vault Id
Secret/Node parent path
Read-only map of metadata field names to their plain-text values. Populated automatically from fields whose metadata flag is true in the static secret template. Changes to metadata fields do not trigger a new secret version.
Timestamp of the most recent verification attempt (scheduled or manual), read-only.
Outcome of the most recent verification attempt, read-only. Never In Progress — only stamped once a verification reaches a terminal state.
Vault-relative path of the secret. When included in a PATCH request body with a value that differs from the current path, triggers a move operation. Only secrets (entityType=secret) can be moved; folder nodes cannot. Must start with '/', must not contain '//', must not end with '/', and the basename must match the existing secret name (rename and move are mutually exclusive). The destination folder must exist and the caller must have sm.node.create and sm.node.delete permissions on it.
Secondary credential key-value map. Required only when dualAccount is true (Dual Account secrets).
When true the secret holds two sets of credentials (Primary in value and Secondary in secondaryValue) that alternate on each rotation cycle to ensure zero downtime.
Rotation target, notification, and secret verification settings embedded in a secret. Secret verification is decoupled from rotation but reuses targetData to identify the resource to check.
Notification medium IDs
The target resource and account a secret checks/rotates against, along with the optional rotation template the Broker executes. resource/accountDetails are required whenever targetData is supplied at all -- both rotation and secret verification (see verificationEnabled/verificationTemplate below) rely on them. rotationTemplate is required only to opt into rotation itself; a secret may supply targetData with verificationEnabled/verificationTemplate set and no rotationTemplate, in which case rotation simply stays unconfigured for that secret.
Identifier of the target resource. Must have rotation enabled in Resource Manager.
Account on the target resource that receives the updated credential
Account name on the target resource
Account identifier value
Defines the script/logic the Broker executes to update the credential on the target resource
Unique identifier of the rotation template
Human-readable name of the rotation template
Variables required by the rotation template. System-defined variables are populated automatically; user-defined variables must be supplied.
A single variable used by the rotation template
Variable name as referenced in the rotation script
True if populated automatically by the system; false if user-supplied
One or more values for this variable
Per-secret opt-in for secret verification ("Allow Verifications"). Requires targetData to be configured — cannot be true unless targetData is set.
The resource type's verification template (and per-secret variable values) this secret should be checked against. A resource type may have multiple verification templates, so templateId selects which one applies to this secret. Required — and validated for completeness (templateId, and at least one fully-populated templateVariable) — only when verificationEnabled is true; otherwise optional, and accepted as-is with no completeness checks (e.g. a caller may leave a previously-selected template in place while toggling verification off).
Unique identifier of the verification template
Human-readable name of the verification template
Variables required by the verification template. System-defined variables are populated automatically; user-defined variables must be supplied.
A single variable used by the verification template
Variable name as referenced in the verification script
True if populated automatically by the system; false if user-supplied
One or more values for this variable
Unit for the secret rotation interval. DAYS for static secrets, HOURS for dynamic secrets. Defaults to DAYS if not provided.
successful operation
Bad request. Returned for the following rotation interval violations when rotationIntervalUnit is HOURS:
SM-0178—rotationIntervalin hours is not a valid multiple of the vault'sdynamicRotationIntervalHours. Message:Secret rotation interval in hours must be a multiple of the vault's dynamic rotation interval ({n} hours). Valid options: {list}.SM-0179— Hourly rotation is not allowed when the vault'sdynamicRotationIntervalHoursis24. Message:Hourly rotation interval is not allowed when the vault's dynamic rotation frequency is set to 24 hours. Please use a days-based rotation interval.SM-0180— Hourly rotation interval is not allowed for static secrets (secretNature: static). Message:Hourly rotation interval is not allowed for static secrets. Please use a days-based rotation interval.