Add Vault Account - DYNAMIC

Request Overview

This API allows a Vault account to be added. The account can be of type STATIC or DYNAMIC, and additional parameters may be included based on the use case (such as SSH key passphrases or device bindings). The response will include the created Vault account.

Required Parameters

• secretName: Name of the secret associated with the Vault account.

• privateType: Indicates whether the account is private.

• secretType: Type of the secret (e.g., STATIC).

• password: Password associated with the account.

• sapmGroupdbId: ID of the SAPM group database.

• sapmConfigId: ID of the SAPM configuration.

• passwordChangePeriod: Period after which the password will be changed.

Optional Parameters

• sapmUserName: Username to be associated with the secret

• deviceId: UUID of the device to bind the Vault account to

• sshKeyPassphrase: Passphrase used if the password field represents an SSH private key

---

Add Vault Account parameters

POST /rest/sc/sapm/addSapmAccount accepts SapmRequestModel. Request field names differ from the SAPM account object returned in the response.

JSON field	Type	Required	Description
secretName	String	Yes	Vault account name. / is not allowed.
sapmConfigId	Long	Yes	Existing Vault configuration ID. Use a configuration whose strategy matches the account type.
secretType	String	Yes	Account type, such as STATIC or DYNAMIC.
sapmUserName	String	Config-dependent	Username stored by credential-based configurations.
password / secretData	String / Object	Config-dependent	Initial secret in the format expected by the selected configuration.
privateType	String	No	Private-account option, normally YES or NO; server configuration may supply or lock the value.
sapmGroupDbId	Long	No	Parent Vault group database ID.
passwordChangePeriod	String	No	Rotation interval in days. The server stores it internally in minutes.
passwordChangePeriodCronExpression	String	No	Cron-based rotation schedule.
masterSapmDbId	Long	No	Master SAPM account database ID when the selected strategy requires one.
description	String	No	Account description.
secretNotes	String	No	Encrypted notes; maximum length is 100,000 characters.
permissions	Array	No	Initial account permissions.
accountLevelProperties	Object	No	Configuration-specific account properties.

Response-only fields such as validationStatus, passwordSeenStatus, groupFullPath, createdAt, and updatedAt must not be sent as configuration inputs.

---

DYNAMIC request example

This request is a runnable JSON example for an interval-based DYNAMIC account. Replace sapmConfigId, sapmGroupDbId, and the sample secret with values from the target environment. For cron scheduling, omit passwordChangePeriod and send passwordChangePeriodCronExpression.

curl --request POST \
     --url {{url}}/aioc-rest-web/rest/sc/sapm/addSapmAccount \
     --header 'accept: application/json' \
     --header 'content-type: application/json' \
     --cookie {{netrightCookie}}  \
     --header 'x-xsrf-token: {{csrftoken}}' \
     --data '"{\n  \"secretName\": \"dynamic-db-password\",\n  \"sapmUserName\": \"app_user\",\n  \"password\": \"CHANGE_ME\",\n  \"privateType\": \"YES\",\n  \"secretType\": \"DYNAMIC\",\n  \"sapmConfigId\": 12345,\n  \"sapmGroupDbId\": 383826,\n  \"passwordChangePeriod\": \"1\"\n}"'