ara-enabledboolean
Enable or disable Agentic Runtime Authority rule enforcement for this item.
When false, user-defined input/output rules are stored but not enforced;
the base security validation still runs.
AraEnabled is tri-state (nil/true/false), not a plain bool: it self-encodes
its wire value (see akl.OptionalBool) so an explicit false survives the
curl-proxy relay instead of being dropped like a default-false bool flag.
authentication-credentialsstring
The credentials to connect with use-user-creds/use-target-creds
custom-payloadstring
Secret payload to be sent with rotation request
delete_protectionstring
Protection from accidental deletion of this object [true/false]
descriptionstring
Description of the object
enable-agentic-runtime-authorityboolean
EnableAra is the documented spelling of AraEnabled. Both set the same
field; --ara-enabled shipped first and stays as an undocumented alias
so existing scripts and the Terraform provider keep working.
enable-ai-quorumboolean
Turns on AI Quorum checks for this item.
enable-password-policystring
host-providerstring
Host provider type [explicit/target], Default Host provider is explicit, Relevant only for SRA items.
input-rulestring[]
Agentic input rule in name=...,rule=... format (e.g. name=rule1,rule=Sanitize input)
item-custom-fieldsobject
Additional custom fields to associate with the item
jsonboolean
Set output format to JSON
lock-during-sra-sessionstring
Lock this secret for read/update while an SRA session is active
lock-on-readstring
Lock this secret after each successful value read
max-versionsstring
Set the maximum number of versions, limited by the account settings defaults.
output-rulestring[]
Agentic output rule in name=...,rule=... format (e.g. name=rule1,rule=Mask secrets)
password-lengthstring
The length of the password to be generated
rotate-after-disconnectstring
StringOrBool accepts JSON strings, booleans, and numbers for backward
compatibility with older SDK versions that send boolean values for
rotate-after-disconnect.
rotate-on-unlockstring
Rotate this secret after it is unlocked
rotation-event-instring[]
How many days before the rotation of the item would you like to be notified
secure-access-allow-external-userboolean
Allow providing external user for a domain users
secure-access-bastion-issuerstring
Deprecated. use secure-access-certificate-issuer
secure-access-certificate-issuerstring
Path to the SSH Certificate Issuer for your Akeyless Secure Access
secure-access-enablestring
Enable/Disable secure remote access [true/false]
secure-access-enforce-hosts-restrictionboolean
Enforce connections only to allowed SRA hosts
secure-access-hoststring[]
Target servers for connections (In case of Linked Target association, host(s) will inherit Linked Target hosts - Relevant only for Dynamic Secrets/producers)
secure-access-rdp-domainstring
Default domain name server. i.e. microsoft.com
secure-access-rdp-userstring
Override the RDP Domain username
secure-access-ssh-userstring
Override the SSH username as indicated in SSH Certificate Issuer
secure-access-urlstring
Destination URL to inject secrets
secure-access-webboolean
Enable Web Secure Remote Access
secure-access-web-browsingboolean
Secure browser via Akeyless's Secure Remote Access (SRA)
secure-access-web-proxyboolean
Web-Proxy via Akeyless's Secure Remote Access (SRA)
skip-dry-runboolean
If set, dry-run will be skipped [true/false]
tagsstring[]
Add tags attached to this object
targetstring[]
A list of targets to be associated with an SRA item, To specify multiple targets use argument multiple times
target-namestring required
The target name to associate
timeout-secinteger
Maximum allowed time in seconds for the custom rotator to return the results
tokenstring
Authentication token (see /auth and /configure)
uid-tokenstring
The universal identity token, Required only for universal_identity authentication
use-capital-lettersstring
Specifies whether the generated temporary password must contain at least one uppercase character from the ISO basic Latin alphabet (A to Z). [true/false]
use-lower-lettersstring
Specifies whether the generated temporary password must contain at least one lowercase character from the ISO basic Latin alphabet (a to z). [true/false]
use-numbersstring
Specifies whether the generated temporary password must contain at least one numeric character (0 to 9). [true/false]
use-special-charactersstring