API Reference

/update-item

post
https://api.akeyless.io/update-item
Recent Requests
Log in to see full request history
TimeStatusUser Agent
Retrieving recent requests…
LoadingLoading…
Body Params
string
string
Defaults to regular

for personal password manager

add-tag
array of strings

List of the new tags that will be attached to this item

add-tag
boolean

Enable or disable Agentic Runtime Authority rule enforcement for this item.
When false, user-defined input/output rules are stored but not enforced;
the base security validation still runs.

AraEnabled is tri-state (nil/true/false), not a plain bool: it self-encodes
its wire value (see akl.OptionalBool) so an explicit false survives the
curl-proxy relay instead of being dropped like a default-false bool flag.

string

PEM Certificate in a Base64 format. Used for updating RSA keys' certificates.

string
string

Trigger an event when a secret value changed [true/false] (Relevant only for Static Secret)

string

Protection from accidental deletion of this object [true/false]

string
Defaults to default_metadata

Description of the object

boolean

EnableAra is the documented spelling of AraEnabled. Both set the same
field; --ara-enabled shipped first and stays as an undocumented alias
so existing scripts and the Terraform provider keep working.

boolean

Turns on AI Quorum checks for this item.

expiration-event-in
array of strings

How many days before the expiration of the certificate would you like to be notified.

expiration-event-in
string

GCP Secret Manager regions to query for regional secrets (comma-separated, e.g., us-east1,us-west1). Max 12 regions.
USC with GCP targets only.

string

Host provider type [explicit/target], Default Host provider is explicit, Relevant only for SRA items.

input-rule
array of strings

Agentic input rule in name=...,rule=... format (e.g. name=rule1,rule=Sanitize input)

input-rule
item-custom-fields
object

Additional custom fields to associate with the item

boolean
Defaults to false

Set output format to JSON

string

Lock this secret for read/update while an SRA session is active

string

Lock this secret after each successful value read

string

Lock TTL in minutes

string

Set the maximum number of versions, limited by the account settings defaults.

string
required

Current item name

string
Defaults to default_metadata

Deprecated - use description

string

New item name

output-rule
array of strings

Agentic output rule in name=...,rule=... format (e.g. name=rule1,rule=Mask secrets)

output-rule
rm-tag
array of strings

List of the existent tags that will be removed from this item

rm-tag
string

StringOrBool accepts JSON strings, booleans, and numbers for backward
compatibility with older SDK versions that send boolean values for
rotate-after-disconnect.

string

Rotate this secret after it is unlocked

secure-access-add-host
array of strings

List of the new hosts that will be attached to SRA servers host

secure-access-add-host
string

Allow providing external user for a domain users [true/false]

boolean

Enable Port forwarding while using CLI access (relevant only for EKS/GKE/K8s Dynamic-Secret)

string

Bastion's SSH control API endpoint. E.g. https://my.sra-server:9900 (relevant only for ssh cert issuer)

string

The AWS account id (relevant only for aws)

boolean

The AWS native cli (relevant only for aws)

string

The AWS region (relevant only for aws)

string

Deprecated. use secure-access-api

string

Deprecated. use secure-access-certificate-issuer

string

Deprecated. use secure-access-ssh

string

Path to the SSH Certificate Issuer for your Akeyless Secure Access

string

The K8s cluster endpoint URL (relevant only for EKS/GKE/K8s Dynamic-Secret)

string

The K8s dashboard url (relevant only for k8s)

string

The DB name (relevant only for DB Dynamic-Secret)

string

The DB schema (relevant only for DB Dynamic-Secret)

string

Enable/Disable secure remote access [true/false]

boolean

Enforce connections only to allowed SRA hosts

string
secure-access-host
array of strings

Target servers for connections (In case of Linked Target association, host(s) will inherit Linked Target hosts - Relevant only for Dynamic Secrets/producers)

secure-access-host
string

RD Gateway server (relevant only for rdp)

string

Required when the Dynamic Secret is used for a domain user (relevant only for RDP Dynamic-Secret)

string

Override the RDP Domain username

secure-access-rm-host
array of strings

List of the existent hosts that will be removed from SRA servers host

secure-access-rm-host
string

Bastion's SSH server. E.g. my.sra-server:22 (relevant only for ssh cert issuer)

string

Secret values contains SSH Credentials, either Private Key or Password [password/private-key] (relevant only for Static-Secret or Rotated-secret)

string

SSH username to connect to target server, must be in 'Allowed Users' list (relevant only for ssh cert issuer)

string

Destination URL to inject secrets

boolean

Deprecated. Use secure-access-use-internal-ssh-access

boolean

Use internal SSH Access

boolean

Secure browser via Akeyless's Secure Remote Access (SRA)

boolean

Web-Proxy via Akeyless's Secure Remote Access (SRA)

target
array of strings

A list of targets to be associated with an SRA item, To specify multiple targets use argument multiple times

target
string

Authentication token (see /auth and /configure)

string

The universal identity token, Required only for universal_identity authentication

string

Comma-separated list of tags to apply to all secrets created/synced on the remote USC

USC items only.

string

Whether to filter the USC secret list using the specified usc-tags [true/false]

USC items only.

Responses

Updated 4 days ago

Did this page help you?
Language
LoadingLoading…
Response
Click Try It! to start a request and see the response here! Or choose an example:
application/json

Updated 4 days ago

Did this page help you?
Footer Section