Updating a Secret

Function

This API is used to update the metadata of a specified secret.

Constraints

This API can be used to modify only the secret metadata, not the secret value.

Calling Method

For details, see Calling APIs.

URI

PUT /v1/{project_id}/secrets/{secret_name}

**Table 1** Path Parameters
Parameter	Mandatory	Type	Description
project_id	Yes	String	Definition Project ID. For details, see Obtaining a Project ID. Constraints N/A Range The value returned by the IAM API is used, which contains 32 characters. Default Value N/A
secret_name	Yes	String	Definition Secret name. Constraints N/A Range The value must match the regular expression ^[a-zA-Z0-9_-]{1,64}$. Default Value N/A

Request Parameters

**Table 2** Request header parameters
Parameter	Mandatory	Type	Description
X-Auth-Token	Yes	String	Definition User token. It can be obtained by calling the IAM API. The value of X-Subject-Token in the response header is the user token. This parameter is optional if AK/SK authentication is used. Constraints N/A Range Obtain the value by calling the IAM API for obtaining the user token. Default Value N/A

**Table 3** Request body parameters
Parameter	Mandatory	Type	Description
kms_key_id	No	String	Definition ID of the KMS CMK used to encrypt secrets. If this parameter is not specified, the default master key csms/default will be used. If the CMK you specified does not exist under your account, it will be automatically created. Constraints N/A Range The value must match the regular expression ^[0-9a-z]{8}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{12}$. Default Value N/A
description	No	String	Definition Secret description Constraints N/A Range N/A Default Value N/A
auto_rotation	No	Boolean	Definition Automatic rotation. This parameter can be configured only for secrets of specific types. Constraints N/A Range true: enabled, false: disabled (default) Default Value false
rotation_period	No	String	Definition Rotation period. This parameter is mandatory when automatic rotation is enabled. Constraints Integer[unit]. Integer indicates the time length. unit indicates the time unit, which can be d (day), h (hour), m (minute), or s (second). For example, 1d and 24h indicate one day. Range 4 hours to 8,760 hours (365 days) Default Value N/A
event_subscriptions	No	Array of strings	Definition Events to which a secret is subscribed. When a basic event is triggered, a message is sent to the topic corresponding to the event. Constraints Currently, only one event can be subscribed to. Range N/A Default Value N/A
rotation_func_urn	No	String	Definition Secret rotation function, which is the URN of the FunctionGraph function. This parameter is mandatory when automatic rotation is enabled. Constraints A secret rotation function has been created. Range N/A Default Value N/A

Response Parameters

Status code: 200

**Table 4** Response body parameters
Parameter	Type	Description
secret	Secret object	Definition Secret details. Range N/A

**Table 5** Secret
Parameter	Type	Description
id	String	Definition Secret ID Range N/A
name	String	Definition Secret name Range N/A
state	String	Definition Secret status Range ENABLED DISABLED PENDING_DELETE FROZEN
kms_key_id	String	Definition ID of the KMS CMK used to encrypt secret values Range N/A
description	String	Definition Secret description Range N/A
create_time	Long	Definition Timestamp when a secret was created, that is, total number of milliseconds since January 1, 1970. Range N/A
update_time	Long	Definition Timestamp when a secret was last updated, that is, the total number of milliseconds since January 1, 1970. Range N/A
scheduled_delete_time	Long	Definition Timestamp when a secret is to be deleted as scheduled, that is, total number of milliseconds since January 1, 1970. If a secret is not in the Pending deletion state, the value of this parameter is null. Range N/A
secret_type	String	Definition Secret type Range COMMON: shared secret (default). It is used to store sensitive information in an application system. RDS: RDS secret. It is used to store RDS account information. (This value is no longer supported and is replaced by RDS-FG.) RDS-FG: RDS secret. It is used to store RDS account information. GaussDB-FG: TaurusDB secret. It is used to store TaurusDB account information.
auto_rotation	Boolean	Definition Automatic rotation Range true: enabled, false: disabled (default)
rotation_period	String	Definition Rotation period Range 4 hours to 8,760 hours (365 days)
rotation_config	String	Definition Rotation configuration Range The value can contain at most 1,024 characters. If secret_type is set to RDS-FG or GaussDB-FG, set this parameter to {"InstanceId":"","SecretSubType":""}. Note: This parameter is mandatory when secret_type is set to RDS-FG or GaussDB-FG. InstanceId indicates the instance ID, and SecretSubType indicates the rotation subtype. The value can be SingleUser or MultiUser. SingleUser: Single-user rotation is used. A new password is created for the account for each rotation. MultiUser: Multi-user rotation is used. The users are labeled as SYSCURRENT and SYSPREVIOUS, respectively. During secret rotation, the password of the user labeled by SYSPREVIOUS will be reset to a random one. Then, the user labels of SYSCURRENT and SYSPREVIOUS are exchanged.
rotation_time	Long	Definition Rotation timestamp. Range N/A
next_rotation_time	Long	Definition Next rotation timestamp. Range N/A
last_used_time	Long	Definition Time when the secret value was last obtained. Range N/A
event_subscriptions	Array of strings	Definition Events to which a secret is subscribed. Currently, only one event can be subscribed to. When a basic event is triggered, a message is sent to the topic corresponding to the event. Range N/A
enterprise_project_id	String	Definition Enterprise project ID. Range N/A
rotation_func_urn	String	Definition URN of the FunctionGraph function Range N/A
domain_id	String	Definition ID of the tenant to which the secret belongs. Range N/A
replica_type	String	Definition Multi-region secret type Range STANDALONE: There is no multi-region replica for the current secret. PRIMARY: There are multi-region replicas for the current secret. This secret is the primary one. REPLICA: There are multi-region replicas for the current secret. This secret is the replica one.
replicas	Array of Replica objects	Definition Replica secret information. Range N/A

**Table 6** Replica
Parameter	Type	Description
id	String	Definition Secret ID Range N/A
kms_key_id	String	Definition ID of the KMS key used to encrypt secret values Range N/A
project_id	String	Definition ID of the project to which the secret belongs Range N/A
region	String	Definition Name of the region to which the secret belongs Range N/A
replica_type	String	Definition Multi-region secret type Range PRIMARY: primary secret REPLICA: replica secret
status	String	Definition Replica secret synchronization status Range IN_PROGRESS: The replica secret is to be synchronized. IN_SYNC: The replica secret is synchronized with the primary secret. FAILED: The replica secret fails to be synchronized with the primary secret.
created_at	Long	Definition Creation timestamp. Range N/A
updated_at	Long	Definition Update timestamp. Range N/A

Example Requests

Update a secret. Change its KMS key ID to 0001293d-fa52-4256-b5bb-661dea066b39 and description to update description.

{
  "kms_key_id" : "0001293d-fa52-4256-b5bb-661dea066b39",
  "description" : "update description",
  "event_subscriptions" : [ "pocEvent2" ]
}

Example Responses

Status code: 200

Request succeeded.

{
  "secret" : {
    "id" : "bb6a3d22-dc93-47ac-b5bd-88df7ad35f1e",
    "name" : "test",
    "state" : "ENABLED",
    "kms_key_id" : "0001293d-fa52-4256-b5bb-661dea066b39",
    "description" : "description",
    "create_time" : 1581507580000,
    "update_time" : 1581507580000,
    "scheduled_delete_time" : 1581507580000,
    "secret_type" : "RDS-FG",
    "auto_rotation" : true,
    "rotation_config" : "{'InstanceId':'instance id','SecretSubType':'MultiUser'}",
    "rotation_period" : "1d",
    "rotation_time" : 1668567940000,
    "next_rotation_time" : 1668629140000,
    "event_subscriptions" : [ "pocEvent" ],
    "rotation_func_urn" : "urn:fss:{region}:46b6f338fc3445b8846c71dfb1fbxxxx:function:default:test2-0:latest"
  }
}