Harthelm Docs
REST APIVault

Set a secret

Stores a new revision of the key, encrypted with the vault's data key. Services that reference the key get the value at their next Sync. Needs `landscape.manage` on the workspace that uses the vault.

Generated from openapi/harthelm.yaml at v1.5.0
PUT
/vaults/{vault}/secrets/{key}

Authorization

cookie__Host-harthelm_session<token>

Browser session of the UI (12 h idle, 7 days absolute). State-changing requests also need the header Harthelm-CSRF: 1 and a matching Origin.

Path Parameters

vault*integer

A vault id, e.g. Workspace.vault_id.

Formatint64
Range1 <= value
key*string
Match^[A-Za-z_][A-Za-z0-9_]{0,127}$

Request Body

application/json
  1. body
value*string
Length1 <= length <= 65536

Response Body

The key's new revision (without the value).

application/json
  1. response
key*SecretKeyValue
Match^[A-Za-z_][A-Za-z0-9_]{0,127}$
revision*integer
Range1 <= value
generated*boolean

The value came from generate.

created_at*string
Formatdate-time
created_by?ID

Numeric resource id.

Formatint64
Range1 <= value
curl -X PUT 'https://console.example.com/api/v1/vaults/1/secrets/string' \  -H 'Content-Type: application/json' \  -d '{  "value": "string"}'
{  "key": "string",  "revision": 1,  "generated": true,  "created_at": "2019-08-24T14:15:22Z",  "created_by": 1}

List the keys of a vault

Keys and their current revision; values are never returned. A workspace's vault id is `Workspace.vault_id`. Needs `workspace.view` on the workspace that uses the vault.

Agent channel (WebSocket)

A WebSocket upgrade (subprotocol `harthelm.agent.v1`) that core relays to the workspace agent: shared terminals, status, git head and the read-only file API. Core checks `workspace.view` and passes the agent a signed claim with the caller's permissions; the agent refuses terminal input without `workspace.exec`. Frames are `ChannelMessage` JSON text frames and binary terminal frames.