manage_secrets
Create, retrieve, update, and delete static and dynamic secrets including LDAP, MySQL, and MongoDB credentials, with bulk operations and listing.
Instructions
SECRETS MANAGEMENT TOOL - Create, retrieve, update, and delete secrets
SUPPORTED ACTIONS:
• create_static_secret: Create text/JSON secrets with metadata
• get_static_secret_value: Retrieve secret values securely
• update: Modify secret properties and values
• delete: Delete individual secrets (smart detection)
• delete_items: Bulk delete multiple secrets or directories
• list: List secrets in directory with type filtering
• list_dynamic_secrets: List all dynamic secrets globally
• create_dynamic_secret_ldap: Create LDAP dynamic secrets
• create_dynamic_secret_mysql: Create MySQL dynamic secrets
• create_dynamic_secret_mongodb: Create MongoDB dynamic secrets
• list_shared_items: List shared secrets and items
DELETE OPERATIONS: • Individual: delete(name="/secret1") • Multiple: delete_items(items=["/secret1", "/secret2"]) • Directory: delete_items(path="/directory/")
Example: Create a database password secret
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| ssl | No | Enable/Disable SSL for MySQL dynamic secrets | |
| ttl | No | Time to live in seconds (for dynamic secrets) | |
| json | No | Set output format to JSON | |
| name | No | Secret/directory name/path (required for create_static_secret, get_static_secret_value, update, delete) | |
| path | No | Path to list secrets from (for list action only - not used for list_dynamic_secrets) | |
| tags | No | Tags to attach to the dynamic secret | |
| items | No | List of item names to delete (for bulk delete). Must be an array of strings, e.g., ['/item1', '/item2'] | |
| value | No | Secret value (required for create_static_secret, optional for update) | |
| action | Yes | Secret management action to perform. SUPPORTED ACTIONS: 'create_static_secret' (create text/JSON secrets), 'get_static_secret_value' (retrieve secret values), 'update' (modify secret properties), 'delete' (smart delete individual items), 'delete_items' (bulk delete multiple items or directories), 'list' (list secrets in directory with type filtering), 'list_dynamic_secrets' (list all dynamic secrets globally), 'create_dynamic_secret_ldap' (create LDAP dynamic secrets), 'create_dynamic_secret_mysql' (create MySQL dynamic secrets), 'create_dynamic_secret_mongodb' (create MongoDB dynamic secrets), 'list_shared_items' (list shared secrets/items) | |
| format | No | Secret format: 'text', 'json', 'key-value' | text |
| bind_dn | No | Bind DN for LDAP dynamic secrets | |
| user_dn | No | User DN for LDAP dynamic secrets | |
| version | No | Version to delete (-1 for all versions) | |
| group_dn | No | Group DN for temporary user addition | |
| ldap_url | No | LDAP Server URL for dynamic secrets | |
| metadata | No | Additional metadata in JSON format | |
| new_name | No | New name for the secret (for update action) | |
| password | No | Password for the secret | |
| user_ttl | No | User TTL for dynamic secrets (default: 60m) | 60m |
| username | No | Username for the secret | |
| filter_by | No | Filter secrets by pattern (for list action only - not used for list_dynamic_secrets) | |
| inject_url | No | Website context URLs | |
| mysql_host | No | MySQL host for dynamic secrets | 127.0.0.1 |
| mysql_port | No | MySQL port for dynamic secrets | 3306 |
| auto_rotate | No | Enable auto-rotation (for rotated secrets) | |
| description | No | Secret description | |
| secret_type | No | Secret type: 'static' (for create_static_secret action only). For dynamic secrets, use specific actions: create_dynamic_secret_ldap/mysql/mongodb | static |
| target_name | No | Target name to associate with dynamic secret | |
| change_event | No | Trigger an event when a secret value changed | |
| custom_field | No | Custom key-value pairs | |
| dynamic_type | No | Dynamic secret type (for dynamic secrets) | |
| ldap_ca_cert | No | CA Certificate File Content for LDAP | |
| max_versions | No | Maximum number of versions to keep | |
| mongodb_name | No | MongoDB name for dynamic secrets | |
| mysql_dbname | No | MySQL database name for dynamic secrets | |
| secret_types | No | Filter by secret types within the specified directory. Options: ['static-secret', 'dynamic-secret', 'rotated-secret']. Leave empty to include all types. Note: This filters within the specified path, unlike 'list_dynamic_secrets' which searches globally. | |
| accessibility | No | Accessibility level | regular |
| host_provider | No | Host provider type [explicit/target] | explicit |
| mongodb_roles | No | MongoDB roles (default: []) | [] |
| provider_type | No | Provider type for LDAP dynamic secrets | |
| db_server_name | No | Server name for certificate verification | |
| delete_in_days | No | Soft delete retention period in days | |
| mysql_password | No | MySQL password for dynamic secrets | |
| mysql_username | No | MySQL username for dynamic secrets | |
| protection_key | No | Protection key name | |
| user_attribute | No | User attribute for LDAP dynamic secrets | |
| multiline_value | No | Whether the provided value is multiline | |
| password_length | No | Length of password to be generated for dynamic secrets | |
| ssl_certificate | No | SSL connection certificate for MySQL | |
| bind_dn_password | No | Bind DN Password for LDAP dynamic secrets | |
| mongodb_password | No | MongoDB server password | |
| mongodb_username | No | MongoDB server username | |
| token_expiration | No | Token expiration for LDAP dynamic secrets | |
| delete_protection | No | Protection from accidental deletion [true/false] | |
| external_username | No | Use externally provided username [true/false] | |
| mongodb_host_port | No | MongoDB server host and port | |
| rotation_interval | No | Rotation interval in seconds (for rotated secrets) | |
| secure_access_web | No | Enable Web Secure Remote Access (for database dynamic secrets) | |
| delete_immediately | No | Delete immediately (bypass soft delete) | |
| mongodb_server_uri | No | MongoDB server URI | |
| secure_access_host | No | Target servers for connections | |
| mongodb_custom_data | No | MongoDB custom data | |
| mongodb_uri_options | No | MongoDB server URI options | |
| secure_access_delay | No | Delay duration in seconds (0-120) after generating credentials | |
| secure_access_enable | No | Enable/Disable secure remote access [true/false] | |
| db_server_certificates | No | DB server certificates for verification | |
| mongodb_default_auth_db | No | MongoDB default authentication database | |
| custom_username_template | No | Custom username template using go template syntax | |
| fixed_user_claim_keyname | No | Key-name of IdP claim for external username | ext_username |
| mongodb_atlas_project_id | No | MongoDB Atlas project ID | |
| mysql_creation_statements | No | MySQL creation statements | |
| mysql_revocation_statements | No | MySQL revocation statements | |
| mongodb_atlas_api_public_key | No | MongoDB Atlas API public key | |
| producer_encryption_key_name | No | Dynamic producer encryption key name | |
| mongodb_atlas_api_private_key | No | MongoDB Atlas API private key | |
| secure_access_certificate_issuer | No | Path to SSH Certificate Issuer for Secure Access |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||