Update a secret provider on a gateway group

PUT /apisix/admin/secret_providers/{secret_provider}/{secret_provider_id}

Update a secret provider on a gateway group

Create or replace the configuration of a secret provider integration in the gateway group. This controls how the gateway resolves externally managed secrets referenced by runtime configs. Required IAM Permission: Action gateway:PutSecretProvider, Resource arn:api7:gateway:gatewaygroup/%s/secret_provider/%s

Parameters

• secret_provider (path, string, required): Secret provider.
• secret_provider_id (path, string, required): Secret provider ID.
• gateway_group_id (query, string, required): Gateway group ID. Optional when using the gateway group admin key to authenticate.

Request body

Content type: application/json

• allOf variant 1
• oneOf variant 1: Vault
• uri (string, required): Vault endpoint.
• prefix (string, required): Vault prefix to access secrets.
• token (string, required): Vault token.
• namespace (string, optional): Vault namespace.
• kv_version (string, optional): Vault KV secrets engine version.
• authentication_method (string, optional): Authentication method.
• oneOf variant 2: AWS Secret
• access_key_id (string, required): AWS access key ID.
• secret_access_key (string, required): AWS secret access key.
• session_token (string, optional): AWS session token.
• region (string, optional): AWS region.
• endpoint_url (string, optional): AWS endpoint.
• oneOf variant 3
• apiserver_addr (string, optional): Kubernetes API server Address.
• token (string, optional): Service account token for Kubernetes API authentication
• token_file (string, optional): The path to the token file of the Kubernetes service account.
• oneOf variant 1: Kubernetes Secret (Token)
• oneOf variant 2: Kubernetes Secret (Token File)
• allOf variant 2
• desc (string, optional): The object description.
• labels (object, optional): Key-value pairs of labels.

Responses

• 200: Update a secret by ID.
• allOf variant 1
• value (object, optional): The specific resource.
• allOf variant 2
• value (object, optional): secret with management fields
• allOf variant 1
• allOf variant 1
• oneOf variant 1: Vault
• value.uri (string, required): Vault endpoint.
• value.prefix (string, required): Vault prefix to access secrets.
• value.token (string, required): Vault token.
• value.namespace (string, optional): Vault namespace.
• value.kv_version (string, optional): Vault KV secrets engine version.
• value.authentication_method (string, optional): Authentication method.
• oneOf variant 2: AWS Secret
• value.access_key_id (string, required): AWS access key ID.
• value.secret_access_key (string, required): AWS secret access key.
• value.session_token (string, optional): AWS session token.
• value.region (string, optional): AWS region.
• value.endpoint_url (string, optional): AWS endpoint.
• oneOf variant 3
• value.apiserver_addr (string, optional): Kubernetes API server Address.
• value.token (string, optional): Service account token for Kubernetes API authentication
• value.token_file (string, optional): The path to the token file of the Kubernetes service account.
• oneOf variant 1: Kubernetes Secret (Token)
• oneOf variant 2: Kubernetes Secret (Token File)
• allOf variant 2
• value.desc (string, optional): The object description.
• value.labels (object, optional): Key-value pairs of labels.
• allOf variant 2
• value.id (string, optional): Secret ID.
• value.secret_provider (string, optional): Type of secret manager.
• value.created_at (integer, optional): The object created timestamp.
• value.updated_at (integer, optional): The object updated timestamp.
• 400: Bad Request — The request was malformed or contained invalid parameters. Check the error_msg field for details.
• value (object, optional): The specific resource.
• error_msg (string, optional): The error message.

cURL

curl -X PUT '$API_BASE_URL/apisix/admin/secret_providers/{secret_provider}/{secret_provider_id}'