VaultsClient

class oci.vault.VaultsClient(config, **kwargs)

Use the Secret Management API to manage secrets and secret versions. For more information, see [Managing Secrets](/Content/KeyManagement/Tasks/managingsecrets.htm).

Methods

__init__(config, **kwargs) Creates a new service client
cancel_secret_deletion(secret_id, **kwargs) Cancels the pending deletion of the specified secret.
cancel_secret_rotation(secret_id, **kwargs) Cancels the ongoing secret rotation.
cancel_secret_version_deletion(secret_id, …) Cancels the scheduled deletion of a secret version.
change_secret_compartment(secret_id, …) Moves a secret into a different compartment within the same tenancy.
create_secret(create_secret_details, **kwargs) Creates a new secret according to the details of the request.
get_secret(secret_id, **kwargs) Gets information about the specified secret.
get_secret_version(secret_id, …) Gets information about the specified version of a secret.
list_secret_versions(secret_id, **kwargs) Lists all secret versions for the specified secret.
list_secrets(compartment_id, **kwargs) Lists all secrets in the specified vault and compartment.
rotate_secret(secret_id, **kwargs) API to force rotation of an existing secret in Vault and the specified target system; expects secret to have a valid Target System Details object
schedule_secret_deletion(secret_id, …) Schedules the deletion of the specified secret.
schedule_secret_version_deletion(secret_id, …) Schedules the deletion of the specified secret version.
update_secret(secret_id, …) Updates the properties of a secret.
__init__(config, **kwargs)

Creates a new service client

Parameters:
  • config (dict) – Configuration keys and values as per SDK and Tool Configuration. The from_file() method can be used to load configuration from a file. Alternatively, a dict can be passed. You can validate_config the dict using validate_config()
  • service_endpoint (str) – (optional) The endpoint of the service to call using this client. For example https://iaas.us-ashburn-1.oraclecloud.com. If this keyword argument is not provided then it will be derived using the region in the config parameter. You should only provide this keyword argument if you have an explicit need to specify a service endpoint.
  • timeout (float or tuple(float, float)) – (optional) The connection and read timeouts for the client. The default values are connection timeout 10 seconds and read timeout 60 seconds. This keyword argument can be provided as a single float, in which case the value provided is used for both the read and connection timeouts, or as a tuple of two floats. If a tuple is provided then the first value is used as the connection timeout and the second value as the read timeout.
  • signer (AbstractBaseSigner) –

    (optional) The signer to use when signing requests made by the service client. The default is to use a Signer based on the values provided in the config parameter.

    One use case for this parameter is for Instance Principals authentication by passing an instance of InstancePrincipalsSecurityTokenSigner as the value for this keyword argument

  • retry_strategy (obj) –

    (optional) A retry strategy to apply to all calls made by this service client (i.e. at the client level). There is no retry strategy applied by default. Retry strategies can also be applied at the operation level by passing a retry_strategy keyword argument as part of calling the operation. Any value provided at the operation level will override whatever is specified at the client level.

    This should be one of the strategies available in the retry module. A convenience DEFAULT_RETRY_STRATEGY is also available. The specifics of the default retry strategy are described here.

  • circuit_breaker_strategy (obj) – (optional) A circuit breaker strategy to apply to all calls made by this service client (i.e. at the client level). This client uses DEFAULT_CIRCUIT_BREAKER_STRATEGY as default if no circuit breaker strategy is provided. The specifics of circuit breaker strategy are described here.
  • circuit_breaker_callback (function) – (optional) Callback function to receive any exceptions triggerred by the circuit breaker.
  • client_level_realm_specific_endpoint_template_enabled (bool) – (optional) A boolean flag to indicate whether or not this client should be created with realm specific endpoint template enabled or disable. By default, this will be set as None.
  • allow_control_chars – (optional) allow_control_chars is a boolean to indicate whether or not this client should allow control characters in the response object. By default, the client will not allow control characters to be in the response object.
cancel_secret_deletion(secret_id, **kwargs)

Cancels the pending deletion of the specified secret. Canceling a scheduled deletion restores the secret’s lifecycle state to what it was before you scheduled the secret for deletion.

Parameters:
  • secret_id (str) – (required) The OCID of the secret.
  • if_match (str) – (optional) For optimistic concurrency control. In the PUT or DELETE call for a resource, set the if-match parameter to the value of the etag from a previous GET or POST response for that resource. The resource will be updated or deleted only if the etag you provide matches the resource’s current etag value.
  • opc_request_id (str) – (optional) Unique identifier for the request. If provided, the returned request ID will include this value. Otherwise, a random request ID will be generated by the service.
  • retry_strategy (obj) –

    (optional) A retry strategy to apply to this specific operation/call. This will override any retry strategy set at the client-level.

    This should be one of the strategies available in the retry module. This operation will not retry by default, users can also use the convenient DEFAULT_RETRY_STRATEGY provided by the SDK to enable retries for it. The specifics of the default retry strategy are described here.

    To have this operation explicitly not perform any retries, pass an instance of NoneRetryStrategy.

  • allow_control_chars (bool) – (optional) allow_control_chars is a boolean to indicate whether or not this request should allow control characters in the response object. By default, the response will not allow control characters in strings
Returns:

A Response object with data of type None
Return type:

Response
Example:

Click here to see an example of how to use cancel_secret_deletion API.

cancel_secret_rotation(secret_id, **kwargs)

Cancels the ongoing secret rotation. The cancellation is contingent on how far the rotation process has progressed. Upon cancelling a rotation, all future rotations are also disabled.

Parameters:
  • secret_id (str) – (required) The OCID of the secret.
  • if_match (str) – (optional) For optimistic concurrency control. In the PUT or DELETE call for a resource, set the if-match parameter to the value of the etag from a previous GET or POST response for that resource. The resource will be updated or deleted only if the etag you provide matches the resource’s current etag value.
  • opc_request_id (str) – (optional) Unique identifier for the request. If provided, the returned request ID will include this value. Otherwise, a random request ID will be generated by the service.
  • retry_strategy (obj) –

    (optional) A retry strategy to apply to this specific operation/call. This will override any retry strategy set at the client-level.

    This should be one of the strategies available in the retry module. This operation uses DEFAULT_RETRY_STRATEGY as default if no retry strategy is provided. The specifics of the default retry strategy are described here.

    To have this operation explicitly not perform any retries, pass an instance of NoneRetryStrategy.

  • allow_control_chars (bool) – (optional) allow_control_chars is a boolean to indicate whether or not this request should allow control characters in the response object. By default, the response will not allow control characters in strings
Returns:

A Response object with data of type None
Return type:

Response
Example:

Click here to see an example of how to use cancel_secret_rotation API.

cancel_secret_version_deletion(secret_id, secret_version_number, **kwargs)

Cancels the scheduled deletion of a secret version.

Parameters:
  • secret_id (str) – (required) The OCID of the secret.
  • secret_version_number (int) – (required) The version number of the secret.
  • if_match (str) – (optional) For optimistic concurrency control. In the PUT or DELETE call for a resource, set the if-match parameter to the value of the etag from a previous GET or POST response for that resource. The resource will be updated or deleted only if the etag you provide matches the resource’s current etag value.
  • opc_request_id (str) – (optional) Unique identifier for the request. If provided, the returned request ID will include this value. Otherwise, a random request ID will be generated by the service.
  • retry_strategy (obj) –

    (optional) A retry strategy to apply to this specific operation/call. This will override any retry strategy set at the client-level.

    This should be one of the strategies available in the retry module. This operation will not retry by default, users can also use the convenient DEFAULT_RETRY_STRATEGY provided by the SDK to enable retries for it. The specifics of the default retry strategy are described here.

    To have this operation explicitly not perform any retries, pass an instance of NoneRetryStrategy.

  • allow_control_chars (bool) – (optional) allow_control_chars is a boolean to indicate whether or not this request should allow control characters in the response object. By default, the response will not allow control characters in strings
Returns:

A Response object with data of type None
Return type:

Response
Example:

Click here to see an example of how to use cancel_secret_version_deletion API.

change_secret_compartment(secret_id, change_secret_compartment_details, **kwargs)

Moves a secret into a different compartment within the same tenancy. For information about moving resources between compartments, see Moving Resources to a Different Compartment.

When provided, if-match is checked against the ETag values of the secret.

Parameters:
  • secret_id (str) – (required) The OCID of the secret.
  • change_secret_compartment_details (oci.vault.models.ChangeSecretCompartmentDetails) – (required) The updated compartment details.
  • if_match (str) – (optional) For optimistic concurrency control. In the PUT or DELETE call for a resource, set the if-match parameter to the value of the etag from a previous GET or POST response for that resource. The resource will be updated or deleted only if the etag you provide matches the resource’s current etag value.
  • opc_request_id (str) – (optional) Unique identifier for the request. If provided, the returned request ID will include this value. Otherwise, a random request ID will be generated by the service.
  • opc_retry_token (str) – (optional) A token that uniquely identifies a request so it can be retried in case of a timeout or server error without risk of executing that same action again. Retry tokens expire after 24 hours, but can be invalidated before then due to conflicting operations (e.g., if a resource has been deleted and purged from the system, then a retry of the original creation request may be rejected).
  • retry_strategy (obj) –

    (optional) A retry strategy to apply to this specific operation/call. This will override any retry strategy set at the client-level.

    This should be one of the strategies available in the retry module. This operation will not retry by default, users can also use the convenient DEFAULT_RETRY_STRATEGY provided by the SDK to enable retries for it. The specifics of the default retry strategy are described here.

    To have this operation explicitly not perform any retries, pass an instance of NoneRetryStrategy.

  • allow_control_chars (bool) – (optional) allow_control_chars is a boolean to indicate whether or not this request should allow control characters in the response object. By default, the response will not allow control characters in strings
Returns:

A Response object with data of type None
Return type:

Response
Example:

Click here to see an example of how to use change_secret_compartment API.

create_secret(create_secret_details, **kwargs)

Creates a new secret according to the details of the request.

This operation is not supported by the Oracle Cloud Infrastructure Terraform Provider.

Parameters:
  • create_secret_details (oci.vault.models.CreateSecretDetails) – (required) Request to create a new secret.
  • opc_request_id (str) – (optional) Unique identifier for the request. If provided, the returned request ID will include this value. Otherwise, a random request ID will be generated by the service.
  • opc_retry_token (str) – (optional) A token that uniquely identifies a request so it can be retried in case of a timeout or server error without risk of executing that same action again. Retry tokens expire after 24 hours, but can be invalidated before then due to conflicting operations (e.g., if a resource has been deleted and purged from the system, then a retry of the original creation request may be rejected).
  • retry_strategy (obj) –

    (optional) A retry strategy to apply to this specific operation/call. This will override any retry strategy set at the client-level.

    This should be one of the strategies available in the retry module. This operation uses DEFAULT_RETRY_STRATEGY as default if no retry strategy is provided. The specifics of the default retry strategy are described here.

    To have this operation explicitly not perform any retries, pass an instance of NoneRetryStrategy.

  • allow_control_chars (bool) – (optional) allow_control_chars is a boolean to indicate whether or not this request should allow control characters in the response object. By default, the response will not allow control characters in strings
Returns:

A Response object with data of type Secret
Return type:

Response
Example:

Click here to see an example of how to use create_secret API.

get_secret(secret_id, **kwargs)

Gets information about the specified secret.

Parameters:
  • secret_id (str) – (required) The OCID of the secret.
  • opc_request_id (str) – (optional) Unique identifier for the request. If provided, the returned request ID will include this value. Otherwise, a random request ID will be generated by the service.
  • retry_strategy (obj) –

    (optional) A retry strategy to apply to this specific operation/call. This will override any retry strategy set at the client-level.

    This should be one of the strategies available in the retry module. This operation uses DEFAULT_RETRY_STRATEGY as default if no retry strategy is provided. The specifics of the default retry strategy are described here.

    To have this operation explicitly not perform any retries, pass an instance of NoneRetryStrategy.

  • allow_control_chars (bool) – (optional) allow_control_chars is a boolean to indicate whether or not this request should allow control characters in the response object. By default, the response will not allow control characters in strings
Returns:

A Response object with data of type Secret
Return type:

Response
Example:

Click here to see an example of how to use get_secret API.

get_secret_version(secret_id, secret_version_number, **kwargs)

Gets information about the specified version of a secret.

Parameters:
  • secret_id (str) – (required) The OCID of the secret.
  • secret_version_number (int) – (required) The version number of the secret.
  • opc_request_id (str) – (optional) Unique identifier for the request. If provided, the returned request ID will include this value. Otherwise, a random request ID will be generated by the service.
  • retry_strategy (obj) –

    (optional) A retry strategy to apply to this specific operation/call. This will override any retry strategy set at the client-level.

    This should be one of the strategies available in the retry module. This operation uses DEFAULT_RETRY_STRATEGY as default if no retry strategy is provided. The specifics of the default retry strategy are described here.

    To have this operation explicitly not perform any retries, pass an instance of NoneRetryStrategy.

  • allow_control_chars (bool) – (optional) allow_control_chars is a boolean to indicate whether or not this request should allow control characters in the response object. By default, the response will not allow control characters in strings
Returns:

A Response object with data of type SecretVersion
Return type:

Response
Example:

Click here to see an example of how to use get_secret_version API.

list_secret_versions(secret_id, **kwargs)

Lists all secret versions for the specified secret.

Parameters:
  • secret_id (str) – (required) The OCID of the secret.
  • limit (int) – (optional) The maximum number of items to return in a paginated “List” call.
  • page (str) – (optional) The value of the opc-next-page response header from the previous “List” call.
  • opc_request_id (str) – (optional) Unique identifier for the request. If provided, the returned request ID will include this value. Otherwise, a random request ID will be generated by the service.
  • sort_by (str) –

    (optional) The field to sort by. Only one sort order may be provided. Time created is default ordered as descending. Display name is default ordered as ascending.

    Allowed values are: “VERSION_NUMBER”

  • sort_order (str) –

    (optional) The sort order to use, either ascending (ASC) or descending (DESC).

    Allowed values are: “ASC”, “DESC”

  • retry_strategy (obj) –

    (optional) A retry strategy to apply to this specific operation/call. This will override any retry strategy set at the client-level.

    This should be one of the strategies available in the retry module. This operation uses DEFAULT_RETRY_STRATEGY as default if no retry strategy is provided. The specifics of the default retry strategy are described here.

    To have this operation explicitly not perform any retries, pass an instance of NoneRetryStrategy.

  • allow_control_chars (bool) – (optional) allow_control_chars is a boolean to indicate whether or not this request should allow control characters in the response object. By default, the response will not allow control characters in strings
Returns:

A Response object with data of type list of SecretVersionSummary
Return type:

Response
Example:

Click here to see an example of how to use list_secret_versions API.

list_secrets(compartment_id, **kwargs)

Lists all secrets in the specified vault and compartment.

Parameters:
  • compartment_id (str) – (required) The OCID of the compartment.
  • name (str) – (optional) The secret name.
  • limit (int) – (optional) The maximum number of items to return in a paginated “List” call.
  • page (str) – (optional) The value of the opc-next-page response header from the previous “List” call.
  • opc_request_id (str) – (optional) Unique identifier for the request. If provided, the returned request ID will include this value. Otherwise, a random request ID will be generated by the service.
  • sort_by (str) –

    (optional) The field to sort by. You can specify only one sort order. The default order for TIMECREATED is descending. The default order for NAME is ascending.

    Allowed values are: “TIMECREATED”, “NAME”

  • sort_order (str) –

    (optional) The sort order to use, either ascending (ASC) or descending (DESC).

    Allowed values are: “ASC”, “DESC”

  • vault_id (str) – (optional) The OCID of the vault.
  • lifecycle_state (str) –

    (optional) A filter that returns only resources that match the specified lifecycle state. The state value is case-insensitive.

    Allowed values are: “CREATING”, “ACTIVE”, “UPDATING”, “DELETING”, “DELETED”, “SCHEDULING_DELETION”, “PENDING_DELETION”, “CANCELLING_DELETION”, “FAILED”

  • retry_strategy (obj) –

    (optional) A retry strategy to apply to this specific operation/call. This will override any retry strategy set at the client-level.

    This should be one of the strategies available in the retry module. This operation uses DEFAULT_RETRY_STRATEGY as default if no retry strategy is provided. The specifics of the default retry strategy are described here.

    To have this operation explicitly not perform any retries, pass an instance of NoneRetryStrategy.

  • allow_control_chars (bool) – (optional) allow_control_chars is a boolean to indicate whether or not this request should allow control characters in the response object. By default, the response will not allow control characters in strings
Returns:

A Response object with data of type list of SecretSummary
Return type:

Response
Example:

Click here to see an example of how to use list_secrets API.

rotate_secret(secret_id, **kwargs)

API to force rotation of an existing secret in Vault and the specified target system; expects secret to have a valid Target System Details object

Parameters:
  • secret_id (str) – (required) The OCID of the secret.
  • if_match (str) – (optional) For optimistic concurrency control. In the PUT or DELETE call for a resource, set the if-match parameter to the value of the etag from a previous GET or POST response for that resource. The resource will be updated or deleted only if the etag you provide matches the resource’s current etag value.
  • opc_request_id (str) – (optional) Unique identifier for the request. If provided, the returned request ID will include this value. Otherwise, a random request ID will be generated by the service.
  • opc_retry_token (str) – (optional) A token that uniquely identifies a request so it can be retried in case of a timeout or server error without risk of executing that same action again. Retry tokens expire after 24 hours, but can be invalidated before then due to conflicting operations (e.g., if a resource has been deleted and purged from the system, then a retry of the original creation request may be rejected).
  • retry_strategy (obj) –

    (optional) A retry strategy to apply to this specific operation/call. This will override any retry strategy set at the client-level.

    This should be one of the strategies available in the retry module. This operation uses DEFAULT_RETRY_STRATEGY as default if no retry strategy is provided. The specifics of the default retry strategy are described here.

    To have this operation explicitly not perform any retries, pass an instance of NoneRetryStrategy.

  • allow_control_chars (bool) – (optional) allow_control_chars is a boolean to indicate whether or not this request should allow control characters in the response object. By default, the response will not allow control characters in strings
Returns:

A Response object with data of type None
Return type:

Response
Example:

Click here to see an example of how to use rotate_secret API.

schedule_secret_deletion(secret_id, schedule_secret_deletion_details, **kwargs)

Schedules the deletion of the specified secret. This sets the lifecycle state of the secret to PENDING_DELETION and then deletes it after the specified retention period ends.

Parameters:
  • secret_id (str) – (required) The OCID of the secret.
  • schedule_secret_deletion_details (oci.vault.models.ScheduleSecretDeletionDetails) – (required) Request to schedule the deletion of a secret.
  • if_match (str) – (optional) For optimistic concurrency control. In the PUT or DELETE call for a resource, set the if-match parameter to the value of the etag from a previous GET or POST response for that resource. The resource will be updated or deleted only if the etag you provide matches the resource’s current etag value.
  • opc_request_id (str) – (optional) Unique identifier for the request. If provided, the returned request ID will include this value. Otherwise, a random request ID will be generated by the service.
  • retry_strategy (obj) –

    (optional) A retry strategy to apply to this specific operation/call. This will override any retry strategy set at the client-level.

    This should be one of the strategies available in the retry module. This operation will not retry by default, users can also use the convenient DEFAULT_RETRY_STRATEGY provided by the SDK to enable retries for it. The specifics of the default retry strategy are described here.

    To have this operation explicitly not perform any retries, pass an instance of NoneRetryStrategy.

  • allow_control_chars (bool) – (optional) allow_control_chars is a boolean to indicate whether or not this request should allow control characters in the response object. By default, the response will not allow control characters in strings
Returns:

A Response object with data of type None
Return type:

Response
Example:

Click here to see an example of how to use schedule_secret_deletion API.

schedule_secret_version_deletion(secret_id, secret_version_number, schedule_secret_version_deletion_details, **kwargs)

Schedules the deletion of the specified secret version. This deletes it after the specified retention period ends. You can only delete a secret version if the secret version rotation state is marked as DEPRECATED.

Parameters:
  • secret_id (str) – (required) The OCID of the secret.
  • secret_version_number (int) – (required) The version number of the secret.
  • schedule_secret_version_deletion_details (oci.vault.models.ScheduleSecretVersionDeletionDetails) – (required) Request to delete a secret version.
  • if_match (str) – (optional) For optimistic concurrency control. In the PUT or DELETE call for a resource, set the if-match parameter to the value of the etag from a previous GET or POST response for that resource. The resource will be updated or deleted only if the etag you provide matches the resource’s current etag value.
  • opc_request_id (str) – (optional) Unique identifier for the request. If provided, the returned request ID will include this value. Otherwise, a random request ID will be generated by the service.
  • retry_strategy (obj) –

    (optional) A retry strategy to apply to this specific operation/call. This will override any retry strategy set at the client-level.

    This should be one of the strategies available in the retry module. This operation will not retry by default, users can also use the convenient DEFAULT_RETRY_STRATEGY provided by the SDK to enable retries for it. The specifics of the default retry strategy are described here.

    To have this operation explicitly not perform any retries, pass an instance of NoneRetryStrategy.

  • allow_control_chars (bool) – (optional) allow_control_chars is a boolean to indicate whether or not this request should allow control characters in the response object. By default, the response will not allow control characters in strings
Returns:

A Response object with data of type None
Return type:

Response
Example:

Click here to see an example of how to use schedule_secret_version_deletion API.

update_secret(secret_id, update_secret_details, **kwargs)

Updates the properties of a secret. Specifically, you can update the version number of the secret to make that version number the current version. You can also update a secret’s description, its free-form or defined tags, rules and the secret contents. Updating the secret content automatically creates a new secret version. You cannot, however, update the current secret version number, secret contents, and secret rules at the same time. Furthermore, the secret must in an ACTIVE lifecycle state to be updated.

This operation is not supported by the Oracle Cloud Infrastructure Terraform Provider.

Parameters:
  • secret_id (str) – (required) The OCID of the secret.
  • update_secret_details (oci.vault.models.UpdateSecretDetails) – (required) Request to update a secret.
  • if_match (str) – (optional) For optimistic concurrency control. In the PUT or DELETE call for a resource, set the if-match parameter to the value of the etag from a previous GET or POST response for that resource. The resource will be updated or deleted only if the etag you provide matches the resource’s current etag value.
  • opc_request_id (str) – (optional) Unique identifier for the request. If provided, the returned request ID will include this value. Otherwise, a random request ID will be generated by the service.
  • retry_strategy (obj) –

    (optional) A retry strategy to apply to this specific operation/call. This will override any retry strategy set at the client-level.

    This should be one of the strategies available in the retry module. This operation will not retry by default, users can also use the convenient DEFAULT_RETRY_STRATEGY provided by the SDK to enable retries for it. The specifics of the default retry strategy are described here.

    To have this operation explicitly not perform any retries, pass an instance of NoneRetryStrategy.

  • allow_control_chars (bool) – (optional) allow_control_chars is a boolean to indicate whether or not this request should allow control characters in the response object. By default, the response will not allow control characters in strings
Returns:

A Response object with data of type Secret
Return type:

Response
Example:

Click here to see an example of how to use update_secret API.