Sign in
Secrets

Create a credential injection route

Requires an owner/admin browser session with recent MFA. Secret values are accepted only for create/rotate requests, never returned, and sensitive route hardening headers are advertised for mutation calls. Credential injection routes bind a secret to one tenant agent and an explicit allowlisted upstream host/path/method/header. Broad host, path, method, internal-host, line-break, and unsafe header injection patterns are rejected by the API.

post/secrets/routes

Headers

X-Steward-Request-Timestampstring

Unix seconds, Unix milliseconds, or HTTP/ISO timestamp. Sensitive mutating routes require this or X-Steward-Request-Expires-At when request-expiry or request signatures are enforced.

X-Steward-Request-Expires-Atstring

Unix seconds, Unix milliseconds, or HTTP/ISO expiry time. Sensitive mutating routes require this or X-Steward-Request-Timestamp when request-expiry or request signatures are enforced.

X-Steward-Signaturestring

Authorization signature for sensitive mutating routes when STEWARD_REQUIRE_AUTH_SIGNATURE=true or production enforcement is enabled. Use v1=<hmac-sha256> or p256=<signature>.

X-Steward-Signing-Key-Idstring

Tenant request-signing key id used to select a managed HMAC signing key. Required when signing with a managed tenant key; omit only for static or app-client signing secrets.

Idempotency-Keystring

Required for signed sensitive requests and recommended for all sensitive mutating requests. Replays are scoped to authenticated or explicitly signed contexts.

Request body

agentIdstring required
hostPatternstring required
pathPatternstring
method'*' | 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE' | 'HEAD'
injectAs'header' required
injectKeystring required
injectFormatstring
injectionStrategy'header' | 'sigv4'
priorityinteger
enabledboolean
secretIdstring required

Response

JSON response

oktrue required

Changes

Changed in 2 of the 9 revisions of this API.5

  • 0397c6d8e6844See the full diff
    • ○

      added the new optional request property injectionConfig

      new-optional-request-property

    • ○

      added the new optional request property injectionStrategy

      new-optional-request-property

    • ○

      added the required property data/injectionConfig to the response with the 201 status

      response-required-property-added

    • ○

      added the required property data/injectionStrategy to the response with the 201 status

      response-required-property-added

  • 261a7c8070b21See the full diff
    • ○

      endpoint added

      endpoint-added

    This revision also has 6 changes that name no endpoint, such as unreferenced schemas being removed. See the revision's changelog