api-idstring
API ID to rotate (relevant only for rotator-type=api-key)
api-keystring
API key to rotate (relevant only for rotator-type=api-key)
application-idstring
Id of the azure app that hold the serect to be rotated (relevant only for rotator-type=api-key)
ara-enabledboolean
Enable or disable Agentic Runtime Authority rule enforcement for this item.
When false, user-defined input/output rules are stored but not enforced;
the base security validation still runs.
AraEnabled is tri-state (nil/true/false), not a plain bool: it self-encodes
its wire value (see akl.OptionalBool) so an explicit false survives the
curl-proxy relay instead of being dropped like a default-false bool flag.
authentication-credentialsstring
The credentials to connect with use-user-creds/use-target-creds
delete_protectionstring
Protection from accidental deletion of this object [true/false]
descriptionstring
Description of the object
enable-agentic-runtime-authorityboolean
EnableAra is the documented spelling of AraEnabled. Both set the same
field; --ara-enabled shipped first and stays as an undocumented alias
so existing scripts and the Terraform provider keep working.
enable-ai-quorumboolean
Turns on AI Quorum checks for this item.
explicitly-set-sastring
If set, explicitly provide the storage account details [true/false]
grace-rotationstring
Enable graceful rotation (keep both versions temporarily). When enabled, a new secret version is created while the previous version is kept for the grace period, so both versions exist for a limited time. [true/false]
grace-rotation-hourinteger
The Hour of the grace rotation in UTC
grace-rotation-intervalstring
The number of days to wait before deleting the old key (must be bigger than rotation-interval)
grace-rotation-timingstring
When to create the new version relative to the rotation date [after/before]
input-rulestring[]
Agentic input rule in name=...,rule=... format (e.g. name=rule1,rule=Sanitize input)
item-custom-fieldsobject
Additional custom fields to associate with the item
jsonboolean
Set output format to JSON
lock-during-sra-sessionstring
Lock this secret for read/update while an SRA session is active
lock-on-readstring
Lock this secret after each successful value read
max-versionsstring
Set the maximum number of versions, limited by the account settings defaults.
output-rulestring[]
Agentic output rule in name=...,rule=... format (e.g. name=rule1,rule=Mask secrets)
passwordstring
The password for the user principal name to rotate (relevant only for rotator-type=password)
password-lengthstring
The length of the password to be generated
resource-group-namestring
The resource group name (only relevant when explicitly-set-sa=true)
resource-namestring
The name of the storage account (only relevant when explicitly-set-sa=true)
rotate-after-disconnectstring
StringOrBool accepts JSON strings, booleans, and numbers for backward
compatibility with older SDK versions that send boolean values for
rotate-after-disconnect.
rotate-on-unlockstring
Rotate this secret after it is unlocked
rotation-event-instring[]
How many days before the rotation of the item would you like to be notified
rotator-typestring required
The rotator type. options: [target/password/api-key/azure-storage-account]
secure-access-disable-concurrent-connectionsboolean
Enable this flag to prevent simultaneous use of the same secret
secure-access-enablestring
Enable/Disable secure remote access [true/false]
secure-access-urlstring
Destination URL to inject secrets
secure-access-webboolean
Enable Web Secure Remote Access
secure-access-web-browsingboolean
Secure browser via Akeyless's Secure Remote Access (SRA)
secure-access-web-proxyboolean
Web-Proxy via Akeyless's Secure Remote Access (SRA)
skip-dry-runboolean
If set, dry-run will be skipped [true/false]
storage-account-key-namestring
The name of the storage account key to rotate [key1/key2/kerb1/kerb2] (relevat to azure-storage-account)
tagsstring[]
Add tags attached to this object
target-namestring required
The target name to associate
tokenstring
Authentication token (see /auth and /configure)
uid-tokenstring
The universal identity token, Required only for universal_identity authentication
use-capital-lettersstring
Specifies whether the generated temporary password must contain at least one uppercase character from the ISO basic Latin alphabet (A to Z). [true/false]
use-lower-lettersstring
Specifies whether the generated temporary password must contain at least one lowercase character from the ISO basic Latin alphabet (a to z). [true/false]
use-numbersstring
Specifies whether the generated temporary password must contain at least one numeric character (0 to 9). [true/false]
use-special-charactersstring
usernamestring
The user principal name to rotate his password (relevant only for rotator-type=password)