vania-janet/multiturn-rag-retrieval-data huggingface dataset:
{region}.secrets-manager.appdomain.cloud/v1/ibmcloud/arbitrary/secrets/{secret_id}/metadata" -H 'Accept: application/json' -H 'X-Vault-Token: {Vault-Token}' -d '{
"name": "updated-arbitrary-secret-name"
}'

Update the expiration date of an arbitrary secret in an existing secret group.

curl -X PUT "https://{instance_id}.{region}.secrets-manager.appdomain.cloud/v1/ibmcloud/arbitrary/secrets/groups/{group_id}/{secret_id}/metadata" -H 'Accept: application/json' -H 'X-Vault-Token: {Vault-Token}' -d '{
"expiration_date": "2030-05-01T09:30:00Z"
}'





 Example responses 

A request to update the metadata of an arbitrary secret in the default secret group returns the following response:

{
"request_id": "372645c0-9d97-5f6b-0755-99145eacdb93",
"lease_id": "",
"renewable": false,
"lease_duration": 0,
"data": {
"created_by": "iam-ServiceId-c0c7cfa4-b24e-4917-ad74-278f2fee5ba0",
"creation_date": "2021-06-04T02:55:40Z",
"crn": "crn:v1:bluemix:public:secrets-manager:us-south:a/a5ebf2570dcaedf18d7ed78e216c263a:0f4c764e-dc3d-44d1-bd60-a2f7cd91e0c0:secret:ea1907c8-8c8e-6b83-3c20-05f2015b80d8",
* remove_previous_and_delete: Carries out the same function as remove_previous, but also permanently deletes the data of the previous secret version if it doesn't have any locks.



ibmcloud secrets-manager secret-locks-bulk-create --id ID --locks LOCKS [--mode MODE]



 Command options 

--id (string)
: The ID of the secret. Required.

The maximum length is 36 characters. The minimum length is 36 characters. The value must match regular expression /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/.

--locks ([SecretLockPrototype]](https://cloud.ibm.com/docs/secrets-manager-cli-plugin?topic=secrets-manager-cli-plugin-secrets-manager-clicli-secret-lock-prototype-example-schema))
: The locks data to be attached to a secret version. Required.

The maximum length is 1000 items. The minimum length is 0 items.

Provide a JSON string option or specify a JSON file to read from by providing a filepath option that begins with a @, e.g. --locks=@path/to/file.json.

--mode (string)
: Set the lock mode. Allowable values: remove_previous, and remove_previous_and_delete. Use remove_previous to create a lock that clears existing locks with matching names. Use remove_previous_and_delete to also delete data from the previous version.

Allowable values are: remove_previous, remove_previous_and_delete.





 Example
Show more

v2 example

let res = await secretsManager.createSecret({
secretPrototype: {
description: 'Extended description for this secret.',
experation_date: '2030-04-01T09:30:00Z",
labels: ['label1', 'label2'],
name: 'example-username-password-secret',
secret_group_id: 'default',
secret_type: 'username_password',
'username': 'user123'
'password': '123456789'
}
});







 Migrating Java applications 

If you use Java, review the following steps and examples to migrate to Secrets Manager API v2.



1. Update your pom.xml file to use the latest version (2.0.0).
2. Update your import statements to use v2.
3. Remove the secret type, and the metadata and resources wrapper from your resource for each operation that you are using.



The response type is unified across operations. For example, Response<Secret> is the response to <CreateSecret> and <GetSecret>. With the changes to how response fields are handled in v2, now you have dedicated getters for each field.



 Comparing v1 and v2 Java examples 

Compare the following examples to see the changes between the v1 Java code snippet and how the code must look like in v2.

v1 example

CollectionMetadata collectionMetadata = new CollectionMetadata.Builder()
.collectionType("application/vnd.ibm.secrets-manager.secret+json")
.collectionTotal(Long.parseLong("1"))
.build();
ArbitrarySecretResource arbitrarySecretResource = new ArbitrarySecretResource.Builder()
.name("example-arbitrary-secret")
.description("Extended description for this secret.")
.payload("secret-data")
.build();
Managing key-value secrets with Vault API 

With IBM Cloud® Secrets Manager, you can manage multiple versions per key and access the history and metadata of your [key-value secret](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-key-value&interface=ui) by using the HashiCorp Vault HTTP API.



 Overview 

If you already use the Vault API, you can use its API format and guidelines to interact with Secrets Manager. Secrets Manager supports KV version 2 only. The endpoints for the key-value secrets engine that are defined in the [Vault documentation](https://developer.hashicorp.com/vault/api-docs/secret/kv/kv-v2kv-secrets-engine-version-2-api) are compatible with the CLI and other applicable tools.

For more information about authentication and the custom version of open source HashiCorp Vault that Secrets Manager uses, see [Vault API](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-vault-api).

To use the standard REST API for Secrets Manager, check out the [Secrets Manager API reference](https://cloud.ibm.com/apidocs/secrets-manager/secrets-manager-v2).



 Difference between KV and Secrets Manager 

The key-value secrets engine that Secrets Manager uses differs slightly from Vault's KV secrets engine.



* You cannot fully customize the path. The path to a key-value secret must be:



* {secret_group_id}/{secret_name} for secrets that are located in a custom secret group.
* /{secret_name} for secrets that are in the default group.



* The methods that are used on Vault to [configure the key-value engine](https://developer.hashicorp.com/vault/api-docs/secret/kv/kv-v2configure-the-kv-engine) and [read the configuration](https://developer.hashicorp.com/vault/api-docs/secret/kv/kv-v2read-kv-engine-configuration) are not supported.
Create a lock on a secret in the default secret group.

curl -X POST "https://{instance_id}.{region}.secrets-manager.appdomain.cloud/v1/ibmcloud/{secret_type}/locks/{secret_id}/lock" -H 'X-Vault-Token: {Vault-Token}'
-H 'Content-Type: application/json' -D '{
"locks": [
{
"name": "lock-for-app-1",
"description": "Test lock for secret in the default secret group.",
"attributes": {
"key": "value"
}
}
]
}'

Create two locks on the current version of a secret in an existing secret group.

curl -X POST "https://{instance_id}.{region}.secrets-manager.appdomain.cloud/v1/ibmcloud/{secret_type}/locks/groups/{group_id}/{secret_id}/lock" -H 'X-Vault-Token: {Vault-Token}'
-H 'Content-Type: application/json' -D '{
"locks": [
{
"name": "lock-for-app-1",
"description": "Test lock for secret in a custom secret group.",
"attributes": {
"key": "value"
}
},
{
"name": "lock-for-app-2",
"description": "Test lock for secret in a custom secret group.",
"attributes": {
"key": "value"
}
}
]
}'
Show more

Lock a secret version exclusively.

curl -X POST "https://{instance_id}.
{region}.secrets-manager.appdomain.cloud/v1/ibmcloud/username_password/locks/groups/{group_id}/{secret_id}/versions/current?limit={limit}&offset={offset}" -H 'Accept: application/json' -H 'X-Vault-Token: {Vault-Token}'

Filter for locks that contain book in their names.

curl -X GET "https://{instance_id}.{region}.secrets-manager.appdomain.cloud/v1/ibmcloud/username_password/locks/groups/{group_id}/{secret_id}/versions/current?search=book" -H 'Accept: application/json' -H 'X-Vault-Token: {Vault-Token}'





 Example response 

A request to get the lock details on the current version of a secret returns the following response:

{
"request_id": "ba51140d-31a8-0a51-dd5b-1ca59838e881",
"lease_id": "",
"renewable": false,
"lease_duration": 0,
"data": {
"locks": [
{
"attributes": {
"key": "value"
},
"created_by": "iam-ServiceId-222b47ab-b08e-4619-b68f-8014a2c3acb8",
"creation_date": "2022-06-30T21:41:36.616174Z",
"description": "Test lock for secret in the default secret group.",
"last_update_date": "2022-06-30T21:41:36.616174Z",
"name": "lock-for-app-2",
"secret_group_id": "default",
You can now integrate stand-alone IBM Cloud plug-ins for Vault. These open source plug-ins can be used independently from each other so that you can manage IBM Cloud secrets through your on-premises Vault server.



* To set up authentication between Vault and your IBM Cloud account, you can use the [IBM Cloud Auth Method plug-in for Vault](https://github.com/ibm-cloud-security/vault-plugin-auth-ibmcloud).
* To dynamically create API keys for IBM Cloud service IDs, you can use the [IBM Cloud Secrets Backend plug-in for Vault](https://github.com/ibm-cloud-security/vault-plugin-secrets-ibmcloud).



For more information, check out the [announcement blog](https://www.ibm.com/cloud/blog/announcements/hashicorp-enterprise-vault-plugins-for-ibm-cloud)





 9 November 2020 

Grant controlled access to secret data with the SecretsReader role
: You can now choose between the Reader and SecretsReader IAM roles for better control over access to the payload of your secrets.



* As a reader, you can browse a high-level view of secrets in your instance. Readers can't access the payload of a secret.
* As a secrets reader, you can browse a high-level view of secrets, and you can access the payload of a secret. A secrets reader can't create secrets or modify the value of an existing secret.



To learn more about service access roles, see [Managing IAM access for Secrets Manager](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-iam).





 24 September 2020 

Introducing Secrets Manager
: With IBM Cloud Secrets Manager, you can create secrets dynamically and lease them to applications while you control access from a single location. Built on open source HashiCorp Vault, Secrets Manager helps you get the data isolation of a dedicated environment with the benefits of a public cloud.

In this release, Secrets Manager offers support for the following types of secrets:



* IAM credentials, which consist of a service ID and API key that are generated dynamically on your behalf.
5.4.1 Prefer using secrets as files over secrets as environment variables Not Scored 1 [Fail](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-412ibm-remediations-and-explanations-412) Shared 
 5.4.2 Consider external secret storage Not Scored 2 [Fail](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-412ibm-remediations-and-explanations-412) Shared 







 5.5 Extensible admission control 



Section 5.5 Extensible admission control benchmark results

 Section Recommendation Scored/Not Scored Level Result Responsibility 

 5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller Not Scored 2 [Fail](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-412ibm-remediations-and-explanations-412) Shared 







 5.6 General policies 



Section 5.6 General policies benchmark results

 Section Recommendation Scored/Not Scored Level Result Responsibility 

 5.6.1 Create administrative boundaries between resources using namespaces Not Scored 1 Pass Shared 
 5.6.2 Ensure that the seccomp profile is set to docker/default in your pod definitions Not Scored 2 [Fail](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-412ibm-remediations-and-explanations-412) Shared 
 5.6.3 Apply Security Context to Your Pods and Containers Not Scored 2 [Fail](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-412ibm-remediations-and-explanations-412) Shared 
 5.6.4 The default namespace should not be used Scored 2 Pass Shared 







 IBM remediations and explanations 



Explanations and remediations

 Section Remediation/Explanation
5.4.1 Prefer using secrets as files over secrets as environment variables Not Scored 1 [Fail](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-411ibm-remediations-and-explanations-411) Shared 
 5.4.2 Consider external secret storage Not Scored 2 [Fail](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-411ibm-remediations-and-explanations-411) Shared 







 5.5 Extensible admission control 



Section 5.5 Extensible admission control benchmark results

 Section Recommendation Scored/Not Scored Level Result Responsibility 

 5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller Not Scored 2 [Fail](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-411ibm-remediations-and-explanations-411) Shared 







 5.6 General policies 



Section 5.6 General policies benchmark results

 Section Recommendation Scored/Not Scored Level Result Responsibility 

 5.6.1 Create administrative boundaries between resources using namespaces Not Scored 1 Pass Shared 
 5.6.2 Ensure that the seccomp profile is set to docker/default in your pod definitions Not Scored 2 [Fail](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-411ibm-remediations-and-explanations-411) Shared 
 5.6.3 Apply Security Context to Your Pods and Containers Not Scored 2 [Fail](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-411ibm-remediations-and-explanations-411) Shared 
 5.6.4 The default namespace should not be used Scored 2 Pass Shared 







 IBM remediations and explanations 



Explanation and remediation

 Section Remediation/Explanation
"creation_date": "2022-01-27T21:00:27Z",
"downloaded": false,
"id": "00000ea00-7d0000-0000ce-c0002a-0a0000f4b3ee",
"payload_available": true
}
],
"versions_total": 3
},
"wrap_info": null,
"warnings": null,
"auth": null
}







 Delete a secret 

Deletes a secret from a Secrets Manager secrets engine.



 Example requests 

Delete an arbitrary secret in the default secret group.

curl -X DELETE "https://{instance_id}.{region}.secrets-manager.appdomain.cloud/v1/ibmcloud/arbitrary/secrets/{secret_id}" -H 'Accept: application/json' -H 'X-Vault-Token: {Vault-Token}'

Delete an arbitrary secret in an existing secret group.

curl -X DELETE "https://{instance_id}.{region}.secrets-manager.appdomain.cloud/v1/ibmcloud/arbitrary/secrets/groups/{group_id}/{secret_id}" -H 'Accept: application/json' -H 'X-Vault-Token: {Vault-Token}'





 Example response 

{
"request_id": "e48436e3-23d3-ab4a-7642-535cab8935a8",
"lease_id": "",
"renewable": false,
"lease_duration": 0,
"data": null,
"wrap_info": null,
"warnings": null,
"auth": null
}









 Locks 



 List secret locks 

List the locks that are associated with a specified secret.



Table 9. Lock secret request parameters

 Query parameters Description 

 limit The number of locks to retrieve. Default is 25.
Access a storage bucket by using a dynamic secret 

In this tutorial, you learn how to use IBM Cloud® Secrets Manager to create and lease an IAM credential that can be used to access a bucket in Cloud Object Storage.

As an enterprise developer, you might be looking for ways to improve the security of your application secrets. When it comes to managing API keys, you want the ability to create your credentials dynamically so that they exist only when you need them to. You also want to lease an API key to someone else on your team and ensure that it is automatically revoked after a time duration that you specify.

With Secrets Manager, you can create a

dynamic secretthat you can use to access a protected resource, such as deployment logs that you store in a Cloud Object Storage bucket. For example, consider the following scenario.

Zoom

![The diagram shows the basic flow between the Secrets Manager and Cloud Object Storage services.](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/secrets-manager/images/iam-credential-flow.svg)

Figure 1. IAM credential flow



1. As an admin user, you want to create a dynamic secret that your team can use to access a Cloud Object Storage bucket in your account. You send a request to create IAM credentials in Secrets Manager.
2. Secrets Manager creates the secret and validates it against your defined IAM access policies.
3. Later, a developer wants to access the contents of your storage bucket. The developer sends a request to retrieve the value of your IAM credential.
4. Secrets Manager validates the request and generates a single-use API key that the developer can use to authenticate to Cloud Object Storage. After the API key reaches the end of its lease, the API key is revoked automatically.





 Before you begin
There are several different strategies that you might use to approach secret groups. For more information and recommendations, see [Best practices for organizing secrets and assigning access](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-best-practices-organize-secrets).
* What is an IAM credential?

An IAM credential is a type of dynamic secret that you can use to access an IBM Cloud resource that requires IAM authentication. When you create an IAM credential through Secrets Manager, the service creates a service ID and an API key on your behalf. For more information about creating and storing IAM credentials, see [Creating IAM credentials](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-iam-credentials).
* What happens when I rotate my secret?

When a secret is rotated, a new version of its value becomes available for use. You can choose to manually add a value or automatically generate one at regular intervals by enabling automatic rotation.

For more information about secret rotation, see [Rotating secrets](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-manual-rotation).
* What happens when my secret expires?

In some secret types such as arbitrary or username_password, you can set the date and time when your secret expires. When the secret reaches its expiration date, it transitions to a Destroyed state. When the transition happens, the value that is associated with the secret is no longer recoverable. The transition to the Destroyed state can take up to a couple of minutes after the secret expires, or a lock that prevented expiration is removed.

For more information about how your information is protected, see [Securing your data](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-mng-data).
* What are differences between the Reader and SecretsReader roles?

Both the Reader and SecretsReader roles help you to assign read-only access to Secrets Manager resources.



* As a reader, you can browse a high-level view of secrets in your instance.
{region}.secrets-manager.appdomain.cloud/v1/ibmcloud/kv/data/{secret_name}' -H 'Accept: application/json'  -H 'X-Vault-Token: {Vault-Token}' -H 'Content-Type: application/merge-patch+json' -d '{
"data": {
"key":"value"
}
}'



Table 11. Create or update a key-value secret request parameters

 Request parameter Description 

 instance_id The ID of the Secrets Manager instance. 
 region The region in which the Secrets Manager instance was created. 
 secret_name The name of the key-value secret. 
 Vault-Token The authentication token that is retrieved from Vault. 
 data Required. The secret data in JSON format to patch the secret with. The maximum file size is 512 KB. 







 Example response 

A request to update a key-value secret in the default secret group returns the following response:

{
"request_id": "9000000d4-f0000-4c000-000000-800000000f",
"lease_id": "",
"renewable": false,
"lease_duration": 0,
"data": {
"created_time": "2022-02-09T23:41:58.888138788Z",
"deletion_time": "",
"destroyed": false,
"version": 2
},
"wrap_info": null,
"warnings": null,
"auth": null
}
To create a dynamic service ID and API key by using the Secrets Manager CLI plug-in, run the [ibmcloud secrets-manager secret-create](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-cli-plugin-secrets-manager-clisecrets-manager-cli-secret-create-command) command. For example, the following command creates an IAM secret with a lease duration of 12 hours.

ibmcloud secrets-manager secret-create 
--secret-prototype='{"name": "example-iam-credentials-secret","description": "Description of my IAM credentials secret","secret_type": "iam_credentials","secret_group_id": "<secret_group_id>","labels": ["dev","us-south"],"ttl": "30m","access_groups": ["<access_group_id>"],"reuse_api_key": false, "custom_metadata": {"metadata_custom_key": "metadata_custom_value"},"version_custom_metadata": { "custom_version_key": "custom_version_value"}}'

The command outputs the ID value of the secret, along with other metadata. For more information about the command options, see [ibmcloud secrets-manager secret-create](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-cli-plugin-secrets-manager-clisecrets-manager-cli-secret-create-command).



 Reusing the same API key until the lease expires 

IAM credentials consist of a service ID and an API key. By default, the service ID and API key are single-use, ephemeral values that are generated and deleted each time that an IAM credentials secret is read or accessed.

If you'd like to continue to use those credentials through the end of the lease of your secret, you can use the reuse_api_key field.
"secret_version_id" : "50277266-d706-4b3e-badb-f07257f8f581",
"secret_id" : "cb7a2502-8ede-47d6-b5b6-1b7af6b6f563",
"secret_group_id" : "bc656587-8fda-4d05-9ad8-b1de1ec7e712",
"last_update_date" : "2022-04-27T18:50:09.692573+03:00",
"secret_version_alias" : "previous"
} ]
}







 ibmcloud secrets-manager secret-lock 

Create a lock on the current version of a secret.

A lock can be used to prevent a secret from being deleted or modified while it's in use by your applications. A successful request attaches a new lock to your secret, or replaces a lock of the same name if it already exists. Additionally, you can use this method to clear any matching locks on a secret by using one of the following optional lock modes:



* exclusive: Removes any other locks with matching names if they are found in the previous version of the secret.
* exclusive_delete: Same as exclusive, but also permanently deletes the data of the previous secret version if it doesn't have any locks.



For more information about locking secrets, check out the [docs](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-secret-locks).

ibmcloud secrets-manager secret-lock --secret-type SECRET-TYPE --id ID [--locks LOCKS] [--mode MODE]



 Command options 

--secret-type (string)
: The secret type. Required.

Allowable values are: arbitrary, iam_credentials, imported_cert, public_cert, private_cert, username_password, kv.

--id (string)
: The v4 UUID that uniquely identifies the secret. Required.
{region}.secrets-manager.appdomain.cloud/v1/ibmcloud/iam_credentials/roles/groups/{group_id}/{secret_name}" -H 'Accept: application/json' -H 'X-Vault-Token: {Vault-Token}' -H 'Content-Type: application/json' -d '{
"name": "test-iam-credentials-in-group",
"description": "Extended description for my secret.",
"access_groups": [
"AccessGroupId-0529f490-129c-4877-a2a0-b57f50d3e53b"
],
"labels": [
"dev",
"us-south"
],
"ttl": "30m"
}'
Show more

Create a key-value secret in the default secret group. [Learn more](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-vault-manage-kv&interface=apioverview-kv).

curl -X POST 'https://{instance_id}.{region}.secrets-manager.appdomain.cloud/v1/ibmcloud/kv/secrets' -H 'Accept: application/json' -H 'X-Vault-Token: {Vault-Token}' -H 'Content-Type: application/json' -d '{
"name": "test-kv-secret",
"description": "Extended description for my secret.",
"payload": {
"key1": "value1"
},
"labels": [
"dev",
"us-south"
]
}'

Create a key-value secret in an existing secret group.

curl -X POST 'https://{instance_id}.