--- title: "POST /describe-item" method: POST path: "/describe-item" tags: ["General"] --- # POST /describe-item `POST /describe-item` ## Request - Base URL: `https://api.akeyless.io` - URL: `https://api.akeyless.io/describe-item` - Auth: none declared ## Request body - DescribeItem - `accessibility` string: for personal password manager - `bastion-details` boolean: Indicate if the item should return with ztb cluster details (url, etc) - `der-certificate-format` boolean: The certificate will be displayed in DER format - `display-id` string: The display id of the item - `gateway-details` boolean: Indicate if the item should return with clusters details (url, etc) - `item-custom-fields-details` boolean: Include all item custom fields details - `item-id` integer: Item id of the item - `json` boolean: Set output format to JSON - `name` string, required: Item name - `services-details` boolean: Include all associated services details - `show-versions` boolean: Include all item versions in reply - `token` string: Authentication token (see `/auth` and `/configure`) - `uid-token` string: The universal identity token, Required only for universal_identity authentication ## Response `200` describeItemResponse wraps response body. - Item - `access_date` string, date-time - `access_date_display` string - `access_request_status` string - `auto_rotate` boolean - `bastion_details` BastionsList - `clusters` BastionListEntry[] - `access_id` string - `allowed_access_ids` string[] - `allowed_urls` string[] - `allowed_urls_per_instance` object - `bastion_ssh_port` integer - `bastion_urls_per_type` object - `cluster_name` string - `display_name` string - `has_gateway_identity` boolean - `last_report` string, date-time - `cert_issuer_signer_key_name` string - `certificate_issue_details` CertificateIssueInfo - `cert_issuer_type` string - `max_ttl` integer - `pki_cert_issuer_details` PKICertificateIssueDetails - `acme_enabled` boolean - `allow_any_name` boolean - `allow_copy_ext_from_csr` boolean - `allow_subdomains` boolean - `allowed_domains_list` string[] - `allowed_extra_extensions` AllowedExtraExtensions - `allowed_ip_sans` string[] - `allowed_uri_sans` string[] - `auto_renew_certificate` boolean - `basic_constraints` string - `basic_constraints_critical` boolean - `basic_constraints_valid_for_non_ca` boolean - `certificate_authority_mode` string - `client_flag` boolean - `code_signing_flag` boolean - `country` string[] - `create_private_crl` boolean - `create_private_ocsp` boolean: CreatePrivateOcsp enables exposing an OCSP endpoint on the Gateway and embedding its URL in the AIA extension of issued certificates. - `create_public_crl` boolean - `create_public_ocsp` boolean: CreatePublicOcsp enables exposing a public OCSP endpoint on the Gateway and embedding its URL in the AIA extension of issued certificates. - `destination_path` string: DestinationPath is the destination to save generated certificates - `disable_wildcards` boolean - `enforce_hostnames` boolean - `expiration_events` CertificateExpirationEvent[]: ExpirationNotification holds a list of expiration notices that should be sent in case a certificate is about to expire, this value is being propagated to the Certificate resources that are created - `seconds_before` integer - `gw_cluster_id` integer - `gw_cluster_url` string: GWClusterURL is required when CAMode is "public" and it defines the cluster URL the PKI should be issued from. The GW cluster must have permissions to read associated target's details - `is_ca` boolean - `key_bits` integer - `key_type` string - `key_usage_list` string[] - `locality` string[] - `max_path_len` integer - `non_critical_key_usage` boolean - `not_before_duration` integer: A Duration represents the elapsed time between two instants as an int64 nanosecond count. The representation limits the largest representable duration to approximately 290 years. - `ocsp_next_update` integer: OcspNextUpdate defines the desired NextUpdate window for OCSP responses. Value is in seconds; 0 means not set. Minimum enforced is 10 minutes. - `organization_list` string[] - `organization_unit_list` string[] - `pki_issuer_type` string - `postal_code` string[] - `protect_generated_certificates` boolean: ProtectGeneratedCertificates dictates whether the created certificates should be protected from deletion - `province` string[] - `renew_before_expiration_in_days` integer - `require_cn` boolean - `scep_challenge_mode` string: ScepChallengeMode is the SCEP challenge mode. Stage 1 supports only "static". - `scep_enabled` boolean: ScepEnabled turns on SCEP enrollment for this dedicated PKI issuer. - `server_flag` boolean - `split_certificate_chain` boolean: SplitCertificateChain, when enabled, separates the leaf certificate from the certificate chain. - `street_address` string[] - `ssh_cert_issuer_details` SSHCertificateIssueDetails - `allowed_domains` string[]: Relevant for host certificate - `allowed_user_key_lengths` object - `allowed_users` string[]: Relevant for user certificate - `cert_type` integer - `critical_options` object - `extensions` object - `externally_provided_user_sub_claim_key` string: ExternallyProvidedUserSubClaimKey is the claim key name where the user name should be taken from - `is_externally_provided_user` boolean: IsExternallyProvidedUser is true if allow users should be taken from claims and not from AllowedUsers - `principals` string[] - `static_key_id` string: In case it is empty, the key ID will be combination of user identifiers and a random string - `certificates` string - `client_permissions` string[] - `creation_date` string, date-time - `customer_fragment_id` string - `delete_protection` boolean - `deletion_date` string, date-time - `display_id` string - `file_download` FileDownloadInstructions - `expires_at` string, date-time - `url` string - `gateway_details` GatewayDetailsForItemReplyObj[] - `cluster_id` integer - `cluster_name` string - `cluster_url` string - `desktop_app` DesktopAppConf - `default_cert_issuer_id` integer - `default_cert_issuer_name` string - `secure_web_access_url` string - `secure_web_proxy_url` string - `is_cluster_available` boolean - `is_access_request_enabled` boolean - `is_enabled` boolean - `item_accessibility` integer - `item_custom_fields_details` ItemCustomFieldsDetails[] - `field_id` integer - `id` integer - `name` string - `required` boolean - `value` string - `item_general_info` ItemGeneralInfo - `agentic_rules` AgenticRules - `enabled` boolean: Enabled is a pointer so rules persisted before this field existed (nil) keep enforcing, rather than silently switching off. - `input_rules` AgenticRule[] - `name` string - `rule` string - `output_rules` AgenticRule[] - `name` string - `rule` string - `quorum_enabled` boolean: QuorumEnabled asks for this item's policy decisions to be evaluated by every model configured on the gateway rather than the Default alone. Also a pointer, but with the opposite nil meaning to Enabled above: nil is OFF. Enabled defaults on because it governs rules that were already being enforced before the field existed, whereas quorum is new behavior that multiplies latency and denies fail-closed - an item that never asked for it must not acquire it by upgrade. - `cert_issue_details` CertificateIssueInfo - `cert_issuer_type` string - `max_ttl` integer - `pki_cert_issuer_details` PKICertificateIssueDetails - `acme_enabled` boolean - `allow_any_name` boolean - `allow_copy_ext_from_csr` boolean - `allow_subdomains` boolean - `allowed_domains_list` string[] - `allowed_extra_extensions` AllowedExtraExtensions - `allowed_ip_sans` string[] - `allowed_uri_sans` string[] - `auto_renew_certificate` boolean - `basic_constraints` string - `basic_constraints_critical` boolean - `basic_constraints_valid_for_non_ca` boolean - `certificate_authority_mode` string - `client_flag` boolean - `code_signing_flag` boolean - `country` string[] - `create_private_crl` boolean - `create_private_ocsp` boolean: CreatePrivateOcsp enables exposing an OCSP endpoint on the Gateway and embedding its URL in the AIA extension of issued certificates. - `create_public_crl` boolean - `create_public_ocsp` boolean: CreatePublicOcsp enables exposing a public OCSP endpoint on the Gateway and embedding its URL in the AIA extension of issued certificates. - `destination_path` string: DestinationPath is the destination to save generated certificates - `disable_wildcards` boolean - `enforce_hostnames` boolean - `expiration_events` CertificateExpirationEvent[]: ExpirationNotification holds a list of expiration notices that should be sent in case a certificate is about to expire, this value is being propagated to the Certificate resources that are created - `seconds_before` integer - `gw_cluster_id` integer - `gw_cluster_url` string: GWClusterURL is required when CAMode is "public" and it defines the cluster URL the PKI should be issued from. The GW cluster must have permissions to read associated target's details - `is_ca` boolean - `key_bits` integer - `key_type` string - `key_usage_list` string[] - `locality` string[] - `max_path_len` integer - `non_critical_key_usage` boolean - `not_before_duration` integer: A Duration represents the elapsed time between two instants as an int64 nanosecond count. The representation limits the largest representable duration to approximately 290 years. - `ocsp_next_update` integer: OcspNextUpdate defines the desired NextUpdate window for OCSP responses. Value is in seconds; 0 means not set. Minimum enforced is 10 minutes. - `organization_list` string[] - `organization_unit_list` string[] - `pki_issuer_type` string - `postal_code` string[] - `protect_generated_certificates` boolean: ProtectGeneratedCertificates dictates whether the created certificates should be protected from deletion - `province` string[] - `renew_before_expiration_in_days` integer - `require_cn` boolean - `scep_challenge_mode` string: ScepChallengeMode is the SCEP challenge mode. Stage 1 supports only "static". - `scep_enabled` boolean: ScepEnabled turns on SCEP enrollment for this dedicated PKI issuer. - `server_flag` boolean - `split_certificate_chain` boolean: SplitCertificateChain, when enabled, separates the leaf certificate from the certificate chain. - `street_address` string[] - `ssh_cert_issuer_details` SSHCertificateIssueDetails - `allowed_domains` string[]: Relevant for host certificate - `allowed_user_key_lengths` object - `allowed_users` string[]: Relevant for user certificate - `cert_type` integer - `critical_options` object - `extensions` object - `externally_provided_user_sub_claim_key` string: ExternallyProvidedUserSubClaimKey is the claim key name where the user name should be taken from - `is_externally_provided_user` boolean: IsExternallyProvidedUser is true if allow users should be taken from claims and not from AllowedUsers - `principals` string[] - `static_key_id` string: In case it is empty, the key ID will be combination of user identifiers and a random string - `certificate_chain_info` CertificateChainInfo - `auto_renew_certificate` boolean - `certificate_chain` CertificateInfo[] - `ExtKeyUsage` ExtKeyUsage[] - `KeyUsage` integer: KeyUsage represents the set of actions that are valid for a given key. It's a bitmap of the KeyUsage* constants. - `crl_distribution_points` string[] - `dns_names` string[] - `email_addresses` string[] - `extensions` Extension[] - `Critical` boolean - `Name` string - `Value` string - `ip_addresses` string[] - `is_ca` boolean - `issuer` Name: Name represents an X.509 distinguished name. This only includes the common elements of a DN. Note that Name is only an approximation of the X.509 structure. If an accurate representation is needed, asn1.Unmarshal the raw subject or issuer as an [RDNSequence]. - `Country` string[] - `ExtraNames` AttributeTypeAndValue[]: ExtraNames contains attributes to be copied, raw, into any marshaled distinguished names. Values override any attributes with the same OID. The ExtraNames field is not populated when parsing, see Names. - `Type` integer[] - `Value` unknown - `Locality` string[] - `Names` AttributeTypeAndValue[]: Names contains all parsed attributes. When parsing distinguished names, this can be used to extract non-standard attributes that are not parsed by this package. When marshaling to RDNSequences, the Names field is ignored, see ExtraNames. - `Type` integer[] - `Value` unknown - `SerialNumber` string - `StreetAddress` string[] - `issuing_certificate_url` string[] - `key_size` integer - `not_after` string, date-time - `not_before` string, date-time - `ocsp_server` string[] - `public_key_algorithm_name` string - `serial_number` string - `sha_1_fingerprint` string - `sha_256_fingerprint` string - `signature` string - `signature_algorithm_name` string - `subject` Name: Name represents an X.509 distinguished name. This only includes the common elements of a DN. Note that Name is only an approximation of the X.509 structure. If an accurate representation is needed, asn1.Unmarshal the raw subject or issuer as an [RDNSequence]. - `Country` string[] - `ExtraNames` AttributeTypeAndValue[]: ExtraNames contains attributes to be copied, raw, into any marshaled distinguished names. Values override any attributes with the same OID. The ExtraNames field is not populated when parsing, see Names. - `Type` integer[] - `Value` unknown - `Locality` string[] - `Names` AttributeTypeAndValue[]: Names contains all parsed attributes. When parsing distinguished names, this can be used to extract non-standard attributes that are not parsed by this package. When marshaling to RDNSequences, the Names field is ignored, see ExtraNames. - `Type` integer[] - `Value` unknown - `SerialNumber` string - `StreetAddress` string[] - `subject_public_key` string - `uris` string[] - `version` integer - `certificate_format` string - `certificate_has_private_key` boolean - `certificate_issuer_gw_cluster_id` integer - `certificate_issuer_gw_cluster_url` string - `certificate_issuer_item_id` integer - `certificate_issuer_name` string - `certificate_pem` string - `certificate_status` string - `common_name` string - `csr_pem` string: CSRPEM contains the PEM-encoded CSR for pending certificates (HTTP-01 challenge) - `error_message` string - `expiration_date` string, date-time - `expiration_events` CertificateExpirationEvent[] - `seconds_before` integer - `external_ca_id` NullString: var s NullString err := db.QueryRow("SELECT name FROM foo WHERE id=?", id).Scan(&s) ... if s.Valid { use s.String } else { NULL value } - `String` string - `Valid` boolean - `issuance_status` string - `leaf_certificate_pem` string: LeafCertificatePem contains only the leaf certificate, derived from CertificatePem. Populated only when the certificate was issued with SplitCertificateChain enabled. - `not_before` string, date-time - `renew_before_expiration_in_days` integer - `split_certificate_chain` boolean: SplitCertificateChain reflects whether this certificate was issued while its PKI Cert Issuer had split-certificate-chain enabled. When true, LeafCertificatePem is populated in addition to CertificatePem (which always holds the full chain). - `certificate_format` string - `certificates_template_info` CertificateTemplateInfo - `common_name` string - `country` string - `csr_cnf_base_64` string - `digest_algo` string - `hash_algorithm` string - `locality` string - `organization` string - `province` string - `self_signed_enabled` boolean - `ttl` integer - `classic_key_details` ClassicKeyDetailsInfo - `classic_key_attributes` object - `classic_key_id` string - `credential_id` string - `gw_cluster_id` integer - `has_certificate` boolean - `is_provided_by_user` boolean - `is_unexportable` boolean - `key_state` string: ItemState defines the different states an Item can be in - `key_type` string - `last_error` string - `public_key` string - `target_alias_helper` string - `target_types` string[] - `targets` ClassicKeyTargetInfo[] - `external_kms_id` ExternalKMSKeyId - `key_id` string - `key_reference` string - `key_purpose` ClassicKeyPurpose[] - `key_status` ClassicKeyStatusInfo - `error_date` string, date-time - `last_error` string - `last_status` string: ClassicKeyTargetStatus defines status of classic key target - `version` integer - `target_assoc_id` string - `target_type` string - `username` string - `websites` string[] - `cluster_gw_url` string - `display_metadata` string - `dynamic_secret_producer_details` DynamicSecretProducerInfo: DynamicSecretProducerInfo The dynamic secret producer info This parameter relevant and required only in case of create update dynamic secret. - `failure_message` string - `gw_cluster_id` integer - `k8s_allowed_namespaces` string: Relevant only for generic k8s producer - `k8s_dynamic_mode` boolean: Relevant only for generic k8s producer - `producer_last_keep_alive` string - `producer_metadata` string - `producer_status` string: RotationStatus defines types of rotation Status - `producer_type` string - `skip_dry_run` boolean - `user_ttl` string - `expiration_events` CertificateExpirationEvent[] - `seconds_before` integer - `importer_info` ImporterInfo - `external_item_id` string - `version` integer - `issuer_overview_info` IssuerOverviewInfo - `certificate_authority_mode` string - `expiration_date` string, date-time - `key_type` string - `lock_on_read` boolean - `lock_ttl` integer - `next_rotation_events` NextAutoRotationEvent[] - `seconds_before` integer - `oidc_client_info` OidcClientInfo - `access_permission_assignment` AccessOrGroupPermissionAssignment[] - `access_id` string - `access_type` string - `assignment_name` string - `assignment_type` string - `group_id` string - `sub_claims` object - `audience` string[] - `client_id` string - `grant_types` string[] - `issuer_url` string - `logout_uris` string[] - `public` boolean - `redirect_uris` string[] - `response_types` string[] - `scopes` string[] - `password_policy` PasswordPolicyInfo - `password_length` integer - `use_capital_letters` boolean - `use_lower_letters` boolean - `use_numbers` boolean - `use_special_characters` boolean - `pending_rotate_on_unlock` boolean - `rotate_on_unlock` boolean - `rotated_secret_details` RotatedSecretDetailsInfo: RotatedSecretDetailsInfo The rotated secret rotator info - `aws_user_name` string - `delete_previous_version_in_days` integer - `enable_custom_password_policy` boolean - `grace_rotation` boolean - `grace_rotation_hour` integer - `grace_rotation_interval` integer - `grace_rotation_timing` string - `gw_cluster_id` integer - `iis_apps_details` WindowsService[] - `attributes` WindowsServiceAttributes - `connection_type` string - `iis_app_pool` boolean: IISAppPool marks this entry as an IIS Application Pool rather than a Windows Service - `port` string - `skip_restart` boolean: SkipRestart allows skipping recycle/start of the IIS App Pool after credential update - `use_tls` boolean - `host` string - `name` string - `key_algorithm` string: SSHKeyAlgorithm identifies the key algorithm an SSH rotated secret uses. Kept apart from Algorithm, which is an encryption-key enum and has no ECDSA-384 or ECDSA-521. - `last_rotation_error` string - `managed_by_akeyless` boolean - `max_versions` integer - `next_auto_rotate_type` string - `number_of_versions_to_save` integer - `public_key_remote_path` string - `rotation_hour` integer - `rotation_interval_min` boolean - `rotation_statement` string - `rotator_creds_type` string - `rotator_status` string: RotationStatus defines types of rotation Status - `rotator_type` string - `same_password` boolean - `services_details` WindowsService[] - `attributes` WindowsServiceAttributes - `connection_type` string - `iis_app_pool` boolean: IISAppPool marks this entry as an IIS Application Pool rather than a Windows Service - `port` string - `skip_restart` boolean: SkipRestart allows skipping recycle/start of the IIS App Pool after credential update - `use_tls` boolean - `host` string - `name` string - `skip_dry_run` boolean - `timeout_seconds` integer - `secure_remote_access_details` SecureRemoteAccess - `account_id` string - `allow_port_forwarding` boolean - `allow_providing_external_username` boolean - `bastion_api` string - `bastion_issuer` string - `bastion_issuer_id` integer - `bastion_ssh` string - `block_concurrent_connections` boolean - `block_concurrent_connections_level` string - `category` string - `connection_delay_seconds` integer - `dashboard_url` string - `db_name` string - `domain` string - `enable` boolean - `endpoint` string - `enforce_hosts_restriction` boolean - `gw_cluster_id` integer - `host` string[] - `host_provider_type` string - `is_cli` boolean - `is_desktop_app` boolean - `is_web` boolean - `isolated` boolean - `lock_during_sra_session` boolean - `native` boolean - `rd_gateway_server` string - `rdp_user` string - `region` string - `rotate_after_disconnect` boolean - `rotate_after_disconnect_delay_mins` integer - `schema` string - `ssh_password` boolean - `ssh_private_key` boolean - `ssh_user` string - `status_info` ItemSraStatus - `count_by_host_info` object - `count_info` object - `hosts_in_use` string[] - `is_in_use` boolean - `last_used_item` string, date-time - `target_hosts` TargetNameWithHosts[] - `hosts` string[] - `target_name` string - `targets` string[] - `url` string - `use_internal_bastion` boolean - `web_proxy` boolean - `static_secret_info` StaticSecretDetailsInfo - `file_info` FileInfo - `blob_storage_key` string - `client_file_sha256` string - `content_type` string - `derivation_data` string - `encrypted_blob_sha256` string - `encrypted_size_bytes` integer - `etag_at_complete` string - `extension` string - `file_id` string - `filename` string - `plain_size_bytes` integer - `previous_active_file_info` FileInfo (recursive) - `previous_blob_storage_key` string - `protection_key_name` string - `protection_key_version` integer - `status` string - `transaction_owner` string - `format` string: StaticSecretFormat defines the format of static secret (e.g. Text) - `max_versions` integer - `notify_on_change_event` boolean - `password_security_info` PasswordSecurityInfo - `breach_info` PasswordBreachInfo - `breach_check_date` string, date-time - `breach_count` integer - `breach_suggestions` PasswordBreachSuggestion[] - `status` string - `score_info` PasswordScoreInfo - `score` integer - `status` string - `suggestions` PasswordScoreSuggestion[] - `username` string - `website` string: deprecated - `websites` string[] - `tokenizer_info` TokenizerInfo - `vaultless_tokenizer_info` VaultlessTokenizerInfo - `email_tokenizer_info` EmailTokenizerInfo: EmailTokenizerInfo represents a tokenizer that specifically tokenizes emails - `domain_suffix_length` integer: What length of a random domain suffix to generate used only if FixedDomainSuffix is empty - `fixed_domain_suffix` string: if FixedDomainSuffix isn't empty, it will be appended to the output - `keep_prefix_length` integer: How many letters of the plaintext to keep in the output - `key_name` string - `regexp_tokenizer_info` RegexpTokenizerInfo: RegexpTokenizerInfo represents a general Regexp tokenization template - `alphabet` string: The Alphabet used for the tokenization - `decoding_template` string: Transformation to perform on the decrypted data - `encoding_template` string: Transformation to perform on the encrypted data, if the required output template doesn't match the input string The output Should still be valid for the Pattern, otherwise the secret would be able to be decrypted. - `pattern` string: Regexp pattern to extract and deposit the text/encdata - `template_type` string - `tweak` string: Tweak used in the case of internal tweak type - `tweak_type` string - `item_id` integer - `item_metadata` string - `item_name` string - `item_size` integer - `item_state` string: ItemState defines the different states an Item can be in - `item_sub_type` string - `item_tags` string[] - `item_targets_assoc` ItemTargetAssociation[] - `assoc_id` string - `attributes` object - `target_id` integer - `target_name` string - `target_type` string - `item_type` string - `item_versions` ItemVersion[] - `access_date` string, date-time - `access_date_display` string - `access_id` string - `certificate_version_info` CertificateVersionInfo - `not_after` string, date-time - `not_before` string, date-time - `status` string - `creation_date` string, date-time - `customer_fragment_id` string - `deletion_date` string, date-time - `item_version_state` string: ItemState defines the different states an Item can be in - `modification_date` string, date-time - `protection_key_name` string - `unique_identifier` string - `version` integer - `with_customer_fragment` boolean - `last_access_request_status` string - `last_rotation_date` string, date-time - `last_version` integer - `linked_details` LinkedDetails - `hosts` object - `locking_info` LockingInfo - `actions` string[] - `expire_at` integer - `lock_origin` string - `locked_at` integer - `locked_by` string - `unique_identifier` string - `modification_date` string, date-time - `next_rotation_date` string, date-time - `protection_key_name` string - `protection_key_type` string - `public_value` string - `rotation_interval` integer - `shared_by` RuleAssigner - `access_id` string - `unique_id` string - `target_versions` TargetItemVersion[] - `access_date` string, date-time - `access_date_display` string - `access_id` string - `certificate_version_info` CertificateVersionInfo - `not_after` string, date-time - `not_before` string, date-time - `status` string - `creation_date` string, date-time - `customer_fragment_id` string - `deletion_date` string, date-time - `item_version_state` string: ItemState defines the different states an Item can be in - `latest_version` boolean - `modification_date` string, date-time - `protection_key_name` string - `target_name` string - `unique_identifier` string - `version` integer - `with_customer_fragment` boolean - `usc_sync_associated_items` ItemUSCSyncAssociation[]: for USC item, hold rotated-secrets that are associated to him for rotated-secret, holds the associated USCs - `assoc_id` string - `attributes` UscSyncInfo - `delete_remote` boolean - `jq_secret_filter` string - `last_error` string - `namespace` string - `project` string - `secret_id` string - `secret_name` string - `selected_environments` string - `selected_repositories` string - `delete_remote` boolean - `item_id` integer - `item_name` string - `item_type` string - `with_customer_fragment` boolean ## Other responses - `default`: errorResponse wraps any error to return it as a JSON object with one "error" field. --- [API](https://skmtc.dev/akeyless/apis/account-settings.md) - [All operations](https://skmtc.dev/akeyless/apis/account-settings/llms.txt) - [OpenAPI document](https://skmtc.dev/akeyless/apis/account-settings/revisions/6beb28d274ac?raw)