Managing Ephemeral Accounts (leaseRenew and revoke)
In addition to the standard parameters described in the table above, the AAPM password request endpoint accepts two more parameters when the target account is an ephemeral account: leaseRenew and revoke.
Prerequisite: To use lease renewal and revocation, create the AAPM token at the vault group level of the ephemeral base account, not for individual ephemeral accounts. This way, every ephemeral account generated from that group automatically falls within the token's scope, so you don't need to create a separate token for each new ephemeral account.
Parameter Name | Parameter Value | Description |
|---|---|---|
leaseRenew | true | Extends the lifetime of an existing ephemeral account so it continues to be used without being deleted. |
revoke | true | Revokes the ephemeral account on demand before its time to live (TTL) expires, and deletes the account from the target. |
Example — Lease Renewal Request
GET https://<HOST>/aioc-rest-web/rest/aapm/request/password?
passwordExpirationInMinute=30&comment=test&token=508f0536-357c-4856-90ea-cff0843ef051&
sapmAccountPath=/LinuxBase&sapmAccountName=sshbase_vja1vk&responseType=json&
tenantId=host&leaseRenew=true
The system returns the following response: "Lease renewed successfully."
Example — Revocation Request
GET https://<HOST>/aioc-rest-web/rest/aapm/request/password?
token=508f0536-357c-4856-90ea-cff0843ef051&sapmAccountPath=/LinuxBase&
sapmAccountName=sshbase_vja1vk&responseType=json&tenantId=host&revoke=true
The system returns the following response: "Account revoked successfully."
Note: Do not use passwordChangeRequired together with leaseRenew or revoke in the same request.
Error: passwordChangeRequired cannot be used with leaseRenew or revoke.