/v1/api/secrets (POST) - User Guide

Creates a new secret.

Example text secret

POST https://api-<BlueCat.edge.url>/v1/api/secrets
Authorization: Bearer authorization token
{
  "name": "string",
  "type": "TEXT",
  "data": "string",
  "secretsProfileId": "3fa85f64-5717-4562-b3fc-2c963f66afa6"
}

Body parameters

name—the name of the secret
type—the type of secret. For text-based secrets, set the value to TEXT.
data—the sensitive data to associate to the secret name.
secretsProfileId—the ID of the secrets profile under which the secret will reside.

Example certificate secret

POST https://api-<BlueCat.edge.url>/v1/api/secrets
Authorization: Bearer authorization token
{
  "name": "string",
  "type": "CERTIFICATE",
  "data": {
      "certificate": "<JSON-escapted-pem-string>",
      "password": "<password-string>"
  },
  "secretsProfileId": "3fa85f64-5717-4562-b3fc-2c963f66afa6"
}

Body parameters

name—the name of the secret
type—the type of secret. For certificate-based secrets, set the value to CERTIFICATE.
data—the sensitive data to associate to the secret name. For certificates, enter the following additional fields:
- certificate—the JSON-escaped PEM certificate contents
  Note: If you are uploading a certificate to use with DNS over HTTPS (DoH) or DNS over TLS (DoT) configurations, the following formats are supported for the certificate input data:
  - The certificate must be PEM-encoded DER format and contain a server certificate, optional intermediates, and private key
  - The PEM data of the certificate must not contain more than 10 intermediate certificates
  - The server and intermediate certificates must be X.509 format
  - The private key must be PKCS#8 encoded, and may be unencrypted or password encrypted
  - The following private key encryption algorithms are supported: AES128CBC, AES128GCM, AES192CBC, AES192GCM, AES256CBC, AES256GCM, and TripleDESCBC
  - The following private key signature algorithms are supported: RSA, ECDSA, and ED25519
- password—(Optional) the password that was used to encrypt the private key.
secretsProfileId—the ID of the secrets profile under which the secret will reside.

Successful response

201 CREATED
Location: <the location and UUID of the secret>
Content-Type: Application/JSON
{
    "id": "<UUID of the secret>",
    "name": "<name of secret>",
    "type": "<TEXT | CERTIFICATE>",
    "secretsProfileId": <secrets profile ID>",
    "dateCreated": <epoch timestamp>,
    "dateNameLastModified": <epoch timestamp>,
    "dateDataLastModified": <epoch timestamp>,
    "dateLastDecrypted": <epoch timestamp>,
    "certificateMetadata": {
      "commonName": "<common name of certificate>",
      "issuer": "<name of certificate issuer>",
      "expiresAt": <epoch timestamp>
    }
}

Possible error codes:

BAD REQUEST - Invalid request or certificate and password failed validation
NOT FOUND - The secrets profile cannot be found
CONFLICT - A secret with the specified name already exists
INTERNAL SERVER ERROR - Unexpected error

/v1/api/secrets (POST) - User Guide - BlueCat Edge

BlueCat Edge User Guide