--- title: "POST /dynamic-secret-create-aerospike" method: POST path: "/dynamic-secret-create-aerospike" tags: ["Dynamic Secrets"] --- # POST /dynamic-secret-create-aerospike `POST /dynamic-secret-create-aerospike` ## Request - Base URL: `https://api.akeyless.io` - URL: `https://api.akeyless.io/dynamic-secret-create-aerospike` - Auth: none declared ## Request body - DynamicSecretCreateAerospike: dynamicSecretCreateAerospike is a command that creates an Aerospike dynamic secret - `aerospike-roles` string[] - `ara-enabled` boolean: Enable or disable Agentic Runtime Authority rule enforcement for this item. Mirrors commands.AgenticRulesParams.AraEnabled. - `custom-username-template` string: Customize how temporary usernames are generated using go template - `delete_protection` string: Protection from accidental deletion of this object [true/false] - `description` string: Description of the object - `enable-agentic-runtime-authority` boolean: EnableAra is the documented spelling of AraEnabled; --ara-enabled shipped first and stays as an undocumented alias. - `enable-ai-quorum` boolean: Turns on AI Quorum checks for this item. - `input-rule` string[]: Agentic input rule in name=...,rule=... format (e.g. name=rule1,rule=Sanitize input) Mirrors commands.AgenticRulesParams — kept separate because ResourceDS cannot embed it (different package, different struct layout). - `item-custom-fields` object: Additional custom fields to associate with the item - `json` boolean: Set output format to JSON - `name` string, required: Dynamic secret name - `output-rule` string[]: Agentic output rule in name=...,rule=... format (e.g. name=rule1,rule=Mask secrets) - `password-length` string: The length of the password to be generated - `skip-dry-run` boolean: If set, dry-run will be skipped [true/false] - `target-name` string - `token` string: Authentication token (see `/auth` and `/configure`) - `uid-token` string: The universal identity token, Required only for universal_identity authentication - `use-capital-letters` string: Specifies whether the generated temporary password must contain at least one uppercase character from the ISO basic Latin alphabet (A to Z). [true/false] - `use-lower-letters` string: Specifies whether the generated temporary password must contain at least one lowercase character from the ISO basic Latin alphabet (a to z). [true/false] - `use-numbers` string: Specifies whether the generated temporary password must contain at least one numeric character (0 to 9). [true/false] - `use-special-characters` string - `user-ttl` string ## Response `201` dynamicSecretCreateAerospikeResponse wraps response body. - DynamicSecretCreateOutput - `dynamic_secret_details` DSProducerDetails - `access_token_manager_id` string - `acl_rules` string[] - `active` boolean - `admin_name` string - `admin_pwd` string - `admin_rotation_interval_days` integer - `administrative_port` string - `aerospike_admin_username` string - `aerospike_client_certificate` string - `aerospike_client_id` string - `aerospike_client_private_key` string - `aerospike_client_secret` string - `aerospike_cloud` boolean - `aerospike_cluster_id` string - `aerospike_db_server_name` string - `aerospike_enable_mtls` boolean - `aerospike_hostname` string - `aerospike_namespace` string - `aerospike_password` string - `aerospike_port` string - `aerospike_roles` string[] - `aerospike_skip_server_name_validation` string - `aerospike_ssl_connection_certificate` string - `aerospike_ssl_connection_mode` boolean - `agentic_rules` AgenticRules - `enabled` boolean: Enabled is a pointer so rules persisted before this field existed (nil) keep enforcing, rather than silently switching off. - `input_rules` AgenticRule[] - `name` string - `rule` string - `output_rules` AgenticRule[] - `name` string - `rule` string - `quorum_enabled` boolean: QuorumEnabled asks for this item's policy decisions to be evaluated by every model configured on the gateway rather than the Default alone. Also a pointer, but with the opposite nil meaning to Enabled above: nil is OFF. Enabled defaults on because it governs rules that were already being enforced before the field existed, whereas quorum is new behavior that multiplies latency and denies fail-closed - an item that never asked for it must not acquire it by upgrade. - `api_key` string - `api_key_id` string - `artifactory_admin_apikey` string - `artifactory_admin_username` string - `artifactory_base_url` string - `artifactory_token_audience` string - `artifactory_token_scope` string - `auth_mode` string: AuthMode selects how this target authenticates. Empty (default) uses ApiKey as a static bearer token against BaseURL, matching all pre-existing behavior. OpenAIAuthModeChatGPTOAuth instead uses the OAuth* fields below. - `authorization_port` string - `aws_access_key_id` string - `aws_access_mode` string - `aws_external_id` string - `aws_region` string - `aws_role_arns` string - `aws_secret_access_key` string - `aws_session_tags` string - `aws_session_token` string - `aws_transitive_tag_keys` string - `aws_user_console_access` boolean - `aws_user_groups` string - `aws_user_name` string - `aws_user_policies` string - `aws_user_programmatic_access` boolean - `azure_administrative_unit` string - `azure_app_object_id` string - `azure_client_id` string - `azure_client_secret` string - `azure_cloud` string - `azure_fixed_user_name_sub_claim_key` string - `azure_fixed_user_only` boolean - `azure_resource_group_name` string - `azure_resource_name` string - `azure_subscription_id` string - `azure_tenant_id` string - `azure_user_groups_obj_id` string - `azure_user_portal_access` boolean - `azure_user_programmatic_access` boolean - `azure_user_roles_template_id` string - `azure_username` string - `block_parent_target_access` boolean - `cassandra_creation_statements` string - `chef_organizations` string - `chef_server_access_mode` string - `chef_server_host_name` string - `chef_server_key` string - `chef_server_port` string - `chef_server_url` string - `chef_server_username` string - `chef_skip_ssl` boolean - `client_authentication_type` string - `client_certificate` string: (Optional) ClientCertificate defines the client certificate for mutual TLS. Must be base64 certificate loaded by UI using file loader field - `client_key_passphrase` string: (Optional) ClientKeyPassphrase defines the passphrase for the client private key - `client_private_key` string: (Optional) ClientPrivateKey defines the client private key for mutual TLS. Must be base64 private key loaded by UI using file loader field - `cloud_service_provider` string - `cluster_mode` boolean - `connection_type` string - `create_sync_url` string - `db_client_id` string - `db_client_secret` string - `db_host_name` string - `db_isolation_level` string - `db_max_idle_conns` string - `db_max_open_conns` string - `db_name` string - `db_port` string - `db_private_key` string: (Optional) Private Key in PEM format - `db_private_key_passphrase` string - `db_pwd` string - `db_server_certificates` string: (Optional) DBServerCertificates defines the set of root certificate authorities that clients use when verifying server certificates. If DBServerCertificates is empty, TLS uses the host's root CA set. - `db_server_name` string: (Optional) ServerName is used to verify the hostname on the returned certificates unless InsecureSkipVerify is given. It is also included in the client's handshake to support virtual hosting unless it is an IP address. - `db_tenant_id` string - `db_user_name` string - `delete_protection` boolean - `dynamic_secret_id` integer - `dynamic_secret_key` string - `dynamic_secret_name` string - `dynamic_secret_type` string - `eks_access_key_id` string - `eks_assume_role` string - `eks_cluster_ca_certificate` string - `eks_cluster_endpoint` string - `eks_cluster_name` string - `eks_region` string - `eks_secret_access_key` string - `enable_admin_rotation` boolean - `enable_mtls` boolean: (Optional) EnableMTLS defines if mutual TLS will be used to connect to DB - `enforce_replay_prevention` boolean: relevant for PRIVATE_KEY_JWT client authentication type - `expiration_date` string, date-time - `externally_provided_user` string - `failure_message` string - `fixed_user_only` string - `gcp_access_type` string - `gcp_fixed_user_claim_keyname` string - `gcp_key_algo` string - `gcp_project_id` string - `gcp_role_bindings` object - `gcp_role_names` string - `gcp_service_account_email` string: GCPServiceAccountEmail overrides the deprecated field from the target - `gcp_service_account_key` string - `gcp_service_account_key_base64` string - `gcp_service_account_key_id` string - `gcp_service_account_type` string - `gcp_tmp_service_account_name` string - `gcp_token_lifetime` string - `gcp_token_scope` string - `gcp_token_type` string - `github_app_id` integer - `github_app_private_key` string - `github_base_url` string - `github_installation_id` integer - `github_installation_token_permissions` object - `github_installation_token_repositories` string[] - `github_installation_token_repositories_ids` integer[] - `github_organization_name` string - `github_repository_path` string - `gitlab_access_token` string - `gitlab_access_type` string - `gitlab_certificate` string - `gitlab_group_name` string - `gitlab_project_name` string - `gitlab_role` string - `gitlab_token_scope` string[] - `gitlab_url` string - `gke_cluster_ca_certificate` string - `gke_cluster_endpoint` string - `gke_cluster_name` string - `gke_service_account_key` string - `gke_service_account_name` string - `google_workspace_access_mode` string - `google_workspace_admin_name` string - `google_workspace_fixed_user_name_sub_claim_key` string - `google_workspace_group_name` string - `google_workspace_group_role` string - `google_workspace_role_name` string - `google_workspace_role_scope` string - `grace_rotated_secret_key` string - `grant_types` string[] - `groups` string - `gw_cloud_identity_external_id_opt` AWSGatewayCloudIdentityExternalIdOpt - `generated_external_id` string - `is_enabled` boolean - `role_arn` string - `hanadb_creation_statements` string - `hanadb_revocation_statements` string - `host_name` string - `host_port` string - `implementation_type` string - `is_fixed_user` string - `issuer` string: relevant for CLIENT_TLS_CERTIFICATE client authentication type - `item_custom_fields_details` ItemCustomFieldsDetails[] - `field_id` integer - `id` integer - `name` string - `required` boolean - `value` string - `item_targets_assoc` ItemTargetAssociation[] - `assoc_id` string - `attributes` object - `target_id` integer - `target_name` string - `target_type` string - `jwks` string - `jwks_url` string - `k8s_allowed_namespaces` string: comma-separated list of allowed namespaces. Can hold just * which signifies that any namespace is allowed - `k8s_auth_type` string - `k8s_bearer_token` string - `k8s_client_cert_data` string: For K8s Client certificates authentication - `k8s_client_key_data` string - `k8s_cluster_ca_certificate` string - `k8s_cluster_endpoint` string - `k8s_cluster_name` string - `k8s_dynamic_mode` boolean: when native k8s is in dynamic mode, user can define allowed namespaces, K8sServiceAccount doesn't exist from the start and will only be created at time of getting dynamic secret value By default dynamic mode is false and producer behaves like it did before - `k8s_multiple_doc_yaml_temp_definition` integer[]: Yaml definition for creation of temporary objects. Field that can hold multiple docs from which following will be extracted: ServiceAccount, Role/ClusterRole and RoleBinding/ClusterRoleBinding. If ServiceAccount not specified - it will be generated automatically - `k8s_namespace` string - `k8s_role_name` string: Name of the pre-existing Role or ClusterRole to bind a generated service account to. - `k8s_role_type` string - `k8s_service_account` string - `last_admin_rotation` integer - `ldap_audience` string - `ldap_bind_dn` string - `ldap_bind_password` string - `ldap_certificate` string - `ldap_fixed_user_name_sub_claim_key` string - `ldap_fixed_user_type` string - `ldap_group_dn` string - `ldap_token_expiration` string - `ldap_url` string - `ldap_user_attr` string - `ldap_user_dn` string - `ldap_username` string - `metadata` string - `mongodb_atlas_api_private_key` string - `mongodb_atlas_api_public_key` string - `mongodb_atlas_project_id` string: mongodb atlas fields - `mongodb_custom_data` string - `mongodb_db_name` string: common fields - `mongodb_default_auth_db` string - `mongodb_host_port` string - `mongodb_is_atlas` boolean - `mongodb_password` string - `mongodb_roles` string: common fields - `mongodb_scopes` string - `mongodb_uri_connection` string: mongodb fields - `mongodb_uri_options` string - `mongodb_username` string - `mssql_allowed_db_names` string: Comma-separated list of allowed DB names for runtime selection when fetching the secret value. Empty string => use target DB name only (no override allowed) "*" => any DB name is allowed One or more names => user must select one of the provided names - `mssql_creation_statements` string - `mssql_revocation_statements` string - `mysql_creation_statements` string - `mysql_revocation_statements` string - `oauth_access_token` string: OAuthAccessToken is the current ChatGPT-issued access token (the `tokens.access_token` field of the customer's local auth.json). Akeyless refreshes this automatically; do not treat it as long-lived. - `oauth_account_id` string: OAuthAccountID is the ChatGPT workspace/account id (`tokens.account_id` in auth.json), required on every request to the ChatGPT backend. - `oauth_last_refresh` string: OAuthLastRefresh is the RFC3339 timestamp of the last successful Akeyless-performed refresh; used as a fallback expiry heuristic when the access token's JWT exp claim can't be parsed. - `oauth_refresh_token` string: OAuthRefreshToken mints new access tokens. It rotates on every refresh - Akeyless persists the new value after each successful refresh, so the previous value becomes invalid. - `openai_url` string - `oracle_creation_statements` string - `oracle_revocation_statements` string - `oracle_wallet_details` WalletDetails - `login_type` string - `p12_data_base64` string - `sso_data_base64` string - `organization_id` string - `password` string - `password_length` integer - `password_policy` string - `password_policy_info` PasswordPolicyInfo - `password_length` integer - `use_capital_letters` boolean - `use_lower_letters` boolean - `use_numbers` boolean - `use_special_characters` boolean - `payload` string - `ping_url` string - `postgres_creation_statements` string - `postgres_revocation_statements` string - `preserve_existing_password_settings` boolean: Internal marker for DS update flows: when true, keep the persisted password settings and merge explicit rule updates on top. - `privileged_user` string - `project_id` string - `rabbitmq_server_password` string - `rabbitmq_server_uri` string - `rabbitmq_server_user` string - `rabbitmq_user_conf_permission` string - `rabbitmq_user_read_permission` string - `rabbitmq_user_tags` string - `rabbitmq_user_vhost` string - `rabbitmq_user_write_permission` string - `rdp_fixed_user_name_sub_claim_key` string - `redirect_uris` string[] - `redshift_creation_statements` string - `restricted_scopes` string[] - `revoke_sync_url` string - `rotate_sync_url` string - `scopes` string[] - `secure_remote_access_details` SecureRemoteAccess - `account_id` string - `allow_port_forwarding` boolean - `allow_providing_external_username` boolean - `bastion_api` string - `bastion_issuer` string - `bastion_issuer_id` integer - `bastion_ssh` string - `block_concurrent_connections` boolean - `block_concurrent_connections_level` string - `category` string - `connection_delay_seconds` integer - `dashboard_url` string - `db_name` string - `domain` string - `enable` boolean - `endpoint` string - `enforce_hosts_restriction` boolean - `gw_cluster_id` integer - `host` string[] - `host_provider_type` string - `is_cli` boolean - `is_desktop_app` boolean - `is_web` boolean - `isolated` boolean - `lock_during_sra_session` boolean - `native` boolean - `rd_gateway_server` string - `rdp_user` string - `region` string - `rotate_after_disconnect` boolean - `rotate_after_disconnect_delay_mins` integer - `schema` string - `ssh_password` boolean - `ssh_private_key` boolean - `ssh_user` string - `status_info` ItemSraStatus - `count_by_host_info` object - `count_info` object - `hosts_in_use` string[] - `is_in_use` boolean - `last_used_item` string, date-time - `target_hosts` TargetNameWithHosts[] - `hosts` string[] - `target_name` string - `targets` string[] - `url` string - `use_internal_bastion` boolean - `web_proxy` boolean - `session_extension_warn_interval_min` integer - `sf_account` string - `sf_auth_mode` string - `sf_key_algo` string - `sf_user_role` string: generated users info - `sf_warehouse_name` string - `should_stop` string: TODO delete this after migration - `signing_algorithm` string - `skip_dry_run` boolean - `skip_server_name_validation` string: (Optional) SkipServerNameValidation disables server name verification while still validating the certificate chain. Postgres treats empty as legacy "skip hostname validation"; MySQL treats empty as false. - `ssl_connection_certificate` string: (Optional) SSLConnectionCertificate defines the certificate for SSL connection. Must be base64 certificate loaded by UI using file loader field - `ssl_connection_mode` boolean: (Optional) SSLConnectionMode defines if SSL mode will be used to connect to DB - `subject_dn` string - `tags` string[] - `timeout_seconds` integer - `use_gw_cloud_identity` boolean - `use_gw_service_account` boolean - `user_name` string - `user_password` string - `user_principal_name` string - `user_ttl` string - `username_length` integer - `username_policy` string - `username_template` string - `venafi_allow_subdomains` boolean - `venafi_allowed_domains` string[] - `venafi_api_key` string - `venafi_auto_generated_folder` string - `venafi_base_url` string - `venafi_root_first_in_chain` boolean - `venafi_sign_using_akeyless_pki` boolean - `venafi_signer_key_name` string - `venafi_store_private_key` boolean - `venafi_tpp_access_token` string - `venafi_tpp_client_id` string - `venafi_tpp_password` string: Deprecated: VenafiAccessToken and VenafiRefreshToken should be used instead - `venafi_tpp_refresh_token` string - `venafi_tpp_username` string: Deprecated: VenafiAccessToken and VenafiRefreshToken should be used instead - `venafi_use_tpp` boolean - `venafi_zone` string - `warn_before_user_expiration_min` integer ## Other responses - `default`: errorResponse wraps any error to return it as a JSON object with one "error" field. ## Changes - **2026-11-03** `4e133adcd48a`: 1 info - endpoint added [Operation history](https://skmtc.dev/akeyless/apis/akeyless-api/changes/dynamic-secret-create-aerospike/post.md) --- [API](https://skmtc.dev/akeyless/apis/akeyless-api.md) - [All operations](https://skmtc.dev/akeyless/apis/akeyless-api/llms.txt) - [OpenAPI document](https://skmtc.dev/akeyless/apis/akeyless-api/revisions/4e133adcd48a?raw)