- Overview
- Reference Guide
- Setup & Architecture
- Release Notes
- Workflow
- API Reference
- Integration Guide
- Discovery Agent Setup Guide
HashiCorp Vault
The HashiCorp Vault endpoints configure a HashiCorp Vault PKI secrets engine as a CA, list its roles and certificates, issue certificates, and synchronize Vault certificates into CertSecure Manager.
Endpoints
| Method | Endpoint | Description |
|---|---|---|
| GET | /hashicorp/certificates | List HashiCorp Vault certificates. |
| GET | /hashicorp/configure | Get HashiCorp Vault config. |
| POST | /hashicorp/configure | Create HashiCorp Vault config. |
| DELETE | /hashicorp/configure | Delete HashiCorp Vault config. |
| POST | /hashicorp/generate_certificate | Generate HashiCorp Vault certificate. |
| GET | /hashicorp/roles | List HashiCorp PKI roles. |
| GET | /hashicorp/roles/{role_name} | Get HashiCorp PKI role. |
| POST | /hashicorp/sync | Sync HashiCorp Vault certificates. |
GET /hashicorp/certificates
Lists the certificates issued by a HashiCorp Vault CA.
Request Parameters
| Name | Located In | Type | Required | Description |
|---|---|---|---|---|
ca_name |
Query | string | Yes | Name of the certificate authority (CA) as configured in CertSecure Manager. |
Example Request
curl -X GET "https://<certsecure-backend-url>/hashicorp/certificates?ca_name=<ca_name>" \
-H "Authorization: Bearer <token>"Responses
| Status Code | Description |
|---|---|
| 200 | Certs. |
GET /hashicorp/configure
Returns the HashiCorp Vault configurations.
Request Parameters
| Name | Located In | Type | Required | Description |
|---|---|---|---|---|
ca_name |
Query | string | No | Name of the certificate authority (CA) as configured in CertSecure Manager. |
Example Request
curl -X GET "https://<certsecure-backend-url>/hashicorp/configure" \
-H "Authorization: Bearer <token>"Example Response
{
"configurations": [
{
"ca_name": "Example Vault PKI",
"vault_addr": "https://vault.example.com:8200",
"namespace": "admin",
"pki_mount": "pki",
"active": true,
"created_at": "2026-03-24T14:48:28.859000",
"last_updated": "2026-03-24T14:52:57.184000"
}
]
}Responses
| Status Code | Description |
|---|---|
| 200 | The configuration is returned. |
POST /hashicorp/configure
Configures a HashiCorp Vault PKI secrets engine as a CA, using AppRole authentication.
Request Body (application/json)
| Field | Type | Required | Description |
|---|---|---|---|
ca_name |
string | Yes | Name of the certificate authority (CA) as configured in CertSecure Manager. |
namespace |
string | Yes | - |
pki_mount |
string | Yes | - |
renewal |
integer | No | - |
role_id |
string | Yes | - |
secret_id |
string | Yes | - |
vault_addr |
string | Yes | - |
Example Request
curl -X POST "https://<certsecure-backend-url>/hashicorp/configure" \
-H "Authorization: Bearer <token>" \
-H "Content-Type: application/json" \
-d '{"ca_name": "string", "namespace": "string", "pki_mount": "string", "role_id": "string", "secret_id": "string", "vault_addr": "string"}'Responses
| Status Code | Description |
|---|---|
| 200 | The settings were saved. |
DELETE /hashicorp/configure
Deletes a HashiCorp Vault configuration.
Request Parameters
| Name | Located In | Type | Required | Description |
|---|---|---|---|---|
ca_name |
Query | string | Yes | Name of the certificate authority (CA) as configured in CertSecure Manager. |
Example Request
curl -X DELETE "https://<certsecure-backend-url>/hashicorp/configure?ca_name=<ca_name>" \
-H "Authorization: Bearer <token>"Responses
| Status Code | Description |
|---|---|
| 200 | The resource was deleted. |
POST /hashicorp/generate_certificate
Issues a certificate from a HashiCorp Vault PKI role.
Request Body (application/json)
| Field | Type | Required | Description |
|---|---|---|---|
ca |
string | Yes | Name of the certificate authority (CA) as configured in CertSecure Manager. |
city |
string | No | City or locality (L) of the certificate subject. |
common_name |
string | Yes | Common name (CN) of the certificate subject. |
country_code |
string | No | Two-letter country code (C) of the certificate subject. |
key_length |
integer | No | Key size in bits, for example 2048. |
key_type |
string | No | - |
organization |
string | No | Organization (O) of the certificate subject. |
organization_unit |
string | No | Organizational unit (OU) of the certificate subject. |
owner |
string | No | - |
san_attributes |
object | No | Subject alternative names grouped by type: DNS, IP, Email, and URI. |
state |
string | No | State or province (ST) of the certificate subject. |
template |
string | Yes | Vault PKI role. |
ttl |
string | No | - |
watchers |
array of string | No | Email addresses of users to add as watchers of the certificate. |
Example Request
curl -X POST "https://<certsecure-backend-url>/hashicorp/generate_certificate" \
-H "Authorization: Bearer <token>" \
-H "Content-Type: application/json" \
-d '{"ca": "string", "common_name": "string", "template": "string"}'Responses
| Status Code | Description |
|---|---|
| 200 | Issued. |
GET /hashicorp/roles
Lists the PKI roles of a HashiCorp Vault CA.
Request Parameters
| Name | Located In | Type | Required | Description |
|---|---|---|---|---|
ca_name |
Query | string | Yes | Name of the certificate authority (CA) as configured in CertSecure Manager. |
Example Request
curl -X GET "https://<certsecure-backend-url>/hashicorp/roles?ca_name=<ca_name>" \
-H "Authorization: Bearer <token>"Responses
| Status Code | Description |
|---|---|
| 200 | Roles. |
GET /hashicorp/roles/{role_name}
Returns a PKI role of a HashiCorp Vault CA.
Request Parameters
| Name | Located In | Type | Required | Description |
|---|---|---|---|---|
role_name |
Path | string | Yes | Name of the Vault PKI role. |
ca_name |
Query | string | No | Name of the certificate authority (CA) as configured in CertSecure Manager. |
Example Request
curl -X GET "https://<certsecure-backend-url>/hashicorp/roles/<role_name>" \
-H "Authorization: Bearer <token>"Responses
| Status Code | Description |
|---|---|
| 200 | Role. |
POST /hashicorp/sync
Synchronizes the certificates of a HashiCorp Vault CA into the CertSecure Manager inventory.
Request Body (application/json)
| Field | Type | Required | Description |
|---|---|---|---|
ca_name |
string | Yes | Name of the certificate authority (CA) as configured in CertSecure Manager. |
Example Request
curl -X POST "https://<certsecure-backend-url>/hashicorp/sync" \
-H "Authorization: Bearer <token>" \
-H "Content-Type: application/json" \
-d '{"ca_name": "string"}'Responses
| Status Code | Description |
|---|---|
| 200 | Sync started. |