Vault | Python SDK
Vault client
Vault(token, config, logger_name)Initializes a new Vault client.
config = PangeaConfig(domain="pangea_domain")
vault = Vault(token="pangea_token", config=config)Decrypt
Vault.decrypt(item_id, cipher_text, version, additional_data)Decrypt a message using a key.
response = vault.decrypt(
id="pvi_p6g5i3gtbvqvc3u6zugab6qs6r63tqf5",
cipher_text="lJkk0gCLux+Q+rPNqLPEYw==",
version=1,
)Decrypt structured
Vault.decrypt_structured(id, structured_data, filter, version, additional_data)Decrypt parts of a JSON object.
data = {"field1": [1, 2, "kxcbC9E9IlgVaSCChPWUMgUC3ko=", "6FfI/LCzatLRLNAc8SuBK/TDnGxp"], "field2": "data2"}
response = vault.decrypt_structured(
id="pvi_[...]",
structured_data=data,
filter="$.field1[2:4]"
)Decrypt transform
Vault.decrypt_transform(id, cipher_text, tweak, alphabet, version)Decrypt using a format-preserving algorithm (FPE).
vault.decrypt_transform(
id="pvi_[...]",
cipher_text="encrypted message",
tweak="MTIzMTIzMT==",
alphabet=TransformAlphabet.ALPHANUMERIC,
)Delete
Vault.delete(item_id, recursive)Delete a secret or key
vault.delete(id="pvi_p6g5i3gtbvqvc3u6zugab6qs6r63tqf5")download-file
Vault.download_file()Encrypt
Vault.encrypt(item_id, plain_text, version, additional_data)Encrypt a message using a key.
response = vault.encrypt(
id="pvi_p6g5i3gtbvqvc3u6zugab6qs6r63tqf5",
plain_text="lJkk0gCLux+Q+rPNqLPEYw==",
version=1,
)Encrypt structured
Vault.encrypt_structured(key_id, structured_data, filter_expr, version, additional_data)Encrypt parts of a JSON object.
data = {"field1": [1, 2, "true", "false"], "field2": "data2"}
response = vault.encrypt_structured(
id="pvi_[...]",
structured_data=data,
filter="$.field1[2:4]"
)Encrypt transform
Vault.encrypt_transform(item_id, plain_text, alphabet, tweak, version)Encrypt using a format-preserving algorithm (FPE).
vault.encrypt_transform(
id="pvi_[...]",
plain_text="message to encrypt",
alphabet=TransformAlphabet.ALPHANUMERIC,
tweak="MTIzMTIzMT==",
)Export
Vault.export(item_id, version, kem_password, asymmetric_public_key, asymmetric_algorithm)Export a symmetric or asymmetric key.
exp_encrypted_resp = self.vault.export(
id=id,
asymmetric_public_key=rsa_pub_key_pem,
asymmetric_algorithm=ExportEncryptionAlgorithm.RSA4096_OAEP_SHA512,
)Create
Vault.folder_create(name, folder, metadata, tags, rotation_frequency, rotation_state, rotation_grace_period, disabled_at)Creates a folder.
response = vault.folder_create(
name="folder_name",
folder="parent/folder/name",
)Generate key
Vault.generate_key(key_type, purpose, algorithm, name, folder, metadata, tags, rotation_frequency, rotation_state, disabled_at, exportable)Generate a key.
response = vault.generate_key(
key_type=ItemType.SYMMETRIC_KEY,
purpose=SymmetricKeyPurpose.FPE,
algorithm=SymmetricKeyFpeAlgorithm.AES_FF3_1_256_BETA,
)Retrieve
Vault.get(item_id, version)Retrieve a secret, key or folder, and any associated information.
response = vault.get(
id="pvi_p6g5i3gtbvqvc3u6zugab6qs6r63tqf5",
version=1,
)Get bulk
Vault.get_bulk(filter, size, order, order_by, last)Retrieve details for multiple Vault items, including keys, secrets, tokens, or folders, that match a given filter specification.
response = vault.get_bulk({"id": "pvi_..."})JWT Retrieve
Vault.jwk_get(id, version)Retrieve a key in JWK format.
response = vault.jwk_get("pvi_p6g5i3gtbvqvc3u6zugab6qs6r63tqf5")JWT Sign
Vault.jwt_sign(id, payload)Sign a JSON Web Token (JWT) using a key.
response = vault.jwt_sign(
id="pvi_p6g5i3gtbvqvc3u6zugab6qs6r63tqf5",
payload="{\"sub\": \"1234567890\",\"name\": \"John Doe\",\"admin\": true}"
)JWT Verify
Vault.jwt_verify(jws)Verify the signature of a JSON Web Token (JWT).
response = vault.jwt_verify(jws="ewogICJhbGciO...")List
Vault.list(filter, size, order, order_by, last)Retrieve a list of secrets, keys and folders, and their associated information.
response = vault.list(
filter={
"folder": "/",
"type": "asymmetric_key",
"name__contains": "test",
"metadata_key1": "value1",
"created_at__lt": "2023-12-12T00:00:00Z"
},
last="WyIvdGVzdF8yMDdfc3ltbWV0cmljLyJd",
order=ItemOrder.ASC,
order_by=ItemOrderBy.NAME,
size=20,
)Poll result
Vault.poll_result(exception)Returns request's result that has been accepted by the server
response = service.poll_result(exception)Rotate secret
Vault.rotate_client_secret(item_id, rotation_grace_period, rotation_state)Rotate a client secret.
response = vault.rotate_client_secret(item_id="foo")Rotate key
Vault.rotate_key(key_id, key_type, rotation_state, public_key, private_key, key)Manually rotate an asymmetric or symmetric key.
response = vault.rotate_key("pvi_...", key_type=ItemType.SYMMETRIC_KEY)Rotate secret
Vault.rotate_pangea_token(item_id, rotation_grace_period, rotation_state)Rotate a Pangea token.
response = vault.rotate_pangea_token(item_id="foo")Rotate secret
Vault.rotate_secret(item_id, secret, rotation_state)Rotate a secret.
response = vault.rotate_secret(item_id="foo", secret="bar")Sign
Vault.sign(id, message, version)Sign a message using a key
response = vault.sign(
id="pvi_p6g5i3gtbvqvc3u6zugab6qs6r63tqf5",
message="lJkk0gCLux+Q+rPNqLPEYw==",
version=1,
)State change
Vault.state_change(item_id, state, version, destroy_period)Change the state of a specific version of a secret or key.
response = vault.state_change(
id="pvi_p6g5i3gtbvqvc3u6zugab6qs6r63tqf5",
state=ItemVersionState.DEACTIVATED,
)Store key
Vault.store_key(key_type, purpose, algorithm, public_key, private_key, key, name, folder, metadata, tags, rotation_frequency, rotation_state, disabled_at, exportable)Import a key.
response = vault.store_key(
key_type=ItemType.SYMMETRIC_KEY,
purpose=SymmetricKeyPurpose.FPE,
algorithm=SymmetricKeyFpeAlgorithm.AES_FF3_1_256_BETA,
)Store secret
Vault.store_pangea_client_secret(client_secret, client_id, client_secret_id, name, folder, metadata, tags, disabled_at, rotation_frequency, rotation_state, rotation_grace_period)Store a Pangea client secret.
response = vault.store_pangea_client_secret(
client_secret="foo",
client_id="bar",
client_secret_id="baz",
)Store secret
Vault.store_pangea_token(token, name, folder, metadata, tags, disabled_at)Store a Pangea token.
response = vault.store_pangea_token(token="foobar")Store secret
Vault.store_secret(secret, name, folder, metadata, tags, disabled_at)Store a secret.
response = vault.store_secret(secret="foobar")Update
Vault.update(item_id, name, folder, metadata, tags, disabled_at, enabled, rotation_frequency, rotation_state, rotation_grace_period)Update information associated with a secret, key or folder.
response = vault.update(
id="pvi_p6g5i3gtbvqvc3u6zugab6qs6r63tqf5",
name="my-very-secret-secret",
folder="/personal",
metadata={
"created_by": "John Doe",
"used_in": "Google products"
},
tags=[
"irs_2023",
"personal"
],
rotation_frequency="10d",
rotation_state=ItemVersionState.DEACTIVATED,
)Verify
Vault.verify(id, message, signature, version)Verify a signature using a key.
response = vault.verify(
id="pvi_p6g5i3gtbvqvc3u6zugab6qs6r63tqf5",
message="lJkk0gCLux+Q+rPNqLPEYw==",
signature="FfWuT2Mq/+cxa7wIugfhzi7ktZxVf926idJNgBDCysF/knY9B7M6wxqHMMPDEBs86D8OsEGuED21y3J7IGOpCQ==",
version=1,
)