Trial and Standard plans

The Trial and Standard plans are available in the following regions.

Vault Dedicated plan

The Vault Dedicated is available in the following regions.

The Vault Dedicated plan is currently available as a public beta. Beta features are provided for evaluation and testing purposes and have limitations compared to generally available features.

Service endpoints for Trial and Standard plans

If you need to manage your Secrets Manager resources, see the following table to determine the API endpoints to use when you connect to the Secrets Manager API.

To learn how to configure your Secrets Manager instance to use private endpoints, see Securing your connection to Secrets Manager.

Ready to try the APIs? To interact with a Swagger UI from your browser, add api/v2/swagger-ui to your service endpoint URL. For example, https://{instance_ID}.{region}.secrets-manager.appdomain.cloud/api/v2/swagger-ui.

Service endpoints for the Vault Dedicated plan

The Vault Dedicated plan exposes two private endpoint URLs per instance: one for the Vault API and one for the Vault UI. Both are accessible only through a VPE gateway — Cloud Service Endpoints (CSE) are not supported for this plan.

Replace {instance_ID} with your instance UUID and {region} with the region abbreviation, for example us-south or eu-de.

If your instance is configured with private-only endpoints, the following access requirements apply:

• API access: Requires a VPE gateway that targets your Vault Dedicated instance. For setup instructions, see Using service endpoints to privately connect to Secrets Manager.
• Vault UI access: Requires a Client-to-Site VPN that routes traffic through the VPE. A browser cannot reach the private Vault UI URL directly from outside the IBM Cloud private network. For setup instructions, see Using Client-to-Site VPN to privately connect to Secrets Manager.

If your instance is configured with public-and-private endpoints, the Vault API and Vault UI are reachable over the public internet without a VPE or VPN. The private endpoint URLs are also available, but using them still requires a VPE gateway (and a Client-to-Site VPN for Vault UI access), exactly as described above for private-only instances.

You can retrieve the exact endpoint URLs for your instance from the Endpoints page of the Secrets Manager UI, or by calling the instance details API.

Viewing your endpoint URLs

You can find your service endpoint URLs in the Endpoints page of the Secrets Manager UI.

The private control plane endpoint is accessible through a VPE gateway. For more information, see Using service endpoints to privately connect to Secrets Manager. If you need to retrieve your service endpoint URLs programmatically, you can also call the following API to retrieve the values that are specific to your Secrets Manager instance.

curl -X GET  
    -H "Accept: application/json" \
    -H "Authorization: Bearer {IAM_token}"
"https://{region}.secrets-manager.cloud.ibm.com/api/v1/instances/{url_encoded_instance_CRN}/endpoints"

Replace the variables in the example request according to the following table.

A successful request returns the endpoint URLs that are associated with the region and service instance CRN that you specify. The following JSON snippet shows an example response.

{
    "plan": "standard",
    "public_endpoints": {
        "service_api": "https://927fb8ae-1ddd-4483-a21f-7d3c0fc81234.us-south.secrets-manager.appdomain.cloud/api",
        "vault_api": "https://927fb8ae-1ddd-4483-a21f-7d3c0fc81234.us-south.secrets-manager.appdomain.cloud"
    },
    "private_endpoints": {
        "service_api": "https://927fb8ae-1ddd-4483-a21f-7d3c0fc1234.private.us-south.secrets-manager.appdomain.cloud/api",
        "vault_api": "https://927fb8ae-1ddd-4483-a21f-7d3c0fc81234.private.us-south.secrets-manager.appdomain.cloud"
    },
    "encryption": {
      "provider_managed_encryption": "key_protect",  
      "encryption_key_crn": "crn:v1:staging:public:kms:us-south:a/791f5fb10986423e97aa8512f181234:31639268-42e8-4420-9872-590a6ee21234:key:b4af8f76-e6ea-4dc5-89cc-5f1b9bb1234"
    }
}

Control plane endpoints

Use the following control plane endpoints to call control plane APIs.

The private control plane endpoint is accessible through a VPE gateway. For more information, see Using service endpoints to privately connect to Secrets Manager.

To try this API, you can interact with the following Swagger UI from your browser: https://{region}.secrets-manager.cloud.ibm.com/swagger-ui.

If your instance is configured with the Private only option, this API returns only the private_endpoints object in the response.