vaultrs/api/transit/
requests.rs

1use super::responses::{
2    BackupKeyResponse, DecryptDataResponse, EncryptDataResponse, ExportKeyResponse,
3    GenerateDataKeyResponse, GenerateHmacResponse, GenerateRandomBytesResponse, HashDataResponse,
4    ListKeysResponse, ReadKeyResponse, ReadTransitCacheConfigurationResponse, RewrapDataResponse,
5    SignDataResponse, VerifySignedDataResponse,
6};
7use super::{HashAlgorithm, KeyType, MarshalingAlgorithm, OutputFormat, SignatureAlgorithm};
8use rustify_derive::Endpoint;
9use serde::Serialize;
10use std::fmt::Debug;
11
12/// ## Create Key
13/// This endpoint creates a new named encryption key of the specified type. The
14/// values set here cannot be changed after key creation.
15///
16/// * Path: {self.mount}/keys/{self.name}
17/// * Method: POST
18/// * Response: N/A
19/// * Reference: <https://developer.hashicorp.com/vault/api-docs/secret/transit#create-key>
20#[derive(Builder, Debug, Default, Endpoint, Serialize)]
21#[endpoint(
22    path = "{self.mount}/keys/{self.name}",
23    method = "POST",
24    builder = "true"
25)]
26#[builder(setter(into, strip_option), default)]
27pub struct CreateKeyRequest {
28    #[endpoint(skip)]
29    pub mount: String,
30    /// Specifies the name of the encryption key to create.
31    #[endpoint(skip)]
32    pub name: String,
33    /// If enabled, the key will support convergent encryption, where the same
34    /// plaintext creates the same ciphertext. This requires derived to be set
35    /// to true. When enabled, each encryption(/decryption/rewrap/datakey)
36    /// operation will derive a nonce value rather than randomly generate it.
37    pub convergent_encryption: Option<bool>,
38    /// Specifies if key derivation is to be used. If enabled, all
39    /// encrypt/decrypt requests to this named key must provide a context which
40    /// is used for key derivation.
41    pub derived: Option<bool>,
42    /// Enables keys to be exportable. This allows for all the valid keys in the
43    /// key ring to be exported. Once set, this cannot be disabled.
44    pub exportable: Option<bool>,
45    /// If set, enables taking backup of named key in the plaintext format. Once
46    /// set, this cannot be disabled.
47    pub allow_plaintext_backup: Option<bool>,
48    /// Specifies the type of key to create.
49    #[serde(rename = "type")]
50    pub key_type: Option<KeyType>,
51    /// The period at which this key should be rotated automatically. Setting
52    /// this to "0" (the default) will disable automatic key rotation. This
53    /// value cannot be shorter than one hour.
54    pub auto_rotate_period: Option<String>,
55}
56
57/// ## Read Key
58/// This endpoint returns information about a named encryption key. The keys
59/// object shows the creation time of each key version; the values are not the
60/// keys themselves. Depending on the type of key, different information may be
61/// returned, e.g. an asymmetric key will return its public key in a standard
62/// format for the type.
63///
64/// * Path: {self.mount}/keys/{self.name}
65/// * Method: GET
66/// * Response: ReadKeyResponse
67/// * Reference: <https://developer.hashicorp.com/vault/api-docs/secret/transit#read-key>
68#[derive(Builder, Debug, Default, Endpoint)]
69#[endpoint(
70    path = "{self.mount}/keys/{self.name}",
71    response = "ReadKeyResponse",
72    builder = "true"
73)]
74#[builder(setter(into), default)]
75pub struct ReadKeyRequest {
76    #[endpoint(skip)]
77    pub mount: String,
78    #[endpoint(skip)]
79    pub name: String,
80}
81
82/// ## List Keys
83/// This endpoint returns a list of keys. Only the key names are returned (not
84/// the actual keys themselves).
85///
86/// * Path: {self.mount}/keys
87/// * Method: LIST
88/// * Response: ListKeysResponse
89/// * Reference: <https://developer.hashicorp.com/vault/api-docs/secret/transit#list-keys>
90#[derive(Builder, Debug, Default, Endpoint)]
91#[endpoint(
92    path = "{self.mount}/keys",
93    response = "ListKeysResponse",
94    method = "LIST",
95    builder = "true"
96)]
97#[builder(setter(into), default)]
98pub struct ListKeysRequest {
99    #[endpoint(skip)]
100    pub mount: String,
101}
102
103/// ## Update Key Configuration
104/// This endpoint allows tuning configuration values for a given key. (These
105/// values are returned during a read operation on the named key.)
106///
107/// * Path: {self.mount}/keys/{self.name}/config
108/// * Method: POST
109/// * Response: N/A
110/// * Reference: <https://developer.hashicorp.com/vault/api-docs/secret/transit#update-key-configuration>
111#[derive(Builder, Debug, Default, Endpoint)]
112#[endpoint(
113    path = "{self.mount}/keys/{self.name}/config",
114    method = "POST",
115    builder = "true"
116)]
117#[builder(setter(into), default)]
118pub struct UpdateKeyConfigurationRequest {
119    #[endpoint(skip)]
120    pub mount: String,
121    #[endpoint(skip)]
122    pub name: String,
123    /// Specifies the minimum version of ciphertext allowed to be decrypted.
124    /// Adjusting this as part of a key rotation policy can prevent old copies
125    /// of ciphertext from being decrypted, should they fall into the wrong
126    /// hands. For signatures, this value controls the minimum version of
127    /// signature that can be verified against. For HMACs, this controls the
128    /// minimum version of a key allowed to be used as the key for verification.
129    pub min_decryption_version: Option<u64>,
130    /// Specifies the minimum version of the key that can be used to encrypt
131    /// plaintext, sign payloads, or generate HMACs. Must be 0 (which will use
132    /// the latest version) or a value greater or equal to
133    /// min_decryption_version.
134    pub min_encryption_version: Option<u64>,
135    /// Specifies if the key is allowed to be deleted.
136    pub deletion_allowed: Option<bool>,
137    /// Enables keys to be exportable. This allows for all the valid keys in the
138    /// key ring to be exported. Once set, this cannot be disabled.
139    pub exportable: Option<bool>,
140    /// If set, enables taking backup of named key in the plaintext format. Once
141    /// set, this cannot be disabled.
142    pub allow_plaintext_backup: Option<bool>,
143    /// The period at which this key should be rotated automatically. Setting
144    /// this to "0" will disable automatic key rotation. This value cannot be
145    /// shorter than one hour. When no value is provided, the period remains
146    /// unchanged.
147    pub auto_rotate_period: Option<String>,
148}
149
150/// ## Delete Key
151/// This endpoint deletes a named encryption key. It will no longer be possible
152/// to decrypt any data encrypted with the named key. Because this is a
153/// potentially catastrophic operation, the deletion_allowed tunable must be set
154/// in the key's `/config` endpoint.
155///
156/// * Path: {self.mount}/keys/{self.name}
157/// * Method: DELETE
158/// * Response: N/A
159/// * Reference: <https://developer.hashicorp.com/vault/api-docs/secret/transit#delete-key>
160#[derive(Builder, Debug, Default, Endpoint)]
161#[endpoint(
162    path = "{self.mount}/keys/{self.name}",
163    method = "DELETE",
164    builder = "true"
165)]
166#[builder(setter(into), default)]
167pub struct DeleteKeyRequest {
168    #[endpoint(skip)]
169    pub mount: String,
170    #[endpoint(skip)]
171    pub name: String,
172}
173
174/// ## Rotate Key
175/// This endpoint rotates the version of the named key. After rotation, new
176/// plaintext requests will be encrypted with the new version of the key. To
177/// upgrade ciphertext to be encrypted with the latest version of the key, use
178/// the rewrap endpoint. This is only supported with keys that support
179/// encryption and decryption operations.
180///
181/// * Path: {self.mount}/keys/{self.name}/rotate
182/// * Method: POST
183/// * Response: N/A
184/// * Reference: <https://developer.hashicorp.com/vault/api-docs/secret/transit#rotate-key>
185#[derive(Builder, Debug, Default, Endpoint)]
186#[endpoint(
187    path = "{self.mount}/keys/{self.name}/rotate",
188    method = "POST",
189    builder = "true"
190)]
191#[builder(setter(into), default)]
192pub struct RotateKeyRequest {
193    #[endpoint(skip)]
194    pub mount: String,
195    #[endpoint(skip)]
196    pub name: String,
197}
198
199/// ## Export Key
200/// This endpoint returns the named key. The keys object shows the value of the
201/// key for each version. If version is specified, the specific version will be
202/// returned. If latest is provided as the version, the current key will be
203/// provided. Depending on the type of key, different information may be
204/// returned. The key must be exportable to support this operation and the
205/// version must still be valid.
206///
207/// * Path: {self.mount}/export/{self.key_type}/{self.name}(/{self.version})
208/// * Method: GET
209/// * Response: ExportKeyResponse
210/// * Reference: <https://developer.hashicorp.com/vault/api-docs/secret/transit#export-key>
211#[derive(Builder, Debug, Default, Endpoint)]
212#[endpoint(
213    path = "{self.mount}/export/{self.key_type}/{self.name}{self.version}",
214    response = "ExportKeyResponse",
215    builder = "true"
216)]
217#[builder(setter(into), default)]
218pub struct ExportKeyRequest {
219    #[endpoint(skip)]
220    pub mount: String,
221    #[endpoint(skip)]
222    pub key_type: ExportKeyType,
223    #[endpoint(skip)]
224    pub name: String,
225    #[endpoint(skip)]
226    pub version: ExportVersion,
227}
228
229#[derive(Clone, Copy, Debug)]
230pub enum ExportKeyType {
231    EncryptionKey,
232    SigningKey,
233    HmacKey,
234}
235
236#[allow(clippy::derivable_impls)]
237impl Default for ExportKeyType {
238    fn default() -> Self {
239        ExportKeyType::EncryptionKey
240    }
241}
242
243impl std::fmt::Display for ExportKeyType {
244    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
245        match self {
246            Self::EncryptionKey => write!(f, "encryption-key"),
247            Self::SigningKey => write!(f, "signing-key"),
248            Self::HmacKey => write!(f, "hmac-key"),
249        }
250    }
251}
252
253#[derive(Clone, Copy, Debug)]
254pub enum ExportVersion {
255    All,
256    Latest,
257    Version(u64),
258}
259
260#[allow(clippy::derivable_impls)]
261impl Default for ExportVersion {
262    fn default() -> Self {
263        ExportVersion::Latest
264    }
265}
266
267impl std::fmt::Display for ExportVersion {
268    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
269        match self {
270            Self::All => Ok(()),
271            Self::Latest => write!(f, "/latest"),
272            Self::Version(n) => write!(f, "/{}", n),
273        }
274    }
275}
276
277/// ## Encrypt Data
278/// This endpoint encrypts the provided plaintext using the named key. This path
279/// supports the create and update policy capabilities as follows: if the user
280/// has the create capability for this endpoint in their policies, and the key
281/// does not exist, it will be upserted with default values (whether the key
282/// requires derivation depends on whether the context parameter is empty or
283/// not). If the user only has update capability and the key does not exist, an
284/// error will be returned.
285///
286/// * Path: {self.mount}/encrypt/{self.name}
287/// * Method: POST
288/// * Response: EncryptDataResponse
289/// * Reference: <https://developer.hashicorp.com/vault/api-docs/secret/transit#encrypt-data>
290#[derive(Builder, Debug, Default, Endpoint)]
291#[endpoint(
292    path = "{self.mount}/encrypt/{self.name}",
293    method = "POST",
294    response = "EncryptDataResponse",
295    builder = "true"
296)]
297#[builder(setter(into, strip_option), default)]
298pub struct EncryptDataRequest {
299    #[endpoint(skip)]
300    pub mount: String,
301    /// Specifies the name of the encryption key to encrypt against.
302    #[endpoint(skip)]
303    pub name: String,
304    /// Specifies base64 encoded plaintext to be encoded.
305    /// NOTE: All plaintext data must be base64-encoded. The reason for this
306    /// requirement is that Vault does not require that the plaintext is "text".
307    /// It could be a binary file such as a PDF or image. The easiest safe
308    /// transport mechanism for this data as part of a JSON payload is to
309    /// base64-encode it.
310    pub plaintext: String,
311    /// Specifies the base64 encoded context for key derivation. This is
312    /// required if key derivation is enabled for this key.
313    pub context: Option<String>,
314    /// Specifies the version of the key to use for encryption. If not set, uses
315    /// the latest version. Must be greater than or equal to the key's
316    /// min_encryption_version, if set.
317    pub key_version: Option<u64>,
318    /// Specifies the base64 encoded nonce value. This must be provided if
319    /// convergent encryption is enabled for this key and the key was generated
320    /// with Vault 0.6.1. Not required for keys created in 0.6.2+. The value
321    /// must be exactly 96 bits (12 bytes) long and the user must ensure that
322    /// for any given context (and thus, any given encryption key) this nonce
323    /// value is never reused.
324    pub nonce: Option<String>,
325    /// This parameter is required when encryption key is expected to be
326    /// created. When performing an upsert operation, the type of key to create.
327    pub key_type: Option<KeyType>,
328    /// This parameter will only be used when a key is expected to be created.
329    /// Whether to support convergent encryption. This is only supported when
330    /// using a key with key derivation enabled and will require all requests to
331    /// carry both a context and 96-bit (12-byte) nonce. The given nonce will be
332    /// used in place of a randomly generated nonce. As a result, when the same
333    /// context and nonce are supplied, the same ciphertext is generated. It is
334    /// very important when using this mode that you ensure that all nonces are
335    /// unique for a given context. Failing to do so will severely impact the
336    /// ciphertext's security.
337    pub convergent_encryption: Option<String>,
338}
339
340/// ## Decrypt Data
341/// This endpoint decrypts the provided ciphertext using the named key.
342///
343/// * Path: {self.mount}/decrypt/{self.name}
344/// * Method: POST
345/// * Response: DecryptDataResponse
346/// * Reference: <https://developer.hashicorp.com/vault/api-docs/secret/transit#decrypt-data>
347#[derive(Builder, Debug, Default, Endpoint)]
348#[endpoint(
349    path = "{self.mount}/decrypt/{self.name}",
350    method = "POST",
351    response = "DecryptDataResponse",
352    builder = "true"
353)]
354#[builder(setter(into, strip_option), default)]
355pub struct DecryptDataRequest {
356    #[endpoint(skip)]
357    pub mount: String,
358    /// Specifies the name of the encryption key to decrypt against.
359    #[endpoint(skip)]
360    pub name: String,
361    /// Specifies the ciphertext to decrypt.
362    pub ciphertext: String,
363    /// Specifies the base64 encoded context for key derivation. This is
364    /// required if key derivation is enabled.
365    pub context: Option<String>,
366    /// Specifies a base64 encoded nonce value used during encryption. Must be
367    /// provided if convergent encryption is enabled for this key and the key
368    /// was generated with Vault 0.6.1. Not required for keys created in 0.6.2+.
369    pub nonce: Option<String>,
370}
371
372/// ## Rewrap Data
373/// This endpoint rewraps the provided ciphertext using the latest version of
374/// the named key. Because this never returns plaintext, it is possible to
375/// delegate this functionality to untrusted users or scripts.
376///
377/// * Path: {self.mount}/rewrap/{self.name}
378/// * Method: POST
379/// * Response: RewrapDataResponse
380/// * Reference: <https://developer.hashicorp.com/vault/api-docs/secret/transit#rewrap-data>
381#[derive(Builder, Debug, Default, Endpoint)]
382#[endpoint(
383    path = "{self.mount}/rewrap/{self.name}",
384    method = "POST",
385    response = "RewrapDataResponse",
386    builder = "true"
387)]
388#[builder(setter(into, strip_option), default)]
389pub struct RewrapDataRequest {
390    #[endpoint(skip)]
391    pub mount: String,
392    /// Specifies the name of the encryption key to re-encrypt against.
393    #[endpoint(skip)]
394    pub name: String,
395    /// Specifies the ciphertext to re-encrypt.
396    pub ciphertext: String,
397    /// Specifies the base64 encoded context for key derivation. This is
398    /// required if key derivation is enabled.
399    pub context: Option<String>,
400    /// Specifies the version of the key to use for the operation. If not set,
401    /// uses the latest version. Must be greater than or equal to the key's
402    /// min_encryption_version, if set.
403    pub key_version: Option<u64>,
404    /// Specifies a base64 encoded nonce value used during encryption. Must be
405    /// provided if convergent encryption is enabled for this key and the key
406    /// was generated with Vault 0.6.1. Not required for keys created in 0.6.2+.
407    pub nonce: Option<String>,
408}
409
410/// ## Generate Data Key
411/// This endpoint generates a new high-entropy key and the value encrypted with
412/// the named key. Optionally return the plaintext of the key as well. Whether
413/// plaintext is returned depends on the path; as a result, you can use Vault
414/// ACL policies to control whether a user is allowed to retrieve the plaintext
415/// value of a key. This is useful if you want an untrusted user or operation to
416/// generate keys that are then made available to trusted users.
417///
418/// * Path: {self.mount}/datakey/{self.key_type}/{self.name}
419/// * Method: POST
420/// * Response: GenerateDataKeyResponse
421/// * Reference: <https://developer.hashicorp.com/vault/api-docs/secret/transit#generate-data-key>
422#[derive(Builder, Debug, Default, Endpoint)]
423#[endpoint(
424    path = "{self.mount}/datakey/{self.key_type}/{self.name}",
425    method = "POST",
426    response = "GenerateDataKeyResponse",
427    builder = "true"
428)]
429#[builder(setter(into, strip_option), default)]
430pub struct GenerateDataKeyRequest {
431    #[endpoint(skip)]
432    pub mount: String,
433    /// Specifies the type of key to generate. If plaintext, the plaintext key
434    /// will be returned along with the ciphertext. If wrapped, only the
435    /// ciphertext value will be returned.
436    #[endpoint(skip)]
437    pub key_type: DataKeyType,
438    /// Specifies the name of the encryption key to use to encrypt the datakey.
439    #[endpoint(skip)]
440    pub name: String,
441    /// Specifies the key derivation context, provided as a base64-encoded
442    /// string. This must be provided if derivation is enabled.
443    pub context: Option<String>,
444    /// Specifies a nonce value, provided as base64 encoded. Must be provided if
445    /// convergent encryption is enabled for this key and the key was generated
446    /// with Vault 0.6.1. Not required for keys created in 0.6.2+. The value
447    /// must be exactly 96 bits (12 bytes) long and the user must ensure that
448    /// for any given context (and thus, any given encryption key) this nonce
449    /// value is never reused.
450    pub nonce: Option<String>,
451    /// Specifies the number of bits in the desired key. Can be 128, 256, or
452    /// 512. Default is 256 bits.
453    pub bits: Option<u16>,
454}
455
456#[derive(Clone, Copy, Debug)]
457pub enum DataKeyType {
458    Plaintext,
459    Wrapped,
460}
461
462#[allow(clippy::derivable_impls)]
463impl Default for DataKeyType {
464    fn default() -> Self {
465        DataKeyType::Wrapped
466    }
467}
468
469impl std::fmt::Display for DataKeyType {
470    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
471        match self {
472            Self::Plaintext => write!(f, "plaintext"),
473            Self::Wrapped => write!(f, "wrapped"),
474        }
475    }
476}
477
478/// ## Generate Random Bytes
479/// This endpoint returns high-quality random bytes of the specified length.
480///
481/// * Path: {self.mount}/random(/{self.source})(/{self.bytes})
482/// * Method: POST
483/// * Response: GenerateRandomBytesResponse
484/// * Reference: <https://developer.hashicorp.com/vault/api-docs/secret/transit#generate-random-bytes>
485#[derive(Builder, Debug, Default, Endpoint)]
486#[endpoint(
487    path = "{self.mount}/random",
488    method = "POST",
489    response = "GenerateRandomBytesResponse",
490    builder = "true"
491)]
492#[builder(setter(into, strip_option), default)]
493pub struct GenerateRandomBytesRequest {
494    #[endpoint(skip)]
495    pub mount: String,
496    /// Specifies the number of bytes to return. Default is 32.
497    pub bytes: Option<u32>,
498    /// Specifies the output encoding.
499    pub format: OutputFormat,
500    /// Specifies the source of the requested bytes.
501    pub source: RandomBytesSource,
502}
503
504#[derive(Clone, Copy, Debug, Serialize)]
505#[serde(rename_all = "kebab-case")]
506pub enum RandomBytesSource {
507    /// Sources bytes from the platform's entropy source.
508    Platform,
509    /// Sources from entropy augmentation (enterprise only).
510    Seal,
511    /// Mixes bytes from all available sources.
512    All,
513}
514
515#[allow(clippy::derivable_impls)]
516impl Default for RandomBytesSource {
517    fn default() -> Self {
518        RandomBytesSource::Platform
519    }
520}
521
522/// ## Hash Data
523/// This endpoint returns the cryptographic hash of given data using the
524/// specified algorithm.
525///
526/// * Path: {self.mount}/hash(/{self.algorithm)
527/// * Method: POST
528/// * Response: HashDataResponse
529/// * Reference: <https://developer.hashicorp.com/vault/api-docs/secret/transit#hash-data>
530#[derive(Builder, Debug, Default, Endpoint)]
531#[endpoint(
532    path = "{self.mount}/hash",
533    method = "POST",
534    response = "HashDataResponse",
535    builder = "true"
536)]
537#[builder(setter(into, strip_option), default)]
538pub struct HashDataRequest {
539    #[endpoint(skip)]
540    pub mount: String,
541    /// Specifies the hash algorithm to use.
542    pub algorithm: Option<HashAlgorithm>,
543    /// Specifies the base64 encoded input data.
544    pub input: String,
545    /// Specifies the output encoding.
546    pub format: Option<OutputFormat>,
547}
548
549/// ## Generate HMAC
550/// This endpoint returns the digest of given data using the specified hash
551/// algorithm and the named key. The key can be of any type supported by
552/// transit; the raw key will be marshaled into bytes to be used for the HMAC
553/// function. If the key is of a type that supports rotation, the latest
554/// (current) version will be used.
555///
556/// * Path: {self.mount}/hmac/{self.name}(/{self.algorithm)
557/// * Method: POST
558/// * Response: GenerateHmacResponse
559/// * Reference: <https://developer.hashicorp.com/vault/api-docs/secret/transit#generate-hmac>
560#[derive(Builder, Debug, Default, Endpoint)]
561#[endpoint(
562    path = "{self.mount}/hmac/{self.name}",
563    method = "POST",
564    response = "GenerateHmacResponse",
565    builder = "true"
566)]
567#[builder(setter(into, strip_option), default)]
568pub struct GenerateHmacRequest {
569    #[endpoint(skip)]
570    pub mount: String,
571    #[endpoint(skip)]
572    pub name: String,
573    /// Specifies the version of the key to use for the operation. If not set,
574    /// uses the latest version. Must be greater than or equal to the key's
575    /// min_encryption_version, if set.
576    pub key_version: Option<u64>,
577    /// Specifies the hash algorithm to use.
578    pub algorithm: Option<HashAlgorithm>,
579    /// Specifies the base64 encoded input data.
580    pub input: String,
581}
582
583/// ## Sign Data
584/// This endpoint returns the cryptographic signature of the given data using
585/// the named key and the specified hash algorithm. The key must be of a type
586/// that supports signing.
587///
588/// * Path: {self.mount}/sign/{self.name}(/{self.hash_algorithm)
589/// * Method: POST
590/// * Response: SignDataResponse
591/// * Reference: <https://developer.hashicorp.com/vault/api-docs/secret/transit#sign-data>
592#[derive(Builder, Debug, Default, Endpoint)]
593#[endpoint(
594    path = "{self.mount}/sign/{self.name}",
595    method = "POST",
596    response = "SignDataResponse",
597    builder = "true"
598)]
599#[builder(setter(into, strip_option), default)]
600pub struct SignDataRequest {
601    #[endpoint(skip)]
602    pub mount: String,
603    #[endpoint(skip)]
604    pub name: String,
605    /// Specifies the version of the key to use for the operation. If not set,
606    /// uses the latest version. Must be greater than or equal to the key's
607    /// min_encryption_version, if set.
608    pub key_version: Option<u64>,
609    /// Specifies the hash algorithm to use.
610    pub hash_algorithm: Option<HashAlgorithm>,
611    /// Specifies the base64 encoded input data.
612    pub input: String,
613    /// Base64 encoded context for key derivation. Required if key derivation is
614    /// enabled; currently only available with ed25519 keys.
615    pub context: Option<String>,
616    /// Set to true when the input is already hashed. If the key type is
617    /// rsa-2048, rsa-3072 or rsa-4096, then the algorithm used to hash the
618    /// input should be indicated by the hash_algorithm parameter. Just as the
619    /// value to sign should be the base64-encoded representation of the exact
620    /// binary data you want signed, when set, input is expected to be
621    /// base64-encoded binary hashed data, not hex-formatted.
622    pub prehashed: Option<bool>,
623    /// When using a RSA key, specifies the RSA signature algorithm to use for
624    /// signing.
625    pub signature_algorithm: Option<SignatureAlgorithm>,
626    /// Specifies the way in which the signature should be marshaled. This
627    /// currently only applies to ECDSA keys.
628    pub marshaling_algorithm: Option<MarshalingAlgorithm>,
629}
630
631/// ## Verify Signed Data
632/// This endpoint returns whether the provided signature is valid for the given
633/// data.
634///
635/// * Path: {self.mount}/verify/{self.name}(/{self.hash_algorithm)
636/// * Method: POST
637/// * Response: VerifySignedDataResponse
638/// * Reference: <https://developer.hashicorp.com/vault/api-docs/secret/transit#verify-signed-data>
639#[derive(Builder, Debug, Default, Endpoint)]
640#[endpoint(
641    path = "{self.mount}/verify/{self.name}",
642    method = "POST",
643    response = "VerifySignedDataResponse",
644    builder = "true"
645)]
646#[builder(setter(into, strip_option), default)]
647pub struct VerifySignedDataRequest {
648    #[endpoint(skip)]
649    pub mount: String,
650    #[endpoint(skip)]
651    pub name: String,
652    /// Specifies the hash algorithm to use.
653    pub hash_algorithm: Option<HashAlgorithm>,
654    /// Specifies the base64 encoded input data.
655    pub input: String,
656    /// Specifies the signature output from the /transit/sign function. Either
657    /// this must be supplied or hmac must be supplied.
658    pub signature: Option<String>,
659    /// Specifies the signature output from the /transit/hmac function. Either
660    /// this must be supplied or signature must be supplied.
661    pub hmac: Option<String>,
662    /// Base64 encoded context for key derivation. Required if key derivation is
663    /// enabled; currently only available with ed25519 keys.
664    pub context: Option<String>,
665    /// Set to true when the input is already hashed. If the key type is
666    /// rsa-2048, rsa-3072 or rsa-4096, then the algorithm used to hash the
667    /// input should be indicated by the hash_algorithm parameter.
668    pub prehashed: Option<bool>,
669    /// When using a RSA key, specifies the RSA signature algorithm to use for
670    /// signature verification.
671    pub signature_algorithm: Option<SignatureAlgorithm>,
672    /// Specifies the way in which the signature was originally marshaled. This
673    /// currently only applies to ECDSA keys.
674    pub marshaling_algorithm: Option<MarshalingAlgorithm>,
675}
676
677/// ## Backup Key
678/// This endpoint returns a plaintext backup of a named key. The backup contains
679/// all the configuration data and keys of all the versions along with the HMAC
680/// key. The response from this endpoint can be used with the /restore endpoint
681/// to restore the key.
682///
683/// * Path: {self.mount}/backup/{self.name}
684/// * Method: GET
685/// * Response: BackupKeyResponse
686/// * Reference: <https://developer.hashicorp.com/vault/api-docs/secret/transit#backup-key>
687#[derive(Builder, Debug, Default, Endpoint)]
688#[endpoint(
689    path = "{self.mount}/backup/{self.name}",
690    response = "BackupKeyResponse",
691    builder = "true"
692)]
693#[builder(setter(into), default)]
694pub struct BackupKeyRequest {
695    #[endpoint(skip)]
696    pub mount: String,
697    #[endpoint(skip)]
698    pub name: String,
699}
700
701/// ## Restore Key
702/// This endpoint restores the backup as a named key. This will restore the key
703/// configurations and all the versions of the named key along with HMAC keys.
704/// The input to this endpoint should be the output of /backup endpoint.
705///
706/// * Path: {self.mount}/restore(/{self.name})
707/// * Method: POST
708/// * Response: N/A
709/// * Reference: <https://developer.hashicorp.com/vault/api-docs/secret/transit#restore-key>
710#[derive(Builder, Debug, Default, Endpoint)]
711#[endpoint(path = "{self.mount}/restore", method = "POST", builder = "true")]
712#[builder(setter(into, strip_option), default)]
713pub struct RestoreKeyRequest {
714    #[endpoint(skip)]
715    pub mount: String,
716    /// Backed up key data to be restored. This should be the output from the
717    /// /backup endpoint.
718    pub backup: String,
719    /// If set, this will be the name of the restored key.
720    pub name: Option<String>,
721    /// If set, force the restore to proceed even if a key by this name already
722    /// exists.
723    pub force: Option<bool>,
724}
725
726/// ## Trim Key
727/// This endpoint trims older key versions setting a minimum version for the
728/// keyring. Once trimmed, previous versions of the key cannot be recovered.
729///
730/// * Path: {self.mount}/keys/{self.name}/trim
731/// * Method: POST
732/// * Response: N/A
733/// * Reference: <https://developer.hashicorp.com/vault/api-docs/secret/transit#trim-key>
734#[derive(Builder, Debug, Default, Endpoint)]
735#[endpoint(
736    path = "{self.mount}/keys/{self.name}/trim",
737    method = "POST",
738    builder = "true"
739)]
740#[builder(setter(into), default)]
741pub struct TrimKeyRequest {
742    #[endpoint(skip)]
743    pub mount: String,
744    #[endpoint(skip)]
745    pub name: String,
746    /// The minimum available version for the key ring. All versions before this
747    /// version will be permanently deleted. This value can at most be equal to
748    /// the lesser of min_decryption_version and min_encryption_version. This is
749    /// not allowed to be set when either min_encryption_version or
750    /// min_decryption_version is set to zero.
751    pub min_available_version: u64,
752}
753
754/// ## Configure Cache
755/// This endpoint is used to configure the transit engine's cache. Note that
756/// configuration changes will not be applied until the transit plugin is
757/// reloaded which can be achieved using the /sys/plugins/reload/backend
758/// endpoint.
759///
760/// * Path: {self.mount}/transit/cache-config
761/// * Method: POST
762/// * Response: N/A
763/// * Reference: <https://developer.hashicorp.com/vault/api-docs/secret/transit#configure-cache>
764#[derive(Builder, Debug, Default, Endpoint)]
765#[endpoint(path = "{self.mount}/cache-config", method = "POST", builder = "true")]
766#[builder(setter(into, strip_option), default)]
767pub struct ConfigureCacheRequest {
768    #[endpoint(skip)]
769    pub mount: String,
770    /// Specifies the size in terms of number of entries. A size of 0 means
771    /// unlimited. A Least Recently Used (LRU) caching strategy is used for a
772    /// non-zero cache size. Must be 0 (default) or a value greater or equal to
773    /// 10 (minimum cache size).
774    pub size: Option<u64>,
775}
776
777/// ## Read Transit Cache Configuration
778/// This endpoint retrieves configurations for the transit engine's cache.
779///
780/// * Path: {self.mount}/transit/cache-config
781/// * Method: GET
782/// * Response: ReadTransitCacheConfigurationResponse
783/// * Reference: <https://developer.hashicorp.com/vault/api-docs/secret/transit#read-transit-cache-configuration>
784#[derive(Builder, Debug, Default, Endpoint)]
785#[endpoint(
786    path = "{self.mount}/cache-config",
787    response = "ReadTransitCacheConfigurationResponse",
788    builder = "true"
789)]
790#[builder(setter(into), default)]
791pub struct ReadTransitCacheConfigurationRequest {
792    #[endpoint(skip)]
793    pub mount: String,
794}
vaultrs/api/transit/requests.rs

vaultrs/api/transit/
requests.rs
