Add Vault Account - DYNAMIC

1 min

POST

{{url}}/aioc-rest-web/rest/sc/sapm/addSapmAccount

Request Overview

This API allows a Vault account to be added. The account can be of type STATIC or DYNAMIC, and additional parameters may be included based on the use case (such as SSH key passphrases or device bindings). The response will include the created Vault account.

Required Parameters

secretName: Name of the secret associated with the Vault account.
privateType: Indicates whether the account is private.
secretType: Type of the secret (e.g., STATIC).
password: Password associated with the account.
sapmGroupdbId: ID of the SAPM group database.
sapmConfigId: ID of the SAPM configuration.
passwordChangePeriod: Period after which the password will be changed.

Optional Parameters

sapmUserName: Username to be associated with the secret
deviceId: UUID of the device to bind the Vault account to
sshKeyPassphrase: Passphrase used if the password field represents an SSH private key

Add Vault Account parameters

POST /rest/sc/sapm/addSapmAccount accepts SapmRequestModel. Request field names differ from the SAPM account object returned in the response.

JSON field	Type	Required	Description
`secretName`	String	Yes	Vault account name. `/` is not allowed.
`sapmConfigId`	Long	Yes	Existing Vault configuration ID. Use a configuration whose strategy matches the account type.
`secretType`	String	Yes	Account type, such as `STATIC` or `DYNAMIC`.
`sapmUserName`	String	Config-dependent	Username stored by credential-based configurations.
`password` / `secretData`	String / Object	Config-dependent	Initial secret in the format expected by the selected configuration.
`privateType`	String	No	Private-account option, normally `YES` or `NO`; server configuration may supply or lock the value.
`sapmGroupDbId`	Long	No	Parent Vault group database ID.
`passwordChangePeriod`	String	No	Rotation interval in days. The server stores it internally in minutes.
`passwordChangePeriodCronExpression`	String	No	Cron-based rotation schedule.
`masterSapmDbId`	Long	No	Master SAPM account database ID when the selected strategy requires one.
`description`	String	No	Account description.
`secretNotes`	String	No	Encrypted notes; maximum length is 100,000 characters.
`permissions`	Array	No	Initial account permissions.
`accountLevelProperties`	Object	No	Configuration-specific account properties.

Response-only fields such as validationStatus, passwordSeenStatus, groupFullPath, createdAt, and updatedAt must not be sent as configuration inputs.

DYNAMIC request example

This request is a runnable JSON example for an interval-based DYNAMIC account. Replace sapmConfigId, sapmGroupDbId, and the sample secret with values from the target environment. For cron scheduling, omit passwordChangePeriod and send passwordChangePeriodCronExpression.

Path Parameters

urlstring
Default
url

Header Parameters

Content-Typestring
Default
application/json
Cookiestring
Default
{{netrightCookie}}
X-XSRF-TOKENstring
Default
{{csrftoken}}

Body Parameters

bodyobject
Default
{ "secretName": "dynamic-db-password", "sapmUserName": "app_user", "password": "CHANGE_ME", "privateType": "YES", "secretType": "DYNAMIC", "sapmConfigId": 12345, "sapmGroupDbId": 383826, "passwordChangePeriod": "1" }

Responses

200

Add Vault Account - DYNAMIC

curl

curl --request POST \
     --url {{url}}/aioc-rest-web/rest/sc/sapm/addSapmAccount \
     --header 'accept: application/json' \
     --header 'content-type: application/json' \
     --cookie {{netrightCookie}}  \
     --header 'x-xsrf-token: {{csrftoken}}' \
     --data '"{\n  \"secretName\": \"dynamic-db-password\",\n  \"sapmUserName\": \"app_user\",\n  \"password\": \"CHANGE_ME\",\n  \"privateType\": \"YES\",\n  \"secretType\": \"DYNAMIC\",\n  \"sapmConfigId\": 12345,\n  \"sapmGroupDbId\": 383826,\n  \"passwordChangePeriod\": \"1\"\n}"'

javascript

var myHeaders = new Headers();
myHeaders.append("accept", "application/json");
myHeaders.append("content-type", "application/json");
myHeaders.append("cookie", "{{netrightCookie}} ");
myHeaders.append("x-xsrf-token", "{{csrftoken}}");

var raw = JSON.stringify("{\n  \"secretName\": \"dynamic-db-password\",\n  \"sapmUserName\": \"app_user\",\n  \"password\": \"CHANGE_ME\",\n  \"privateType\": \"YES\",\n  \"secretType\": \"DYNAMIC\",\n  \"sapmConfigId\": 12345,\n  \"sapmGroupDbId\": 383826,\n  \"passwordChangePeriod\": \"1\"\n}");

var requestOptions = {
   method: 'POST',
   headers: myHeaders,
   body: raw,
   redirect: 'follow'
};

fetch("{{url}}/aioc-rest-web/rest/sc/sapm/addSapmAccount", requestOptions)
   .then(response => response.text())
   .then(result => console.log(result))
   .catch(error => console.log('error', error));

ruby

require "uri"
require "json"
require "net/http"

url = URI("{{url}}/aioc-rest-web/rest/sc/sapm/addSapmAccount")

http = Net::HTTP.new(url.host, url.port);
request = Net::HTTP::Post.new(url)
request["accept"] = "application/json"
request["content-type"] = "application/json"
request["cookie"] = "{{netrightCookie}} "
request["x-xsrf-token"] = "{{csrftoken}}"
request.body = JSON.dump("{\n  \"secretName\": \"dynamic-db-password\",\n  \"sapmUserName\": \"app_user\",\n  \"password\": \"CHANGE_ME\",\n  \"privateType\": \"YES\",\n  \"secretType\": \"DYNAMIC\",\n  \"sapmConfigId\": 12345,\n  \"sapmGroupDbId\": 383826,\n  \"passwordChangePeriod\": \"1\"\n}")

response = http.request(request)
puts response.read_body

python

import requests
import json

url = "{{url}}/aioc-rest-web/rest/sc/sapm/addSapmAccount"

payload = json.dumps("{\n  \"secretName\": \"dynamic-db-password\",\n  \"sapmUserName\": \"app_user\",\n  \"password\": \"CHANGE_ME\",\n  \"privateType\": \"YES\",\n  \"secretType\": \"DYNAMIC\",\n  \"sapmConfigId\": 12345,\n  \"sapmGroupDbId\": 383826,\n  \"passwordChangePeriod\": \"1\"\n}")
headers = {
   'accept': 'application/json',
   'content-type': 'application/json',
   'cookie': '{{netrightCookie}} ',
   'x-xsrf-token': '{{csrftoken}}'
}

response = requests.request("POST", url, headers=headers, data=payload)

print(response.text)

200

{
  "dbId": 2000001,
  "device": null,
  "secretName": "dynamic-db-password",
  "config": {
    "configId": 12345,
    "name": "Example Dynamic Configuration",
    "description": "Example dynamic configuration",
    "strategy": "DYNAMIC",
    "properties": {}
  },
  "changePeriod": 1440,
  "username": "app_user",
  "description": null,
  "secretNotes": null,
  "lastChangeTime": null,
  "nextChangeTime": 1893542400000,
  "passwordSeenStatus": "UNSEEN",
  "validationStatus": "UNKNOWN",
  "masterAccountId": null,
  "accountLevelProperties": {},
  "permissions": [],
  "identicalSapmAccounts": [],
  "parentSapmGroup": {
    "dbId": 383826,
    "id": "00000000-0000-4000-8000-000000000001",
    "name": "Example Group",
    "description": null
  },
  "secretType": "DYNAMIC",
  "owner": {
    "id": "00000000-0000-4000-8000-000000000002",
    "eid": "example.admin"
  },
  "createdAt": 1893456000000,
  "updatedAt": 1893456000000,
  "managers": [],
  "userPermissionLevel": 6,
  "approvalStatus": null,
  "groupFullPath": "/Example Group",
  "approvedBy": null,
  "approvedDate": null,
  "approvalRequired": false
}