations/tokenization/restore/:name.

Parameters

* **name** (*str*) – the name of the transformation to restore.

* **values** (*str*) – number of tokenization state values from a previous snapshot call.

* **mount\_point** (*str*) – The “path” the method/backend was mounted on.

Returns

The response of the restore\_tokenization\_state request.

Return type

requests.Response

`retrieve_token_metadata`(*role\_name*, *value*, *transformation*, *batch\_input=None*, *mount\_point='transform'*)[[source]](_modules/hvac/api/secrets_engines/transform.html#Transform.retrieve_token_metadata)[¶](#hvac.api.secrets_engines.Transform.retrieve_token_metadata "Permalink to this definition")

This endpoint retrieves metadata for a tokenized value using a named role.

Only valid for tokenization transformations.

Supported methods:POST: /{mount\_point}/metadata/:role\_name.

Parameters

* **role\_name** (*str*) – the role name to use for this operation. This is specified as part

of the URL.

* **value** (*str*) – the token for which to retrieve metadata.

* **transformation** (*str*) – the transformation within the role that should be used for this

decode operation. If a single transformation exists for role, this parameter

may be skipped and will be inferred. If multiple transformations exist, one

must be specified.

* **batch\_input** (*list*) – a list of items to be decoded in a single batch. When this

parameter is set, the ‘value’ parameter is

ignored. Instead, the aforementioned parameters should be provided within

each object in the list.

* **mount\_point** (*str*) – The “path” the method/backend was mounted on.

Returns

The response of the retrieve\_token\_metadata request.

Return type

requests.Response

`rotate_tokenization_key`(*transform\_name*, *mount\_point='transform'*)[[source]](_modules/hvac/api/secrets_engines/transform.html#Transform.rotate_tokenization_key)[¶](#hvac.api.secrets_engines.Transform.rotate_tokenization_key "Permalink to this definition")

Rotate the version of the named key.

After rotation, new requests will be encoded with the new version of the key.

Supported methods:POST: /{mount\_point}/tokenization/keys/{transform\_name}/rotate.

Parameters

* **transform\_name** (*str*) – the transform name to use for this operation. This is specified as part

of the URL.

* **mount\_point** (*str*) – The “path” the method/backend was mounted on.

Returns

The response of the rotate\_tokenization\_key request.

Return type

requests.Response

`snapshot_tokenization_state`(*name*, *limit=1000*, *continuation=''*, *mount\_point='transform'*)[[source]](_modules/hvac/api/secrets_engines/transform.html#Transform.snapshot_tokenization_state)[¶](#hvac.api.secrets_engines.Transform.snapshot_tokenization_state "Permalink to this definition")

This endpoint starts or continues retrieving a snapshot of the stored

state of a tokenization transform. This state is protected as it is

in the underlying store, and so is safe for storage or transport. Snapshots

may be used for backup purposes or to migrate from one store to another.

If more than one store is configured for a tokenization transform, the

snapshot data contains the contents of the first store.

Supported methods:POST: /{mount\_point}/transformations/tokenization/snapshot/:name.

Parameters

* **name** (*str*) – the name of the transformation to snapshot.

* **limit** (*int*) – maximum number of tokenized value states to return on this call.

* **continuation** (*str*) – absent or empty, a new snapshot is started. If present, the

snapshot should continue at the next available value.

* **mount\_point** (*str*) – The “path” the method/backend was mounted on.

Returns

The response of the snapshot\_tokenization\_state request.

Return type

requests.Response

`trim_tokenization_key_version`(*transform\_name*, *min\_available\_version*, *mount\_point='transform'*)[[source]](_modules/hvac/api/secrets_engines/transform.html#Transform.trim_tokenization_key_version)[¶](#hvac.api.secrets_engines.Transform.trim_tokenization_key_version "Permalink to this definition")

Trim older key versions setting a minimum version for the keyring.

Once trimmed, previous versions of the key cannot be recovered.

Supported methods:POST: /{mount\_point}/tokenization/keys/{transform\_name}/trim.

Parameters

* **transform\_name** (*str*) – the transform name to use for this operation. This is specified as part

of the URL.

* **min\_available\_version** (*int*) –

* **mount\_point** (*str*) – The “path” the method/backend was mounted on.

Returns

The response of the trim\_tokenization\_key\_version request.

Return type

requests.Response

`update_tokenization_key_config`(*transform\_name*, *min\_decryption\_version*, *mount\_point='transform'*)[[source]](_modules/hvac/api/secrets_engines/transform.html#Transform.update_tokenization_key_config)[¶](#hvac.api.secrets_engines.Transform.update_tokenization_key_config "Permalink to this definition")

Allow the minimum key version to be set for decode operations.

Only valid for tokenization transformations.

Supported methods:POST: /{mount\_point}/tokenization/keys/{transform\_name}/config.

Parameters

* **transform\_name** (*str*) – the transform name to use for this operation. This is specified as part

of the URL.

* **min\_decryption\_version** (*int*) – the minimum key version that vault can use to decode values for the

corresponding transform.

* **mount\_point** (*str*) – The “path” the method/backend was mounted on.

Returns

The response of the update\_tokenization\_key\_config request.

Return type

requests.Response

`validate_token`(*role\_name*, *value*, *transformation*, *batch\_input=None*, *mount\_point='transform'*)[[source]](_modules/hvac/api/secrets_engines/transform.html#Transform.validate_token)[¶](#hvac.api.secrets_engines.Transform.validate_token "Permalink to this definition")

Determine if a provided tokenized value is valid and unexpired.

Only valid for tokenization transformations.

Supported methods:POST: /{mount\_point}/validate/:role\_name.

Parameters

* **role\_name** (*str*) – the role name to use for this operation. This is specified as part

of the URL.

* **value** (*str*) – the token for which to check validity.

* **transformation** (*str*) – the transformation within the role that should be used for this

decode operation. If a single transformation exists for role, this parameter

may be skipped and will be inferred. If multiple transformations exist, one

must be specified.

* **batch\_input** (*list*) – a list of items to be decoded in a single batch. When this

parameter is set, the ‘value’ parameter is

ignored. Instead, the aforementioned parameters should be provided within

each object in the list.

* **mount\_point** (*str*) – The “path” the method/backend was mounted on.

Returns

The response of the validate\_token request.

Return type

requests.Response

*class* `hvac.api.secrets_engines.``Transit`(*adapter*)[[source]](_modules/hvac/api/secrets_engines/transit.html#Transit)[¶](#hvac.api.secrets_engines.Transit "Permalink to this definition")

Bases: `hvac.api.vault\_api\_base.VaultApiBase`

Transit Secrets Engine (API).

Reference: <https://www.vaultproject.io/api/secret/transit/index.html>

**Methods**

| [`backup\_key`](#hvac.api.secrets_engines.Transit.backup_key "hvac.api.secrets_engines.Transit.backup_key")(name[, mount\_point]) | Return a plaintext backup of a named key. |

| [`create\_key`](#hvac.api.secrets_engines.Transit.create_key "hvac.api.secrets_engines.Transit.create_key")(name[, convergent\_encryption, …]) | Create a new named encryption key of the specified type. |

| [`decrypt\_data`](#hvac.api.secrets_engines.Transit.decrypt_data "hvac.api.secrets_engines.Transit.decrypt_data")(name, ciphertext[, context, …]) | Decrypt the provided ciphertext using the named key. |

| [`delete\_key`](#hvac.api.secrets_engines.Transit.delete_key "hvac.api.secrets_engines.Transit.delete_key")(name[, mount\_point]) | Delete a named encryption key. |

| [`encrypt\_data`](#hvac.api.secrets_engines.Transit.encrypt_data "hvac.api.secrets_engines.Transit.encrypt_data")(name, plaintext[, context, …]) | Encrypt the provided plaintext using the named key. |

| [`export\_key`](#hvac.api.secrets_engines.Transit.export_key "hvac.api.secrets_engines.Transit.export_key")(name, key\_type[, version, …]) | Return the named key. |

| [`generate\_data\_key`](#hvac.api.secrets_engines.Transit.generate_data_key "hvac.api.secrets_engines.Transit.generate_data_key")(name, key\_type[, context, …]) | Generates a new high-entropy key and the value encrypted with the named key. |

| [`generate\_hmac`](#hvac.api.secrets_engines.Transit.generate_hmac "hvac.api.secrets_engines.Transit.generate_hmac")(name, hash\_input[, …]) | Return the digest of given data using the specified hash algorithm and the named key. |

| [`generate\_random\_bytes`](#hvac.api.secrets_engines.Transit.generate_random_bytes "hvac.api.secrets_engines.Transit.generate_random_bytes")([n\_bytes, …]) | Return high-quality random bytes of the specified length. |

| [`hash\_data`](#hvac.api.secrets_engines.Transit.hash_data "hvac.api.secrets_engines.Transit.hash_data")(hash\_input[, algorithm, …]) | Return the cryptographic hash of given data using the specified algorithm. |

| [`list\_keys`](#hvac.api.secrets_engines.Transit.list_keys "hvac.api.secrets_engines.Transit.list_keys")([mount\_point]) | List keys (if there are any). |

| [`read\_key`](#hvac.api.secrets_engines.Transit.read_key "hvac.api.secrets_engines.Transit.read_key")(name[, mount\_point]) | Read information about a named encryption key. |

| [`restore\_key`](#hvac.api.secrets_engines.Transit.restore_key "hvac.api.secrets_engines.Transit.restore_key")(backup[, name, force, mount\_point]) | Restore the backup as a named key. |

| [`rewrap\_data`](#hvac.api.secrets_engines.Transit.rewrap_data "hvac.api.secrets_engines.Transit.rewrap_data")(name, ciphertext[, context, …]) | Rewrap the provided ciphertext using the latest version of the named key. |

| [`rotate\_key`](#hvac.api.secrets_engines.Transit.rotate_key "hvac.api.secrets_engines.Transit.rotate_key")(name[, mount\_point]) | Rotate the version of the named key. |

| [`sign\_data`](#hvac.api.secrets_engines.Transit.sign_data "hvac.api.secrets_engines.Transit.sign_data")(name, hash\_input[, key\_version, …]) | Return the cryptographic signature of the given data using the named key and the specified hash algorithm. |

| [`trim\_key`](#hvac.api.secrets_engines.Transit.trim_key "hvac.api.secrets_engines.Transit.trim_key")(name, min\_version[, mount\_point]) | Trims older key versions setting a minimum version for the keyring. |

| [`update\_key\_configuration`](#hvac.api.secrets_engines.Transit.update_key_configuration "hvac.api.secrets_engines.Transit.update_key_configuration")(name[, …]) | Tune configuration values for a given key. |

| [`verify\_signed\_data`](#hvac.api.secrets_engines.Transit.verify_signed_data "hvac.api.secrets_engines.Transit.verify_signed_data")(name, hash\_input[, …]) | Return whether the provided signature is valid for the given data. |

`backup_key`(*name*, *mount\_point='transit'*)[[source]](_modules/hvac/api/secrets_engines/transit.html#Transit.backup_key)[¶](#hvac.api.secrets_engines.Transit.backup_key "Permalink to this definition")

Return a plaintext backup of a named key.

The backup contains all the configuration data and keys of all the versions along with the HMAC key. The

response from this endpoint can be used with the /restore endpoint to restore the key.

Supported methods:GET: /{mount\_point}/backup/{name}. Produces: 200 application/json

Parameters

* **name** (*str | unicode*) – Name of the key.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

`create_key`(*name*, *convergent\_encryption=None*, *derived=None*, *exportable=None*, *allow\_plaintext\_backup=None*, *key\_type=None*, *mount\_point='transit'*)[[source]](_modules/hvac/api/secrets_engines/transit.html#Transit.create_key)[¶](#hvac.api.secrets_engines.Transit.create_key "Permalink to this definition")

Create a new named encryption key of the specified type.

The values set here cannot be changed after key creation.

Supported methods:POST: /{mount\_point}/keys/{name}. Produces: 204 (empty body)

Parameters

* **name** (*str | unicode*) – Specifies the name of the encryption key to create. This is specified as part of the URL.

* **convergent\_encryption** (*bool*) – If enabled, the key will support convergent encryption, where the same plaintext

creates the same ciphertext. This requires derived to be set to true. When enabled, each

encryption(/decryption/rewrap/datakey) operation will derive a nonce value rather than randomly generate it.

* **derived** (*bool*) – Specifies if key derivation is to be used. If enabled, all encrypt/decrypt requests to this

named key must provide a context which is used for key derivation.

* **exportable** (*bool*) – Enables keys to be exportable. This allows for all the valid keys in the key ring to be

exported. Once set, this cannot be disabled.

* **allow\_plaintext\_backup** (*bool*) – If set, enables taking backup of named key in the plaintext format. Once set,

this cannot be disabled.

* **key\_type** (*str | unicode*) – Specifies the type of key to create. The currently-supported types are:

	+ **aes256-gcm96**: AES-256 wrapped with GCM using a 96-bit nonce size AEAD

	+ **chacha20-poly1305**: ChaCha20-Poly1305 AEAD (symmetric, supports derivation and convergent encryption)

	+ **ed25519**: ED25519 (asymmetric, supports derivation).

	+ **ecdsa-p256**: ECDSA using the P-256 elliptic curve (asymmetric)

	+ **ecdsa-p384**: ECDSA using the P-384 elliptic curve (asymmetric)

	+ **ecdsa-p521**: ECDSA using the P-521 elliptic curve (asymmetric)

	+ **rsa-2048**: RSA with bit size of 2048 (asymmetric)

	+ **rsa-3072**: RSA with bit size of 3072 (asymmetric)

	+ **rsa-4096**: RSA with bit size of 4096 (asymmetric)

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the request.

Return type

requests.Response

`decrypt_data`(*name*, *ciphertext*, *context=None*, *nonce=None*, *batch\_input=None*, *mount\_point='transit'*)[[source]](_modules/hvac/api/secrets_engines/transit.html#Transit.decrypt_data)[¶](#hvac.api.secrets_engines.Transit.decrypt_data "Permalink to this definition")

Decrypt the provided ciphertext using the named key.

Supported methods:POST: /{mount\_point}/decrypt/{name}. Produces: 200 application/json

Parameters

* **name** (*str | unicode*) – Specifies the name of the encryption key to decrypt against. This is specified as part of the URL.

* **ciphertext** (*str | unicode*) – the ciphertext to decrypt.

* **context** (*str | unicode*) – Specifies the base64 encoded context for key derivation. This is required if key derivation is

enabled.

* **nonce** (*str | unicode*) – Specifies a base64 encoded nonce value used during encryption. Must be provided if convergent

encryption is enabled for this key and the key was generated with Vault 0.6.1. Not required for keys created

in 0.6.2+.

* **batch\_input** (*List**[**dict**]*) – Specifies a list of items to be decrypted in a single batch. When this parameter is set, if

the parameters ‘ciphertext’, ‘context’ and ‘nonce’ are also set, they will be ignored. Format for the input

goes like this: [dict(context=”b64\_context”, ciphertext=”b64\_plaintext”), …]

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

`delete_key`(*name*, *mount\_point='transit'*)[[source]](_modules/hvac/api/secrets_engines/transit.html#Transit.delete_key)[¶](#hvac.api.secrets_engines.Transit.delete_key "Permalink to this definition")

Delete a named encryption key.

It will no longer be possible to decrypt any data encrypted with the named key. Because this is a potentially

catastrophic operation, the deletion\_allowed tunable must be set in the key’s /config endpoint.

Supported methods:DELETE: /{mount\_point}/keys/{name}. Produces: 204 (empty body)

Parameters

* **name** (*str | unicode*) – Specifies the name of the encryption key to delete. This is specified as part of the URL.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the request.

Return type

requests.Response

`encrypt_data`(*name*, *plaintext*, *context=None*, *key\_version=None*, *nonce=None*, *batch\_input=None*, *type=None*, *convergent\_encryption=None*, *mount\_point='transit'*)[[source]](_modules/hvac/api/secrets_engines/transit.html#Transit.encrypt_data)[¶](#hvac.api.secrets_engines.Transit.encrypt_data "Permalink to this definition")

Encrypt the provided plaintext using the named key.

This path supports the create and update policy capabilities as follows: if the user has the create capability

for this endpoint in their policies, and the key does not exist, it will be upserted with default values

(whether the key requires derivation depends on whether the context parameter is empty or not). If the user only

has update capability and the key does not exist, an error will be returned.

Supported methods:POST: /{mount\_point}/encrypt/{name}. Produces: 200 application/json

Parameters

* **name** (*str | unicode*) – Specifies the name of the encryption key to encrypt against. This is specified as part of the URL.

* **plaintext** (*str | unicode*) – Specifies base64 encoded plaintext to be encoded.

* **context** (*str | unicode*) – Specifies the base64 encoded context for key derivation. This is required if key derivation is

enabled for this key.

* **key\_version** (*int*) – Specifies the version of the key to use for encryption. If not set, uses the latest version.

Must be greater than or equal to the key’s min\_encryption\_version, if set.

* **nonce** (*str | unicode*) – Specifies the base64 encoded nonce value. This must be provided if convergent encryption is

enabled for this key and the key was generated with Vault 0.6.1. Not required for keys created in 0.6.2+.

The value must be exactly 96 bits (12 bytes) long and the user must ensure that for any given context (and

thus, any given encryption key) this nonce value is never reused.

* **batch\_input** (*List**[**dict**]*) – Specifies a list of items to be encrypted in a single batch. When this parameter is set, if

the parameters ‘plaintext’, ‘context’ and ‘nonce’ are also set, they will be ignored. The format for the

input is: [dict(context=”b64\_context”, plaintext=”b64\_plaintext”), …]

* **type** (*str | unicode*) – This parameter is required when encryption key is expected to be created. When performing an

upsert operation, the type of key to create.

* **convergent\_encryption** (*str | unicode*) – This parameter will only be used when a key is expected to be created. Whether to

support convergent encryption. This is only supported when using a key with key derivation enabled and will

require all requests to carry both a context and 96-bit (12-byte) nonce. The given nonce will be used in

place of a randomly generated nonce. As a result, when the same context and nonce are supplied, the same

ciphertext is generated. It is very important when using this mode that you ensure that all nonces are

unique for a given context. Failing to do so will severely impact the ciphertext’s security.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

`export_key`(*name*, *key\_type*, *version=None*, *mount\_point='transit'*)[[source]](_modules/hvac/api/secrets_engines/transit.html#Transit.export_key)[¶](#hvac.api.secrets_engines.Transit.export_key "Permalink to this definition")

Return the named key.

The keys object shows the value of the key for each version. If version is specified, the specific version will

be returned. If latest is provided as the version, the current key will be provided. Depending on the type of

key, different information may be returned. The key must be exportable to support this operation and the version

must still be valid.

Supported methods:GET: /{mount\_point}/export/{key\_type}/{name}(/{version}). Produces: 200 application/json

Parameters

* **name** (*str | unicode*) – Specifies the name of the key to read information about. This is specified as part of the URL.

* **key\_type** (*str | unicode*) – Specifies the type of the key to export. This is specified as part of the URL. Valid values are:

encryption-key

signing-key

hmac-key

* **version** (*str | unicode*) – Specifies the version of the key to read. If omitted, all versions of the key will be returned.

If the version is set to latest, the current key will be returned.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

`generate_data_key`(*name*, *key\_type*, *context=None*, *nonce=None*, *bits=None*, *mount\_point='transit'*)[[source]](_modules/hvac/api/secrets_engines/transit.html#Transit.generate_data_key)[¶](#hvac.api.secrets_engines.Transit.generate_data_key "Permalink to this definition")

Generates a new high-entropy key and the value encrypted with the named key.

Optionally return the plaintext of the key as well. Whether plaintext is returned depends on the path; as a

result, you can use Vault ACL policies to control whether a user is allowed to retrieve the plaintext value of a

key. This is useful if you want an untrusted user or operation to generate keys that are then made available to

trusted users.

Supported methods:POST: /{mount\_point}/datakey/{key\_type}/{name}. Produces: 200 application/json

Parameters

* **name** (*str | unicode*) – Specifies the name of the encryption key to use to encrypt the datakey. This is specified as part

of the URL.

* **key\_type** (*str | unicode*) – Specifies the type of key to generate. If plaintext, the plaintext key will be returned along

with the ciphertext. If wrapped, only the ciphertext value will be returned. This is specified as part of

the URL.

* **context** (*str | unicode*) – Specifies the key derivation context, provided as a base64-encoded string. This must be provided

if derivation is enabled.

* **nonce** (*str | unicode*) – Specifies a nonce value, provided as base64 encoded. Must be provided if convergent encryption is

enabled for this key and the key was generated with Vault 0.6.1. Not required for keys created in 0.6.2+.

The value must be exactly 96 bits (12 bytes) long and the user must ensure that for any given context (and

thus, any given encryption key) this nonce value is never reused.

* **bits** (*int*) – Specifies the number of bits in the desired key. Can be 128, 256, or 512.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

`generate_hmac`(*name*, *hash\_input*, *key\_version=None*, *algorithm=None*, *mount\_point='transit'*)[[source]](_modules/hvac/api/secrets_engines/transit.html#Transit.generate_hmac)[¶](#hvac.api.secrets_engines.Transit.generate_hmac "Permalink to this definition")

Return the digest of given data using the specified hash algorithm and the named key.

The key can be of any type supported by transit; the raw key will be marshaled into bytes to be used for the

HMAC function. If the key is of a type that supports rotation, the latest (current) version will be used.

Supported methods:POST: /{mount\_point}/hmac/{name}(/{algorithm}). Produces: 200 application/json

Parameters

* **name** (*str | unicode*) – Specifies the name of the encryption key to generate hmac against. This is specified as part of the

URL.

* **hash\_input** – Specifies the base64 encoded input data.

* **key\_version** (*int*) – Specifies the version of the key to use for the operation. If not set, uses the latest

version. Must be greater than or equal to the key’s min\_encryption\_version, if set.

* **algorithm** (*str | unicode*) – Specifies the hash algorithm to use. This can also be specified as part of the URL.

Currently-supported algorithms are: sha2-224, sha2-256, sha2-384, sha2-512

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

`generate_random_bytes`(*n\_bytes=None*, *output\_format=None*, *mount\_point='transit'*)[[source]](_modules/hvac/api/secrets_engines/transit.html#Transit.generate_random_bytes)[¶](#hvac.api.secrets_engines.Transit.generate_random_bytes "Permalink to this definition")

Return high-quality random bytes of the specified length.

Supported methods:POST: /{mount\_point}/random(/{bytes}). Produces: 200 application/json

Parameters

* **n\_bytes** (*int*) – Specifies the number of bytes to return. This value can be specified either in the request body,

or as a part of the URL.

* **output\_format** (*str | unicode*) – Specifies the output encoding. Valid options are hex or base64.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

`hash_data`(*hash\_input*, *algorithm=None*, *output\_format=None*, *mount\_point='transit'*)[[source]](_modules/hvac/api/secrets_engines/transit.html#Transit.hash_data)[¶](#hvac.api.secrets_engines.Transit.hash_data "Permalink to this definition")

Return the cryptographic hash of given data using the specified algorithm.

Supported methods:POST: /{mount\_point}/hash(/{algorithm}). Produces: 200 application/json

Parameters

* **hash\_input** (*str | unicode*) – Specifies the base64 encoded input data.

* **algorithm** (*str | unicode*) – Specifies the hash algorithm to use. This can also be specified as part of the URL.

Currently-supported algorithms are: sha2-224, sha2-256, sha2-384, sha2-512

* **output\_format** (*str | unicode*) – Specifies the output encoding. This can be either hex or base64.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

`list_keys`(*mount\_point='transit'*)[[source]](_modules/hvac/api/secrets_engines/transit.html#Transit.list_keys)[¶](#hvac.api.secrets_engines.Transit.list_keys "Permalink to this definition")

List keys (if there are any).

Only the key names are returned (not the actual keys themselves).

An exception is thrown if there are no keys.

Supported methods:LIST: /{mount\_point}/keys. Produces: 200 application/json

Parameters

**mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

`read_key`(*name*, *mount\_point='transit'*)[[source]](_modules/hvac/api/secrets_engines/transit.html#Transit.read_key)[¶](#hvac.api.secrets_engines.Transit.read_key "Permalink to this definition")

Read information about a named encryption key.

The keys object shows the creation time of each key version; the values are not the keys themselves. Depending

on the type of key, different information may be returned, e.g. an asymmetric key will return its public key in

a standard format for the type.

Supported methods:GET: /{mount\_point}/keys/{name}. Produces: 200 application/json

Parameters

* **name** (*str | unicode*) – Specifies the name of the encryption key to read. This is specified as part of the URL.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the read\_key request.

Return type

dict

`restore_key`(*backup*, *name=None*, *force=None*, *mount\_point='transit'*)[[source]](_modules/hvac/api/secrets_engines/transit.html#Transit.restore_key)[¶](#hvac.api.secrets_engines.Transit.restore_key "Permalink to this definition")

Restore the backup as a named key.

This will restore the key configurations and all the versions of the named key along with HMAC keys. The input

to this endpoint should be the output of /backup endpoint. For safety, by default the backend will refuse to

restore to an existing key. If you want to reuse a key name, it is recommended you delete the key before

restoring. It is a good idea to attempt restoring to a different key name first to verify that the operation

successfully completes.

Supported methods:POST: /{mount\_point}/restore(/name). Produces: 204 (empty body)

Parameters

* **backup** (*str | unicode*) – Backed up key data to be restored. This should be the output from the /backup endpoint.

* **name** (*str | unicode*) – If set, this will be the name of the restored key.

* **force** (*bool*) – If set, force the restore to proceed even if a key by this name already exists.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the request.

Return type

requests.Response

`rewrap_data`(*name*, *ciphertext*, *context=None*, *key\_version=None*, *nonce=None*, *batch\_input=None*, *mount\_point='transit'*)[[source]](_modules/hvac/api/secrets_engines/transit.html#Transit.rewrap_data)[¶](#hvac.api.secrets_engines.Transit.rewrap_data "Permalink to this definition")

Rewrap the provided ciphertext using the latest version of the named key.

Because this never returns plaintext, it is possible to delegate this functionality to untrusted users or scripts.

Supported methods:POST: /{mount\_point}/rewrap/{name}. Produces: 200 application/json

Parameters

* **name** (*str | unicode*) – Specifies the name of the encryption key to re-encrypt against. This is specified as part of the URL.

* **ciphertext** (*str | unicode*) – Specifies the ciphertext to re-encrypt.

* **context** (*str | unicode*) – Specifies the base64 encoded context for key derivation. This is required if key derivation is

enabled.

* **key\_version** (*int*) – Specifies the version of the key to use for the operation. If not set, uses the latest

version. Must be greater than or equal to the key’s min\_encryption\_version, if set.

* **nonce** (*str | unicode*) – Specifies a base64 encoded nonce value used during encryption. Must be provided if convergent

encryption is enabled for this key and the key was generated with Vault 0.6.1. Not required for keys created

in 0.6.2+.

* **batch\_input** (*List**[**dict**]*) – Specifies a list of items to be decrypted in a single batch. When this parameter is set, if

the parameters ‘ciphertext’, ‘context’ and ‘nonce’ are also set, they will be ignored. Format for the input

goes like this: [dict(context=”b64\_context”, ciphertext=”b64\_plaintext”), …]

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

`rotate_key`(*name*, *mount\_point='transit'*)[[source]](_modules/hvac/api/secrets_engines/transit.html#Transit.rotate_key)[¶](#hvac.api.secrets_engines.Transit.rotate_key "Permalink to this definition")

Rotate the version of the named key.

After rotation, new plaintext requests will be encrypted with the new version of the key. To upgrade ciphertext

to be encrypted with the latest version of the key, use the rewrap endpoint. This is only supported with keys

that support encryption and decryption operations.

Supported methods:POST: /{mount\_point}/keys/{name}/rotate. Produces: 204 (empty body)

Parameters

* **name** (*str | unicode*) – Specifies the name of the key to read information about. This is specified as part of the URL.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the request.

Return type

requests.Response

`sign_data`(*name*, *hash\_input*, *key\_version=None*, *hash\_algorithm=None*, *context=None*, *prehashed=None*, *signature\_algorithm=None*, *marshaling\_algorithm=None*, *mount\_point='transit'*)[[source]](_modules/hvac/api/secrets_engines/transit.html#Transit.sign_data)[¶](#hvac.api.secrets_engines.Transit.sign_data "Permalink to this definition")

Return the cryptographic signature of the given data using the named key and the specified hash algorithm.

The key must be of a type that supports signing.

Supported methods:POST: /{mount\_point}/sign/{name}(/{hash\_algorithm}). Produces: 200 application/json

Parameters

* **name** (*str | unicode*) – Specifies the name of the encryption key to use for signing. This is specified as part of the URL.

* **hash\_input** (*str | unicode*) – Specifies the base64 encoded input data.

* **key\_version** (*int*) – Specifies the version of the key to use for signing. If not set, uses the latest version.

Must be greater than or equal to the key’s min\_encryption\_version, if set.

* **hash\_algorithm** (*str | unicode*) – Specifies the hash algorithm to use for supporting key types (notably, not including

ed25519 which specifies its own hash algorithm). This can also be specified as part of the URL.

Currently-supported algorithms are: sha2-224, sha2-256, sha2-384, sha2-512

* **context** (*str | unicode*) – Base64 encoded context for key derivation. Required if key derivation is enabled; currently only

available with ed25519 keys.

* **prehashed** (*bool*) – Set to true when the input is already hashed. If the key type is rsa-2048 or rsa-4096, then

the algorithm used to hash the input should be indicated by the hash\_algorithm parameter. Just as the value

to sign should be the base64-encoded representation of the exact binary data you want signed, when set, input

is expected to be base64-encoded binary hashed data, not hex-formatted. (As an example, on the command line,

you could generate a suitable input via openssl dgst -sha256 -binary | base64.)

* **signature\_algorithm** (*str | unicode*) – When using a RSA key, specifies the RSA signature algorithm to use for signing.

Supported signature types are: pss, pkcs1v15

* **marshaling\_algorithm** (*str | unicode*) – Specifies the way in which the signature should be marshaled. This currently only applies to ECDSA keys.

Supported types are: asn1, jws

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

`trim_key`(*name*, *min\_version*, *mount\_point='transit'*)[[source]](_modules/hvac/api/secrets_engines/transit.html#Transit.trim_key)[¶](#hvac.api.secrets_engines.Transit.trim_key "Permalink to this definition")

Trims older key versions setting a minimum version for the keyring.

Once trimmed, previous versions of the key cannot be recovered.

Supported methods:POST: /{mount\_point}/keys/{name}/trim. Produces: 200 application/json

Parameters

* **name** (*str | unicode*) – Specifies the name of the key to be trimmed.

* **min\_version** (*int*) – The minimum version for the key ring. All versions before this version will be permanently

deleted. This value can at most be equal to the lesser of min\_decryption\_version and min\_encryption\_version.

This is not allowed to be set when either min\_encryption\_version or min\_decryption\_version is set to zero.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the request.

Return type

dict

`update_key_configuration`(*name*, *min\_decryption\_version=None*, *min\_encryption\_version=None*, *deletion\_allowed=None*, *exportable=None*, *allow\_plaintext\_backup=None*, *mount\_point='transit'*)[[source]](_modules/hvac/api/secrets_engines/transit.html#Transit.update_key_configuration)[¶](#hvac.api.secrets_engines.Transit.update_key_configuration "Permalink to this definition")

Tune configuration values for a given key.

These values are returned during a read operation on the named key.

Supported methods:POST: /{mount\_point}/keys/{name}/config. Produces: 204 (empty body)

Parameters

* **name** (*str | unicode*) – Specifies the name of the encryption key to update configuration for.

* **min\_decryption\_version** (*int*) – Specifies the minimum version of ciphertext allowed to be decrypted. Adjusting

this as part of a key rotation policy can prevent old copies of ciphertext from being decrypted, should they

fall into the wrong hands. For signatures, this value controls the minimum version of signature that can be

verified against. For HMACs, this controls the minimum version of a key allowed to be used as the key for

verification.

* **min\_encryption\_version** (*int*) – Specifies the minimum version of the key that can be used to encrypt plaintext,

sign payloads, or generate HMACs. Must be 0 (which will use the latest version) or a value greater or equal

to min\_decryption\_version.

* **deletion\_allowed** (*bool*) – Specifies if the key is allowed to be deleted.

* **exportable** (*bool*) – Enables keys to be exportable. This allows for all the valid keys in the key ring to be

exported. Once set, this cannot be disabled.

* **allow\_plaintext\_backup** (*bool*) – If set, enables taking backup of named key in the plaintext format. Once set,

this cannot be disabled.

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The response of the request.

Return type

requests.Response

`verify_signed_data`(*name*, *hash\_input*, *signature=None*, *hmac=None*, *hash\_algorithm=None*, *context=None*, *prehashed=None*, *signature\_algorithm=None*, *marshaling\_algorithm=None*, *mount\_point='transit'*)[[source]](_modules/hvac/api/secrets_engines/transit.html#Transit.verify_signed_data)[¶](#hvac.api.secrets_engines.Transit.verify_signed_data "Permalink to this definition")

Return whether the provided signature is valid for the given data.

Supported methods:POST: /{mount\_point}/verify/{name}(/{hash\_algorithm}). Produces: 200 application/json

Parameters

* **name** (*str | unicode*) – Specifies the name of the encryption key that was used to generate the signature or HMAC.

* **hash\_input** – Specifies the base64 encoded input data.

* **signature** (*str | unicode*) – Specifies the signature output from the /transit/sign function. Either this must be supplied

or hmac must be supplied.

* **hmac** (*str | unicode*) – Specifies the signature output from the /transit/hmac function. Either this must be supplied or

signature must be supplied.

* **hash\_algorithm** (*str | unicode*) – Specifies the hash algorithm to use. This can also be specified as part of the URL.

Currently-supported algorithms are: sha2-224, sha2-256, sha2-384, sha2-512

* **context** (*str | unicode*) – Base64 encoded context for key derivation. Required if key derivation is enabled; currently only

available with ed25519 keys.

* **prehashed** (*bool*) – Set to true when the input is already hashed. If the key type is rsa-2048 or rsa-4096, then

the algorithm used to hash the input should be indicated by the hash\_algorithm parameter.

* **signature\_algorithm** (*str | unicode*) – When using a RSA key, specifies the RSA signature algorithm to use for signature

verification. Supported signature types are: pss, pkcs1v15

* **marshaling\_algorithm** (*str | unicode*) – Specifies the way in which the signature should be marshaled. This currently only applies to ECDSA keys.

Supported types are: asn1, jws

* **mount\_point** (*str | unicode*) – The “path” the method/backend was mounted on.

Returns

The JSON response of the request.

Return type

dict

### hvac.api.system\_backend[¶](#module-hvac.api.system_backend "Permalink to this headline")

Collection of Vault system backend API endpoint classes.

**Classes**

| [`Audit`](#hvac.api.system_backend.Audit "hvac.api.system_backend.Audit")(adapter) |  |

| [`Auth`](#hvac.api.system_backend.Auth "hvac.api.system_backend.Auth")(adapter) |  |

| [`Capabilities`](#hvac.api.system_backend.Capabilities "hvac.api.system_backend.Capabilities")(adapter) |  |

| [`Health`](#hvac.api.system_backend.Health "hvac.api.system_backend.Health")(adapter) | .

 |

| [`Init`](#hvac.api.system_backend.Init "hvac.api.system_backend.Init")(adapter) |  |

| [`Key`](#hvac.api.system_backend.Key "hvac.api.system_backend.Key")(adapter) |  |

| [`Leader`](#hvac.api.system_backend.Leader "hvac.api.system_backend.Leader")(adapter) |  |

| [`Lease`](#hvac.api.system_backend.Lease "hvac.api.system_backend.Lease")(adapter) |  |

| [`Mount`](#hvac.api.system_backend.Mount "hvac.api.system_backend.Mount")(adapter) |  |

| [`Namespace`](#hvac.api.system_backend.Namespace "hvac.api.system_backend.Namespace")(adapter) |  |

| [`Policy`](#hvac.api.system_backend.Policy "hvac.api.system_backend.Policy")(adapter) |  |

| [`Raft`](#hvac.api.system_backend.Raft "hvac.api.system_backend.Raft")(adapter) | Raft cluster-related system backend methods. |

| [`Seal`](#hvac.api.system_backend.Seal "hvac.api.system_backend.Seal")(adapter) |  |

| [`SystemBackend`](#hvac.api.system_backend.SystemBackend "hvac.api.system_backend.SystemBackend")(adapter) |  |

| [`SystemBackendMixin`](#hvac.api.system_backend.SystemBackendMixin "hvac.api.system_backend.SystemBackendMixin")(adapter) | Base class for System Backend API endpoints. |

| [`Wrapping`](#hvac.api.system_backend.Wrapping "hvac.api.system_backend.Wrapping")(adapter) |  |

*class* `hvac.api.system_backend.``Audit`(*adapter*)[[source]](_modules/hvac/api/system_backend/audit.html#Audit)[¶](#hvac.api.system_backend.Audit "Permalink to this definition")

Bases: `hvac.api.system\_backend.system\_backend\_mixin.SystemBackendMixin`

**Methods**

| [`calculate\_hash`](#hvac.api.system_backend.Audit.calculate_hash "hvac.api.system_backend.Audit.calculate_hash")(path, input\_to\_hash) | Hash the given input data with the specified audit device’s hash function and salt. |

| [`disable\_audit\_device`](#hvac.api.system_backend.Audit.disable_audit_device "hvac.api.system_backend.Audit.disable_audit_device")(path) | Disable the audit device at the given path. |

| [`enable\_audit\_device`](#hvac.api.system_backend.Audit.enable_audit_device "hvac.api.system_backend.Audit.enable_audit_device")(device\_type[, …]) | Enable a new audit device at the supplied path. |

| [`list\_enabled\_audit\_devices`](#hvac.api.system_backend.Audit.list_enabled_audit_devices "hvac.api.system_backend.Audit.list_enabled_audit_devices")() | List enabled audit devices. |

`calculate_hash`(*path*, *input\_to\_hash*)[[source]](_modules/hvac/api/system_backend/audit.html#Audit.calculate_hash)[¶](#hvac.api.system_backend.Audit.calculate_hash "Permalink to this definition")

Hash the given input data with the specified audit device’s hash function and salt.

This endpoint can be used to discover whether a given plaintext string (the input parameter) appears in the

audit log in obfuscated form.

Supported methods:POST: /sys/audit-hash/{path}. Produces: 204 (empty body)

Parameters

* **path** (*str | unicode*) – The path of the audit device to generate hashes for. This is part of the request URL.

* **input\_to\_hash** (*str | unicode*) – The input string to hash.

Returns

The JSON response of the request.

Return type

requests.Response

`disable_audit_device`(*path*)[[source]](_modules/hvac/api/system_backend/audit.html#Audit.disable_audit_device)[¶](#hvac.api.system_backend.Audit.disable_audit_device "Permalink to this definition")

Disable the audit device at the given path.

Supported methods:DELETE: /sys/audit/{path}. Produces: 204 (empty body)

Parameters

**path** (*str | unicode*) – The path of the audit device to delete. This is part of the request URL.

Returns

The response of the request.

Return type

requests.Response

`enable_audit_device`(*device\_type*, *description=None*, *options=None*, *path=None*, *local=None*)[[source]](_modules/hvac/api/system_backend/audit.html#Audit.enable_audit_device)[¶](#hvac.api.system_backend.Audit.enable_audit_device "Permalink to this definition")

Enable a new audit device at the supplied path.

The path can be a single word name or a more complex, nested path.

Supported methods:PUT: /sys/audit/{path}. Produces: 204 (empty body)

Parameters

* **device\_type** (*str | unicode*) – Specifies the type of the audit device.

* **description** (*str | unicode*) – Human-friendly description of the audit device.

* **options** (*str | unicode*) – Configuration options to pass to the audit device itself. This is

dependent on the audit device type.

* **path** (*str | unicode*) – Specifies the path in which to enable the audit device. This is part of

the request URL.

* **local** (*bool*) – Specifies if the audit device is a local only.

Returns

The response of the request.

Return type

requests.Response

`list_enabled_audit_devices`()[[source]](_modules/hvac/api/system_backend/audit.html#Audit.list_enabled_audit_devices)[¶](#hvac.api.system_backend.Audit.list_enabled_audit_devices "Permalink to this definition")

List enabled audit devices.

It does not list all available audit devices.

This endpoint requires sudo capability in addition to any path-specific capabilities.

Supported methods:GET: /sys/audit. Produces: 200 application/json

Returns

JSON response of the request.

Return type

dict

*class* `hvac.api.system_backend.``Auth`(*adapter*)[[source]](_modules/hvac/api/system_backend/auth.html#Auth)[¶](#hvac.api.system_backend.Auth "Permalink to this definition")

Bases: `hvac.api.system\_backend.system\_backend\_mixin.SystemBackendMixin`

**Methods**

| [`disable\_auth\_method`](#hvac.api.system_backend.Auth.disable_auth_method "hvac.api.system_backend.Auth.disable_auth_method")(path) | Disable the auth method at the given auth path. |

| [`enable\_auth\_method`](#hvac.api.system_backend.Auth.enable_auth_method "hvac.api.system_backend.Auth.enable_auth_method")(method\_type[, …]) | Enable a new auth method. |

| [`list\_auth\_methods`](#hvac.api.system_backend.Auth.list_auth_methods "hvac.api.system_backend.Auth.list_auth_methods")() | List all enabled auth methods. |

| [`read\_auth\_method\_tuning`](#hvac.api.system_backend.Auth.read_auth_method_tuning "hvac.api.system_backend.Auth.read_auth_method_tuning")(path) | Read the given auth path’s configuration. |

| [`tune\_auth\_method`](#hvac.api.system_backend.Auth.tune_auth_method "hvac.api.system_backend.Auth.tune_auth_method")(path[, default\_lease\_ttl, …]) | Tune configuration parameters for a given auth path. |

`disable_auth_method`(*path*)[[source]](_modules/hvac/api/system_backend/auth.html#Auth.disable_auth_method)[¶](#hvac.api.system_backend.Auth.disable_auth_method "Permalink to this definition")

Disable the auth method at the given auth path.

Supported methods:DELETE: /sys/auth/{path}. Produces: 204 (empty body)

Parameters

**path** (*str | unicode*) – The path the method was mounted on. If not provided, defaults to the value of the “method\_type”

argument.

Returns

The response of the request.

Return type

requests.Response

`enable_auth_method`(*method\_type*, *description=None*, *config=None*, *plugin\_name=None*, *local=False*, *path=None*, *\*\*kwargs*)[[source]](_modules/hvac/api/system_backend/auth.html#Auth.enable_auth_method)[¶](#hvac.api.system_backend.Auth.enable_auth_method "Permalink to this definition")

Enable a new auth method.

After enabling, the auth method can be accessed and configured via the auth path specified as part of the URL.

This auth path will be nested under the auth prefix.

Supported methods:POST: /sys/auth/{path}. Produces: 204 (empty body)

Parameters

* **method\_type** (*str | unicode*) – The name of the authentication method type, such as “github” or “token”.

* **description** (*str | unicode*) – A human-friendly description of the auth method.

* **config** (*dict*) – Configuration options for this auth method. These are the possible values:

	+ **default\_lease\_ttl**: The default lease duration, specified as a string duration like “5s” or “30m”.

	+ **max\_lease\_ttl**: The maximum lease duration, specified as a string duration like “5s” or “30m”.

	+ **audit\_non\_hmac\_request\_keys**: Comma-separated list of keys that will not be HMAC’d by audit devices in

	the request data object.

	+ **audit\_non\_hmac\_response\_keys**: Comma-separated list of keys that will not be HMAC’d by audit devices in

	the response data object.

	+ **listing\_visibility**: Speficies whether to show this mount in the UI-specific listing endpoint.

	+ **passthrough\_request\_headers**: Comma-separated list of headers to whitelist and pass from the request to

	the backend.

* **plugin\_name** (*str | unicode*) – The name of the auth plugin to use based from the name in the plugin catalog. Applies only

to plugin methods.

* **local** (*bool*) – <Vault enterprise only> Specifies if the auth method is a local only. Local auth methods are not

replicated nor (if a secondary) removed by replication.

* **path** (*str | unicode*) – The path to mount the method on. If not provided, defaults to the value of the “method\_type”

argument.

* **kwargs** (*dict*) – All dicts are accepted and passed to vault. See your specific secret engine for details on which

extra key-word arguments you might want to pass.

Returns

The response of the request.

Return type

requests.Response

`list_auth_methods`()[[source]](_modules/hvac/api/system_backend/auth.html#Auth.list_auth_methods)[¶](#hvac.api.system_backend.Auth.list_auth_methods "Permalink to this definition")

List all enabled auth methods.

Supported methods:GET: /sys/auth. Produces: 200 application/json

Returns

The JSON response of the request.

Return type

dict

`read_auth_method_tuning`(*path*)[[source]](_modules/hvac/api/system_backend/auth.html#Auth.read_auth_method_tuning)[¶](#hvac.api.system_backend.Auth.read_auth_method_tuning "Permalink to this definition")

Read the given auth path’s configuration.

This endpoint requires sudo capability on the final path, but the same functionality can be achieved without

sudo via sys/mounts/auth/[auth-path]/tune.

Supported methods:GET: /sys/auth/{path}/tune. Produces: 200 application/json

Parameters

**path** (*str | unicode*) – The path the method was mounted on. If not provided, defaults to the value of the “method\_type”

argument.

Returns

The JSON response of the request.

Return type

dict

`tune_auth_method`(*path*, *default\_lease\_ttl=None*, *max\_lease\_ttl=None*, *description=None*, *audit\_non\_hmac\_request\_keys=None*, *audit\_non\_hmac\_response\_keys=None*, *listing\_visibility=None*, *passthrough\_request\_headers=None*, *\*\*kwargs*)[[source]](_modules/hvac/api/system_backend/auth.html#Auth.tune_auth_method)[¶](#hvac.api.system_backend.Auth.tune_auth_method "Permalink to this definition")

Tune configuration parameters for a given auth path.

This endpoint requires sudo capability on the final path, but the same functionality can be achieved without

sudo via sys/mounts/auth/[auth-path]/tune.

Supported methods:POST: /sys/auth/{path}/tune. Produces: 204 (empty body)

Parameters

* **path** (*str | unicode*) – The path the method was mounted on. If not provided, defaults to the value of the “method\_type”

argument.

* **default\_lease\_ttl** (*int*) – Specifies the default time-to-live. If set on a specific auth path, this overrides the

global default.

* **max\_lease\_ttl** (*int*) – The maximum time-to-live. If set on a specific auth path, this overrides the global

default.

* **description** (*str | unicode*) – Specifies the description of the mount. This overrides the current stored value, if any.

* **audit\_non\_hmac\_request\_keys** (*array*) – Specifies the list of keys that will not be HMAC’d by audit devices in the

request data object.

* **audit\_non\_hmac\_response\_keys** (*list*) – Specifies the list of keys that will not be HMAC’d by audit devices in the

response data object.

* **listing\_visibility** (*list*) – Specifies whether to show this mount in the UI-specific listing endpoint. Valid

values are “unauth” or “”.

* **passthrough\_request\_headers** (*list*) – List of headers to whitelist and pass from the request to the backend.

* **kwargs** (*dict*) – All dicts are accepted and passed to vault. See your specific secret engine for details on which

extra key-word arguments you might want to pass.

Returns

The response of the request.

Return type

requests.Response

*class* `hvac.api.system_backend.``Capabilities`(*adapter*)[[source]](_modules/hvac/api/system_backend/capabilities.html#Capabilities)[¶](#hvac.api.system_backend.Capabilities "Permalink to this definition")

Bases: `hvac.api.system\_backend.system\_backend\_mixin.SystemBackendMixin`

**Methods**

| [`get\_capabilities`](#hvac.api.system_backend.Capabilities.get_capabilities "hvac.api.system_backend.Capabilities.get_capabilities")(paths[, token, accessor]) | Get the capabilities associated with a token. |

`get_capabilities`(*paths*, *token=None*, *accessor=None*)[[source]](_modules/hvac/api/system_backend/capabilities.html#Capabilities.get_capabilities)[¶](#hvac.api.system_backend.Capabilities.get_capabilities "Permalink to this definition")

Get the capabilities associated with a token.

Supported methods:POST: /sys/capabilities-self. Produces: 200 application/json

POST: /sys/capabilities. Produces: 200 application/json

POST: /sys/capabilities-accessor. Produces: 200 application/json

Parameters

* **paths** (*List**[**str**]*) – Paths on which capabilities are being queried.

* **token** (*str*) – Token for which capabilities are being queried.

* **accessor** (*str*) – Accessor of the token for which capabilities are being queried.

Returns

The JSON response of the request.

Return type

dict

*class* `hvac.api.system_backend.``Health`(*adapter*)[[source]](_modules/hvac/api/system_backend/health.html#Health)[¶](#hvac.api.system_backend.Health "Permalink to this definition")

Bases: `hvac.api.system\_backend.system\_backend\_mixin.SystemBackendMixin`

**Methods**

| [`read\_health\_status`](#hvac.api.system_backend.Health.read_health_status "hvac.api.system_backend.Health.read_health_status")([standby\_ok, …]) | Read the health status of Vault. |

.

Reference: <https://www.vaultproject.io/api-docs/system/health>

`read_health_status`(*standby\_ok=None*, *active\_code=None*, *standby\_code=None*, *dr\_secondary\_code=None*, *performance\_standby\_code=None*, *sealed\_code=None*, *uninit\_code=None*, *method='HEAD'*)[[source]](_modules/hvac/api/system_backend/health.html#Health.read_health_status)[¶](#hvac.api.system_backend.Health.read_health_status "Permalink to this definition")

Read the health status of Vault.

This matches the semantics of a Consul HTTP health check and provides a simple way to monitor the health of a

Vault instance.

Parameters

* **standby\_ok** (*bool*) – Specifies if being a standby should still return the active status code instead of the

standby status code. This is useful when Vault is behind a non-configurable load balance that just wants a

200-level response.

* **active\_code** (*int*) – The status code that should be returned for an active node.

* **standby\_code** (*int*) – Specifies the status code that should be returned for a standby node.

* **dr\_secondary\_code** (*int*) – Specifies the status code that should be returned for a DR secondary node.

* **performance\_standby\_code** (*int*) – Specifies the status code that should be returned for a performance standby

node.

* **sealed\_code** (*int*) – Specifies the status code that should be returned for a sealed node.

* **uninit\_code** (*int*) – Specifies the status code that should be returned for a uninitialized node.

* **method** (*str | unicode*) – Supported methods:

HEAD: /sys/health. Produces: 000 (empty body)

GET: /sys/health. Produces: 000 application/json

Returns

The JSON response of the request.

Return type

requests.Response

*class* `hvac.api.system_backend.``Init`(*adapter*)[[source]](_modules/hvac/api/system_backend/init.html#Init)[¶](#hvac.api.system_backend.Init "Permalink to this definition")

Bases: `hvac.api.system\_backend.system\_backend\_mixin.SystemBackendMixin`

**Methods**

| [`initialize`](#hvac.api.system_backend.Init.initialize "hvac.api.system_backend.Init.initialize")([secret\_shares, …]) | Initialize a new Vault. |

| [`is\_initialized`](#hvac.api.system_backend.Init.is_initialized "hvac.api.system_backend.Init.is_initialized")() | Determine is Vault is initialized or not. |

| [`read\_init\_status`](#hvac.api.system_backend.Init.read_init_status "hvac.api.system_backend.Init.read_init_status")() | Read the initialization status of Vault. |

`initialize`(*secret\_shares=5*, *secret\_threshold=3*, *pgp\_keys=None*, *root\_token\_pgp\_key=None*, *stored\_shares=None*, *recovery\_shares=None*, *recovery\_threshold=None*, *recovery\_pgp\_keys=None*)[[source]](_modules/hvac/api/system_backend/init.html#Init.initialize)[¶](#hvac.api.system_backend.Init.initialize "Permalink to this definition")

Initialize a new Vault.

The Vault must not have been previously initialized. The recovery options, as well as the stored shares option,

are only available when using Vault HSM.

Supported methods:PUT: /sys/init. Produces: 200 application/json

Parameters

* **secret\_shares** (*int*) – The number of shares to split the master key into.

* **secret\_threshold** (*int*) – Specifies the number of shares required to reconstruct the master key. This must be

less than or equal secret\_shares. If using Vault HSM with auto-unsealing, this value must be the same as

secret\_shares.

* **pgp\_keys** (*list*) – List of PGP public keys used to encrypt the output unseal keys.

Ordering is preserved. The keys must be base64-encoded from their original binary representation.

The size of this array must be the same as secret\_shares.

* **root\_token\_pgp\_key** (*str | unicode*) – Specifies a PGP public key used to encrypt the initial root token. The

key must be base64-encoded from its original binary representation.

* **stored\_shares** (*int*) – <enterprise only> Specifies the number of shares that should be encrypted by the HSM and

stored for auto-unsealing. Currently must be the same as secret\_shares.

* **recovery\_shares** (*int*) – <enterprise only> Specifies the number of shares to split the recovery key into.

* **recovery\_threshold** (*int*) – <enterprise only> Specifies the number of shares required to reconstruct the recovery

key. This must be less than or equal to recovery\_shares.

* **recovery\_pgp\_keys** (*list*) – <enterprise only> Specifies an array of PGP public keys used to encrypt the output

recovery keys. Ordering is preserved. The keys must be base64-encoded from their original binary

representation. The size of this array must be the same as recovery\_shares.

Returns

The JSON response of the request.

Return type

dict

`is_initialized`()[[source]](_modules/hvac/api/system_backend/init.html#Init.is_initialized)[¶](#hvac.api.system_backend.Init.is_initialized "Permalink to this definition")

Determine is Vault is initialized or not.

Returns

True if Vault is initialized, False otherwise.

Return type

bool

`read_init_status`()[[source]](_modules/hvac/api/system_backend/init.html#Init.read_init_status)[¶](#hvac.api.system_backend.Init.read_init_status "Permalink to this definition")

Read the initialization status of Vault.

Supported methods:GET: /sys/init. Produces: 200 application/json

Returns

The JSON response of the request.

Return type

dict

*class* `hvac.api.system_backend.``Key`(*adapter*)[[source]](_modules/hvac/api/system_backend/key.html#Key)[¶](#hvac.api.system_backend.Key "Permalink to this definition")

Bases: `hvac.api.system\_backend.system\_backend\_mixin.SystemBackendMixin`

**Methods**

| [`cancel\_rekey`](#hvac.api.system_backend.Key.cancel_rekey "hvac.api.system_backend.Key.cancel_rekey")([recovery\_key]) | Cancel any in-progress rekey. |

| [`cancel\_rekey\_verify`](#hvac.api.system_backend.Key.cancel_rekey_verify "hvac.api.system_backend.Key.cancel_rekey_verify")() | Cancel any in-progress rekey verification. |

| [`cancel\_root\_generation`](#hvac.api.system_backend.Key.cancel_root_generation "hvac.api.system_backend.Key.cancel_root_generation")() | Cancel any in-progress root generation attempt. |

| [`generate\_root`](#hvac.api.system_backend.Key.generate_root "hvac.api.system_backend.Key.generate_root")(key, nonce) | Enter a single master key share to progress the root generation attempt. |

| [`get\_encryption\_key\_status`](#hvac.api.system_backend.Key.get_encryption_key_status "hvac.api.system_backend.Key.get_encryption_key_status")() | Read information about the current encryption key used by Vault. |

| [`read\_backup\_keys`](#hvac.api.system_backend.Key.read_backup_keys "hvac.api.system_backend.Key.read_backup_keys")([recovery\_key]) | Retrieve the backup copy of PGP-encrypted unseal keys. |

| [`read\_rekey\_progress`](#hvac.api.system_backend.Key.read_rekey_progress "hvac.api.system_backend.Key.read_rekey_progress")([recovery\_key]) | Read the configuration and progress of the current rekey attempt. |

| [`read\_rekey\_verify\_progress`](#hvac.api.system_backend.Key.read_rekey_verify_progress "hvac.api.system_backend.Key.read_rekey_verify_progress")() | Read the configuration and progress of the current rekey verify attempt. |

| [`read\_root\_generation\_progress`](#hvac.api.system_backend.Key.read_root_generation_progress "hvac.api.system_backend.Key.read_root_generation_progress")() | Read the configuration and process of the current root generation attempt. |

| [`rekey`](#hvac.api.system_backend.Key.rekey "hvac.api.system_backend.Key.rekey")(key[, nonce, recovery\_key]) | Enter a single recovery key share to progress the rekey of the Vault. |

| [`rekey\_multi`](#hvac.api.system_backend.Key.rekey_multi "hvac.api.system_backend.Key.rekey_multi")(keys[, nonce, recovery\_key]) | Enter multiple recovery key shares to progress the rekey of the Vault. |

| [`rekey\_verify`](#hvac.api.system_backend.Key.rekey_verify "hvac.api.system_backend.Key.rekey_verify")(key, nonce) | Enter a single new recovery key share to progress the rekey verification of the Vault. |

| [`rekey\_verify\_multi`](#hvac.api.system_backend.Key.rekey_verify_multi "hvac.api.system_backend.Key.rekey_verify_multi")(keys, nonce) | Enter multiple new recovery key shares to progress the rekey verification of the Vault. |

| [`rotate\_encryption\_key`](#hvac.api.system_backend.Key.rotate_encryption_key "hvac.api.system_backend.Key.rotate_encryption_key")() | Trigger a rotation of the backend encryption key. |

| [`start\_rekey`](#hvac.api.system_backend.Key.start_rekey "hvac.api.system_backend.Key.start_rekey")([secret\_shares, …]) | Initializes a new rekey attempt. |

| [`start\_root\_token\_generation`](#hvac.api.system_backend.Key.start_root_token_generation "hvac.api.system_backend.Key.start_root_token_generation")([otp, pgp\_key]) | Initialize a new root generation attempt. |

`cancel_rekey`(*recovery\_key=False*)[[source]](_modules/hvac/api/system_backend/key.html#Key.cancel_rekey)[¶](#hvac.api.system_backend.Key.cancel_rekey "Permalink to this definition")

Cancel any in-progress rekey.

This clears the rekey settings as well as any progress made. This must be called to change the parameters of the

rekey.

Note: Verification is still a part of a rekey. If rekeying is canceled during the verification flow, the current

unseal keys remain valid.

Supported methods:DELETE: /sys/rekey/init. Produces: 204 (empty body)

DELETE: /sys/rekey-recovery-key/init. Produces: 204 (empty body)

Parameters

**recovery\_key** (*bool*) – If true, send requests to “rekey-recovery-key” instead of “rekey” api path.

Returns

The response of the request.

Return type

requests.Response

`cancel_rekey_verify`()[[source]](_modules/hvac/api/system_backend/key.html#Key.cancel_rekey_verify)[¶](#hvac.api.system_backend.Key.cancel_rekey_verify "Permalink to this definition")

Cancel any in-progress rekey verification.

This clears any progress made and resets the nonce. Unlike cancel\_rekey, this only resets

the current verification operation, not the entire rekey atttempt.

The return value is the same as GET along with the new nonce.

Supported methods:DELETE: /sys/rekey/verify. Produces: 204 (empty body)

Returns

The response of the request.

Return type

requests.Response

`cancel_root_generation`()[[source]](_modules/hvac/api/system_backend/key.html#Key.cancel_root_generation)[¶](#hvac.api.system_backend.Key.cancel_root_generation "Permalink to this definition")

Cancel any in-progress root generation attempt.

This clears any progress made. This must be called to change the OTP or PGP key being used.

Supported methods:DELETE: /sys/generate-root/attempt. Produces: 204 (empty body)

Returns

The response of the request.

Return type

request.Response

`generate_root`(*key*, *nonce*)[[source]](_modules/hvac/api/system_backend/key.html#Key.generate_root)[¶](#hvac.api.system_backend.Key.generate_root "Permalink to this definition")

Enter a single master key share to progress the root generation attempt.

If the threshold number of master key shares is reached, Vault will complete the root generation and issue the

new token. Otherwise, this API must be called multiple times until that threshold is met. The attempt nonce must

be provided with each call.

Supported methods:PUT: /sys/generate-root/update. Produces: 200 application/json

Parameters

* **key** (*str | unicode*) – Specifies a single master key share.

* **nonce** (*str | unicode*) – The nonce of the attempt.

Returns

The JSON response of the request.

Return type

dict

`get_encryption_key_status`()[[source]](_modules/hvac/api/system_backend/key.html#Key.get_encryption_key_status)[¶](#hvac.api.system_backend.Key.get_encryption_key_status "Permalink to this definition")

Read information about the current encryption key used by Vault.

Supported methods:GET: /sys/key-status. Produces: 200 application/json

Returns

JSON response with information regarding the current encryption key used by Vault.

Return type

dict

`read_backup_keys`(*recovery\_key=False*)[[source]](_modules/hvac/api/system_backend/key.html#Key.read_backup_keys)[¶](#hvac.api.system_backend.Key.read_backup_keys "Permalink to this definition")

Retrieve the backup copy of PGP-encrypted unseal keys.

The returned value is the nonce of the rekey operation and a map of PGP key fingerprint to hex-encoded

PGP-encrypted key.

Supported methods:PUT: /sys/rekey/backup. Produces: 200 application/json

PUT: /sys/rekey-recovery-key/backup. Produces: 200 application/json

Parameters

**recovery\_key** (*bool*) – If true, send requests to “rekey-recovery-key” instead of “rekey” api path.

Returns

The JSON response of the request.

Return type

dict

`read_rekey_progress`(*recovery\_key=False*)[[source]](_modules/hvac/api/system_backend/key.html#Key.read_rekey_progress)[¶](#hvac.api.system_backend.Key.read_rekey_progress "Permalink to this definition")

Read the configuration and progress of the current rekey attempt.

Supported methods:GET: /sys/rekey-recovery-key/init. Produces: 200 application/json

GET: /sys/rekey/init. Produces: 200 application/json

Parameters

**recovery\_key** (*bool*) – If true, send requests to “rekey-recovery-key” instead of “rekey” api path.

Returns

The JSON response of the request.

Return type

requests.Response

`read_rekey_verify_progress`()[[source]](_modules/hvac/api/system_backend/key.html#Key.read_rekey_verify_progress)[¶](#hvac.api.system_backend.Key.read_rekey_verify_progress "Permalink to this definition")

Read the configuration and progress of the current rekey verify attempt.

Supported methods:GET: /sys/rekey/verify. Produces: 200 application/json

Returns

The JSON response of the request.

Return type

requests.Response

`read_root_generation_progress`()[[source]](_modules/hvac/api/system_backend/key.html#Key.read_root_generation_progress)[¶](#hvac.api.system_backend.Key.read_root_generation_progress "Permalink to this definition")

Read the configuration and process of the current root generation attempt.

Supported methods:GET: /sys/generate-root/attempt. Produces: 200 application/json

Returns

The JSON response of the request.

Return type

dict

`rekey`(*key*, *nonce=None*, *recovery\_key=False*)[[source]](_modules/hvac/api/system_backend/key.html#Key.rekey)[¶](#hvac.api.system_backend.Key.rekey "Permalink to this definition")

Enter a single recovery key share to progress the rekey of the Vault.

If the threshold number of recovery key shares is reached, Vault will complete the rekey. Otherwise, this API

must be called multiple times until that threshold is met. The rekey nonce operation must be provided with each

call.

Supported methods:PUT: /sys/rekey/update. Produces: 200 application/json

PUT: /sys/rekey-recovery-key/update. Produces: 200 application/json

Parameters

* **key** (*str | unicode*) – Specifies a single recovery share key.

* **nonce** (*str | unicode*) – Specifies the nonce of the rekey operation.

* **recovery\_key** (*bool*) – If true, send requests to “rekey-recovery-key” instead of “rekey” api path.

Returns

The JSON response of the request.

Return type

dict

`rekey_multi`(*keys*, *nonce=None*, *recovery\_key=False*)[[source]](_modules/hvac/api/system_backend/key.html#Key.rekey_multi)[¶](#hvac.api.system_backend.Key.rekey_multi "Permalink to this definition")

Enter multiple recovery key shares to progress the rekey of the Vault.

If the threshold number of recovery key shares is reached, Vault will complete the rekey.

Parameters

* **keys** (*list*) – Specifies multiple recovery share keys.

* **nonce** (*str | unicode*) – Specifies the nonce of the rekey operation.

* **recovery\_key** (*bool*) – If true, send requests to “rekey-recovery-key” instead of “rekey” api path.

Returns

The last response of the rekey request.

Return type

response.Request

`rekey_verify`(*key*, *nonce*)[[source]](_modules/hvac/api/system_backend/key.html#Key.rekey_verify)[¶](#hvac.api.system_backend.Key.rekey_verify "Permalink to this definition")

Enter a single new recovery key share to progress the rekey verification of the Vault.

If the threshold number of new recovery key shares is reached, Vault will complete the

rekey. Otherwise, this API must be called multiple times until that threshold is met.

The rekey verification nonce must be provided with each call.

Supported methods:PUT: /sys/rekey/verify. Produces: 200 application/json

Parameters

* **key** (*str | unicode*) – Specifies multiple recovery share keys.

* **nonce** (*str | unicode*) – Specifies the nonce of the rekey verify operation.

Returns

The JSON response of the request.

Return type

dict

`rekey_verify_multi`(*keys*, *nonce*)[[source]](_modules/hvac/api/system_backend/key.html#Key.rekey_verify_multi)[¶](#hvac.api.system_backend.Key.rekey_verify_multi "Permalink to this definition")

Enter multiple new recovery key shares to progress the rekey verification of the Vault.

If the threshold number of new recovery key shares is reached, Vault will complete the

rekey. Otherwise, this API must be called multiple times until that threshold is met.

The rekey verification nonce must be provided with each call.

Supported methods:PUT: /sys/rekey/verify. Produces: 200 application/json

Parameters

* **keys** (*list*) – Specifies multiple recovery share keys.

* **nonce** (*str | unicode*) – Specifies the nonce of the rekey verify operation.

Returns

The JSON response of the request.

Return type

dict

`rotate_encryption_key`()[[source]](_modules/hvac/api/system_backend/key.html#Key.rotate_encryption_key)[¶](#hvac.api.system_backend.Key.rotate_encryption_key "Permalink to this definition")

Trigger a rotation of the backend encryption key.

This is the key that is used to encrypt data written to the storage backend, and is not provided to operators.

This operation is done online. Future values are encrypted with the new key, while old values are decrypted with

previous encryption keys.

This path requires sudo capability in addition to update.

Supported methods:PUT: /sys/rorate. Produces: 204 (empty body)

Returns

The response of the request.

Return type

requests.Response

`start_rekey`(*secret\_shares=5*, *secret\_threshold=3*, *pgp\_keys=None*, *backup=False*, *require\_verification=False*, *recovery\_key=False*)[[source]](_modules/hvac/api/system_backend/key.html#Key.start_rekey)[¶](#hvac.api.system_backend.Key.start_rekey "Permalink to this definition")

Initializes a new rekey attempt.

Only a single recovery key rekeyattempt can take place at a time, and changing the parameters of a rekey

requires canceling and starting a new rekey, which will also provide a new nonce.

Supported methods:PUT: /sys/rekey/init. Produces: 204 (empty body)

PUT: /sys/rekey-recovery-key/init. Produces: 204 (empty body)

Parameters

* **secret\_shares** (*int*) – Specifies the number of shares to split the master key into.

* **secret\_threshold** (*int*) – Specifies the number of shares required to reconstruct the master key. This must be

less than or equal to secret\_shares.

* **pgp\_keys** (*list*) – Specifies an array of PGP public keys used to encrypt the output unseal keys. Ordering is

preserved. The keys must be base64-encoded from their original binary representation. The size of this array

must be the same as secret\_shares.

* **backup** (*bool*) – Specifies if using PGP-encrypted keys, whether Vault should also store a plaintext backup of the

PGP-encrypted keys at core/unseal-keys-backup in the physical storage backend. These can then be retrieved

and removed via the sys/rekey/backup endpoint.

* **require\_verification** (*bool*) – This turns on verification functionality. When verification is turned on, after

successful authorization with the current unseal keys, the new unseal keys are returned but the master key

is not actually rotated. The new keys must be provided to authorize the actual rotation of the master key.

This ensures that the new keys have been successfully saved and protects against a risk of the keys being

lost after rotation but before they can be persisted. This can be used with without pgp\_keys, and when used

with it, it allows ensuring that the returned keys can be successfully decrypted before committing to the

new shares, which the backup functionality does not provide.

* **recovery\_key** (*bool*) – If true, send requests to “rekey-recovery-key” instead of “rekey” api path.

Returns

The JSON dict of the response.

Return type

dict | request.Response

`start_root_token_generation`(*otp=None*, *pgp\_key=None*)[[source]](_modules/hvac/api/system_backend/key.html#Key.start_root_token_generation)[¶](#hvac.api.system_backend.Key.start_root_token_generation "Permalink to this definition")

Initialize a new root generation attempt.

Only a single root generation attempt can take place at a time. One (and only one) of otp or pgp\_key are

required.

Supported methods:PUT: /sys/generate-root/attempt. Produces: 200 application/json

Parameters

* **otp** (*str | unicode*) – Specifies a base64-encoded 16-byte value. The raw bytes of the token will be XOR’d with this value

before being returned to the final unseal key provider.

* **pgp\_key** (*str | unicode*) – Specifies a base64-encoded PGP public key. The raw bytes of the token will be encrypted with

this value before being returned to the final unseal key provider.

Returns

The JSON response of the request.

Return type

dict

*class* `hvac.api.system_backend.``Leader`(*adapter*)[[source]](_modules/hvac/api/system_backend/leader.html#Leader)[¶](#hvac.api.system_backend.Leader "Permalink to this definition")

Bases: `hvac.api.system\_backend.system\_backend\_mixin.SystemBackendMixin`

**Methods**

| [`read\_leader\_status`](#hvac.api.system_backend.Leader.read_leader_status "hvac.api.system_backend.Leader.read_leader_status")() | Read the high availability status and current leader instance of Vault. |

| [`step\_down`](#hvac.api.system_backend.Leader.step_down "hvac.api.system_backend.Leader.step_down")() | Force the node to give up active status. |

`read_leader_status`()[[source]](_modules/hvac/api/system_backend/leader.html#Leader.read_leader_status)[¶](#hvac.api.system_backend.Leader.read_leader_status "Permalink to this definition")

Read the high availability status and current leader instance of Vault.

Supported methods:GET: /sys/leader. Produces: 200 application/json

Returns

The JSON response of the request.

Return type

dict

`step_down`()[[source]](_modules/hvac/api/system_backend/leader.html#Leader.step_down)[¶](#hvac.api.system_backend.Leader.step_down "Permalink to this definition")

Force the node to give up active status.

If the node does not have active status, this endpoint does nothing.

Note that the node will sleep for ten seconds before attempting to grab

the active lock again, but if no standby nodes grab the active lock in

the interim, the same node may become the active node again. Requires a

token with root policy or sudo capability on the path.

Returns

The JSON response of the request.

Return type

dict

*class* `hvac.api.system_backend.``Lease`(*adapter*)[[source]](_modules/hvac/api/system_backend/lease.html#Lease)[¶](#hvac.api.system_backend.Lease "Permalink to this definition")

Bases: `hvac.api.system\_backend.system\_backend\_mixin.SystemBackendMixin`

**Methods**

| [`list\_leases`](#hvac.api.system_backend.Lease.list_leases "hvac.api.system_backend.Lease.list_leases")(prefix) | Retrieve a list of lease ids. |

| [`read\_lease`](#hvac.api.system_backend.Lease.read_lease "hvac.api.system_backend.Lease.read_lease")(lease\_id) | Retrieve lease metadata. |

| [`renew\_lease`](#hvac.api.system_backend.Lease.renew_lease "hvac.api.system_backend.Lease.renew_lease")(lease\_id[, increment]) | Renew a lease, requesting to extend the lease. |

| [`revoke\_force`](#hvac.api.system_backend.Lease.revoke_force "hvac.api.system_backend.Lease.revoke_force")(prefix) | Revoke all secrets or tokens generated under a given prefix immediately. |

| [`revoke\_lease`](#hvac.api.system_backend.Lease.revoke_lease "hvac.api.system_backend.Lease.revoke_lease")(lease\_id) | Revoke a lease immediately. |

| [`revoke\_prefix`](#hvac.api.system_backend.Lease.revoke_prefix "hvac.api.system_backend.Lease.revoke_prefix")(prefix) | Revoke all secrets (via a lease ID prefix) or tokens (via the tokens’ path property) generated under a given prefix immediately. |

`list_leases`(*prefix*)[[source]](_modules/hvac/api/system_backend/lease.html#Lease.list_leases)[¶](#hvac.api.system_backend.Lease.list_leases "Permalink to this definition")

Retrieve a list of lease ids.

Supported methods:LIST: /sys/leases/lookup/{prefix}. Produces: 200 application/json

Parameters

**prefix** (*str | unicode*) – Lease prefix to filter list by.

Returns

The JSON response of the request.

Return type

dict

`read_lease`(*lease\_id*)[[source]](_modules/hvac/api/system_backend/lease.html#Lease.read_lease)[¶](#hvac.api.system_backend.Lease.read_lease "Permalink to this definition")

Retrieve lease metadata.

Supported methods:PUT: /sys/leases/lookup. Produces: 200 application/json

Parameters

**lease\_id** (*str | unicode*) – the ID of the lease to lookup.

Returns

Parsed JSON response from the leases PUT request

Return type

dict.

`renew_lease`(*lease\_id*, *increment=None*)[[source]](_modules/hvac/api/system_backend/lease.html#Lease.renew_lease)[¶](#hvac.api.system_backend.Lease.renew_lease "Permalink to this definition")

Renew a lease, requesting to extend the lease.

Supported methods:PUT: /sys/leases/renew. Produces: 200 application/json

Parameters

* **lease\_id** (*str | unicode*) – The ID of the lease to extend.

* **increment** (*int*) – The requested amount of time (in seconds) to extend the lease.

Returns

The JSON response of the request

Return type

dict

`revoke_force`(*prefix*)[[source]](_modules/hvac/api/system_backend/lease.html#Lease.revoke_force)[¶](#hvac.api.system_backend.Lease.revoke_force "Permalink to this definition")

Revoke all secrets or tokens generated under a given prefix immediately.

Unlike revoke\_prefix, this path ignores backend errors encountered during revocation. This is potentially very

dangerous and should only be used in specific emergency situations where errors in the backend or the connected

backend service prevent normal revocation.

Supported methods:PUT: /sys/leases/revoke-force/{prefix}. Produces: 204 (empty body)

Parameters

**prefix** (*str | unicode*) – The prefix to revoke.

Returns

The response of the request.

Return type

requests.Response

`revoke_lease`(*lease\_id*)[[source]](_modules/hvac/api/system_backend/lease.html#Lease.revoke_lease)[¶](#hvac.api.system_backend.Lease.revoke_lease "Permalink to this definition")

Revoke a lease immediately.

Supported methods:PUT: /sys/leases/revoke. Produces: 204 (empty body)

Parameters

**lease\_id** (*str | unicode*) – Specifies the ID of the lease to revoke.

Returns

The response of the request.

Return type

requests.Response

`revoke_prefix`(*prefix*)[[source]](_modules/hvac/api/system_backend/lease.html#Lease.revoke_prefix)[¶](#hvac.api.system_backend.Lease.revoke_prefix "Permalink to this definition")

Revoke all secrets (via a lease ID prefix) or tokens (via the tokens’ path property) generated under a given

prefix immediately.

This requires sudo capability and access to it should be tightly controlled as it can be used to revoke very

large numbers of secrets/tokens at once.

Supported methods:PUT: /sys/leases/revoke-prefix/{prefix}. Produces: 204 (empty body)

Parameters

**prefix** (*str | unicode*) – The prefix to revoke.

Returns

The response of the request.

Return type

requests.Response

*class* `hvac.api.system_backend.``Mount`(*adapter*)[[source]](_modules/hvac/api/system_backend/mount.html#Mount)[¶](#hvac.api.system_backend.Mount "Permalink to this definition")

Bases: `hvac.api.system\_backend.system\_backend\_mixin.SystemBackendMixin`

**Methods**

| [`disable\_secrets\_engine`](#hvac.api.system_backend.Mount.disable_secrets_engine "hvac.api.system_backend.Mount.disable_secrets_engine")(path) | Disable the mount point specified by the provided path. |

| [`enable\_secrets\_engine`](#hvac.api.system_backend.Mount.enable_secrets_engine "hvac.api.system_backend.Mount.enable_secrets_engine")(backend\_type[, path, …]) | Enable a new secrets engine at the given path. |

| [`list\_mounted\_secrets\_engines`](#hvac.api.system_backend.Mount.list_mounted_secrets_engines "hvac.api.system_backend.Mount.list_mounted_secrets_engines")() | Lists all the mounted secrets engines. |

| [`move\_backend`](#hvac.api.system_backend.Mount.move_backend "hvac.api.system_backend.Mount.move_backend")(from\_path, to\_path) | Move an already-mounted backend to a new mount point. |

| [`read\_mount\_configuration`](#hvac.api.system_backend.Mount.read_mount_configuration "hvac.api.system_backend.Mount.read_mount_configuration")(path) | Read the given mount’s configuration. |

| [`retrieve\_mount\_option`](#hvac.api.system_backend.Mount.retrieve_mount_option "hvac.api.system_backend.Mount.retrieve_mount_option")(mount\_point, option\_name) |  |

| [`tune\_mount\_configuration`](#hvac.api.system_backend.Mount.tune_mount_configuration "hvac.api.system_backend.Mount.tune_mount_configuration")(path[, …]) | Tune configuration parameters for a given mount point. |

`disable_secrets_engine`(*path*)[[source]](_modules/hvac/api/system_backend/mount.html#Mount.disable_secrets_engine)[¶](#hvac.api.system_backend.Mount.disable_secrets_engine "Permalink to this definition")

Disable the mount point specified by the provided path.

Supported methods:DELETE: /sys/mounts/{path}. Produces: 204 (empty body)

Parameters

**path** (*str | unicode*) – Specifies the path where the secrets engine will be mounted. This is specified as part of the URL.

Returns

The response of the request.

Return type

requests.Response

`enable_secrets_engine`(*backend\_type*, *path=None*, *description=None*, *config=None*, *plugin\_name=None*, *options=None*, *local=False*, *seal\_wrap=False*, *\*\*kwargs*)[[source]](_modules/hvac/api/system_backend/mount.html#Mount.enable_secrets_engine)[¶](#hvac.api.system_backend.Mount.enable_secrets_engine "Permalink to this definition")

Enable a new secrets engine at the given path.

Supported methods:POST: /sys/mounts/{path}. Produces: 204 (empty body)

Parameters

* **backend\_type** (*str | unicode*) – The name of the backend type, such as “github” or “token”.

* **path** (*str | unicode*) – The path to mount the method on. If not provided, defaults to the value of the “backend\_type”

argument.

* **description** (*str | unicode*) – A human-friendly description of the mount.

* **config** (*dict*) – Configuration options for this mount. These are the possible values:

	+ **default\_lease\_ttl**: The default lease duration, specified as a string duration like “5s” or “30m”.

	+ **max\_lease\_ttl**: The maximum lease duration, specified as a string duration like “5s” or “30m”.

	+ **force\_no\_cache**: Disable caching.

	+ **plugin\_name**: The name of the plugin in the plugin catalog to use.

	+ **audit\_non\_hmac\_request\_keys**: Comma-separated list of keys that will not be HMAC’d by audit devices in

	the request data object.

	+ **audit\_non\_hmac\_response\_keys**: Comma-separated list of keys that will not be HMAC’d by audit devices in

	the response data object.

	+ **listing\_visibility**: Specifies whether to show this mount in the UI-specific listing endpoint. (“unauth” or “hidden”)

	+ **passthrough\_request\_headers**: Comma-separated list of headers to whitelist and pass from the request to

	the backend.

* **options** (*dict*) – Specifies mount type specific options that are passed to the backend.

	+ **version**: <KV> The version of the KV to mount. Set to “2” for mount KV v2.

* **plugin\_name** (*str | unicode*) – Specifies the name of the plugin to use based from the name in the plugin catalog. Applies only to plugin backends.

* **local** (*bool*) – <Vault enterprise only> Specifies if the auth method is a local only. Local auth methods are not

replicated nor (if a secondary) removed by replication.

* **seal\_wrap** (*bool*) – <Vault enterprise only> Enable seal wrapping for the mount.

* **kwargs** (*dict*) – All dicts are accepted and passed to vault. See your specific secret engine for details on which

extra key-word arguments you might want to pass.

Returns

The response of the request.

Return type

requests.Response

`list_mounted_secrets_engines`()[[source]](_modules/hvac/api/system_backend/mount.html#Mount.list_mounted_secrets_engines)[¶](#hvac.api.system_backend.Mount.list_mounted_secrets_engines "Permalink to this definition")

Lists all the mounted secrets engines.

Supported methods:POST: /sys/mounts. Produces: 200 application/json

Returns

JSON response of the request.

Return type

dict

`move_backend`(*from\_path*, *to\_path*)[[source]](_modules/hvac/api/system_backend/mount.html#Mount.move_backend)[¶](#hvac.api.system_backend.Mount.move_backend "Permalink to this definition")

Move an already-mounted backend to a new mount point.

Supported methods:POST: /sys/remount. Produces: 204 (empty body)

Parameters

* **from\_path** (*str | unicode*) – Specifies the previous mount point.

* **to\_path** (*str | unicode*) – Specifies the new destination mount point.

Returns

The response of the request.

Return type

requests.Response

`read_mount_configuration`(*path*)[[source]](_modules/hvac/api/system_backend/mount.html#Mount.read_mount_configuration)[¶](#hvac.api.system_backend.Mount.read_mount_configuration "Permalink to this definition")

Read the given mount’s configuration.

Unlike the mounts endpoint, this will return the current time in seconds for each TTL, which may be the system

default or a mount-specific value.

Supported methods:GET: /sys/mounts/{path}/tune. Produces: 200 application/json

Parameters

**path** (*str | unicode*) – Specifies the path where the secrets engine will be mounted. This is specified as part of the URL.

Returns

The JSON response of the request.

Return type

requests.Response

`retrieve_mount_option`(*mount\_point*, *option\_name*, *default\_value=None*)[[source]](_modules/hvac/api/system_backend/mount.html#Mount.retrieve_mount_option)[¶](#hvac.api.system_backend.Mount.retrieve_mount_option "Permalink to this definition")

`tune_mount_configuration`(*path*, *default\_lease\_ttl=None*, *max\_lease\_ttl=None*, *description=None*, *audit\_non\_hmac\_request\_keys=None*, *audit\_non\_hmac\_response\_keys=None*, *listing\_visibility=None*, *passthrough\_request\_headers=None*, *options=None*, *force\_no\_cache=None*, *\*\*kwargs*)[[source]](_modules/hvac/api/system_backend/mount.html#Mount.tune_mount_configuration)[¶](#hvac.api.system_backend.Mount.tune_mount_configuration "Permalink to this definition")

Tune configuration parameters for a given mount point.

Supported methods:POST: /sys/mounts/{path}/tune. Produces: 204 (empty body)

Parameters

* **path** (*str | unicode*) – Specifies the path where the secrets engine will be mounted. This is specified as part of the URL.

* **mount\_point** (*str*) – The path the associated secret backend is mounted

* **description** (*str*) – Specifies the description of the mount. This overrides the current stored value, if any.

* **default\_lease\_ttl** (*int*) – Default time-to-live. This overrides the global default. A value of 0 is equivalent to

the system default TTL

* **max\_lease\_ttl** (*int*) – Maximum time-to-live. This overrides the global default. A value of 0 are equivalent and

set to the system max TTL.

* **audit\_non\_hmac\_request\_keys** (*list*) – Specifies the comma-separated list of keys that will not be HMAC’d by audit

devices in the request data object.

* **audit\_non\_hmac\_response\_keys** (*list*) – Specifies the comma-separated list of keys that will not be HMAC’d by audit

devices in the response data object.

* **listing\_visibility** (*str*) – Speficies whether to show this mount in the UI-specific listing endpoint. Valid

values are “unauth” or “”.

* **passthrough\_request\_headers** (*str*) – Comma-separated list of headers to whitelist and pass from the request

to the backend.

* **options** (*dict*) – Specifies mount type specific options that are passed to the backend.

	+ **version**: <KV> The version of the KV to mount. Set to “2” for mount KV v2.

* **force\_no\_cache** (*bool*) – Disable caching.

* **kwargs** (*dict*) – All dicts are accepted and passed to vault. See your specific secret engine for details on which

extra key-word arguments you might want to pass.

Returns

The response from the request.

Return type

request.Response

*class* `hvac.api.system_backend.``Namespace`(*adapter*)[[source]](_modules/hvac/api/system_backend/namespace.html#Namespace)[¶](#hvac.api.system_backend.Namespace "Permalink to this definition")

Bases: `hvac.api.system\_backend.system\_backend\_mixin.SystemBackendMixin`

**Methods**

| [`create\_namespace`](#hvac.api.system_backend.Namespace.create_namespace "hvac.api.system_backend.Namespace.create_namespace")(path) | Create a namespace at the given path. |

| [`delete\_namespace`](#hvac.api.system_backend.Namespace.delete_namespace "hvac.api.system_backend.Namespace.delete_namespace")(path) | Delete a namespaces. |

| [`list\_namespaces`](#hvac.api.system_backend.Namespace.list_namespaces "hvac.api.system_backend.Namespace.list_namespaces")() | Lists all the namespaces. |

`create_namespace`(*path*)[[source]](_modules/hvac/api/system_backend/namespace.html#Namespace.create_namespace)[¶](#hvac.api.system_backend.Namespace.create_namespace "Permalink to this definition")

Create a namespace at the given path.

Supported methods:POST: /sys/namespaces/{path}. Produces: 200 application/json

Returns

The response of the request.

Return type

requests.Response

`delete_namespace`(*path*)[[source]](_modules/hvac/api/system_backend/namespace.html#Namespace.delete_namespace)[¶](#hvac.api.system_backend.Namespace.delete_namespace "Permalink to this definition")

Delete a namespaces. You cannot delete a namespace with existing child namespaces.

Supported methods:DELETE: /sys/namespaces. Produces: 204 (empty body)

Returns

The response of the request.

Return type

requests.Response

`list_namespaces`()[[source]](_modules/hvac/api/system_backend/namespace.html#Namespace.list_namespaces)[¶](#hvac.api.system_backend.Namespace.list_namespaces "Permalink to this definition")

Lists all the namespaces.

Supported methods:LIST: /sys/namespaces. Produces: 200 application/json

Returns

The JSON response of the request.

Return type

dict

*class* `hvac.api.system_backend.``Policy`(*adapter*)[[source]](_modules/hvac/api/system_backend/policy.html#Policy)[¶](#hvac.api.system_backend.Policy "Permalink to this definition")

Bases: `hvac.api.system\_backend.system\_backend\_mixin.SystemBackendMixin`

**Methods**

| [`create\_or\_update\_policy`](#hvac.api.system_backend.Policy.create_or_update_policy "hvac.api.system_backend.Policy.create_or_update_policy")(name, policy[, …]) | Add a new or update an existing policy. |

| [`delete\_policy`](#hvac.api.system_backend.Policy.delete_policy "hvac.api.system_backend.Policy.delete_policy")(name) | Delete the policy with the given name. |

| [`list\_policies`](#hvac.api.system_backend.Policy.list_policies "hvac.api.system_backend.Policy.list_policies")() | List all configured policies. |

| [`read\_policy`](#hvac.api.system_backend.Policy.read_policy "hvac.api.system_backend.Policy.read_policy")(name) | Retrieve the policy body for the named policy. |

`create_or_update_policy`(*name*, *policy*, *pretty\_print=True*)[[source]](_modules/hvac/api/system_backend/policy.html#Policy.create_or_update_policy)[¶](#hvac.api.system_backend.Policy.create_or_update_policy "Permalink to this definition")

Add a new or update an existing policy.

Once a policy is updated, it takes effect immediately to all associated users.

Supported methods:PUT: /sys/policy/{name}. Produces: 204 (empty body)

Parameters

* **name** (*str | unicode*) – Specifies the name of the policy to create.

* **policy** (*str | unicode | dict*) – Specifies the policy document.

* **pretty\_print** (*bool*) – If True, and provided a dict for the policy argument, send the policy JSON to Vault with

“pretty” formatting.

Returns

The response of the request.

Return type

requests.Response

`delete_policy`(*name*)[[source]](_modules/hvac/api/system_backend/policy.html#Policy.delete_policy)[¶](#hvac.api.system_backend.Policy.delete_policy "Permalink to this definition")

Delete the policy with the given name.

This will immediately affect all users associated with this policy.

Supported methods:DELETE: /sys/policy/{name}. Produces: 204 (empty body)

Parameters

**name** (*str | unicode*) – Specifies the name of the policy to delete.

Returns

The response of the request.

Return type

requests.Response

`list_policies`()[[source]](_modules/hvac/api/system_backend/policy.html#Policy.list_policies)[¶](#hvac.api.system_backend.Policy.list_policies "Permalink to this definition")

List all configured policies.

Supported methods:GET: /sys/policy. Produces: 200 application/json

Returns

The JSON response of the request.

Return type

dict

`read_policy`(*name*)[[source]](_modules/hvac/api/system_backend/policy.html#Policy.read_policy)[¶](#hvac.api.system_backend.Policy.read_policy "Permalink to this definition")

Retrieve the policy body for the named policy.

Supported methods:GET: /sys/policy/{name}. Produces: 200 application/json

Parameters

**name** (*str | unicode*) – The name of the policy to retrieve.

Returns

The response of the request

Return type

dict

*class* `hvac.api.system_backend.``Raft`(*adapter*)[[source]](_modules/hvac/api/system_backend/raft.html#Raft)[¶](#hvac.api.system_backend.Raft "Permalink to this definition")

Bases: `hvac.api.system\_backend.system\_backend\_mixin.SystemBackendMixin`

Raft cluster-related system backend methods.

When using Shamir seal, as soon as the Vault server is brought up, this API should be invoked

instead of sys/init. This API completes in 2 phases. Once this is invoked, the joining node

will receive a challenge from the Raft’s leader node. This challenge can be answered by the

joining node only after a successful unseal. Hence, the joining node should be unsealed using

the unseal keys of the Raft’s leader node.

Reference: <https://www.vaultproject.io/api-docs/system/storage/raft>

**Methods**

| [`force\_restore\_raft\_snapshot`](#hvac.api.system_backend.Raft.force_restore_raft_snapshot "hvac.api.system_backend.Raft.force_restore_raft_snapshot")(snapshot) | Installs the provided snapshot, returning the cluster to the state defined in it. |

| [`join\_raft\_cluster`](#hvac.api.system_backend.Raft.join_raft_cluster "hvac.api.system_backend.Raft.join_raft_cluster")(leader\_api\_addr[, retry, …]) | Join a new server node to the Raft cluster. |

| [`read\_raft\_config`](#hvac.api.system_backend.Raft.read_raft_config "hvac.api.system_backend.Raft.read_raft_config")() | Read the details of all the nodes in the raft cluster. |

| [`remove\_raft\_node`](#hvac.api.system_backend.Raft.remove_raft_node "hvac.api.system_backend.Raft.remove_raft_node")(server\_id) | Remove a node from the raft cluster. |

| [`restore\_raft\_snapshot`](#hvac.api.system_backend.Raft.restore_raft_snapshot "hvac.api.system_backend.Raft.restore_raft_snapshot")(snapshot) | Install the provided snapshot, returning the cluster to the state defined in it. |

| [`take\_raft\_snapshot`](#hvac.api.system_backend.Raft.take_raft_snapshot "hvac.api.system_backend.Raft.take_raft_snapshot")() | Returns a snapshot of the current state of the raft cluster. |

`force_restore_raft_snapshot`(*snapshot*)[[source]](_modules/hvac/api/system_backend/raft.html#Raft.force_restore_raft_snapshot)[¶](#hvac.api.system_backend.Raft.force_restore_raft_snapshot "Permalink to this definition")

Installs the provided snapshot, returning the cluster to the state defined in it.

This is same as writing to /sys/storage/raft/snapshot except that this bypasses checks

ensuring the Autounseal or shamir keys are consistent with the snapshot data.

Supported methods:POST: /sys/storage/raft/snapshot-force.

Parameters

**snapshot** (*bytes*) – Previously created raft snapshot / binary data.

Returns

The response of the force\_restore\_raft\_snapshot request.

Return type

requests.Response

`join_raft_cluster`(*leader\_api\_addr*, *retry=False*, *leader\_ca\_cert=None*, *leader\_client\_cert=None*, *leader\_client\_key=None*)[[source]](_modules/hvac/api/system_backend/raft.html#Raft.join_raft_cluster)[¶](#hvac.api.system_backend.Raft.join_raft_cluster "Permalink to this definition")

Join a new server node to the Raft cluster.

When using Shamir seal, as soon as the Vault server is brought up, this API should be invoked

instead of sys/init. This API completes in 2 phases. Once this is invoked, the joining node will

receive a challenge from the Raft’s leader node. This challenge can be answered by the joining

node only after a successful unseal. Hence, the joining node should be unsealed using the unseal

keys of the Raft’s leader node.

Supported methods:POST: /sys/storage/raft/join.

Parameters

* **leader\_api\_addr** (*str | unicode*) – Address of the leader node in the Raft cluster to which this node is trying to join.

* **retry** (*bool*) – Retry joining the Raft cluster in case of failures.

* **leader\_ca\_cert** (*str | unicode*) – CA certificate used to communicate with Raft’s leader node.

* **leader\_client\_cert** (*str | unicode*) – Client certificate used to communicate with Raft’s leader node.

* **leader\_client\_key** (*str | unicode*) – Client key used to communicate with Raft’s leader node.

Returns

The response of the join\_raft\_cluster request.

Return type

requests.Response

`read_raft_config`()[[source]](_modules/hvac/api/system_backend/raft.html#Raft.read_raft_config)[¶](#hvac.api.system_backend.Raft.read_raft_config "Permalink to this definition")

Read the details of all the nodes in the raft cluster.

Supported methods:GET: /sys/storage/raft/configuration.

Returns

The response of the read\_raft\_config request.

Return type

requests.Response

`remove_raft_node`(*server\_id*)[[source]](_modules/hvac/api/system_backend/raft.html#Raft.remove_raft_node)[¶](#hvac.api.system_backend.Raft.remove_raft_node "Permalink to this definition")

Remove a node from the raft cluster.

Supported methods:POST: /sys/storage/raft/remove-peer.

Parameters

**server\_id** (*str*) – The ID of the node to remove.

Returns

The response of the remove\_raft\_node request.

Return type

requests.Response

`restore_raft_snapshot`(*snapshot*)[[source]](_modules/hvac/api/system_backend/raft.html#Raft.restore_raft_snapshot)[¶](#hvac.api.system_backend.Raft.restore_raft_snapshot "Permalink to this definition")

Install the provided snapshot, returning the cluster to the state defined in it.

Supported methods:POST: /sys/storage/raft/snapshot.

Parameters

**snapshot** (*bytes*) – Previously created raft snapshot / binary data.

Returns

The response of the restore\_raft\_snapshot request.

Return type

requests.Response

`take_raft_snapshot`()[[source]](_modules/hvac/api/system_backend/raft.html#Raft.take_raft_snapshot)[¶](#hvac.api.system_backend.Raft.take_raft_snapshot "Permalink to this definition")

Returns a snapshot of the current state of the raft cluster.

The snapshot is returned as binary data and should be redirected to a file.

Supported methods:GET: /sys/storage/raft/snapshot.

Returns

The response of the s request.

Return type

requests.Response

*class* `hvac.api.system_backend.``Seal`(*adapter*)[[source]](_modules/hvac/api/system_backend/seal.html#Seal)[¶](#hvac.api.system_backend.Seal "Permalink to this definition")

Bases: `hvac.api.system\_backend.system\_backend\_mixin.SystemBackendMixin`

**Methods**

| [`is\_sealed`](#hvac.api.system_backend.Seal.is_sealed "hvac.api.system_backend.Seal.is_sealed")() | Determine if Vault is sealed. |

| [`read\_seal\_status`](#hvac.api.system_backend.Seal.read_seal_status "hvac.api.system_backend.Seal.read_seal_status")() | Read the seal status of the Vault. |

| [`seal`](#hvac.api.system_backend.Seal.seal "hvac.api.system_backend.Seal.seal")() | Seal the Vault. |

| [`submit\_unseal\_key`](#hvac.api.system_backend.Seal.submit_unseal_key "hvac.api.system_backend.Seal.submit_unseal_key")([key, reset, migrate]) | Enter a single master key share to progress the unsealing of the Vault. |

| [`submit\_unseal\_keys`](#hvac.api.system_backend.Seal.submit_unseal_keys "hvac.api.system_backend.Seal.submit_unseal_keys")(keys[, migrate]) | Enter multiple master key share to progress the unsealing of the Vault. |

`is_sealed`()[[source]](_modules/hvac/api/system_backend/seal.html#Seal.is_sealed)[¶](#hvac.api.system_backend.Seal.is_sealed "Permalink to this definition")

Determine if Vault is sealed.

Returns

True if Vault is seal, False otherwise.

Return type

bool

`read_seal_status`()[[source]](_modules/hvac/api/system_backend/seal.html#Seal.read_seal_status)[¶](#hvac.api.system_backend.Seal.read_seal_status "Permalink to this definition")

Read the seal status of the Vault.

This is an unauthenticated endpoint.

Supported methods:GET: /sys/seal-status. Produces: 200 application/json

Returns

The JSON response of the request.

Return type

dict

`seal`()[[source]](_modules/hvac/api/system_backend/seal.html#Seal.seal)[¶](#hvac.api.system_backend.Seal.seal "Permalink to this definition")

Seal the Vault.

In HA mode, only an active node can be sealed. Standby nodes should be restarted to get the same effect.

Requires a token with root policy or sudo capability on the path.

Supported methods:PUT: /sys/seal. Produces: 204 (empty body)

Returns

The response of the request.

Return type

requests.Response

`submit_unseal_key`(*key=None*, *reset=False*, *migrate=False*)[[source]](_modules/hvac/api/system_backend/seal.html#Seal.submit_unseal_key)[¶](#hvac.api.system_backend.Seal.submit_unseal_key "Permalink to this definition")

Enter a single master key share to progress the unsealing of the Vault.

If the threshold number of master key shares is reached, Vault will attempt to unseal the Vault. Otherwise, this

API must be called multiple times until that threshold is met.

Either the key or reset parameter must be provided; if both are provided, reset takes precedence.

Supported methods:PUT: /sys/unseal. Produces: 200 application/json

Parameters

* **key** (*str | unicode*) – Specifies a single master key share. This is required unless reset is true.

* **reset** (*bool*) – Specifies if previously-provided unseal keys are discarded and the unseal process is reset.

* **migrate** – Available in 1.0 Beta - Used to migrate the seal from shamir to autoseal or autoseal to shamir.

Must be provided on all unseal key calls.

Type

migrate: bool

Returns

The JSON response of the request.

Return type

dict

`submit_unseal_keys`(*keys*, *migrate=False*)[[source]](_modules/hvac/api/system_backend/seal.html#Seal.submit_unseal_keys)[¶](#hvac.api.system_backend.Seal.submit_unseal_keys "Permalink to this definition")

Enter multiple master key share to progress the unsealing of the Vault.

Parameters

* **keys** (*List**[**str**]*) – List of master key shares.

* **migrate** – Available in 1.0 Beta - Used to migrate the seal from shamir to autoseal or autoseal to shamir.

Must be provided on all unseal key calls.

Type

migrate: bool

Returns

The JSON response of the last unseal request.

Return type

dict

*class* `hvac.api.system_backend.``SystemBackend`(*adapter*)[[source]](_modules/hvac/api/system_backend.html#SystemBackend)[¶](#hvac.api.system_backend.SystemBackend "Permalink to this definition")

Bases: `hvac.api.vault\_api\_category.VaultApiCategory`, `hvac.api.system\_backend.audit.Audit`, `hvac.api.system\_backend.auth.Auth`, `hvac.api.system\_backend.capabilities.Capabilities`, `hvac.api.system\_backend.health.Health`, `hvac.api.system\_backend.init.Init`, `hvac.api.system\_backend.key.Key`, `hvac.api.system\_backend.leader.Leader`, `hvac.api.system\_backend.lease.Lease`, `hvac.api.system\_backend.mount.Mount`, `hvac.api.system\_backend.namespace.Namespace`, `hvac.api.system\_backend.policy.Policy`, `hvac.api.system\_backend.raft.Raft`, `hvac.api.system\_backend.seal.Seal`, `hvac.api.system\_backend.wrapping.Wrapping`

**Methods**

| [`\_\_init\_\_`](#hvac.api.system_backend.SystemBackend.__init__ "hvac.api.system_backend.SystemBackend.__init__")(adapter) | API Category class constructor. |

**Attributes**

| [`implemented\_classes`](#hvac.api.system_backend.SystemBackend.implemented_classes "hvac.api.system_backend.SystemBackend.implemented_classes") | Built-in mutable sequence. |

| [`unimplemented\_classes`](#hvac.api.system_backend.SystemBackend.unimplemented_classes "hvac.api.system_backend.SystemBackend.unimplemented_classes") | Built-in mutable sequence. |

`__init__`(*adapter*)[[source]](_modules/hvac/api/system_backend.html#SystemBackend.__init__)[¶](#hvac.api.system_backend.SystemBackend.__init__ "Permalink to this definition")

API Category class constructor.

Parameters

**adapter** ([*hvac.adapters.Adapter*](index.html#hvac.adapters.Adapter "hvac.adapters.Adapter")) – Instance of [`hvac.adapters.Adapter`](index.html#hvac.adapters.Adapter "hvac.adapters.Adapter"); used for performing HTTP requests.

`implemented_classes` *= [<class 'hvac.api.system\_backend.audit.Audit'>, <class 'hvac.api.system\_backend.auth.Auth'>, <class 'hvac.api.system\_backend.capabilities.Capabilities'>, <class 'hvac.api.system\_backend.health.Health'>, <class 'hvac.api.system\_backend.init.Init'>, <class 'hvac.api.system\_backend.key.Key'>, <class 'hvac.api.system\_backend.leader.Leader'>, <class 'hvac.api.system\_backend.lease.Lease'>, <class 'hvac.api.system\_backend.mount.Mount'>, <class 'hvac.api.system\_backend.namespace.Namespace'>, <class 'hvac.api.system\_backend.policy.Policy'>, <class 'hvac.api.system\_backend.raft.Raft'>, <class 'hvac.api.system\_backend.seal.Seal'>, <class 'hvac.api.system\_backend.wrapping.Wrapping'>]*[¶](#hvac.api.system_backend.SystemBackend.implemented_classes "Permalink to this definition")

`unimplemented_classes` *= []*[¶](#hvac.api.system_backend.SystemBackend.unimplemented_classes "Permalink to this definition")

*class* `hvac.api.system_backend.``SystemBackendMixin`(*adapter*)[[source]](_modules/hvac/api/system_backend/system_backend_mixin.html#SystemBackendMixin)[¶](#hvac.api.system_backend.SystemBackendMixin "Permalink to this definition")

Bases: `hvac.api.vault\_api\_base.VaultApiBase`

Base class for System Backend API endpoints.

*class* `hvac.api.system_backend.``Wrapping`(*adapter*)[[source]](_modules/hvac/api/system_backend/wrapping.html#Wrapping)[¶](#hvac.api.system_backend.Wrapping "Permalink to this definition")

Bases: `hvac.api.system\_backend.system\_backend\_mixin.SystemBackendMixin`

**Methods**

| [`unwrap`](#hvac.api.system_backend.Wrapping.unwrap "hvac.api.system_backend.Wrapping.unwrap")([token]) | Return the original response inside the given wrapping token. |

`unwrap`(*token=None*)[[source]](_modules/hvac/api/system_backend/wrapping.html#Wrapping.unwrap)[¶](#hvac.api.system_backend.Wrapping.unwrap "Permalink to this definition")

Return the original response inside the given wrapping token.

Unlike simply reading cubbyhole/response (which is deprecated), this endpoint provides additional validation

checks on the token, returns the original value on the wire rather than a JSON string representation of it, and

ensures that the response is properly audit-logged.

Supported methods:POST: /sys/wrapping/unwrap. Produces: 200 application/json

Parameters

**token** (*str | unicode*) – Specifies the wrapping token ID. This is required if the client token is not the wrapping token.

Do not use the wrapping token in both locations.

Returns

The JSON response of the request.

Return type

dict

### hvac.utils[¶](#module-hvac.utils "Permalink to this headline")

Misc utility functions and constants

**Functions**

| [`comma\_delimited\_to\_list`](#hvac.utils.comma_delimited_to_list "hvac.utils.comma_delimited_to_list")(list\_param) | Convert comma-delimited list / string into a list of strings |

| [`deprecated\_method`](#hvac.utils.deprecated_method "hvac.utils.deprecated_method")(to\_be\_removed\_in\_version) | This is a decorator which can be used to mark methods as deprecated. |

| [`format\_url`](#hvac.utils.format_url "hvac.utils.format_url")(format\_str, \*args, \*\*kwargs) | Creates a URL using the specified format after escaping the provided arguments. |

| [`generate\_method\_deprecation\_message`](#hvac.utils.generate_method_deprecation_message "hvac.utils.generate_method_deprecation_message")(…[, …]) | Generate a message to be used when warning about the use of deprecated methods. |

| [`generate\_property\_deprecation\_message`](#hvac.utils.generate_property_deprecation_message "hvac.utils.generate_property_deprecation_message")(…[, …]) | Generate a message to be used when warning about the use of deprecated properties. |

| [`get\_token\_from\_env`](#hvac.utils.get_token_from_env "hvac.utils.get_token_from_env")() | Get the token from env var, VAULT\_TOKEN. |

| [`getattr\_with\_deprecated\_properties`](#hvac.utils.getattr_with_deprecated_properties "hvac.utils.getattr_with_deprecated_properties")(obj, …) | Helper method to use in the getattr method of a class with deprecated properties. |

| [`list\_to\_comma\_delimited`](#hvac.utils.list_to_comma_delimited "hvac.utils.list_to_comma_delimited")(list\_param) | Convert a list of strings into a comma-delimited list / string. |

| [`raise\_for\_error`](#hvac.utils.raise_for_error "hvac.utils.raise_for_error")(method, url, status\_code[, …]) | Helper method to raise exceptions based on the status code of a response received back from Vault. |

| [`remove\_nones`](#hvac.utils.remove_nones "hvac.utils.remove_nones")(params) | Removes None values from optional arguments in a parameter dictionary. |

| [`validate\_list\_of\_strings\_param`](#hvac.utils.validate_list_of_strings_param "hvac.utils.validate_list_of_strings_param")(param\_name, …) | Validate that an argument is a list of strings. |

| [`validate\_pem\_format`](#hvac.utils.validate_pem_format "hvac.utils.validate_pem_format")(param\_name, param\_argument) | Validate that an argument is a PEM-formatted public key or certificate |

`hvac.utils.``comma_delimited_to_list`(*list\_param*)[[source]](_modules/hvac/utils.html#comma_delimited_to_list)[¶](#hvac.utils.comma_delimited_to_list "Permalink to this definition")

Convert comma-delimited list / string into a list of strings

Parameters

**list\_param** (*str | unicode*) – Comma-delimited string

Returns

A list of strings

Return type

list

`hvac.utils.``deprecated_method`(*to\_be\_removed\_in\_version*, *new\_method=None*)[[source]](_modules/hvac/utils.html#deprecated_method)[¶](#hvac.utils.deprecated_method "Permalink to this definition")

This is a decorator which can be used to mark methods as deprecated. It will result in a warning being emitted

when the function is used.

Parameters

* **to\_be\_removed\_in\_version** (*str*) – Version of this module the decorated method will be removed in.

* **new\_method** (*function*) – Method intended to replace the decorated method. This method’s docstrings are included in the

decorated method’s docstring.

Returns

Wrapped function that includes a deprecation warning and update docstrings from the replacement method.

Return type

types.FunctionType

`hvac.utils.``format_url`(*format\_str*, *\*args*, *\*\*kwargs*)[[source]](_modules/hvac/utils.html#format_url)[¶](#hvac.utils.format_url "Permalink to this definition")

Creates a URL using the specified format after escaping the provided arguments.

Parameters

* **format\_str** (*str*) – The URL containing replacement fields.

* **kwargs** (*dict*) – Positional replacement field values.

* **kwargs** – Named replacement field values.

Returns

The formatted URL path with escaped replacement fields.

Return type

str

`hvac.utils.``generate_method_deprecation_message`(*to\_be\_removed\_in\_version*, *old\_method\_name*, *method\_name=None*, *module\_name=None*)[[source]](_modules/hvac/utils.html#generate_method_deprecation_message)[¶](#hvac.utils.generate_method_deprecation_message "Permalink to this definition")

Generate a message to be used when warning about the use of deprecated methods.

Parameters

* **to\_be\_removed\_in\_version** (*str*) – Version of this module the deprecated method will be removed in.

* **old\_method\_name** (*str*) – Deprecated method name.

* **method\_name** (*str*) – Method intended to replace the deprecated method indicated. This method’s docstrings are

included in the decorated method’s docstring.

* **module\_name** (*str*) – Name of the module containing the new method to use.

Returns

Full deprecation warning message for the indicated method.

Return type

str

`hvac.utils.``generate_property_deprecation_message`(*to\_be\_removed\_in\_version*, *old\_name*, *new\_name*, *new\_attribute*, *module\_name='Client'*)[[source]](_modules/hvac/utils.html#generate_property_deprecation_message)[¶](#hvac.utils.generate_property_deprecation_message "Permalink to this definition")

Generate a message to be used when warning about the use of deprecated properties.

Parameters

* **to\_be\_removed\_in\_version** (*str*) – Version of this module the deprecated property will be removed in.

* **old\_name** (*str*) – Deprecated property name.

* **new\_name** (*str*) – Name of the new property name to use.

* **new\_attribute** (*str*) – The new attribute where the new property can be found.

* **module\_name** (*str*) – Name of the module containing the new method to use.

Returns

Full deprecation warning message for the indicated property.

Return type

str

`hvac.utils.``get_token_from_env`()[[source]](_modules/hvac/utils.html#get_token_from_env)[¶](#hvac.utils.get_token_from_env "Permalink to this definition")

Get the token from env var, VAULT\_TOKEN. If not set, attempt to get the token from, ~/.vault-token

Returns

The vault token if set, else None

Return type

str | None

`hvac.utils.``getattr_with_deprecated_properties`(*obj*, *item*, *deprecated\_properties*)[[source]](_modules/hvac/utils.html#getattr_with_deprecated_properties)[¶](#hvac.utils.getattr_with_deprecated_properties "Permalink to this definition")

Helper method to use in the getattr method of a class with deprecated properties.

Parameters

* **obj** (*object*) – Instance of the Class containing the deprecated properties in question.

* **item** (*str*) – Name of the attribute being requested.

* **deprecated\_properties** (*List**[**dict**]*) – List of deprecated properties. Each item in the list is a dict with at least a

“to\_be\_removed\_in\_version” and “client\_property” key to be used in the displayed deprecation warning.

Returns

The new property indicated where available.

Return type

object

`hvac.utils.``list_to_comma_delimited`(*list\_param*)[[source]](_modules/hvac/utils.html#list_to_comma_delimited)[¶](#hvac.utils.list_to_comma_delimited "Permalink to this definition")

Convert a list of strings into a comma-delimited list / string.

Parameters

**list\_param** (*list*) – A list of strings.

Returns

Comma-delimited string.

Return type

str

`hvac.utils.``raise_for_error`(*method*, *url*, *status\_code*, *message=None*, *errors=None*)[[source]](_modules/hvac/utils.html#raise_for_error)[¶](#hvac.utils.raise_for_error "Permalink to this definition")

Helper method to raise exceptions based on the status code of a response received back from Vault.

Parameters

* **method** (*str*) – HTTP method of a request to Vault.

* **url** (*str*) – URL of the endpoint requested in Vault.

* **status\_code** (*int*) – Status code received in a response from Vault.

* **message** (*str*) – Optional message to include in a resulting exception.

* **errors** (*list | str*) – Optional errors to include in a resulting exception.

Raises

hvac.exceptions.InvalidRequest | hvac.exceptions.Unauthorized | hvac.exceptions.Forbidden |

hvac.exceptions.InvalidPath | hvac.exceptions.RateLimitExceeded | hvac.exceptions.InternalServerError |

hvac.exceptions.VaultNotInitialized | hvac.exceptions.BadGateway | hvac.exceptions.VaultDown |

hvac.exceptions.UnexpectedError

`hvac.utils.``remove_nones`(*params*)[[source]](_modules/hvac/utils.html#remove_nones)[¶](#hvac.utils.remove_nones "Permalink to this definition")

Removes None values from optional arguments in a parameter dictionary.

Parameters

**params** (*dict*) – The dictionary of parameters to be filtered.

Returns

A filtered copy of the parameter dictionary.

Return type

dict

`hvac.utils.``validate_list_of_strings_param`(*param\_name*, *param\_argument*)[[source]](_modules/hvac/utils.html#validate_list_of_strings_param)[¶](#hvac.utils.validate_list_of_strings_param "Permalink to this definition")

Validate that an argument is a list of strings.

Parameters

* **param\_name** (*str | unicode*) – The name of the parameter being validated. Used in any resulting exception messages.

* **param\_argument** (*list*) – The argument to validate.

Returns

True if the argument is validated, False otherwise.

Return type

bool

`hvac.utils.``validate_pem_format`(*param\_name*, *param\_argument*)[[source]](_modules/hvac/utils.html#validate_pem_format)[¶](#hvac.utils.validate_pem_format "Permalink to this definition")

Validate that an argument is a PEM-formatted public key or certificate

Parameters

* **param\_name** (*str | unicode*) – The name of the parameter being validate. Used in any resulting exception messages.

* **param\_argument** (*str | unicode*) – The argument to validate

Returns

True if the argument is validate False otherwise

Return type

bool

### hvac.aws\_utils[¶](#module-hvac.aws_utils "Permalink to this headline")

**Classes**

| [`SigV4Auth`](#hvac.aws_utils.SigV4Auth "hvac.aws_utils.SigV4Auth")(access\_key, secret\_key[, …]) |  |

**Functions**

| [`generate\_sigv4\_auth\_request`](#hvac.aws_utils.generate_sigv4_auth_request "hvac.aws_utils.generate_sigv4_auth_request")([header\_value]) | Helper function to prepare a AWS API request to subsequently generate a “AWS Signature Version 4” header. |

*class* `hvac.aws_utils.``SigV4Auth`(*access\_key*, *secret\_key*, *session\_token=None*, *region='us-east-1'*)[[source]](_modules/hvac/aws_utils.html#SigV4Auth)[¶](#hvac.aws_utils.SigV4Auth "Permalink to this definition")

Bases: `object`

**Methods**

| [`\_\_init\_\_`](#hvac.aws_utils.SigV4Auth.__init__ "hvac.aws_utils.SigV4Auth.__init__")(access\_key, secret\_key[, …]) | Initialize self. |

| [`add\_auth`](#hvac.aws_utils.SigV4Auth.add_auth "hvac.aws_utils.SigV4Auth.add_auth")(request) |  |

`__init__`(*access\_key*, *secret\_key*, *session\_token=None*, *region='us-east-1'*)[[source]](_modules/hvac/aws_utils.html#SigV4Auth.__init__)[¶](#hvac.aws_utils.SigV4Auth.__init__ "Permalink to this definition")

Initialize self. See help(type(self)) for accurate signature.

`add_auth`(*request*)[[source]](_modules/hvac/aws_utils.html#SigV4Auth.add_auth)[¶](#hvac.aws_utils.SigV4Auth.add_auth "Permalink to this definition")

`hvac.aws_utils.``generate_sigv4_auth_request`(*header\_value=None*)[[source]](_modules/hvac/aws_utils.html#generate_sigv4_auth_request)[¶](#hvac.aws_utils.generate_sigv4_auth_request "Permalink to this definition")

Helper function to prepare a AWS API request to subsequently generate a “AWS Signature Version 4” header.

Parameters

**header\_value** (*str*) – Vault allows you to require an additional header, X-Vault-AWS-IAM-Server-ID, to be present

to mitigate against different types of replay attacks. Depending on the configuration of the AWS auth

backend, providing a argument to this optional parameter may be required.

Returns

A PreparedRequest instance, optionally containing the provided header value under a

‘X-Vault-AWS-IAM-Server-ID’ header name pointed to AWS’s simple token service with action “GetCallerIdentity”

Return type

requests.PreparedRequest

### hvac.adapters[¶](#module-hvac.adapters "Permalink to this headline")

HTTP Client Library Adapters

**Classes**

| [`Adapter`](#hvac.adapters.Adapter "hvac.adapters.Adapter")([base\_uri, token, cert, verify, …]) | Abstract base class used when constructing adapters for use with the Client class. |

| [`JSONAdapter`](#hvac.adapters.JSONAdapter "hvac.adapters.JSONAdapter")([base\_uri, token, cert, verify, …]) | The JSONAdapter adapter class. |

| [`RawAdapter`](#hvac.adapters.RawAdapter "hvac.adapters.RawAdapter")([base\_uri, token, cert, verify, …]) | The RawAdapter adapter class. |

| [`Request`](#hvac.adapters.Request "hvac.adapters.Request") | The RawAdapter adapter class. |

*class* `hvac.adapters.``Adapter`(*base\_uri='http://localhost:8200'*, *token=None*, *cert=None*, *verify=True*, *timeout=30*, *proxies=None*, *allow\_redirects=True*, *session=None*, *namespace=None*, *ignore\_exceptions=False*, *strict\_http=False*, *request\_header=True*)[[source]](_modules/hvac/adapters.html#Adapter)[¶](#hvac.adapters.Adapter "Permalink to this definition")

Bases: `object`

Abstract base class used when constructing adapters for use with the Client class.

**Methods**

| [`\_\_init\_\_`](#hvac.adapters.Adapter.__init__ "hvac.adapters.Adapter.__init__")([base\_uri, token, cert, verify, …]) | Create a new request adapter instance. |

| [`auth`](#hvac.adapters.Adapter.auth "hvac.adapters.Adapter.auth")(url[, use\_token]) | Call to deprecated function ‘auth’. |

| [`close`](#hvac.adapters.Adapter.close "hvac.adapters.Adapter.close")() | Close the underlying Requests session. |

| [`delete`](#hvac.adapters.Adapter.delete "hvac.adapters.Adapter.delete")(url, \*\*kwargs) | Performs a DELETE request. |

| [`get`](#hvac.adapters.Adapter.get "hvac.adapters.Adapter.get")(url, \*\*kwargs) | Performs a GET request. |

| [`get\_login\_token`](#hvac.adapters.Adapter.get_login_token "hvac.adapters.Adapter.get_login_token")(response) | Extracts the client token from a login response. |

| [`head`](#hvac.adapters.Adapter.head "hvac.adapters.Adapter.head")(url, \*\*kwargs) | Performs a HEAD request. |

| [`list`](#hvac.adapters.Adapter.list "hvac.adapters.Adapter.list")(url, \*\*kwargs) | Performs a LIST request. |

| [`login`](#hvac.adapters.Adapter.login "hvac.adapters.Adapter.login")(url[, use\_token]) | Perform a login request. |

| [`post`](#hvac.adapters.Adapter.post "hvac.adapters.Adapter.post")(url, \*\*kwargs) | Performs a POST request. |

| [`put`](#hvac.adapters.Adapter.put "hvac.adapters.Adapter.put")(url, \*\*kwargs) | Performs a PUT request. |

| [`request`](#hvac.adapters.Adapter.request "hvac.adapters.Adapter.request")(method, url[, headers, raise\_exception]) | Main method for routing HTTP requests to the configured Vault base\_uri. |

| [`urljoin`](#hvac.adapters.Adapter.urljoin "hvac.adapters.Adapter.urljoin")(\*args) | Joins given arguments into a url. |

`__init__`(*base\_uri='http://localhost:8200'*, *token=None*, *cert=None*, *verify=True*, *timeout=30*, *proxies=None*, *allow\_redirects=True*, *session=None*, *namespace=None*, *ignore\_exceptions=False*, *strict\_http=False*, *request\_header=True*)[[source]](_modules/hvac/adapters.html#Adapter.__init__)[¶](#hvac.adapters.Adapter.__init__ "Permalink to this definition")

Create a new request adapter instance.

Parameters

* **base\_uri** (*str*) – Base URL for the Vault instance being addressed.

* **token** (*str*) – Authentication token to include in requests sent to Vault.

* **cert** (*tuple*) – Certificates for use in requests sent to the Vault instance. This should be a tuple with the

certificate and then key.

* **verify** (*Union**[**bool**,**str**]*) – Either a boolean to indicate whether TLS verification should be performed when sending requests to Vault,

or a string pointing at the CA bundle to use for verification. See <http://docs.python-requests.org/en/master/user/advanced/#ssl-cert-verification>.

* **timeout** (*int*) – The timeout value for requests sent to Vault.

* **proxies** (*dict*) – Proxies to use when preforming requests.

See: <http://docs.python-requests.org/en/master/user/advanced/#proxies>

* **allow\_redirects** (*bool*) – Whether to follow redirects when sending requests to Vault.

* **session** (*request.Session*) – Optional session object to use when performing request.

* **namespace** (*str*) – Optional Vault Namespace.

* **ignore\_exceptions** (*bool*) – If True, \_always\_ return the response object for a given request. I.e., don’t raise an exception

based on response status code, etc.

* **strict\_http** (*bool*) – If True, use only standard HTTP verbs in request with additional params, otherwise process as is

* **request\_header** (*bool*) – If true, add the X-Vault-Request header to all requests to protect against SSRF vulnerabilities.

`auth`(*url*, *use\_token=True*, *\*\*kwargs*)[[source]](_modules/hvac/adapters.html#Adapter.auth)[¶](#hvac.adapters.Adapter.auth "Permalink to this definition")

Call to deprecated function ‘auth’. This method will be removed in version ‘0.9.0’ Please use the ‘login’ method on the ‘hvac.adapters’ class moving forward.Docstring content from this method’s replacement copied below:

Perform a login request.

Associated request is typically to a path prefixed with “/v1/auth”) and optionally stores the client token sentin the resulting Vault response for use by the [`hvac.adapters.Adapter()`](#hvac.adapters.Adapter "hvac.adapters.Adapter") instance under the \_adapater

Client attribute.

Parameters

* **url** (*str | unicode*) – Path to send the authentication request to.

* **use\_token** (*bool*) – if True, uses the token in the response received from the auth request to set the “token”

attribute on the the [`hvac.adapters.Adapter()`](#hvac.adapters.Adapter "hvac.adapters.Adapter") instance under the \_adapater Client attribute.

* **kwargs** (*dict*) – Additional keyword arguments to include in the params sent with the request.

Returns

The response of the auth request.

Return type

requests.Response

`close`()[[source]](_modules/hvac/adapters.html#Adapter.close)[¶](#hvac.adapters.Adapter.close "Permalink to this definition")

Close the underlying Requests session.

`delete`(*url*, *\*\*kwargs*)[[source]](_modules/hvac/adapters.html#Adapter.delete)[¶](#hvac.adapters.Adapter.delete "Permalink to this definition")

Performs a DELETE request.

Parameters

* **url** (*str | unicode*) – Partial URL path to send the request to. This will be joined to the end of the instance’s base\_uri

attribute.

* **kwargs** (*dict*) – Additional keyword arguments to include in the requests call.

Returns

The response of the request.

Return type

requests.Response

`get`(*url*, *\*\*kwargs*)[[source]](_modules/hvac/adapters.html#Adapter.get)[¶](#hvac.adapters.Adapter.get "Permalink to this definition")

Performs a GET request.

Parameters

* **url** (*str | unicode*) – Partial URL path to send the request to. This will be joined to the end of the instance’s base\_uri

attribute.

* **kwargs** (*dict*) – Additional keyword arguments to include in the requests call.

Returns

The response of the request.

Return type

requests.Response

*abstract* `get_login_token`(*response*)[[source]](_modules/hvac/adapters.html#Adapter.get_login_token)[¶](#hvac.adapters.Adapter.get_login_token "Permalink to this definition")

Extracts the client token from a login response.

Parameters

**response** – The response object returned by the login method.

Returns

A client token.

Return type

str

`head`(*url*, *\*\*kwargs*)[[source]](_modules/hvac/adapters.html#Adapter.head)[¶](#hvac.adapters.Adapter.head "Permalink to this definition")

Performs a HEAD request.

Parameters

* **url** (*str | unicode*) – Partial URL path to send the request to. This will be joined to the end of the instance’s base\_uri

attribute.

* **kwargs** (*dict*) – Additional keyword arguments to include in the requests call.

Returns

The response of the request.

Return type

requests.Response

`list`(*url*, *\*\*kwargs*)[[source]](_modules/hvac/adapters.html#Adapter.list)[¶](#hvac.adapters.Adapter.list "Permalink to this definition")

Performs a LIST request.

Parameters

* **url** (*str | unicode*) – Partial URL path to send the request to. This will be joined to the end of the instance’s base\_uri

attribute.

* **kwargs** (*dict*) – Additional keyword arguments to include in the requests call.

Returns

The response of the request.

Return type

requests.Response

`login`(*url*, *use\_token=True*, *\*\*kwargs*)[[source]](_modules/hvac/adapters.html#Adapter.login)[¶](#hvac.adapters.Adapter.login "Permalink to this definition")

Perform a login request.

Associated request is typically to a path prefixed with “/v1/auth”) and optionally stores the client token sentin the resulting Vault response for use by the [`hvac.adapters.Adapter()`](#hvac.adapters.Adapter "hvac.adapters.Adapter") instance under the \_adapater

Client attribute.

Parameters

* **url** (*str | unicode*) – Path to send the authentication request to.

* **use\_token** (*bool*) – if True, uses the token in the response received from the auth request to set the “token”

attribute on the the [`hvac.adapters.Adapter()`](#hvac.adapters.Adapter "hvac.adapters.Adapter") instance under the \_adapater Client attribute.

* **kwargs** (*dict*) – Additional keyword arguments to include in the params sent with the request.

Returns

The response of the auth request.

Return type

requests.Response

`post`(*url*, *\*\*kwargs*)[[source]](_modules/hvac/adapters.html#Adapter.post)[¶](#hvac.adapters.Adapter.post "Permalink to this definition")

Performs a POST request.

Parameters

* **url** (*str | unicode*) – Partial URL path to send the request to. This will be joined to the end of the instance’s base\_uri

attribute.

* **kwargs** (*dict*) – Additional keyword arguments to include in the requests call.

Returns

The response of the request.

Return type

requests.Response

`put`(*url*, *\*\*kwargs*)[[source]](_modules/hvac/adapters.html#Adapter.put)[¶](#hvac.adapters.Adapter.put "Permalink to this definition")

Performs a PUT request.

Parameters

* **url** (*str | unicode*) – Partial URL path to send the request to. This will be joined to the end of the instance’s base\_uri

attribute.

* **kwargs** (*dict*) – Additional keyword arguments to include in the requests call.

Returns

The response of the request.

Return type

requests.Response

*abstract* `request`(*method*, *url*, *headers=None*, *raise\_exception=True*, *\*\*kwargs*)[[source]](_modules/hvac/adapters.html#Adapter.request)[¶](#hvac.adapters.Adapter.request "Permalink to this definition")

Main method for routing HTTP requests to the configured Vault base\_uri. Intended to be implement by subclasses.

Parameters

* **method** (*str*) – HTTP method to use with the request. E.g., GET, POST, etc.

* **url** (*str | unicode*) – Partial URL path to send the request to. This will be joined to the end of the instance’s base\_uri

attribute.

* **headers** (*dict*) – Additional headers to include with the request.

* **kwargs** (*dict*) – Additional keyword arguments to include in the requests call.

* **raise\_exception** (*bool*) – If True, raise an exception via utils.raise\_for\_error(). Set this parameter to False to

bypass this functionality.

Returns

The response of the request.

Return type

requests.Response

*static* `urljoin`(*\*args*)[[source]](_modules/hvac/adapters.html#Adapter.urljoin)[¶](#hvac.adapters.Adapter.urljoin "Permalink to this definition")

Joins given arguments into a url. Trailing and leading slashes are stripped for each argument.

Parameters

**args** (*str | unicode*) – Multiple parts of a URL to be combined into one string.

Returns

Full URL combining all provided arguments

Return type

str | unicode

*class* `hvac.adapters.``JSONAdapter`(*base\_uri='http://localhost:8200'*, *token=None*, *cert=None*, *verify=True*, *timeout=30*, *proxies=None*, *allow\_redirects=True*, *session=None*, *namespace=None*, *ignore\_exceptions=False*, *strict\_http=False*, *request\_header=True*)[[source]](_modules/hvac/adapters.html#JSONAdapter)[¶](#hvac.adapters.JSONAdapter "Permalink to this definition")

Bases: [`hvac.adapters.RawAdapter`](#hvac.adapters.RawAdapter "hvac.adapters.RawAdapter")

The JSONAdapter adapter class.

This adapter works just like the RawAdapter adapter except that HTTP 200 responses are returned as JSON dicts.

All non-200 responses are returned as Response objects.

**Methods**

| [`get\_login\_token`](#hvac.adapters.JSONAdapter.get_login_token "hvac.adapters.JSONAdapter.get_login_token")(response) | Extracts the client token from a login response. |

| [`request`](#hvac.adapters.JSONAdapter.request "hvac.adapters.JSONAdapter.request")(\*args, \*\*kwargs) | Main method for routing HTTP requests to the configured Vault base\_uri. |

`get_login_token`(*response*)[[source]](_modules/hvac/adapters.html#JSONAdapter.get_login_token)[¶](#hvac.adapters.JSONAdapter.get_login_token "Permalink to this definition")

Extracts the client token from a login response.

Parameters

**response** (*dict | requests.Response*) – The response object returned by the login method.

Returns

A client token.

Return type

str

`request`(*\*args*, *\*\*kwargs*)[[source]](_modules/hvac/adapters.html#JSONAdapter.request)[¶](#hvac.adapters.JSONAdapter.request "Permalink to this definition")

Main method for routing HTTP requests to the configured Vault base\_uri.

Parameters

* **args** (*list*) – Positional arguments to pass to RawAdapter.request.

* **kwargs** (*dict*) – Keyword arguments to pass to RawAdapter.request.

Returns

Dict on HTTP 200 with JSON body, otherwise the response object.

Return type

dict | requests.Response

*class* `hvac.adapters.``RawAdapter`(*base\_uri='http://localhost:8200'*, *token=None*, *cert=None*, *verify=True*, *timeout=30*, *proxies=None*, *allow\_redirects=True*, *session=None*, *namespace=None*, *ignore\_exceptions=False*, *strict\_http=False*, *request\_header=True*)[[source]](_modules/hvac/adapters.html#RawAdapter)[¶](#hvac.adapters.RawAdapter "Permalink to this definition")

Bases: [`hvac.adapters.Adapter`](#hvac.adapters.Adapter "hvac.adapters.Adapter")

The RawAdapter adapter class.

This adapter adds Vault-specific headers as required and optionally raises exceptions on errors,

but always returns Response objects for requests.

**Methods**

| [`get\_login\_token`](#hvac.adapters.RawAdapter.get_login_token "hvac.adapters.RawAdapter.get_login_token")(response) | Extracts the client token from a login response. |

| [`request`](#hvac.adapters.RawAdapter.request "hvac.adapters.RawAdapter.request")(method, url[, headers, raise\_exception]) | Main method for routing HTTP requests to the configured Vault base\_uri. |

`get_login_token`(*response*)[[source]](_modules/hvac/adapters.html#RawAdapter.get_login_token)[¶](#hvac.adapters.RawAdapter.get_login_token "Permalink to this definition")

Extracts the client token from a login response.

Parameters

**response** (*requests.Response*) – The response object returned by the login method.

Returns

A client token.

Return type

str

`request`(*method*, *url*, *headers=None*, *raise\_exception=True*, *\*\*kwargs*)[[source]](_modules/hvac/adapters.html#RawAdapter.request)[¶](#hvac.adapters.RawAdapter.request "Permalink to this definition")

Main method for routing HTTP requests to the configured Vault base\_uri.

Parameters

* **method** (*str*) – HTTP method to use with the request. E.g., GET, POST, etc.

* **url** (*str | unicode*) – Partial URL path to send the request to. This will be joined to the end of the instance’s base\_uri

attribute.

* **headers** (*dict*) – Additional headers to include with the request.

* **raise\_exception** (*bool*) – If True, raise an exception via utils.raise\_for\_error(). Set this parameter to False to

bypass this functionality.

* **kwargs** (*dict*) – Additional keyword arguments to include in the requests call.

Returns

The response of the request.

Return type

requests.Response

`hvac.adapters.``Request`[¶](#hvac.adapters.Request "Permalink to this definition")

| `get\_login\_token`(response) | Extracts the client token from a login response. |

| `request`(method, url[, headers, raise\_exception]) | Main method for routing HTTP requests to the configured Vault base\_uri. |

**Methods**

alias of [`hvac.adapters.RawAdapter`](#hvac.adapters.RawAdapter "hvac.adapters.RawAdapter")

### hvac.exceptions[¶](#module-hvac.exceptions "Permalink to this headline")

**Exceptions**

| [`BadGateway`](#hvac.exceptions.BadGateway "hvac.exceptions.BadGateway")([message, errors, method, url]) |  |

| [`Forbidden`](#hvac.exceptions.Forbidden "hvac.exceptions.Forbidden")([message, errors, method, url]) |  |

| [`InternalServerError`](#hvac.exceptions.InternalServerError "hvac.exceptions.InternalServerError")([message, errors, …]) |  |

| [`InvalidPath`](#hvac.exceptions.InvalidPath "hvac.exceptions.InvalidPath")([message, errors, method, url]) |  |

| [`InvalidRequest`](#hvac.exceptions.InvalidRequest "hvac.exceptions.InvalidRequest")([message, errors, method, url]) |  |

| [`ParamValidationError`](#hvac.exceptions.ParamValidationError "hvac.exceptions.ParamValidationError")([message, errors, …]) |  |

| [`RateLimitExceeded`](#hvac.exceptions.RateLimitExceeded "hvac.exceptions.RateLimitExceeded")([message, errors, method, url]) |  |

| [`Unauthorized`](#hvac.exceptions.Unauthorized "hvac.exceptions.Unauthorized")([message, errors, method, url]) |  |

| [`UnexpectedError`](#hvac.exceptions.UnexpectedError "hvac.exceptions.UnexpectedError")([message, errors, method, url]) |  |

| [`VaultDown`](#hvac.exceptions.VaultDown "hvac.exceptions.VaultDown")([message, errors, method, url]) |  |

| [`VaultError`](#hvac.exceptions.VaultError "hvac.exceptions.VaultError")([message, errors, method, url]) |  |

| [`VaultNotInitialized`](#hvac.exceptions.VaultNotInitialized "hvac.exceptions.VaultNotInitialized")([message, errors, …]) |  |

*exception* `hvac.exceptions.``BadGateway`(*message=None*, *errors=None*, *method=None*, *url=None*)[[source]](_modules/hvac/exceptions.html#BadGateway)[¶](#hvac.exceptions.BadGateway "Permalink to this definition")

Bases: [`hvac.exceptions.VaultError`](#hvac.exceptions.VaultError "hvac.exceptions.VaultError")

*exception* `hvac.exceptions.``Forbidden`(*message=None*, *errors=None*, *method=None*, *url=None*)[[source]](_modules/hvac/exceptions.html#Forbidden)[¶](#hvac.exceptions.Forbidden "Permalink to this definition")

Bases: [`hvac.exceptions.VaultError`](#hvac.exceptions.VaultError "hvac.exceptions.VaultError")

*exception* `hvac.exceptions.``InternalServerError`(*message=None*, *errors=None*, *method=None*, *url=None*)[[source]](_modules/hvac/exceptions.html#InternalServerError)[¶](#hvac.exceptions.InternalServerError "Permalink to this definition")

Bases: [`hvac.exceptions.VaultError`](#hvac.exceptions.VaultError "hvac.exceptions.VaultError")

*exception* `hvac.exceptions.``InvalidPath`(*message=None*, *errors=None*, *method=None*, *url=None*)[[source]](_modules/hvac/exceptions.html#InvalidPath)[¶](#hvac.exceptions.InvalidPath "Permalink to this definition")

Bases: [`hvac.exceptions.VaultError`](#hvac.exceptions.VaultError "hvac.exceptions.VaultError")

*exception* `hvac.exceptions.``InvalidRequest`(*message=None*, *errors=None*, *method=None*, *url=None*)[[source]](_modules/hvac/exceptions.html#InvalidRequest)[¶](#hvac.exceptions.InvalidRequest "Permalink to this definition")

Bases: [`hvac.exceptions.VaultError`](#hvac.exceptions.VaultError "hvac.exceptions.VaultError")

*exception* `hvac.exceptions.``ParamValidationError`(*message=None*, *errors=None*, *method=None*, *url=None*)[[source]](_modules/hvac/exceptions.html#ParamValidationError)[¶](#hvac.exceptions.ParamValidationError "Permalink to this definition")

Bases: [`hvac.exceptions.VaultError`](#hvac.exceptions.VaultError "hvac.exceptions.VaultError")

*exception* `hvac.exceptions.``RateLimitExceeded`(*message=None*, *errors=None*, *method=None*, *url=None*)[[source]](_modules/hvac/exceptions.html#RateLimitExceeded)[¶](#hvac.exceptions.RateLimitExceeded "Permalink to this definition")

Bases: [`hvac.exceptions.VaultError`](#hvac.exceptions.VaultError "hvac.exceptions.VaultError")

*exception* `hvac.exceptions.``Unauthorized`(*message=None*, *errors=None*, *method=None*, *url=None*)[[source]](_modules/hvac/exceptions.html#Unauthorized)[¶](#hvac.exceptions.Unauthorized "Permalink to this definition")

Bases: [`hvac.exceptions.VaultError`](#hvac.exceptions.VaultError "hvac.exceptions.VaultError")

*exception* `hvac.exceptions.``UnexpectedError`(*message=None*, *errors=None*, *method=None*, *url=None*)[[source]](_modules/hvac/exceptions.html#UnexpectedError)[¶](#hvac.exceptions.UnexpectedError "Permalink to this definition")

Bases: [`hvac.exceptions.VaultError`](#hvac.exceptions.VaultError "hvac.exceptions.VaultError")

*exception* `hvac.exceptions.``VaultDown`(*message=None*, *errors=None*, *method=None*, *url=None*)[[source]](_modules/hvac/exceptions.html#VaultDown)[¶](#hvac.exceptions.VaultDown "Permalink to this definition")

Bases: [`hvac.exceptions.VaultError`](#hvac.exceptions.VaultError "hvac.exceptions.VaultError")

*exception* `hvac.exceptions.``VaultError`(*message=None*, *errors=None*, *method=None*, *url=None*)[[source]](_modules/hvac/exceptions.html#VaultError)[¶](#hvac.exceptions.VaultError "Permalink to this definition")

Bases: `Exception`

`__init__`(*message=None*, *errors=None*, *method=None*, *url=None*)[[source]](_modules/hvac/exceptions.html#VaultError.__init__)[¶](#hvac.exceptions.VaultError.__init__ "Permalink to this definition")

Initialize self. See help(type(self)) for accurate signature.

*exception* `hvac.exceptions.``VaultNotInitialized`(*message=None*, *errors=None*, *method=None*, *url=None*)[[source]](_modules/hvac/exceptions.html#VaultNotInitialized)[¶](#hvac.exceptions.VaultNotInitialized "Permalink to this definition")

Bases: [`hvac.exceptions.VaultError`](#hvac.exceptions.VaultError "hvac.exceptions.VaultError")

Contributing[¶](#contributing "Permalink to this headline")

-----------------------------------------------------------

Feel free to open issues and/or pull requests with additional features or improvements! For general questions about contributing to hvac that don’t fit in the scope of a GitHub issue, and for any folks are interested in becoming a maintainer of hvac, please feel free to join our gitter chat room for discussions at: [gitter.im/hvac/community](https://gitter.im/hvac/community).

### Typical Development Environment Setup[¶](#typical-development-environment-setup "Permalink to this headline")

```

virtualenv hvac-env

source hvac-env/bin/activate

git clone https://github.com/hvac/hvac.git

cd hvac

pip install -e .

```

### Testing[¶](#testing "Permalink to this headline")

Integration tests will automatically start a Vault server in the background. Just make sure

the latest `vault` binary is available in your `PATH`.

1. [Install Vault](https://vaultproject.io/docs/install/index.html)

2. Install requirements

```

cd hvac

pip install -r requirements-dev.txt

```

1. Run tests: `make test`

### Updating Requirements[¶](#updating-requirements "Permalink to this headline")

This project uses [pip-tool’s](https://pypi.org/project/pip-tools/) `pip-compile` utility to manage its various requirements.

Any given requirements file can be manually updated by following the pip-compile comments at the top of the file. Alternatively, the `update-all-requirements` Makefile target can be used to update requirements across the board (this has a dependency on docker being available).

### Documentation[¶](#documentation "Permalink to this headline")

#### Adding New Documentation Files[¶](#adding-new-documentation-files "Permalink to this headline")

When adding documentation for an entirely new feature / class, it often makes sense to place the documentation in a new `.rst` file. After drafting the new file, be sure to add the file as an entry to at least one table of contents directive (e.g., `toctree`) to ensure it gets rendered and published on <https://hvac.readthedocs.io/>. As an example, the process for adding a new documentation file for a secrets engine related to Active Directory could involve:

1. Add a new file to `docs/usage/secrets\_engines` with a name along the lines of `active\_directory.rst`.

2. Update the `toctree` directive within `docs/usage/secrets\_engines/index.rst` to add a line for `active\_directory`

3. Verify the new file is being included and rendered as expected by running `make html` from the `docs/` subdirectory. You can then view the rendered HTML documentation, in a browser or otherwise, by opening `docs/\_build/html/index.html`.

#### Testing Docs[¶](#testing-docs "Permalink to this headline")

```

cd docs/

pip install -r requirements.txt

make doctest

```

#### Examples[¶](#examples "Permalink to this headline")

Example code or general guides for methods in this module can be added under <docs/usage>. Any newly added or updated method in this module will ideally have a corresponding addition to these examples. New usage sections should also be added to the table of contents tracked in <docs/usage.rst>.

### Backwards Compatibility Breaking Changes[¶](#backwards-compatibility-breaking-changes "Permalink to this headline")

Due to the close connection between this module and HashiCorp Vault versions, breaking changes are sometimes required. This can also occur as part of code refactoring to enable improvements in the module generally. In these cases:

* A deprecation notice should be displayed to callers of the module until the minor revision +2. E.g., a notice added in version 0.6.2 could see the marked method / functionality removed in version 0.8.0.

* Breaking changes should be called out in the <CHANGELOG.md> for the affected version.

### Creating / Publishing Releases[¶](#creating-publishing-releases "Permalink to this headline")

* [ ] Checkout the `develop` branch:

```

git checkout develop

git pull

```

* [ ] Update the version number using [bumpversion](https://github.com/peritus/bumpversion). Releases typically just use the “patch” bumpversion option; but “minor” and “major” are available as needed. This will also add an appropriate git commit for the new version.

```

bumpversion --no-tag {patch|minor|major}

```

* [ ] Pull up the current draft [hvac release](https://github.com/hvac/hvac/releases/) and use the [release-drafter](https://github.com/toolmantim/release-drafter) generated release body to update <CHANGELOG.md>. Then commit the changes:

```

git commit CHANGELOG.md -m "Changelog updates for v$(grep -oP '(?<=current\_version = ).\*' .bumpversion.cfg)"

```

* [ ] Git push the updated develop branch (`git push`) and open a PR to rebase merge the develop branch into main: [https://github.com/hvac/hvac/compare/main…develop](https://github.com/hvac/hvac/compare/main...develop). Ensure the PR has the “release” label applied and then merge it.

* [ ] Publish the draft release on GitHub: <https://github.com/hvac/hvac/releases>. Ensure the tag is set to the release name (e.g., vX.X.X) and the target is the main branch.

NOTE: [release-drafter](https://github.com/toolmantim/release-drafter) sets the release name by default. If performing a minor or major update, these values will need to be manually updated before publishing the draft release subsequently.

Changelog[¶](#changelog "Permalink to this headline")

-----------------------------------------------------

### 0.11.2 (September 23rd, 2021)[¶](#september-23rd-2021 "Permalink to this headline")

Breakfix release to revert some unintended post-1.0 requirements changes.

#### 🐛 Bug Fixes[¶](#bug-fixes "Permalink to this headline")

* Revert `six` & `requests` Requirements Changes. GH-768

### 0.11.1 (September 22nd, 2021)[¶](#september-22nd-2021 "Permalink to this headline")

#### 💥 Breaking Changes[¶](#breaking-changes "Permalink to this headline")

* **Note**: This is *actually and truly* (😝) intended to by the last hvac release supporting Python 2.7.

[\*\*](#id1)*Starting with hvac version ``1.0.0``, Python versions ``>=3.6`` will be the only explictly supported versions.*\*\*

* Requirements - Cleanup & Upgrades (`install\_requires` => `requests>=2.25.1` ). GH-741

#### 🚀 Features[¶](#features "Permalink to this headline")

* Add X-Vault-Request header to all requests by default. GH-762

* Add token\_type to kubernetes auth create\_role. GH-760

* jwt: use login adapter and add `use\_token` param. GH-746

#### 🐛 Bug Fixes[¶](#id3 "Permalink to this headline")

* Fix Passing of `cert` Parameter From Client into Adapter Class. GH-743

* Removed vestigial accessor parameter from auth token revoke\_self. GH-744

* Fix Client TLS `verify` Behavior . GH-745

* Fix incorrect recovery key backup path. GH-749

Thanks to @Tylerlhess, @anhdat, @ayav09, @bobmshannon, @bpatterson971, @briantist, @cmanfre4, @jeffwecan, Chris Manfre and tyhess for their lovely contributions.

### 0.11.0 (July 12th, 2021)[¶](#july-12th-2021 "Permalink to this headline")

#### 💥 Breaking Changes[¶](#id4 "Permalink to this headline")

* **Note**: This is intended to by the last hvac release supporting Python 2.7.

[\*\*](#id5)*Starting with hvac version ``1.0.0``, Python versions ``>=3.6`` will be the only explictly supported versions.*\*\*

* Userpass: Add `use\_token` param on `login()`, Accept passthrough `\*\*kwargs` on create user . GH-733

#### 🚀 Features[¶](#id7 "Permalink to this headline")

* Support CA-related Environment Variables. GH-735

* Migrate Token Auth Methods to Dedicated Class. GH-734

* Allow Omission of Password Argument on Userpass `create\_or\_update\_user()`. GH-714

* Add `token\_ttl` & `token\_max\_ttl` Arguments to `ldap.configure()`. GH-707

#### 🐛 Bug Fixes[¶](#id8 "Permalink to this headline")

* Fix Cert.login() handling of use\_token argument. GH-720

* Use PUTs for AWS Secrets Engine STS Requests. GH-718

#### 🧰 Miscellaneous[¶](#miscellaneous "Permalink to this headline")

* Add deprecation notices for `Client()` k8s methods. GH-732

* Add deprecation notices for `Client()` approle methods. GH-731

* Deprecate AppID-related `Client()` Methods. GH-730

* Update Deprecated Usage In Documentation & Tests. GH-728

* Add `python\_requires='>=2.7'` to setuptools Metadata. GH-727

* Transition to `black` Formatting + Updated PR Actions Workflow. GH-726

Thanks to @el-deano, @intgr, @jeffwecan, @pjaudiomv, @tp6783 and tyhess for their lovely contributions.

### 0.10.14 (May 21st, 2021)[¶](#may-21st-2021 "Permalink to this headline")

#### 🐛 Bug Fixes[¶](#id9 "Permalink to this headline")

* Python 2.7: Drop Trailing Comma In `Cert.login()`. GH-712

### 0.10.13 (May 20th, 2021)[¶](#may-20th-2021 "Permalink to this headline")

#### 🐛 Bug Fixes[¶](#id10 "Permalink to this headline")

* Refactor `Cert.login()` Conditional for Python 2.7 Syntax Support. GH-708

### 0.10.12 (May 19th, 2021)[¶](#may-19th-2021 "Permalink to this headline")

#### 🚀 Features[¶](#id11 "Permalink to this headline")

* Add default to `group\_type` argument in `update\_group` and `create\_or\_update\_group\_by\_name`. GH-703

* Add Certificate Authentication Methods. GH-691

Thanks to @Tylerlhess, @jeffwecan, @matusf, @mblau-leaffilter and tyhess for their lovely contributions.

### 0.10.11 (May 7th, 2021)[¶](#may-7th-2021 "Permalink to this headline")

#### 🚀 Features[¶](#id12 "Permalink to this headline")

* Expand Transform class to include new(ish) tokenization methods. GH-696

* Add `delete\_version\_after` KvV2 Param - `configure()` / [`](#id13)update\_metadata(). GH-694

#### 🧰 Miscellaneous[¶](#id15 "Permalink to this headline")

* Bump versions of Vault used in CI workflows. GH-695

Thanks to @jeffwecan for their lovely contributions.

### 0.10.10 (April 29th, 2021)[¶](#april-29th-2021 "Permalink to this headline")

#### 🚀 Features[¶](#id16 "Permalink to this headline")

* AWS Secrets Engine: Add support for iam\_tags when creating roles. GH-684

* Add Active Directory generate credential capability. GH-657

* Add `policies` Parameter to Userpass `create\_or\_update\_user()` Method. GH-562

* Add handling of unsupported HTTP methods inside adapter. GH-689

* Add Convenience `read\_secret()` Method for KVv2 Class. GH-686

#### 🧰 Miscellaneous[¶](#id17 "Permalink to this headline")

* Set daemon attribute instead of using setDaemon method that was deprecated in Python 3.10. GH-688

Thanks to @jeffwecan, @mblau-leaffilter, @nicholaswold, @sshishov, @tirkarthi, @tomwerneruk and @vamshideveloper for their lovely contributions.

### 0.10.9 (April 2nd, 2021)[¶](#april-2nd-2021 "Permalink to this headline")

#### 🐛 Bug Fixes[¶](#id18 "Permalink to this headline")

* Send AppRole generate\_secret\_id Method Metadata Parameter as String GH-689

#### 📚 Documentation[¶](#documentation "Permalink to this headline")

* Fix lambda authentication example in aws auth documentation. GH-675

* Docs(secret\_engines/pki): Remove ‘self’ from examples. GH-676

Thanks to @JPoser, @fhemberger, @jeffwecan, @lperdereau and jposer for their lovely contributions.

### 0.10.8 (February 8th, 2021)[¶](#february-8th-2021 "Permalink to this headline")

#### 🚀 Features[¶](#id19 "Permalink to this headline")

* K8s Auth: Allow wildcards for service account and namespace. GH-669

* Add token\_type support to create\_kubernetes\_role. GH-664

### 0.10.7 (February 1st, 2021)[¶](#february-1st-2021 "Permalink to this headline")

#### 🚀 Features[¶](#id20 "Permalink to this headline")

* Support database secrets static roles. GH-662

#### 🧰 Miscellaneous[¶](#id21 "Permalink to this headline")

* Replace Travis CI w/ GitHub actions. GH-666

Thanks to @jeffwecan, @krish7919 and Krish for their lovely contributions.

### 0.10.6 (December 14th, 2020)[¶](#december-14th-2020 "Permalink to this headline")

#### 🚀 Features[¶](#id22 "Permalink to this headline")

* Enable response wrapping of PKI secrets. GH-649

* Fix OIDC login and add working example. GH-638

* Add rabbitmq vhost\_topics parameter. GH-626

* Expand auth\_methods module to support AppRole. GH-637

#### 🐛 Bug Fixes[¶](#id23 "Permalink to this headline")

* Template “auth method not implemented” error message. GH-651

* Fix health.py read\_health\_status GET method. GH-653

* Fix transit constants for “generate\_data\_key”. GH-632

* Fix PUT method in secrets engine kv\_v1 to use PUT instead of POST. GH-629

* Remove Erroneous json() Calls In rabbitmq Class. GH-624

#### 🧰 Miscellaneous[¶](#id24 "Permalink to this headline")

* Update health.py to match new Vault API query parameters. GH-635

* Remove Consul Secrets Engine create\_or\_update\_role Policy Type Validation. GH-636

Thanks to @Angeall, @JJCella, @briantist, @derBroBro, @discogestalt, @dogfish182, @el-deano, @ghTravis, @godara01, @jeffwecan, @leongyh, @phickey, @tienthanh2509 and @tmcolby for their lovely contributions.

### 0.10.5 (July 26th, 2020)[¶](#july-26th-2020 "Permalink to this headline")

#### 🚀 Features[¶](#id25 "Permalink to this headline")

* Add JWT/OIDC Authentication Method Classes. GH-613

* Add Identity Tokens Methods and Documentation. GH-611

* Add P-521 to list of allowed key types. GH-608

* Add P-384 and RSA-3072 to list of allowed key types. GH-606

#### 🐛 Bug Fixes[¶](#id26 "Permalink to this headline")

* Options not read by tune\_mount\_configuration. GH-603

#### 📚 Documentation[¶](#id27 "Permalink to this headline")

* Add Autodoc Summaries. GH-612

* Correct Return Type Docstrings Within Transit Class. GH-609

* Transit engine docs for Encrypt Data now refer to encrypt\_data. GH-601

#### 🧰 Miscellaneous[¶](#id28 "Permalink to this headline")

* Update Vault version test matrix / Oldest Support Vault Version. GH-610

Thanks to @akdor1154, @jeffwecan, @ns-jshilkaitis and @trishankatdatadog for their lovely contributions.

### 0.10.4 (June 16th, 2020)[¶](#june-16th-2020 "Permalink to this headline")

#### 🚀 Features[¶](#id29 "Permalink to this headline")

* Extract “renew\_self\_token” from “renew\_token”. GH-598

* Add convenience step\_down sys backend method. GH-597

#### 📚 Documentation[¶](#id30 "Permalink to this headline")

* Update AWS Auth Docs With Latest Usage . GH-599

Thanks to @jeffwecan, @jm96441n and @pnijhara for their lovely contributions.

### 0.10.3 (May 24th, 2020)[¶](#may-24th-2020 "Permalink to this headline")

#### 🚀 Features[¶](#id31 "Permalink to this headline")

* Add Support For use\_token\_groups In LDAP Auth Method. GH-591

* Add Raft System Backend Methods. GH-594

Thanks to @finarfin and @jeffwecan for their lovely contributions.

### 0.10.2 (May 19th, 2020)[¶](#may-19th-2020 "Permalink to this headline")

#### 🚀 Features[¶](#id32 "Permalink to this headline")

* Create\_role\_secret\_id: add token\_bound\_cidrs parameter. GH-585

* Add vault rekey verification methods. GH-586

* Add request data to exception objects. GH-583

* Add marshaling\_algorithm to sign/verify params. GH-584

* Add issuer to kubernetes configuration. GH-575

#### 🐛 Bug Fixes[¶](#id33 "Permalink to this headline")

* Remove json() calls (unneeded following JSONAdapter addition) GH-589

#### 📚 Documentation[¶](#id34 "Permalink to this headline")

* Fix format errors in contributing for HTML docs. GH-577

Thanks to @TerryHowe, @and-semakin, @jeffwecan, @jschlyter, @jzck, @mdelaney and @scarabeusiv for their lovely contributions.

### 0.10.1 (April 7th, 2020)[¶](#april-7th-2020 "Permalink to this headline")

#### 💥 Breaking Changes[¶](#id35 "Permalink to this headline")

* Make returned responses more consistent. GH-537

*Note*: [GH-537](https://github.com/hvac/hvac/pull/537) changes some methods’ return types from None to a request.Response

instance. For instance the `client.secrets.identity.lookup\_entity` now returns a Response[204] (truthy) value instead of

None (falsy) when the lookup returns no results.

This change was made to simplify maintenance of response parsing within the hvac code base.

#### 🚀 Features[¶](#id36 "Permalink to this headline")

* Add support for Transform secrets engine. GH-569

#### 🐛 Bug Fixes[¶](#id37 "Permalink to this headline")

* Fix “Exception: member entities can’t be set manually for external groups”. GH-558

Thanks to @jeffwecan, @llamasoft and @msuszko for their lovely contributions.

### 0.10.0 (February 26th, 2020)[¶](#february-26th-2020 "Permalink to this headline")

#### 🚀 Features[¶](#id38 "Permalink to this headline")

* Add a correct endpoint for CRL retrieving . GH-547

#### 📚 Documentation[¶](#id39 "Permalink to this headline")

* Fixes close quotes in example usage of read\_secret\_version. GH-557

* Fixes typo in docs: much -> must. GH-555

#### 🧰 Miscellaneous[¶](#id40 "Permalink to this headline")

* Don’t send optional parameters unless explicitly specified. GH-533

*Note*: [GH-533](https://github.com/hvac/hvac/pull/533) includes fundamental behavior involving sending parameters

to API requests to Vault. Many hvac method parameters that would have been sent with default arguments no

longer are included in requests to Vault. Notably, the following behavioral changes should be expected (copied from the

related PR comments):

Azure:

* CHANGED: `create\_role` parameter `policies` now accepts CSV string or list of strings

Database:

* CHANGED: `create\_role` documentation updated to something meaningful 🙃

GCP:

* `configure` parameter `google\_certs\_endpoint` is deprecated

* `create\_role` parameter `project\_id` is deprecated by `bound\_projects` (list)

GitHub:

* `configure` is missing a lot of parameters

LDAP:

* CHANGED: `configure` parameters `user\_dn` and `group\_dn` made optional

	+ Retained argument position to prevent being a breaking change

* CHANGED: `hvac/constants/ldap.py` file removed as it is no longer used

MFA:

* This entire endpoint is deprecated so I didn’t bother updating it

Okta:

* CHANGED: `configure` parameter `base\_url` default value now differs from API documentation

	+ This is likely just a [documentation issue](https://github.com/hashicorp/vault/issues/7653)

* `register\_user`, `read\_user`, and `delete\_user` duplicate URL parameter `username` in JSON payload

	+ I left this one as-is as it doesn’t appear to hurt anything

* Ditto for `delete\_group`, but `register\_group` and `list\_group` correctly omit it

PKI:

* CHANGED: `sign\_data` and `verify\_signed\_data` optional parameter `marshaling\_algorithm` added

RADIUS:

* `configure` is missing a lot of parameters

* BUG: `register\_user` attempted to convert `username` string into a CSV list (?!) for POST data

	+ Didn’t hurt anything as `username` is extracted from URL path in Vault server

* BUG: `register\_user` parameter `policies` never actually passed as parameter

System Backend:

* Auth

	+ `enable\_auth\_method` parameter `plugin\_name` is deprecated

	+ CHANGED: `enable\_audit\_device` optional parameter `local` was added

* Init

	+ `initialize` provides default for required API parameters `secret\_shares` and `secret\_threshold`

* Key

	+ `start\_root\_token\_generation` parameter `otp` is deprecated

**Misc:**

* There seems to be some discrepancy on how “extra arguments” are accepted:

	+ Some methods use only `\*\*kwargs` (e.g. `hvac/api/system\_backend/auth.py`)

	+ Some use `\*args` and `\*\*kwargs` (e.g. `hvac/api/secrets\_engines/active\_directory.py`)

	+ `hvac/api/secrets\_engines/pki.py` uses `extra\_params={}`

* Most argument names match API parameter names, but some don’t

	+ Example: `hvac/api/auth\_methods/ldap.py` `configure` uses `user\_dn` instead of `userdn`

	+ Example: `hvac/api/system\_backend/auth.py` `configure` uses `method\_type` instead of `type`

* Many methods duplicate URL parameters into JSON payload as well

	+ This isn’t necessary and fortunately Vault ignores the extra parameters

* `ttl`, `max\_ttl`, `policies`, `period`, `num\_uses` and a few other fields are deprecated as of Vault version 1.2.0

	+ <https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#120-july-30th-2019>

Thanks to @findmyname666, @llamasoft, @moisesguimaraes, @philherbert and Adrian Eib for their lovely contributions.

### 0.9.6 (November 20th, 2019)[¶](#november-20th-2019 "Permalink to this headline")

#### 🚀 Features[¶](#id41 "Permalink to this headline")

* Added userpass auth method. GH-519

* added rabbitmq secrets backend. GH-540

* Quote/Escape all URL placeholders. GH-532

#### 📚 Documentation[¶](#id42 "Permalink to this headline")

* Getting Started Guide and LDAP Auth Updates. GH-524

#### 🧰 Miscellaneous[¶](#id43 "Permalink to this headline")

* Handle bad gateway from Vault. GH-542

* Fix GET/LIST typos. GH-536

* Fix Travis HEAD build + Overhaul install scripts. GH-535

* Improve Integration Test Error Handling. GH-531

Thanks to @DaveDeCaprio, @Dowwie, @drewmullen, @jeffwecan, @llamasoft and @vamshideveloper for their lovely contributions.

### 0.9.5 (July 19th, 2019)[¶](#july-19th-2019 "Permalink to this headline")

#### 🚀 Features[¶](#id44 "Permalink to this headline")

* Add Active Directory Secrets Engine Support. GH-508

#### 📚 Documentation[¶](#id45 "Permalink to this headline")

* Include Recently Added Namespace Documentation In Toctree. GH-509

Thanks to @jeffwecan and @vamshideveloper for their lovely contributions.

### 0.9.4 (July 18th, 2019)[¶](#july-18th-2019 "Permalink to this headline")

#### 🚀 Features[¶](#id46 "Permalink to this headline")

* Add delete\_namespace Method and Establish Namespace Documentation. GH-500

#### 🐛 Bug Fixes[¶](#id47 "Permalink to this headline")

* Fix consul configure\_access/create\_or\_update\_role Method Return Values. GH-502

#### 📚 Documentation[¶](#id48 "Permalink to this headline")

* Fix Database generate\_credentials Docstring Params. GH-498

#### 🧰 Miscellaneous[¶](#id49 "Permalink to this headline")

* Add config for updatedocs app. GH-495

* Add a Codeowners file for automatic reviewer assignments. GH-494

Thanks to @Tylerlhess, @drewmullen and @jeffwecan for their lovely contributions.

### 0.9.3 (July 7th, 2019)[¶](#july-7th-2019 "Permalink to this headline")

#### 🚀 Features[¶](#id50 "Permalink to this headline")

* Add Create and List Namespace System Backend Methods. GH-489

* Expanded Support for AWS Auth Method. GH-482

* Capabilities System Backend Support. GH-476

#### 🐛 Bug Fixes[¶](#id51 "Permalink to this headline")

* GCP Auth Test Case Updates For Changes in Vault v1.1.1+. GH-487

* Change AWS `generate\_credentials` request method to GET. GH-475

#### 📚 Documentation[¶](#id52 "Permalink to this headline")

* Numerous Fixes and Doctest Support for Transit Secrets Engine. GH-486

#### 🧰 Miscellaneous[¶](#id53 "Permalink to this headline")

* Start Using Enterprise (Trial) Version of Vault For Travis CI Builds. GH-478

* Update Travis CI Test Matrix With Latest Vault Version & Drop Python 3.6. GH-488

* Set up release-drafter / *mostly* automated releases. GH-485

Thanks to @donjar, @fhemberger, @jeffwecan, @stevefranks and @stevenmanton for their lovely contributions.

### 0.9.2 (June 8th, 2019)[¶](#june-8th-2019 "Permalink to this headline")

BUG FIXES:

* Fix kubernetes auth method list roles method. [GH-466](https://github.com/hvac/hvac/pull/466)

* Enable consul secrets engine. [GH-460](https://github.com/hvac/hvac/pull/460)

* Enable database secrets engine. [GH-455](https://github.com/hvac/hvac/pull/455)

* Many fixes for the database secrets engine. [GH-457](https://github.com/hvac/hvac/pull/457)

IMPROVEMENTS:

* The `enable\_auth\_method()`, `tune\_auth\_method()`, `enable\_secrets\_engine()`, `tune\_mount\_configuration()` system backend method now take arbitrary `\*\*kwargs` parameters to provide greater support for variations in accepted parameters in the underlying Vault plugins.

* Azure auth params, add `num\_uses`, change `bound\_location` -> `bound\_locations` and `bound\_resource\_group\_names` -> `bound\_resource\_groups`. [GH-452](https://github.com/hvac/hvac/pull/452)

MISCELLANEOUS:

* The hvac project now has gitter chat enabled. Feel free to check it out for any online discussions related to this module at: [gitter.im/hvac/community](https://gitter.im/hvac/community))! [GH-465](https://github.com/hvac/hvac/pull/465)

* Added Vault agent socket listener usage example under the “advanced usage” documentation section at: [hvac.readthedocs.io](https://hvac.readthedocs.io/en/stable/advanced_usage.html#vault-agent-unix-socket-listener) [GH-468](https://github.com/hvac/hvac/issues/468)

Thanks to @denisvll, @Dudesons, and @drewmullen for their lovely contributions.

### 0.9.1 (May 25th, 2019)[¶](#may-25th-2019 "Permalink to this headline")

BUG FIXES:

* Fix Azure list roles [GH-448](https://github.com/hvac/hvac/pull/448)

IMPROVEMENTS:

* Support for the PKI secrets engine. [GH-436](https://github.com/hvac/hvac/pull/436)

MISCELLANEOUS:

* `delete\_roleset()` method added to GCP secrets engine support. [GH-449](https://github.com/hvac/hvac/pull/449)

Thanks to @nledez and @drewmullen for their lovely contributions.

### 0.9.0 (May 23rd, 2019)[¶](#may-23rd-2019 "Permalink to this headline")

BUG FIXES:

* Update path to azure.login() [GH-429](https://github.com/hvac/hvac/pull/429)

* AWS secrets engine generate credentials updated to a post request. [GH-430](https://github.com/hvac/hvac/pull/430)

IMPROVEMENTS:

* Support for the Radius auth method. [GH-420](https://github.com/hvac/hvac/pull/420)

* Support for the Database secrets engine. [GH-431](https://github.com/hvac/hvac/pull/431)

* Add the consul secret engine support [GH-432](https://github.com/hvac/hvac/pull/432)

* Support for the GCP secrets engine. [GH-443](https://github.com/hvac/hvac/pull/443)

MISCELLANEOUS:

* Remove logger call within adapters module [GH-445](https://github.com/hvac/hvac/pull/445)

* Add docs for auth\_cubbyhole [GH-427](https://github.com/hvac/hvac/pull/427)

Thanks to @paulcaskey, @stevenmanton, @brad-alexander, @yoyomeng2, @JadeHayes, @Dudesons for their lovely contributions.

### 0.8.2 (April 4th, 2019)[¶](#april-4th-2019 "Permalink to this headline")

BUG FIXES:

* Fix priority of client url and VAULT\_ADDR environment variable. [GH-423](https://github.com/hvac/hvac/pull/423)

* Update setup.py to only compile hvac package. [GH-418](https://github.com/hvac/hvac/pull/418)

Thanks to @eltoder and @andytumelty for their lovely contributions.

### 0.8.1 (March 31st, 2019)[¶](#march-31st-2019 "Permalink to this headline")

BUG FIXES:

* Fix `initialize()` method `recovery\_shares` and `recovery\_threshold` parameter validation regression. [GH-416](https://github.com/hvac/hvac/pull/416)

### 0.8.0 (March 29th, 2019)[¶](#march-29th-2019 "Permalink to this headline")

BACKWARDS COMPATIBILITY NOTICE:

* The `Client()` class constructor now behaves similarly to Vault CLI in that it uses the `VAULT\_ADDR` environmental variable for the Client URL when that variable is set. Along the same lines, when no token is passed into the `Client()` constructor, it will attempt to load a token from the `VAULT\_TOKEN` environmental variable or the `~/.vault-token` file where available. [GH-411](https://github.com/hvac/hvac/pull/411)

IMPROVEMENTS:

* Support for the Kubernetes auth method. [GH-408](https://github.com/hvac/hvac/pull/408)

BUG FIXES:

* Fix for comparision `recovery\_threshold` and `recovery\_shares` during initialization. [GH-398](https://github.com/hvac/hvac/pull/398)

* Fix request method for AWS secrets engine `generate\_credentials()` method. [GH-403](https://github.com/hvac/hvac/pull/403)

* Fix request parameter (`n\_bytes` -> `bytes`) for Transit secrets engine `generate\_random\_bytes()` method. [GH-377](https://github.com/hvac/hvac/pull/377)

Thanks to @engstrom, @viralpoetry, @bootswithdefer, @steved, @kserrano, @spbsoluble, @uepoch, @singuliere, @frgaudet, @jsporna, & @mrsiesta for their lovely contributions.

### 0.7.2 (January 1st, 2019)[¶](#january-1st-2019 "Permalink to this headline")

IMPROVEMENTS:

* Support for the AWS secrets engine. [GH-370](https://github.com/hvac/hvac/pull/370)

BUG FIXES:

* Fixes for intermittent test case failures. [GH-361](https://github.com/hvac/hvac/pull/361) & [GH-364](https://github.com/hvac/hvac/pull/364)

MISCELLANEOUS:

* Travis CI builds now run against Python 3.7 (along side the previously tested 2.7 and 3.6 versions). [GH-360](https://github.com/hvac/hvac/pull/360)

* Documentation build test case added. [GH-366](https://github.com/hvac/hvac/pull/366)

* Module version now managed by the `bumpversion` utility exclusively. [GH-369](https://github.com/hvac/hvac/pull/369)

### 0.7.1 (December 19th, 2018)[¶](#december-19th-2018 "Permalink to this headline")

IMPROVEMENTS:

* Support for the Okta auth method. [GH-341](https://github.com/hvac/hvac/pull/341)

BUG FIXES:

* Simplify redirect handling in `Adapter` class to fix issues following location headers with fully qualified URLs. Note: hvac now converts `//` to `/` within any paths. [GH-348](https://github.com/hvac/hvac/pull/348)

* Fixed a bug where entity and group member IDs were not being passed in to Identity secrets engine group creation / updates. [GH-346](https://github.com/hvac/hvac/pull/346)

* Ensure all types of responses for the `read\_health\_status()` system backend method can be retrieved without exceptions being raised. [GH-347](https://github.com/hvac/hvac/pull/347)

* Fix `read\_seal\_status()` in `Client` class’s `seal\_status` property. [GH-354](https://github.com/hvac/hvac/pull/354)

DOCUMENTATION UPDATES:

* Example GCP auth method `login()` call with google-api-python-client usage added: [Example with google-api-python-client Usage](https://hvac.readthedocs.io/en/latest/usage/auth_methods/gcp.html#example-with-google-api-python-client-usage). [GH-350](https://github.com/hvac/hvac/pull/350)

MISCELLANEOUS:

* Note: Starting after release 0.7.0, `develop` is the main integration branch for the hvac project. The `main` branch is now intended to capture the state of the most recent release.

* Test cases for hvac are no longer included in the release artifacts published to PyPi. [GH-334](https://github.com/hvac/hvac/pull/334)

* The `create\_or\_update\_policy` system backend method now supports a “pretty\_print” argument for different JSON formatting. This allows create more viewable policy documents when retrieve existing policies (e.g., from within the Vault UI interface). [GH-342](https://github.com/hvac/hvac/pull/342)

* Explicit support for Vault v0.8.3 dropped. CI/CD tests updated to run against Vault v1.0.0. [GH-344](https://github.com/hvac/hvac/pull/344)

### 0.7.0 (November 1st, 2018)[¶](#november-1st-2018 "Permalink to this headline")

DEPRECATION NOTICES:

* All auth method classes are now accessible under the `auth` property on the `hvac.Client` class. [GH-310](https://github.com/hvac/hvac/pull/310). (E.g. the `github`, `ldap`, and `mfa` Client properties’ methods are now accessible under `Client.auth.github`, etc.)

* All secrets engines classes are now accessible under the `secrets` property on the `hvac.Client` class. [GH-311](https://github.com/hvac/hvac/pull/311) (E.g. the `kv`, Client property’s methods are now accessible under `Client.secrets.kv`)

* All system backend classes are now accessible under the `sys` property on the `hvac.Client` class. [GH-314](https://github.com/hvac/hvac/pull/314) ([GH-314] through [GH-325]) (E.g. methods such as `enable\_secret\_backend()` under the Client class are now accessible under `Client.sys.enable\_secrets\_engine()`, etc.)

IMPROVEMENTS:

* Support for Vault Namespaces. [GH-268](https://github.com/hvac/hvac/pull/268)

* Support for the Identity secrets engine. [GH-269](https://github.com/hvac/hvac/pull/269)

* Support for the GCP auth method. [GH-240](https://github.com/hvac/hvac/pull/240)

* Support for the Azure auth method. [GH-286](https://github.com/hvac/hvac/pull/286)

* Support for the Azure secrets engine. [GH-287](https://github.com/hvac/hvac/pull/287)

* Expanded Transit secrets engine support. [GH-303](https://github.com/hvac/hvac/pull/303)

Thanks to @tiny-dancer, @jacquat, @deejay1, @MJ111, @jasonarewhy, and @alexandernst for their lovely contributions.

### 0.6.4 (September 5th, 2018)[¶](#september-5th-2018 "Permalink to this headline")

IMPROVEMENTS:

* New KV secret engine-related classes added. See the [KV documentation under hvac’s readthedocs.io site for usage / examples](https://hvac.readthedocs.io/en/latest/usage/secrets_engines/kv.html). [GH-257](https://github.com/hvac/hvac/pull/257) / [GH-260](https://github.com/hvac/hvac/pull/260)

MISCELLANEOUS:

* Language classifiers are now being included with the distribution. [GH-247](https://github.com/hvac/hvac/pull/247)

* Token no longer being sent in URL path for the `Client.renew\_token` method. [GH-250](https://github.com/hvac/hvac/pull/250)

* Support for the response structure in newer versions of Vault within the `Client.get\_policy` method. [GH-254](https://github.com/hvac/hvac/pull/254)

* `config` and `plugin\_name` parameters added to the `Client.enable\_auth\_backend` method. [GH-253](https://github.com/hvac/hvac/pull/253)

Thanks to @ijl, @rastut, @seuf, @downeast for their lovely contributions.

### 0.6.3 (August 8th, 2018)[¶](#august-8th-2018 "Permalink to this headline")

DEPRECATION NOTICES:

* The `auth\_github()` method within the `hvac.Client` class has been marked as deprecated and will be removed in hvac v0.8.0 (or later). Please update any callers of this method to use the `hvac.Client.github.login()` instead.

* The `auth\_ldap()` method within the `hvac.Client` class has been marked as deprecated and will be removed in hvac v0.8.0 (or later). Please update any callers of this method to use the `hvac.Client.ldap.login()` instead.

IMPROVEMENTS:

* New Github auth method class added. See the [Github documentation for usage / examples](https://hvac.readthedocs.io/en/latest/usage/github.html). [GH-242](https://github.com/hvac/hvac/pull/242)

* New Ldap auth method class added. See the [Ldap documentation for usage / examples](https://hvac.readthedocs.io/en/latest/usage/ldap.html). [GH-244](https://github.com/hvac/hvac/pull/244)

* New Mfa auth method class added. See the [documentation for usage / examples](https://hvac.readthedocs.io/en/latest/usage/mfa.html). [GH-255](https://github.com/hvac/hvac/pull/255)

* `auth\_aws\_iam()` method updated to include “region” parameter for deployments in different AWS regions. [GH-243](https://github.com/hvac/hvac/pull/243)

DOCUMENTATION UPDATES:

* Additional guidance for how to configure hvac’s `Client` class to leverage self-signed certificates / private CA bundles has been added at: [Making Use of Private CA](https://hvac.readthedocs.io/en/latest/advanced_usage.html#making-use-of-private-ca). [GH-230](https://github.com/hvac/hvac/pull/230)

* Docstring for `verify` `Client` parameter corrected and expanded. [GH-238](https://github.com/hvac/hvac/pull/238)

MISCELLANEOUS:

* Automated PyPi deploys via travis-ci removed. [GH-226](https://github.com/hvac/hvac/pull/226)

* Repository transferred to the new [“hvac” GitHub organization](https://github.com/hvac); thanks @ianunruh! [GH-227](https://github.com/hvac/hvac/pull/227)

* Codecov (automatic code coverage reports) added. [GH-229](https://github.com/hvac/hvac/pull/229) / [GH-228](https://github.com/hvac/hvac/pull/229)

* Tests subdirectory reorganized; now broken up by integration versus unit tests with subdirectories matching the module path for the code under test. [GH-236](https://github.com/hvac/hvac/pull/236)

Thanks to @otakup0pe, @FabianFrank, @andrewheald for their lovely contributions.

### 0.6.2 (July 19th, 2018)[¶](#july-19th-2018 "Permalink to this headline")

BACKWARDS COMPATIBILITY NOTICE:

* With the newly added `hvac.adapters.Request` class, request kwargs can no longer be directly modified via the `\_kwargs` attribute on the `Client` class. If runtime modifications to this dictionary are required, callers either need to explicitly pass in a new `adapter` instance with the desired settings via the `adapter` propery on the `Client` class *or* access the `\_kwargs` property via the `adapter` property on the `Client` class.

See the [Advanced Usage](https://hvac.readthedocs.io/en/latest/advanced_usage.html#custom-requests-http-adapter) section of this module’s documentation for additional details.

IMPROVEMENTS:

* sphinx documentation and [readthedocs.io project](https://hvac.readthedocs.io/en/latest/) added. [GH-222](https://github.com/hvac/hvac/pull/222)

* README.md included in setuptools metadata. [GH-222](https://github.com/hvac/hvac/pull/222)

* All `tune\_secret\_backend()` parameters now accepted. [GH-215](https://github.com/hvac/hvac/pull/215)

* Add `read\_lease()` method [GH-218](https://github.com/hvac/hvac/pull/218)

* Added adapter module with `Request` class to abstract HTTP requests away from the `Client` class. [GH-223](https://github.com/hvac/hvac/pull/223)

Thanks to @bbayszczak, @jvanbrunschot-coolblue for their lovely contributions.

### 0.6.1 (July 5th, 2018)[¶](#july-5th-2018 "Permalink to this headline")

IMPROVEMENTS:

* Update `unwrap()` method to match current Vault versions [GH-149]

* Initial support for Kubernetes authentication backend [GH-210]

* Initial support for Google Cloud Platform (GCP) authentication backend [GH-206]

* Update enable\_secret\_backend function to support kv version 2 [GH-201]

BUG FIXES:

* Change URL parsing to allow for routes in the base Vault address (e.g., `https://example.com/vault`) [GH-212].

Thanks to @mracter, @cdsf, @SiN, @seanmalloy, for their lovely contributions.

### 0.6.0 (June 14, 2018)[¶](#june-14-2018 "Permalink to this headline")

BACKWARDS COMPATIBILITY NOTICE:

* Token revocation now sends the token in the request payload. Requires Vault >0.6.5

* Various methods have new and/or re-ordered keyword arguments. Code calling these methods with positional arguments

may need to be modified.

IMPROVEMENTS:

* Ensure mount\_point Parameter for All AWS EC2 Methods [GH-195]

* Add Methods for Auth Backend Tuning [GH-193]

* Customizable approle path / mount\_point [GH-190]

* Add more methods for the userpass backend [GH-175]

* Add transit signature\_algorithm parameter [GH-174]

* Add auth\_iam\_aws() method [GH-170]

* lookup\_token function POST token not GET [GH-164]

* Create\_role\_secret\_id with wrap\_ttl & fix get\_role\_secret\_id\_accessor [GH-159]

* Fixed json() from dict bug and added additional arguments on auth\_ec2() method [GH-157]

* Support specifying period when creating EC2 roles [GH-140]

* Added support for /sys/generate-root endpoint [GH-131] / [GH-199]

* Added “auth\_cubbyhole” method [GH-119]

* Send token/accessor as a payload to avoid being logged [GH-117]

* Add AppRole delete\_role method [GH-112]

BUG FIXES:

* Always Specify auth\_type In create\_ec2\_role [GH-197]

* Fix “double parasing” of JSON response in auth\_ec2 method [GH-181]

Thanks to @freimer, @ramiamar, @marcoslopes, @ianwestcott, @marc-sensenich, @sunghyun-lee, @jnaulty, @sijis,

@Myles-Steinhauser-Bose, @oxmane, @ltm, @bchannak, @tkinz27, @crmulliner, for their lovely contributions.

### 0.5.0 (February 20, 2018)[¶](#february-20-2018 "Permalink to this headline")

IMPROVEMENTS:

* Added `disallowed\_policies` parameter to `create\_token\_role` method [GH-169]

Thanks to @morganda for their lovely contribution.

### 0.4.0 (February 1, 2018)[¶](#february-1-2018 "Permalink to this headline")

IMPROVEMENTS:

* Add support for the `period` parameter on token creation [GH-167]

* Add support for the `cidr\_list` parameter for approle secrets [GH-114]

BUG FIXES:

* Documentation is now more accurate [GH-165] / [GH-154]

Thanks to @ti-mo, @dhoeric, @RAbraham, @lhdumittan, @ahsanali for

their lovely contributions.

### 0.3.0 (November 9, 2017)[¶](#november-9-2017 "Permalink to this headline")

This is just the highlights, there have been a bunch of changes!

IMPROVEVEMENTS:

* Some AppRole support [GH-77]

* Response Wrapping [GH-85]

* AWS EC2 stuff [GH-107], [GH-109]

BUG FIXES

* Better handling of various error states [GH-79], [GH-125]

Thanks to @ianwestcott, @s3u, @mracter, @intgr, @jkdihenkar, @gaelL,

@henriquegemignani, @bfeeser, @nicr9, @mwielgoszewski, @mtougeron

for their contributions!

### 0.2.17 (December 15, 2016)[¶](#december-15-2016 "Permalink to this headline")

IMPROVEMENTS:

* Add token role support [GH-94]

* Add support for Python 2.6 [GH-92]

* Allow setting the explicit\_max\_ttl when creating a token [GH-81]

* Add support for write response wrapping [GH-85]

BUG FIXES:

* Fix app role endpoints for newer versions of Vault [GH-93]

### 0.2.16 (September 12, 2016)[¶](#september-12-2016 "Permalink to this headline")

Thanks to @otakup0pe, @nicr9, @marcoslopes, @caiotomazelli,

and @blarghmatey for their contributions!

IMPROVEMENTS:

* Add EC2 auth support [GH-61]

* Add support for token accessors [GH-69]

* Add support for response wrapping [GH-70]

* Add AppRole auth support [GH-77]

BUG FIXES:

* Fix `no\_default\_policy` parameter in `create\_token` [GH-65]

* Fix EC2 auth double JSON parsing [GH-76]

### 0.2.15 (June 22nd, 2016)[¶](#june-22nd-2016 "Permalink to this headline")

Thanks to @blarghmatey, @stevenmanton, and @ahlinc for their contributions!

IMPROVEMENTS:

* Add methods for manipulating app/user IDs [GH-62]

* Add ability to automatically parse policies with pyhcl [GH-58]

* Add TTL option to `create\_userpass` [GH-60]

* Add support for backing up keys on rekey [GH-57]

* Handle non-JSON error responses correctly [GH-46]

BUG FIXES:

* `is\_authenticated` now handles new error type for Vault 0.6.0

### 0.2.14 (June 2nd, 2016)[¶](#june-2nd-2016 "Permalink to this headline")

BUG FIXES:

* Fix improper URL being used when leader redirection occurs [GH-56]

### 0.2.13 (May 31st, 2016)[¶](#may-31st-2016 "Permalink to this headline")

IMPROVEMENTS:

* Add support for Requests sessions [GH-53]

BUG FIXES:

* Properly handle redirects from Vault server [GH-51]

### 0.2.12 (May 12th, 2016)[¶](#may-12th-2016 "Permalink to this headline")

IMPROVEMENTS:

* Add support for `increment` in renewel of secret [GH-48]

BUG FIXES:

* Use unicode literals when constructing URLs [GH-50]

### 0.2.10 (April 8th, 2016)[¶](#april-8th-2016 "Permalink to this headline")

IMPROVEMENTS:

* Add support for list operation [GH-47]

### 0.2.9 (March 18th, 2016)[¶](#march-18th-2016 "Permalink to this headline")

IMPROVEMENTS:

* Add support for nonce during rekey operation [GH-42]

* Add get method for policies [GH-43]

* Add delete method for userpass auth backend [GH-45]

* Add support for response to rekey init

### 0.2.8 (February 2nd, 2016)[¶](#february-2nd-2016 "Permalink to this headline")

IMPROVEMENTS:

* Convenience methods for managing userpass and app-id entries

* Support for new API changes in Vault v0.4.0

### 0.2.7 (December 16th, 2015)[¶](#december-16th-2015 "Permalink to this headline")

IMPROVEMENTS:

* Add support for PGP keys when rekeying [GH-28]

BUG FIXES:

* Fixed token metadata parameter [GH-27]

### 0.2.6 (October 30th, 2015)[¶](#october-30th-2015 "Permalink to this headline")

IMPROVEMENTS:

* Add support for `revoke-self`

* Restrict `requests` dependency to modern version

### 0.2.5 (September 29th, 2015)[¶](#september-29th-2015 "Permalink to this headline")

IMPROVEMENTS:

* Add support for API changes/additions in Vault v0.3.0

	+ Tunable config on secret backends

	+ MFA on username/password and LDAP auth backends

	+ PGP encryption for unseal keys

### 0.2.4 (July 23rd, 2015)[¶](#july-23rd-2015 "Permalink to this headline")

BUG FIXES:

* Fix write response handling [GH-19]

### 0.2.3 (July 18th, 2015)[¶](#july-18th-2015 "Permalink to this headline")

BUG FIXES

* Fix error handling for next Vault release

IMPROVEMENTS:

* Add support for rekey/rotate APIs

### 0.2.2 (June 12th, 2015)[¶](#june-12th-2015 "Permalink to this headline")

BUG FIXES:

* Restrict `requests` dependency to 2.5.0 or later

IMPROVEMENTS:

* Return latest seal status from `unseal\_multi`

### 0.2.1 (June 3rd, 2015)[¶](#june-3rd-2015 "Permalink to this headline")

BUG FIXES:

* Use arguments passed to `initialize` method

### 0.2.0 (May 25th, 2015)[¶](#may-25th-2015 "Permalink to this headline")

BACKWARDS COMPATIBILITY NOTICE:

* Requires Vault 0.1.2 or later for `X-Vault-Token` header

* `auth\_token` method removed in favor of `token` property

* `read` method no longer raises `hvac.exceptions.InvalidPath` on nonexistent paths

IMPROVEMENTS:

* Tolerate falsey URL in client constructor

* Add ability to auth without changing to new token

* Add `is\_authenticated` convenience method

* Return `None` when reading nonexistent path

### 0.1.1 (May 20th, 2015)[¶](#may-20th-2015 "Permalink to this headline")

IMPROVEMENTS:

* Add `is\_sealed` convenience method

* Add `unseal\_multi` convenience method

BUG FIXES:

* Remove secret\_shares argument from `unseal` method

### 0.1.0 (May 17th, 2015)[¶](#may-17th-2015 "Permalink to this headline")

* Initial release

Indices and tables[¶](#indices-and-tables "Permalink to this headline")

=======================================================================

* [Index](genindex.html)

* [Module Index](py-modindex.html)

* [Search Page](search.html)

Source code repository hosted at [github.com/hvac/hvac](https://github.com/hvac/hvac/).

