POST /update-item
Request
- Base URLhttps://api.akeyless.io
- URLhttps://api.akeyless.io/update-item
- Authnone declared
Request body
for personal password manager
List of the new tags that will be attached to this item
Enable or disable Agentic Runtime Authority rule enforcement for this item. When false, user-defined input/output rules are stored but not enforced; the base security validation still runs.
AraEnabled is tri-state (nil/true/false), not a plain bool: it self-encodes its wire value (see akl.OptionalBool) so an explicit false survives the curl-proxy relay instead of being dropped like a default-false bool flag.
PEM Certificate in a Base64 format. Used for updating RSA keys' certificates.
Trigger an event when a secret value changed [true/false] (Relevant only for Static Secret)
Protection from accidental deletion of this object [true/false]
Description of the object
EnableAra is the documented spelling of AraEnabled. Both set the same field; --ara-enabled shipped first and stays as an undocumented alias so existing scripts and the Terraform provider keep working.
Turns on AI Quorum checks for this item.
How many days before the expiration of the certificate would you like to be notified.
GCP Secret Manager regions to query for regional secrets (comma-separated, e.g., us-east1,us-west1). Max 12 regions. USC with GCP targets only.
Host provider type [explicit/target], Default Host provider is explicit, Relevant only for SRA items.
Agentic input rule in name=...,rule=... format (e.g. name=rule1,rule=Sanitize input)
Additional custom fields to associate with the item
Set output format to JSON
Lock this secret for read/update while an SRA session is active
Lock this secret after each successful value read
Lock TTL in minutes
Set the maximum number of versions, limited by the account settings defaults.
Current item name
Deprecated - use description
New item name
Agentic output rule in name=...,rule=... format (e.g. name=rule1,rule=Mask secrets)
List of the existent tags that will be removed from this item
StringOrBool accepts JSON strings, booleans, and numbers for backward compatibility with older SDK versions that send boolean values for rotate-after-disconnect.
Rotate this secret after it is unlocked
List of the new hosts that will be attached to SRA servers host
Allow providing external user for a domain users [true/false]
Deprecated: old misspelled param, kept for backwards-compatibility. Hidden from help; use secure-access-allow-port-forwarding instead.
Enable Port forwarding while using CLI access (relevant only for EKS/GKE/K8s Dynamic-Secret)
Bastion's SSH control API endpoint. E.g. https://my.sra-server:9900 (relevant only for ssh cert issuer)
The AWS account id (relevant only for aws)
The AWS native cli (relevant only for aws)
The AWS region (relevant only for aws)
Deprecated. use secure-access-api
Deprecated. use secure-access-certificate-issuer
Deprecated. use secure-access-ssh
Path to the SSH Certificate Issuer for your Akeyless Secure Access
The K8s cluster endpoint URL (relevant only for EKS/GKE/K8s Dynamic-Secret)
The K8s dashboard url (relevant only for k8s)
The DB name (relevant only for DB Dynamic-Secret)
The DB schema (relevant only for DB Dynamic-Secret)
Enable/Disable secure remote access [true/false]
Enforce connections only to allowed SRA hosts
Target servers for connections (In case of Linked Target association, host(s) will inherit Linked Target hosts - Relevant only for Dynamic Secrets/producers)
RD Gateway server (relevant only for rdp)
Required when the Dynamic Secret is used for a domain user (relevant only for RDP Dynamic-Secret)
Override the RDP Domain username
List of the existent hosts that will be removed from SRA servers host
Bastion's SSH server. E.g. my.sra-server:22 (relevant only for ssh cert issuer)
Secret values contains SSH Credentials, either Private Key or Password [password/private-key] (relevant only for Static-Secret or Rotated-secret)
SSH username to connect to target server, must be in 'Allowed Users' list (relevant only for ssh cert issuer)
Destination URL to inject secrets
Deprecated. Use secure-access-use-internal-ssh-access
Use internal SSH Access
Secure browser via Akeyless's Secure Remote Access (SRA)
Web-Proxy via Akeyless's Secure Remote Access (SRA)
A list of targets to be associated with an SRA item, To specify multiple targets use argument multiple times
Authentication token (see /auth and /configure)
The universal identity token, Required only for universal_identity authentication
Comma-separated list of tags to apply to all secrets created/synced on the remote USC
USC items only.
Whether to filter the USC secret list using the specified usc-tags [true/false]
USC items only.
Response
updateItemResponse wraps response body.
Changes
No recorded changes to this operation across all 1 revision of this API.