ibmcloud secrets-manager docs

Opens the plug-in documentation in the web browser.

ibmcloud secrets-manager docs

ibmcloud secrets-manager docs

Example

ibmcloud secrets-manager \
    --instance-id=provide-here-your-smgr-instanceuuid \
    --region=us-south \
    --output=json \
    --jmes-query="[:10]" \
    --service-url="https://myservice.cloud.ibm.com" \
    --quiet

This example only demonstrates the global options available to all sub-commands and is not a valid command itself.

Examples

ibmcloud secrets-manager config set service-url \
    'https://{instance_id}.{region}.secrets-manager.appdomain.cloud'

Examples

ibmcloud secrets-manager config get service-url

Examples

ibmcloud secrets-manager config unset service-url

Examples

ibmcloud secrets-manager config list

Command options

--name (string)

The name of your secret group. Required.

The maximum length is 64 characters. The minimum length is 2 characters. The value must match regular expression /^[A-Za-z0-9_][A-Za-z0-9_]*(?:_*-*\.*[A-Za-z0-9]*)*[A-Za-z0-9]+$/.

--description (string)

An extended description of your secret group.

The maximum length is 1024 characters. The minimum length is 0 characters. The value must match regular expression /(.*?)/.

Example

ibmcloud secrets-manager secret-group-create \
    --name my-secret-group \
    --description 'Extended description for this group.'

Example output

Example of SecretGroup response

{
  "created_at" : "2020-10-05T21:33:11Z",
  "description" : "Extended description for this group.",
  "id" : "d898bb90-82f6-4d61-b5cc-b079b66cfa76",
  "name" : "my-secret-group",
  "updated_at" : "2020-11-25T22:13:10Z",
  "created_by" : "iam-ServiceId-e4a2f0a4-3c76-4bef-b1f2-fbeae11c0f21"
}

Example

ibmcloud secrets-manager secret-groups

Example output

Example SecretGroup collection response

{
  "secret_groups" : [ {
    "created_at" : "2020-09-05T21:33:11Z",
    "description" : "Default Secret Group",
    "id" : "ee52ebb6-1728-4580-8ede-13f6504e3ae0",
    "name" : "default",
    "updated_at" : "2020-09-25T22:13:10Z",
    "created_by" : "iam-ServiceId-e4a2f0a4-3c76-4bef-b1f2-fbeae11c0f21"
  }, {
    "created_at" : "2020-10-05T21:33:11Z",
    "description" : "Extended description for this group.",
    "id" : "cb52ebb6-1728-4580-8ede-13f6504e3ae0",
    "name" : "my-secret-group",
    "updated_at" : "2020-11-25T22:13:10Z",
    "created_by" : "iam-ServiceId-e4a2f0a4-3c76-4bef-b1f2-fbeae11c0f21"
  }, {
    "created_at" : "2020-10-05T22:05:15Z",
    "description" : "Extended description for this group.",
    "id" : "19f88b9c-4f2f-405c-b877-a09338575c3f",
    "name" : "my-second-secret-group",
    "updated_at" : "2020-11-25T22:13:10Z",
    "created_by" : "iam-ServiceId-e4a2f0a4-3c76-4bef-b1f2-fbeae11c0f21"
  } ],
  "total_count" : 3
}

Default JMESPath

A JMESPath query will be applied to this output of this command by default, if one is not provided by the user. The exact query will depend on the scenario and the output format requested. You can see the condition for each default JMESPath query in the following table:

If a custom JMESPath query is provided, it will replace any of the JMESPath in the table above.

Command options

--secret-group-id (string)

The ID of the secret group. Required.

The maximum length is 36 characters. The minimum length is 7 characters. The value must match regular expression /^([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}|default)$/.

Example

ibmcloud secrets-manager secret-group \
    --secret-group-id d898bb90-82f6-4d61-b5cc-b079b66cfa76

Example output

Example of SecretGroup response

{
  "created_at" : "2020-10-05T21:33:11Z",
  "description" : "Extended description for this group.",
  "id" : "d898bb90-82f6-4d61-b5cc-b079b66cfa76",
  "name" : "my-secret-group",
  "updated_at" : "2020-11-25T22:13:10Z",
  "created_by" : "iam-ServiceId-e4a2f0a4-3c76-4bef-b1f2-fbeae11c0f21"
}

Command options

--id (string)

The ID of the secret group. Required.

Length must be 36 characters. The value must match regular expression /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/.

--secret-group-patch (generic map)

The request body to update a secret group. This JSON option can instead be provided by setting individual fields with other options. It is mutually exclusive with those options.

Provide a JSON string option or specify a JSON file to read from by providing a filepath option that begins with a @, for example, --secret-group-patch=@path/to/file.json.

--name (string)

The name of your secret group. This option provides a value for a sub-field of the JSON option 'secret-group-patch'. It is mutually exclusive with that option.

The maximum length is 64 characters. The minimum length is 2 characters. The value must match regular expression /^[A-Za-z0-9_][A-Za-z0-9_]*(?:_*-*\.*[A-Za-z0-9]*)*[A-Za-z0-9]+$/.

--description (string)

An extended description of your secret group. This option provides a value for a sub-field of the JSON option 'secret-group-patch'. It is mutually exclusive with that option.

The maximum length is 1024 characters. The minimum length is 0 characters. The value must match regular expression /(.*?)/.

Example

ibmcloud secrets-manager secret-group-update \
    --id d898bb90-82f6-4d61-b5cc-b079b66cfa76 \
    --name my-secret-group \
    --description 'Extended description for this group.'

Example output

Example of SecretGroup response

{
  "created_at" : "2020-10-05T21:33:11Z",
  "description" : "Extended description for this group.",
  "id" : "d898bb90-82f6-4d61-b5cc-b079b66cfa76",
  "name" : "my-secret-group",
  "updated_at" : "2020-11-25T22:13:10Z",
  "created_by" : "iam-ServiceId-e4a2f0a4-3c76-4bef-b1f2-fbeae11c0f21"
}

Command options

--id (string)

The ID of the secret group. Required.

Length must be 36 characters. The value must match regular expression /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/.

Example

ibmcloud secrets-manager secret-group-delete \
    --id d898bb90-82f6-4d61-b5cc-b079b66cfa76

Command options

--secret-prototype (SecretPrototype)

A JSON containing the required details for creating a secret. This JSON option can instead be provided by setting individual fields with other options. It is mutually exclusive with those options.

Provide a JSON string option or specify a JSON file to read from by providing a filepath option that begins with a @, for example, --secret-prototype=@path/to/file.json.

--secret-custom-metadata (generic map)

The secret metadata that a user can customize. This option provides a value for a sub-field of the JSON option 'secret-prototype'. It is mutually exclusive with that option.

Provide a JSON string option or specify a JSON file to read from by providing a filepath option that begins with a @, for example, --secret-custom-metadata=@path/to/file.json.

--secret-description (string)

An extended description of your secret. This option provides a value for a sub-field of the JSON option 'secret-prototype'. It is mutually exclusive with that option.

The maximum length is 1024 characters. The minimum length is 0 characters. The value must match regular expression /(.*?)/.

--secret-expiration-date (strfmt.DateTime)

The date when the secret material expires. The date format follows the RFC 3339 format. Supported secret types: Arbitrary, username_password. This option provides a value for a sub-field of the JSON option 'secret-prototype'. It is mutually exclusive with that option.

--secret-labels ([]string)

Labels that you can use to search secrets in your instance. This option provides a value for a sub-field of the JSON option 'secret-prototype'. It is mutually exclusive with that option.

The list items must match regular expression /(.*?)/. The maximum length is 30 items. The minimum length is 0 items.

--secret-name (string)

A human-readable name to assign to your secret. This option provides a value for a sub-field of the JSON option 'secret-prototype'. It is mutually exclusive with that option.

The maximum length is 256 characters. The minimum length is 2 characters. The value must match regular expression /^[A-Za-z0-9_][A-Za-z0-9_]*(?:_*-*\\.*[A-Za-z0-9]*)*[A-Za-z0-9]+$/.

--secret-group-id (string)

A UUID identifier, or default secret group. This option provides a value for a sub-field of the JSON option 'secret-prototype'. It is mutually exclusive with that option.

The maximum length is 36 characters. The minimum length is 7 characters. The value must match regular expression /^([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}|default)$/.

--secret-type (string)

The secret type. This option provides a value for a sub-field of the JSON option 'secret-prototype'. It is mutually exclusive with that option.

Allowable values are: arbitrary, iam_credentials, imported_cert, kv, private_cert, public_cert, service_credentials, username_password, custom_credentials.

--arbitrary-payload (string)

The secret data that is assigned to an ARBITRARY secret. This option provides a value for a sub-field of the JSON option 'secret-prototype'. It is mutually exclusive with that option.

The maximum length is 1000000 characters. The minimum length is 0 characters. The value must match regular expression /(.*?)/.

--secret-version-custom-metadata (generic map)

The secret version metadata that a user can customize. This option provides a value for a sub-field of the JSON option 'secret-prototype'. It is mutually exclusive with that option.

Provide a JSON string option or specify a JSON file to read from by providing a filepath option that begins with a @, for example, --secret-version-custom-metadata=@path/to/file.json.

--secret-ttl (string)

The time-to-live (TTL) or lease duration to assign to credentials that are generated. Supported secret types: IAM_CREDENTIALS, SERVICE_CREDENTIALS, CUSTOM_CREDENTIALS. This option provides a value for a sub-field of the JSON option 'secret-prototype'. It is mutually exclusive with that option.

The maximum length is 10 characters. The value must match regular expression /^[0-9]+[s,m,h,d]{0,1}$/.

--iam-credentials-access-groups ([]string)

Access Groups that you can use for an IAM_CREDENTIALS secret. This option provides a value for a sub-field of the JSON option 'secret-prototype'. It is mutually exclusive with that option.

The list items must match regular expression /^AccessGroupId-[a-z0-9-]+[a-z0-9]$/. The maximum length is 10 items. The minimum length is 1 item.

--iam-credentials-service-id (string)

The service ID under which the API key is created. This option provides a value for a sub-field of the JSON option 'secret-prototype'. It is mutually exclusive with that option.

Length must be 46 characters. The value must match regular expression /^ServiceId-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.

--iam-credentials-account-id (string)

The ID of the account in which the IAM credentials are created. This option provides a value for a sub-field of the JSON option 'secret-prototype'. It is mutually exclusive with that option.

Length must be 32 characters. The value must match regular expression /^[a-z0-9]*$/.

--iam-credentials-reuse-apikey (bool)

This parameter indicates whether to reuse the service ID and API key for future read operations. This option provides a value for a sub-field of the JSON option 'secret-prototype'. It is mutually exclusive with that option.

--secret-rotation (RotationPolicy)

This field indicates whether Secrets Manager rotates your secrets automatically. Supported secret types: USERNAME_PASSWORD, PRIVATE_CERT, PUBLIC_CERT, IAM_CREDENTIALS, CUSTOM_CREDENTIALS. This option provides a value for a sub-field of the JSON option 'secret-prototype'. It is mutually exclusive with that option.

Provide a JSON string option or specify a JSON file to read from by providing a filepath option that begins with a @, for example, --secret-rotation=@path/to/file.json.

--imported-cert-certificate (string)

The PEM-encoded contents of your certificate. This option provides a value for a sub-field of the JSON option 'secret-prototype'. It is mutually exclusive with that option.

The maximum length is 100000 characters. The minimum length is 50 characters. The value must match regular expression /(-{5}BEGIN.+?-{5}[\\s\\S]+-{5}END.+?-{5}[\\s]*)/.

--imported-cert-intermediate (string)

(Optional) The PEM-encoded intermediate certificate that is associated with the root certificate. This option provides a value for a sub-field of the JSON option 'secret-prototype'. It is mutually exclusive with that option.

The maximum length is 100000 characters. The minimum length is 50 characters. The value must match regular expression /(-{5}BEGIN.+?-{5}[\\s\\S]+-{5}END.+?-{5}[\\s]*)/.

--imported-cert-private-key (string)

(Optional) The PEM-encoded private key to associate with the certificate. This option provides a value for a sub-field of the JSON option 'secret-prototype'. It is mutually exclusive with that option.

The maximum length is 100000 characters. The minimum length is 50 characters. The value must match regular expression /(-{5}BEGIN.+?-{5}[\\s\\S]+-{5}END.+?-{5}[\\s]*)/.

--imported-cert-managed-csr (ImportedCertificateManagedCsr)

The data specified to create the CSR and the private key. This option provides a value for a sub-field of the JSON option 'secret-prototype'. It is mutually exclusive with that option.

Provide a JSON string option or specify a JSON file to read from by providing a filepath option that begins with a @, for example, --imported-cert-managed-csr=@path/to/file.json.

--kv-data (generic map)

The payload data of a key-value secret. This option provides a value for a sub-field of the JSON option 'secret-prototype'. It is mutually exclusive with that option.

The minimum length is 1 item.

Provide a JSON string option or specify a JSON file to read from by providing a filepath option that begins with a @, for example, --kv-data=@path/to/file.json.

--private-cert-template-name (string)

The name of the certificate template. This option provides a value for a sub-field of the JSON option 'secret-prototype'. It is mutually exclusive with that option.

The maximum length is 128 characters. The minimum length is 2 characters. The value must match regular expression /^[A-Za-z0-9][A-Za-z0-9]*(?:_?-?\\.?[A-Za-z0-9]+)*$/.

--certificate-common-name (string)

The Common Name (CN) represents the server name that is protected by the SSL certificate. This option provides a value for a sub-field of the JSON option 'secret-prototype'. It is mutually exclusive with that option.

The minimum length is 4 characters.

--certificate-alt-names ([]string)

With the Subject Alternative Name field, you can specify additional hostnames to be protected by a single SSL certificate. This option provides a value for a sub-field of the JSON option 'secret-prototype'. It is mutually exclusive with that option.

The list items must match regular expression /^(.*?)$/. The maximum length is 99 items. The minimum length is 0 items.

--private-cert-ip-sans (string)

The IP Subject Alternative Names to define for the CA certificate, in a comma-delimited list. This option provides a value for a sub-field of the JSON option 'secret-prototype'. It is mutually exclusive with that option.

The maximum length is 2048 characters. The minimum length is 2 characters. The value must match regular expression /(.*?)/.

--private-cert-uri-sans (string)

The URI Subject Alternative Names to define for the CA certificate, in a comma-delimited list. This option provides a value for a sub-field of the JSON option 'secret-prototype'. It is mutually exclusive with that option.

The maximum length is 2048 characters. The minimum length is 2 characters. The value must match regular expression /(.*?)/.

--private-cert-other-sans ([]string)

The custom Object Identifier (OID) or UTF8-string Subject Alternative Names to define for the CA certificate. This option provides a value for a sub-field of the JSON option 'secret-prototype'. It is mutually exclusive with that option.

The list items must match regular expression /(.*?)/. The maximum length is 100 items. The minimum length is 0 items.

--private-cert-csr (string)

The certificate signing request. This option provides a value for a sub-field of the JSON option 'secret-prototype'. It is mutually exclusive with that option.

The maximum length is 4096 characters. The minimum length is 2 characters. The value must match regular expression /^(-{5}BEGIN.+?-{5}[\\s\\S]+-{5}END.+?-{5}[\\s]*)$/.

--private-cert-format (string)

The format of the returned data. This option provides a value for a sub-field of the JSON option 'secret-prototype'. It is mutually exclusive with that option.

Allowable values are: pem, pem_bundle.

--private-cert-private-key-format (string)

The format of the generated private key. This option provides a value for a sub-field of the JSON option 'secret-prototype'. It is mutually exclusive with that option.

The default value is der. Allowable values are: der, pkcs8.

--private-cert-exclude-cn-from-sans (bool)

This parameter controls whether the common name is excluded from Subject Alternative Names (SANs). This option provides a value for a sub-field of the JSON option 'secret-prototype'. It is mutually exclusive with that option.

--public-cert-key-algorithm (string)

The identifier for the cryptographic algorithm that is used to generate the public key that is associated with the certificate. This option provides a value for a sub-field of the JSON option 'secret-prototype'. It is mutually exclusive with that option.

The default value is RSA2048. The maximum length is 8 characters. The minimum length is 5 characters. The value must match regular expression /^(RSA2048|RSA4096|ECDSA256|ECDSA384)$/.

--public-cert-ca (string)

The name of the certificate authority configuration. This option provides a value for a sub-field of the JSON option 'secret-prototype'. It is mutually exclusive with that option.

The maximum length is 128 characters. The minimum length is 2 characters. The value must match regular expression /^[A-Za-z0-9_][A-Za-z0-9_]*(?:_*-*\\.*[A-Za-z0-9]*)*[A-Za-z0-9]+$/.

--public-cert-dns (string)

The name of the DNS provider configuration. This option provides a value for a sub-field of the JSON option 'secret-prototype'. It is mutually exclusive with that option.

The maximum length is 128 characters. The minimum length is 2 characters. The value must match regular expression /^[A-Za-z0-9_][A-Za-z0-9_]*(?:_*-*\\.*[A-Za-z0-9]*)*[A-Za-z0-9]+$/.

--public-cert-bundle-ca (bool)

This field indicates whether your issued certificate is bundled with intermediate certificates. Set to false for the certificate file to contain only the issued certificate. This option provides a value for a sub-field of the JSON option 'secret-prototype'. It is mutually exclusive with that option.

The default value is true.

--secret-source-service (ServiceCredentialsSecretSourceService)

The properties that are required to create the service credentials for the specified source service instance. This option provides a value for a sub-field of the JSON option 'secret-prototype'. It is mutually exclusive with that option.

Provide a JSON string option or specify a JSON file to read from by providing a filepath option that begins with a @, for example, --secret-source-service=@path/to/file.json.

--username-password-username (string)

The username that is assigned to an USERNAME_PASSWORD secret. This option provides a value for a sub-field of the JSON option 'secret-prototype'. It is mutually exclusive with that option.

The maximum length is 64 characters. The minimum length is 2 characters. The value must match regular expression /[A-Za-z0-9+-=.]*/.

--username-password-password (string)

The password that is assigned to an USERNAME_PASSWORD secret. If you omit this parameter, Secrets Manager generates a new random password for your secret. This option provides a value for a sub-field of the JSON option 'secret-prototype'. It is mutually exclusive with that option.

The maximum length is 256 characters. The minimum length is 6 characters. The value must match regular expression /.{6,256}/.

--username-password-policy (PasswordGenerationPolicy)

Policy for auto-generated passwords. This option provides a value for a sub-field of the JSON option 'secret-prototype'. It is mutually exclusive with that option.

Provide a JSON string option or specify a JSON file to read from by providing a filepath option that begins with a @, for example, --username-password-policy=@path/to/file.json.

--custom-credentials-configuration (string)

The name of the custom credentials configuration. This option provides a value for a sub-field of the JSON option 'secret-prototype'. It is mutually exclusive with that option.

The maximum length is 128 characters. The minimum length is 2 characters. The value must match regular expression /^[a-zA-Z0-9]([-a-zA-Z0-9\\-_\\.]*)?$/.

--custom-credentials-parameters (generic map)

The parameters that are passed to custom credentials engine. Allowed types are string, integer, and boolean. This option provides a value for a sub-field of the JSON option 'secret-prototype'. It is mutually exclusive with that option.

Provide a JSON string option or specify a JSON file to read from by providing a filepath option that begins with a @, for example, --custom-credentials-parameters=@path/to/file.json.

Example

Example request

ibmcloud secrets-manager secret-create --secret-name=example-arbitrary-secret --secret-type=ARBITRARY --arbitrary-payload=example-secret-data

ibmcloud secrets-manager secret-create \
  --secret-prototype='{"name": "example-arbitrary-secret", "secret_type": "ARBITRARY", "payload":"example-secret-data"}'

Command options

--offset (int64)

The number of secrets to skip.

The default value is 0. The maximum value is 10000000. The minimum value is 0.

--limit (int64)

The number of secrets to list.

The default value is 200. The maximum value is 1000. The minimum value is 1.

--sort (string)

Sort a collection of secrets by the specified field in ascending order. To sort in descending order use the - character.

The maximum length is 17 characters. The minimum length is 2 characters. The value must match regular expression /^-?(id|created_at|updated_at|retrieved_at|expiration_date|secret_type|name)$/.

--search (string)

Filter secrets that contain the specified string in one or more of these fields: "id", "name", "description","labels", "secret_type".

The maximum length is 256 characters. The minimum length is 2 characters. The value must match regular expression /(.*?)/.

--groups ([]string)

Filter secrets by groups. Provide the IDs of the groups to filter by.

The list items must match regular expression /^([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}|default)$/. The maximum length is 201 items. The minimum length is 0 items.

--secret-types ([]string)

Filter secrets by types. Provide the secret types to filter by.

Allowable list items are: arbitrary, iam_credentials, imported_cert, kv, private_cert, public_cert, service_credentials, username_password, custom_credentials. The maximum length is 9 items. The minimum length is 0 items.

--match-all-labels ([]string)

Filter secrets by labels. Provide the labels to filter by.

The list items must match regular expression /(.*?)/. The maximum length is 30 items. The minimum length is 0 items.

--all-pages (bool)

Invoke multiple requests to display all pages of the collection for secrets.

Example

ibmcloud secrets-manager secrets \
    --offset 0 \
    --limit 10 \
    --sort created_at \
    --search example \
    --groups default,cac40995-c37a-4dcb-9506-472869077634 \
    --secret-types arbitrary,iam_credentials,imported_cert,kv,private_cert,public_cert,service_credentials,username_password,custom_credentials \
    --match-all-labels dev,us-south

Example output

Example secret metadata collection response

{
  "first" : {
    "href" : "https://us-south.secrets-maanger.cloud.ibm.com/88b75b20-aa21-4174-85c9-1feb3cc93c9a/api/v2/secrets?limit=50"
  },
  "previous" : {
    "href" : "https://us-south.secrets-maanger.cloud.ibm.com/88b75b20-aa21-4174-85c9-1feb3cc93c9a/api/v2/secrets?offset=50&limit=50"
  },
  "last" : {
    "href" : "https://us-south.secrets-maanger.cloud.ibm.com/88b75b20-aa21-4174-85c9-1feb3cc93c9a/api/v2/secrets?offset=200&limit=50"
  },
  "limit" : 50,
  "next" : {
    "href" : "https://us-south.secrets-maanger.cloud.ibm.com/88b75b20-aa21-4174-85c9-1feb3cc93c9a/api/v2/secrets?offset=150&limit=50"
  },
  "offset" : 100,
  "secrets" : [ {
    "alt_names" : [ "s1.example.com", "*.s2.example.com" ],
    "common_name" : "example.com",
    "created_at" : "2020-10-05T21:33:11Z",
    "created_by" : "iam-ServiceId-e4a2f0a4-3c76-4bef-b1f2-fbeae11c0f21",
    "crn" : "crn:v1:bluemix:public:secrets-manager:us-south:a/a5ebf2570dcaedf18d7ed78e216c263a:f1bc94a6-64aa-4c55-b00f-f6cd70e4b2ce:secret:a931192f-b6a9-43d6-a59a-834f3003af7b",
    "custom_metadata" : {
      "metadata_custom_key" : "metadata_custom_value"
    },
    "description" : "Extended description for this secret.",
    "downloaded" : false,
    "expiration_date" : "2030-10-05T11:49:42Z",
    "id" : "a931192f-b6a9-43d6-a59a-834f3003af7b",
    "intermediate_included" : true,
    "issuer" : "DigiCert",
    "key_algorithm" : "RSA2048",
    "labels" : [ "dev", "us-south" ],
    "locks_total" : 0,
    "name" : "my-imported-certificate",
    "private_key_included" : true,
    "secret_group_id" : "bfc0a4a9-3d58-4fda-945b-76756af516aa",
    "serial_number" : "03:e2:c6:e4:0b:7d:30:e2:e2:78:1b:b9:13:fd:f0:fc:89:dd",
    "secret_type" : "imported_cert",
    "signing_algorithm" : "SHA256-RSA",
    "state" : 1,
    "state_description" : "active",
    "updated_at" : "2022-10-05T21:33:11Z",
    "validity" : {
      "not_before" : "2020-10-05T21:33:11Z",
      "not_after" : "2030-10-05T11:49:42Z"
    },
    "versions_total" : 1
  }, {
    "alt_names" : [ "s1.example.com", "*.s2.example.com" ],
    "common_name" : "example.com",
    "created_by" : "iam-ServiceId-e4a2f0a4-3c76-4bef-b1f2-fbeae11c0f21",
    "created_at" : "2020-10-05T21:33:11Z",
    "crn" : "crn:v1:bluemix:public:secrets-manager:us-south:a/a5ebf2570dcaedf18d7ed78e216c263a:f1bc94a6-64aa-4c55-b00f-f6cd70e4b2ce:secret:cb7a2502-8ede-47d6-b5b6-1b7af6b6f563",
    "custom_metadata" : {
      "metadata_custom_key" : "metadata_custom_value"
    },
    "description" : "Extended description for this secret.",
    "downloaded" : false,
    "expiration_date" : "2030-10-05T11:49:42Z",
    "id" : "f075f0b3-71e4-4a14-b60f-0b38b855a3d1",
    "issuer" : "Lets Encrypt",
    "issuance_info" : {
      "auto_rotated" : false,
      "ordered_on" : "2022-10-06T06:15:55Z",
      "state" : 1,
      "state_description" : "active"
    },
    "bundle_certs" : true,
    "ca" : "lets-encrypt-config",
    "dns" : "cloud-internet-services-config",
    "key_algorithm" : "RSA2048",
    "labels" : [ "dev", "us-south" ],
    "updated_at" : "2022-10-05T21:33:11Z",
    "locks_total" : 0,
    "name" : "my-public-certificate",
    "rotation" : {
      "auto_rotate" : true,
      "rotate_keys" : true
    },
    "secret_group_id" : "bfc0a4a9-3d58-4fda-945b-76756af516aa",
    "serial_number" : "03:e2:c6:e4:0b:7d:30:e2:e2:78:1b:b9:13:fd:f0:fc:89:dd",
    "secret_type" : "public_cert",
    "signing_algorithm" : "SHA256-RSA",
    "state" : 1,
    "state_description" : "active",
    "validity" : {
      "not_before" : "2020-10-05T21:33:11Z",
      "not_after" : "2030-10-05T11:49:42Z"
    },
    "versions_total" : 1
  } ],
  "total_count" : 232
}

Default JMESPath

A JMESPath query will be applied to this output of this command by default, if one is not provided by the user. The exact query will depend on the scenario and the output format requested. You can see the condition for each default JMESPath query in the following table:

If a custom JMESPath query is provided, it will replace any of the JMESPath in the table above.

Command options

--id (string)

The ID of the secret. Required.

Length must be 36 characters. The value must match regular expression /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/.

Example

ibmcloud secrets-manager secret \
    --id 0b5571f7-21e6-42b7-91c5-3f5ac9793a46

Command options

--id (string)

The ID of the secret. Required.

Length must be 36 characters. The value must match regular expression /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/.

--force-delete (bool)

Set to true to force delete the secret. Available only for custom credentials secret type.

The default value is false.

Example

ibmcloud secrets-manager secret-delete \
    --id 0b5571f7-21e6-42b7-91c5-3f5ac9793a46 \
    --force-delete=false

Command options

--id (string)

The ID of the secret. Required.

Length must be 36 characters. The value must match regular expression /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/.

Example

ibmcloud secrets-manager secret-metadata \
    --id 0b5571f7-21e6-42b7-91c5-3f5ac9793a46

Command options

--id (string)

The ID of the secret. Required.

Length must be 36 characters. The value must match regular expression /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/.

--secret-metadata-patch (generic map)

JSON Merge-Patch content for update_secret_metadata. This JSON option can instead be provided by setting individual fields with other options. It is mutually exclusive with those options.

Provide a JSON string option or specify a JSON file to read from by providing a filepath option that begins with a @, for example, --secret-metadata-patch=@path/to/file.json.

--name (string)

A human-readable name to assign to your secret. This option provides a value for a sub-field of the JSON option 'secret-metadata-patch'. It is mutually exclusive with that option.

The maximum length is 256 characters. The minimum length is 2 characters.

--description (string)

An extended description of your secret. This option provides a value for a sub-field of the JSON option 'secret-metadata-patch'. It is mutually exclusive with that option.

The maximum length is 1024 characters. The minimum length is 0 characters. The value must match regular expression /(.*?)/.

--labels ([]string)

Labels that you can use to search secrets in your instance. This option provides a value for a sub-field of the JSON option 'secret-metadata-patch'. It is mutually exclusive with that option.

The list items must match regular expression /(.*?)/. The maximum length is 30 items. The minimum length is 0 items.

--custom-metadata (generic map)

The secret metadata that a user can customize. It should be a JSON string or a path to a JSON file prepended with @. This option provides a value for a sub-field of the JSON option 'secret-metadata-patch'. It is mutually exclusive with that option.

Provide a JSON string option or specify a JSON file to read from by providing a filepath option that begins with a @, for example, --custom-metadata=@path/to/file.json.

--expiration-date (strfmt.DateTime)

The date when the secret material expires. The date format follows the 'RFC 3339' format. Supported secret types: Arbitrary, username_password or the date when the secret material expires. The date format follows the 'RFC 3339' format. Supported secret types: Arbitrary, username_password. This option provides a value for a sub-field of the JSON option 'secret-metadata-patch'. It is mutually exclusive with that option.

--ttl (string)

The time-to-live (TTL) or lease duration to assign to credentials that are generated. Supported secret types: 'IAM_CREDENTIALS', 'SERVICE_CREDENTIALS', 'CUSTOM_CREDENTIALS'. This option provides a value for a sub-field of the JSON option 'secret-metadata-patch'. It is mutually exclusive with that option.

The maximum length is 10 characters. The minimum length is 1 character. The value must match regular expression /^[0-9]+[s,m,h,d]{0,1}$/.

--rotation (RotationPolicy)

This field indicates whether Secrets Manager rotates your secrets automatically. Supported secret types: 'USERNAME_PASSWORD', 'PRIVATE_CERT', 'PUBLIC_CERT', 'IAM_CREDENTIALS', 'CUSTOM_CREDENTIALS'. It should be a JSON string or a path to a JSON file prepended with @. This option provides a value for a sub-field of the JSON option 'secret-metadata-patch'. It is mutually exclusive with that option.

Provide a JSON string option or specify a JSON file to read from by providing a filepath option that begins with a @, for example, --rotation=@path/to/file.json.

--imported-cert-managed-csr (ImportedCertificateManagedCsr)

The data specified to create the CSR and the private key. It should be a JSON string or a path to a JSON file prepended with @. This option provides a value for a sub-field of the JSON option 'secret-metadata-patch'. It is mutually exclusive with that option.

Provide a JSON string option or specify a JSON file to read from by providing a filepath option that begins with a @, for example, --imported-cert-managed-csr=@path/to/file.json.

--password-generation-policy (PasswordGenerationPolicyPatch)

Policy patch for auto-generated passwords. Policy properties that are included in the patch are updated.\nProperties that are not included in the patch remain unchanged. It should be a JSON string or a path to a JSON file prepended with @. This option provides a value for a sub-field of the JSON option 'secret-metadata-patch'. It is mutually exclusive with that option.

Provide a JSON string option or specify a JSON file to read from by providing a filepath option that begins with a @, for example, --password-generation-policy=@path/to/file.json.

--custom-credentials-parameters (generic map)

The parameters that are passed to custom credentials engine. Allowed types are string, integer, and boolean. It should be a JSON string or a path to a JSON file prepended with @. This option provides a value for a sub-field of the JSON option 'secret-metadata-patch'. It is mutually exclusive with that option.

Provide a JSON string option or specify a JSON file to read from by providing a filepath option that begins with a @, for example, --custom-credentials-parameters=@path/to/file.json.

Example

ibmcloud secrets-manager secret-metadata-update \
    --id 0b5571f7-21e6-42b7-91c5-3f5ac9793a46 \
    --name updated-arbitrary-secret-name-example \
    --description 'updated Arbitrary Secret description' \
    --labels dev,us-south \
    --custom-metadata '{"anyKey": "anyValue"}' \
    --expiration-date 2033-04-12T23:20:50.520Z

Command options

--id (string)

The ID of the secret. Required.

Length must be 36 characters. The value must match regular expression /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/.

--secret-action-prototype (SecretActionPrototype)

The request body to specify the properties for your secret action. This JSON option can instead be provided by setting individual fields with other options. It is mutually exclusive with those options.

Provide a JSON string option or specify a JSON file to read from by providing a filepath option that begins with a @, for example, --secret-action-prototype=@path/to/file.json.

--secret-action-type (string)

The type of secret action. This option provides a value for a sub-field of the JSON option 'secret-action-prototype'. It is mutually exclusive with that option.

Allowable values are: public_cert_action_validate_dns_challenge, private_cert_action_revoke_certificate.

Example

Example request

ibmcloud secrets-manager secret-action-create --id=0b5571f7-21e6-42b7-91c5-3f5ac9793a46 --secret-action-type=PUBLIC_CERT_ACTION_VALIDATE_DNS_CHALLENGE

ibmcloud secrets-manager secret-action-create \
  --id=0b5571f7-21e6-42b7-91c5-3f5ac9793a46 \
  --secret-action-prototype='{"action_type": "PUBLIC_CERT_ACTION_VALIDATE_DNS_CHALLENGE"}'

Command options

--secret-type (string)

The secret type. Required.

Allowable values are: arbitrary, iam_credentials, imported_cert, kv, private_cert, public_cert, service_credentials, username_password, custom_credentials.

--name (string)

A human-readable name to assign to your secret. To protect your privacy, do not use personal data, such as your name or location, as a name for your secret. Required.

The maximum length is 256 characters. The minimum length is 2 characters. The value must match regular expression /^\w(([\w-.]+)?\w)?$/.

--secret-group-name (string)

The name of your secret group. Required.

The maximum length is 64 characters. The minimum length is 2 characters. The value must match regular expression /(.*?)/.

Example

ibmcloud secrets-manager secret-by-name \
    --secret-type arbitrary \
    --name my-secret \
    --secret-group-name default

Command options

--secret-id (string)

The ID of the secret. Required.

Length must be 36 characters. The value must match regular expression /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/.

--secret-version-prototype (SecretVersionPrototype)

Specify the properties for your new secret version. This JSON option can instead be provided by setting individual fields with other options. It is mutually exclusive with those options.

Provide a JSON string option or specify a JSON file to read from by providing a filepath option that begins with a @, for example, --secret-version-prototype=@path/to/file.json.

--arbitrary-payload (string)

The secret data that is assigned to an ARBITRARY secret. This option provides a value for a sub-field of the JSON option 'secret-version-prototype'. It is mutually exclusive with that option.

The maximum length is 1000000 characters. The minimum length is 0 characters. The value must match regular expression /(.*?)/.

--secret-version-custom-metadata (generic map)

The secret metadata that a user can customize. This option provides a value for a sub-field of the JSON option 'secret-version-prototype'. It is mutually exclusive with that option.

Provide a JSON string option or specify a JSON file to read from by providing a filepath option that begins with a @, for example, --secret-version-custom-metadata=@path/to/file.json.

--secret-version-version-custom-metadata (generic map)

The secret version metadata that a user can customize. This option provides a value for a sub-field of the JSON option 'secret-version-prototype'. It is mutually exclusive with that option.

Provide a JSON string option or specify a JSON file to read from by providing a filepath option that begins with a @, for example, --secret-version-version-custom-metadata=@path/to/file.json.

--secret-version-restore-from-version (string)

A UUID identifier, or current or previous secret version aliases. This option provides a value for a sub-field of the JSON option 'secret-version-prototype'. It is mutually exclusive with that option.

The maximum length is 36 characters. The minimum length is 7 characters. The value must match regular expression /^([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}|current|previous)$/.

--imported-cert-certificate (string)

The PEM-encoded contents of your certificate. This option provides a value for a sub-field of the JSON option 'secret-version-prototype'. It is mutually exclusive with that option.

The maximum length is 100000 characters. The minimum length is 50 characters. The value must match regular expression /(-{5}BEGIN.+?-{5}[\\s\\S]+-{5}END.+?-{5}[\\s]*)/.

--imported-cert-intermediate (string)

(Optional) The PEM-encoded intermediate certificate that is associated with the root certificate. This option provides a value for a sub-field of the JSON option 'secret-version-prototype'. It is mutually exclusive with that option.

The maximum length is 100000 characters. The minimum length is 50 characters. The value must match regular expression /(-{5}BEGIN.+?-{5}[\\s\\S]+-{5}END.+?-{5}[\\s]*)/.

--imported-cert-private-key (string)

(Optional) The PEM-encoded private key to associate with the certificate. This option provides a value for a sub-field of the JSON option 'secret-version-prototype'. It is mutually exclusive with that option.

The maximum length is 100000 characters. The minimum length is 50 characters. The value must match regular expression /(-{5}BEGIN.+?-{5}[\\s\\S]+-{5}END.+?-{5}[\\s]*)/.

--kv-data (generic map)

The payload data of a key-value secret. This option provides a value for a sub-field of the JSON option 'secret-version-prototype'. It is mutually exclusive with that option.

The minimum length is 1 item.

Provide a JSON string option or specify a JSON file to read from by providing a filepath option that begins with a @, for example, --kv-data=@path/to/file.json.

--private-cert-csr (string)

The certificate signing request. This option provides a value for a sub-field of the JSON option 'secret-version-prototype'. It is mutually exclusive with that option.

The maximum length is 4096 characters. The minimum length is 2 characters. The value must match regular expression /^(-{5}BEGIN.+?-{5}[\\s\\S]+-{5}END.+?-{5}[\\s]*)$/.

--public-cert-rotation (PublicCertificateRotationObject)

Defines the rotation object that is used to manually rotate public certificates. This option provides a value for a sub-field of the JSON option 'secret-version-prototype'. It is mutually exclusive with that option.

Provide a JSON string option or specify a JSON file to read from by providing a filepath option that begins with a @, for example, --public-cert-rotation=@path/to/file.json.

--username-password-password (string)

The password that is assigned to an USERNAME_PASSWORD secret. If you omit this parameter, Secrets Manager generates a new random password for your secret. This option provides a value for a sub-field of the JSON option 'secret-version-prototype'. It is mutually exclusive with that option.

The maximum length is 256 characters. The minimum length is 6 characters. The value must match regular expression /.{6,256}/.

Example

Example request

ibmcloud secrets-manager secret-version-create --secret-id 0b5571f7-21e6-42b7-91c5-3f5ac9793a46 --arbitrary-payload='updated secret credentials' --secret-version-custom-metadata='{"anyKey": "anyValue"}'

ibmcloud secrets-manager secret-version-create \
  --secret-id=0b5571f7-21e6-42b7-91c5-3f5ac9793a46 \
  --secret-version-prototype='{"payload": "updated secret credentials", "custom_metadata": {"anyKey": "anyValue"}, "version_custom_metadata": {"anyKey": "anyValue"}}'

Command options

--secret-id (string)

The ID of the secret. Required.

Length must be 36 characters. The value must match regular expression /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/.

Example

ibmcloud secrets-manager secret-versions \
    --secret-id 0b5571f7-21e6-42b7-91c5-3f5ac9793a46

Example output

Example secret version metadata collection response

{
  "versions" : [ {
    "created_at" : "2022-06-27T11:58:15Z",
    "created_by" : "iam-ServiceId-e4a2f0a4-3c76-4bef-b1f2-fbeae11c0f21",
    "expiration_date" : "2030-10-05T11:49:42Z",
    "id" : "bc656587-8fda-4d05-9ad8-b1de1ec7e712",
    "payload_available" : true,
    "secret_group_id" : "67d025e1-0248-418f-83ba-deb0ebfb9b4a",
    "secret_id" : "67d025e1-0248-418f-83ba-deb0ebfb9b4a",
    "secret_name" : "example-imported-certificate",
    "secret_type" : "imported_cert",
    "serial_number" : "38:eb:01:a3:22:e9:de:55:24:56:9b:14:cb:e2:f3:e3:e2:fb:f5:18",
    "validity" : {
      "not_after" : "2030-10-05T11:49:42Z",
      "not_before" : "2022-06-27T11:58:15Z"
    },
    "version_custom_metadata" : {
      "custom_version_key" : "custom_version_value"
    }
  } ],
  "total_count" : 1
}

Default JMESPath

A JMESPath query will be applied to this output of this command by default, if one is not provided by the user. The exact query will depend on the scenario and the output format requested. You can see the condition for each default JMESPath query in the following table:

If a custom JMESPath query is provided, it will replace any of the JMESPath in the table above.

Command options

--secret-id (string)

The ID of the secret. Required.

Length must be 36 characters. The value must match regular expression /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/.

--id (string)

The ID of the secret version. Required.

The maximum length is 36 characters. The minimum length is 7 characters. The value must match regular expression /^([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}|current|previous)$/.

Example

ibmcloud secrets-manager secret-version \
    --secret-id 0b5571f7-21e6-42b7-91c5-3f5ac9793a46 \
    --id eb4cf24d-9cae-424b-945e-159788a5f535

Command options

--secret-id (string)

The ID of the secret. Required.

Length must be 36 characters. The value must match regular expression /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/.

--id (string)

The ID of the secret version. Required.

The maximum length is 36 characters. The minimum length is 7 characters. The value must match regular expression /^([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}|current|previous)$/.

Example

ibmcloud secrets-manager secret-version-data-delete \
    --secret-id 0b5571f7-21e6-42b7-91c5-3f5ac9793a46 \
    --id eb4cf24d-9cae-424b-945e-159788a5f535

Command options

--secret-id (string)

The ID of the secret. Required.

Length must be 36 characters. The value must match regular expression /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/.

--id (string)

The ID of the secret version. Required.

The maximum length is 36 characters. The minimum length is 7 characters. The value must match regular expression /^([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}|current|previous)$/.

Example

ibmcloud secrets-manager secret-version-metadata \
    --secret-id 0b5571f7-21e6-42b7-91c5-3f5ac9793a46 \
    --id eb4cf24d-9cae-424b-945e-159788a5f535

Command options

--secret-id (string)

The ID of the secret. Required.

Length must be 36 characters. The value must match regular expression /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/.

--id (string)

The ID of the secret version. Required.

The maximum length is 36 characters. The minimum length is 7 characters. The value must match regular expression /^([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}|current|previous)$/.

--secret-version-metadata-patch (generic map)

JSON Merge-Patch content for update_secret_version_metadata. This JSON option can instead be provided by setting individual fields with other options. It is mutually exclusive with those options.

Provide a JSON string option or specify a JSON file to read from by providing a filepath option that begins with a @, for example, --secret-version-metadata-patch=@path/to/file.json.

--version-custom-metadata (generic map)

The secret version metadata that a user can customize. It should be a JSON string or a path to a JSON file prepended with @. This option provides a value for a sub-field of the JSON option 'secret-version-metadata-patch'. It is mutually exclusive with that option.

Provide a JSON string option or specify a JSON file to read from by providing a filepath option that begins with a @, for example, --version-custom-metadata=@path/to/file.json.

Example

ibmcloud secrets-manager secret-version-metadata-update \
    --secret-id 0b5571f7-21e6-42b7-91c5-3f5ac9793a46 \
    --id eb4cf24d-9cae-424b-945e-159788a5f535 \
    --version-custom-metadata '{"anyKey": "anyValue"}'

Command options

--secret-id (string)

The ID of the secret. Required.

Length must be 36 characters. The value must match regular expression /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/.

--id (string)

The ID of the secret version. Required.

The maximum length is 36 characters. The minimum length is 7 characters. The value must match regular expression /^([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}|current|previous)$/.

--secret-version-action-prototype (SecretVersionActionPrototype)

The request body to specify the properties of the action to create a secret version. This JSON option can instead be provided by setting individual fields with other options. It is mutually exclusive with those options.

Provide a JSON string option or specify a JSON file to read from by providing a filepath option that begins with a @, for example, --secret-version-action-prototype=@path/to/file.json.

--secret-version-action-type (string)

The type of secret version action. This option provides a value for a sub-field of the JSON option 'secret-version-action-prototype'. It is mutually exclusive with that option.

Allowable values are: private_cert_action_revoke_certificate.

Example

Example request

ibmcloud secrets-manager secret-version-action-create --secret-id=0b5571f7-21e6-42b7-91c5-3f5ac9793a46 --id=eb4cf24d-9cae-424b-945e-159788a5f535 --secret-version-action-type=PRIVATE_CERT_ACTION_REVOKE_CERTIFICATE

ibmcloud secrets-manager secret-version-action-create \
  --secret-id=0b5571f7-21e6-42b7-91c5-3f5ac9793a46 \
  --id=eb4cf24d-9cae-424b-945e-159788a5f535 \
  --secret-version-action-prototype='{"action_type": "PRIVATE_CERT_ACTION_REVOKE_CERTIFICATE"}'

Example output

The request body of the action to revoke private certificate versions.

{
  "action_type" : "private_cert_action_revoke_certificate",
  "revocation_time_seconds" : 1667982994
}

Command options

--secret-id (string)

The ID of the secret. Required.

Length must be 36 characters. The value must match regular expression /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/.

Example

ibmcloud secrets-manager secret-tasks \
    --secret-id 0b5571f7-21e6-42b7-91c5-3f5ac9793a46

Example output

Example for a list all tasks response.

{
  "tasks" : [ {
    "id" : "sm-task-b49ad24d-81d4-5ebc-b9b9-b0937d1c84d5",
    "created_by" : "iam-ServiceId-e4a2f0a4-3c76-4bef-b1f2-fbeae11c0f21",
    "creation_date" : "2022-04-12T23:20:50.52Z",
    "last_update_date" : "2022-04-12T23:21:40.22Z",
    "updated_by" : "iam-ServiceId-e4a2f0a4-3c76-4bef-b1f2-fbeae11c0f21",
    "type" : "create_credentials",
    "status" : "queued",
    "trigger" : "secret_creation",
    "secret_id" : "b49ad24d-81d4-5ebc-b9b9-b0937d1c84d5",
    "secret_version_id" : "b49ad24d-81d4-5ebc-b9b9-b0937d1c84d5"
  } ]
}

Command options

--secret-id (string)

The ID of the secret. Required.

Length must be 36 characters. The value must match regular expression /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/.

--id (string)

The ID that uniquely identifies your task. Required.

Length must be 44 characters. The value must match regular expression /^sm-task-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.

Example

ibmcloud secrets-manager secret-task \
    --secret-id 0b5571f7-21e6-42b7-91c5-3f5ac9793a46 \
    --id sm-task-a436bebd-dbbd-5c0d-ab35-1232f1234f95

Example output

Example of a response with a Secret's Task.

{
  "id" : "sm-task-b49ad24d-81d4-5ebc-b9b9-b0937d1a84d5",
  "created_by" : "iam-ServiceId-e4a2f0a4-3c76-4bef-b1f2-abeae11c0f21",
  "creation_date" : "2022-04-12T23:20:50.52Z",
  "last_update_date" : "2022-04-12T23:20:50.52Z",
  "updated_by" : "iam-ServiceId-e4a2f0a4-3c76-4bef-b1f2-abeae11c0f21",
  "type" : "create_credentials",
  "status" : "queued",
  "trigger" : "secret_creation",
  "secret_id" : "b49ad24d-81d4-5ebc-b9b9-b0937d1c84d5",
  "secret_version_id" : "b49ad24d-81d4-5ebc-b9b9-b0937d1a84d5"
}

Command options

--secret-id (string)

The ID of the secret. Required.

Length must be 36 characters. The value must match regular expression /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/.

--id (string)

The ID that uniquely identifies your task. Required.

Length must be 44 characters. The value must match regular expression /^sm-task-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.

--task-put (SecretTaskPrototype)

The request body to specify the properties for your secret task update. This JSON option can instead be provided by setting individual fields with other options. It is mutually exclusive with those options.

Provide a JSON string option or specify a JSON file to read from by providing a filepath option that begins with a @, for example, --task-put=@path/to/file.json.

--task-put-status (string)

Describes the status of a secret's task. This option provides a value for a sub-field of the JSON option 'task-put'. It is mutually exclusive with that option.

Allowable values are: credentials_created, credentials_deleted, failed.

--task-put-credentials (CustomCredentialsNewCredentials)

Newly created credentials provided by the credentials provider. This option provides a value for a sub-field of the JSON option 'task-put'. It is mutually exclusive with that option.

Provide a JSON string option or specify a JSON file to read from by providing a filepath option that begins with a @, for example, --task-put-credentials=@path/to/file.json.

--task-put-errors (SecretTaskError[])

A collection of errors. This option provides a value for a sub-field of the JSON option 'task-put'. It is mutually exclusive with that option.

The maximum length is 10 items. The minimum length is 1 item.

Provide a JSON string option or specify a JSON file to read from by providing a filepath option that begins with a @, for example, --task-put-errors=@path/to/file.json.

Examples

ibmcloud secrets-manager secret-task-update \
    --secret-id 0b5571f7-21e6-42b7-91c5-3f5ac9793a46 \
    --id sm-task-a436bebd-dbbd-5c0d-ab35-1232f1234f95 \
    --task-put '{"status": "credentials_created", "credentials": {"id": "b49ad24d-81d4-5ebc-b9b9-b0937d1c84d5", "payload": {"anyKey": "anyValue"}}}'

Alternatively, granular options are available for the sub-fields of JSON string options:

ibmcloud secrets-manager secret-task-update \
    --secret-id 0b5571f7-21e6-42b7-91c5-3f5ac9793a46 \
    --id sm-task-a436bebd-dbbd-5c0d-ab35-1232f1234f95 \
    --task-put-status credentials_created \
    --task-put-credentials customCredentialsNewCredentials

Example output

Example of a response with a Secret's Task.

{
  "id" : "sm-task-b49ad24d-81d4-5ebc-b9b9-b0937d1a84d5",
  "created_by" : "iam-ServiceId-e4a2f0a4-3c76-4bef-b1f2-abeae11c0f21",
  "creation_date" : "2022-04-12T23:20:50.52Z",
  "last_update_date" : "2022-04-12T23:20:50.52Z",
  "updated_by" : "iam-ServiceId-e4a2f0a4-3c76-4bef-b1f2-abeae11c0f21",
  "type" : "create_credentials",
  "status" : "queued",
  "trigger" : "secret_creation",
  "secret_id" : "b49ad24d-81d4-5ebc-b9b9-b0937d1c84d5",
  "secret_version_id" : "b49ad24d-81d4-5ebc-b9b9-b0937d1a84d5"
}

Command options

--secret-id (string)

The ID of the secret. Required.

Length must be 36 characters. The value must match regular expression /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/.

--id (string)

The ID that uniquely identifies your task. Required.

Length must be 44 characters. The value must match regular expression /^sm-task-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.

Example

ibmcloud secrets-manager secret-task-delete \
    --secret-id 0b5571f7-21e6-42b7-91c5-3f5ac9793a46 \
    --id sm-task-a436bebd-dbbd-5c0d-ab35-1232f1234f95

Command options

--offset (int64)

The number of secrets to skip.

The default value is 0. The maximum value is 10000000. The minimum value is 0.

--limit (int64)

The number of secrets to list.

The default value is 200. The maximum value is 1000. The minimum value is 1.

--search (string)

Filter locks that contain the specified string in the field "name".

The maximum length is 128 characters. The minimum length is 2 characters. The value must match regular expression /(.*?)/.

--groups ([]string)

Filter secrets by groups. Provide the IDs of the groups to filter by.

The list items must match regular expression /^([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}|default)$/. The maximum length is 201 items. The minimum length is 0 items.

--all-pages (bool)

Invoke multiple requests to display all pages of the collection for secrets-locks.

Example

ibmcloud secrets-manager secrets-locks \
    --offset 0 \
    --limit 10 \
    --search example \
    --groups default,cac40995-c37a-4dcb-9506-472869077634

Example output

Example response for listing all Secrets and locks

{
  "secrets_locks" : [ {
    "secret_group_id" : "d8371728-95c8-4c12-b2af-1af98adb9e41",
    "secret_id" : "0cf4addb-7a90-410b-a3a7-a15bbe2b7909",
    "secret_type" : "imported_cert",
    "secret_name" : "example-imported-certificate",
    "versions" : [ {
      "version_id" : "7bf3814d-58f8-4df8-9cbd-f6860e4ca973",
      "version_alias" : "current",
      "locks" : [ "lock-example-1", "lock-example-2" ]
    } ]
  } ],
  "first" : {
    "href" : "https://us-south.secrets-maanger.cloud.ibm.com/88b75b20-aa21-4174-85c9-1feb3cc93c9a/api/v2/secrets_locks?limit=50"
  },
  "previous" : {
    "href" : "https://us-south.secrets-maanger.cloud.ibm.com/88b75b20-aa21-4174-85c9-1feb3cc93c9a/api/v2/secrets_locks?offset=50&limit=50"
  },
  "last" : {
    "href" : "https://us-south.secrets-maanger.cloud.ibm.com/88b75b20-aa21-4174-85c9-1feb3cc93c9a/api/v2/secrets_locks?offset=200&limit=50"
  },
  "limit" : 50,
  "next" : {
    "href" : "https://us-south.secrets-maanger.cloud.ibm.com/88b75b20-aa21-4174-85c9-1feb3cc93c9a/api/v2/secrets_locks?offset=150&limit=50"
  },
  "offset" : 100,
  "total_count" : 1
}

Default JMESPath

A JMESPath query will be applied to this output of this command by default, if one is not provided by the user. The exact query will depend on the scenario and the output format requested. You can see the condition for each default JMESPath query in the following table:

If a custom JMESPath query is provided, it will replace any of the JMESPath in the table above.

Command options

--id (string)

The ID of the secret. Required.

Length must be 36 characters. The value must match regular expression /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/.

--offset (int64)

The number of locks to skip.

The default value is 0. The maximum value is 1000. The minimum value is 0.

--limit (int64)

The number of secrets with locks to list.

The default value is 25. The maximum value is 100. The minimum value is 1.

--sort (string)

Sort a collection of locks by the specified field in ascending order. To sort in descending order use the - character.

The maximum length is 17 characters. The minimum length is 4 characters. The value must match regular expression /^-?(created_at|updated_at|name)$/.

--search (string)

Filter locks that contain the specified string in the field "name".

The maximum length is 128 characters. The minimum length is 2 characters. The value must match regular expression /(.*?)/.

--all-pages (bool)

Invoke multiple requests to display all pages of the collection for secret-locks.

Example

ibmcloud secrets-manager secret-locks \
    --id 0b5571f7-21e6-42b7-91c5-3f5ac9793a46 \
    --offset 0 \
    --limit 10 \
    --sort name \
    --search example

Example output

Example of response body for listing secret locks

{
  "first" : {
    "href" : "https://us-south.secrets-maanger.cloud.ibm.com/88b75b20-aa21-4174-85c9-1feb3cc93c9a/api/v2/secrets/0cf4addb-7a90-410b-a3a7-a15bbe2b7909/locks?limit=50"
  },
  "previous" : {
    "href" : "https://us-south.secrets-maanger.cloud.ibm.com/88b75b20-aa21-4174-85c9-1feb3cc93c9a/api/v2/secrets/0cf4addb-7a90-410b-a3a7-a15bbe2b7909/locks?offset=50&limit=50"
  },
  "limit" : 50,
  "last" : {
    "href" : "https://us-south.secrets-maanger.cloud.ibm.com/88b75b20-aa21-4174-85c9-1feb3cc93c9a/api/v2/secrets/0cf4addb-7a90-410b-a3a7-a15bbe2b7909/locks?offset=200&limit=50"
  },
  "locks" : [ {
    "attributes" : {
      "key" : "value"
    },
    "created_at" : "2022-06-27T11:58:15Z",
    "created_by" : "iam-ServiceId-e4a2f0a4-3c76-4bef-b1f2-fbeae11c0f21",
    "description" : "Lock for consumer 1.",
    "name" : "lock-example-1",
    "secret_group_id" : "d8371728-95c8-4c12-b2af-1af98adb9e41",
    "secret_id" : "0cf4addb-7a90-410b-a3a7-a15bbe2b7909",
    "secret_version_id" : "7bf3814d-58f8-4df8-9cbd-f6860e4ca973",
    "secret_version_alias" : "current",
    "updated_at" : "2022-10-05T21:33:11Z"
  }, {
    "created_at" : "2022-06-27T11:58:15Z",
    "created_by" : "iam-ServiceId-e4a2f0a4-3c76-4bef-b1f2-fbeae11c0f21",
    "description" : "Lock for consumer 2.",
    "name" : "lock-example-2",
    "secret_group_id" : "d8371728-95c8-4c12-b2af-1af98adb9e41",
    "secret_id" : "0cf4addb-7a90-410b-a3a7-a15bbe2b7909",
    "secret_version_id" : "7bf3814d-58f8-4df8-9cbd-f6860e4ca973",
    "secret_version_alias" : "current",
    "updated_at" : "2022-10-05T21:33:11Z"
  } ],
  "next" : {
    "href" : "https://us-south.secrets-maanger.cloud.ibm.com/88b75b20-aa21-4174-85c9-1feb3cc93c9a/api/v2/secrets/0cf4addb-7a90-410b-a3a7-a15bbe2b7909/locks?offset=150&limit=50"
  },
  "offset" : 100,
  "total_count" : 2
}

Command options

--id (string)

The ID of the secret. Required.

Length must be 36 characters. The value must match regular expression /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/.

--locks (SecretLockPrototype[])

The locks data to be attached to a secret version. Required.

The maximum length is 1000 items. The minimum length is 0 items.

Provide a JSON string option or specify a JSON file to read from by providing a filepath option that begins with a @, for example, --locks=@path/to/file.json.

--mode (string)

Set the lock mode. Allowable values: remove_previous, and remove_previous_and_delete. Use remove_previous to create a lock that clears existing locks with matching names. Use remove_previous_and_delete to also delete data from the previous version.

Allowable values are: remove_previous, remove_previous_and_delete.

Example

ibmcloud secrets-manager secret-locks-bulk-create \
    --id 0b5571f7-21e6-42b7-91c5-3f5ac9793a46 \
    --locks '[{"name": "lock-example-1", "description": "lock for consumer 1", "attributes": {"anyKey": "anyValue"}}]' \
    --mode remove_previous

Example output

Example of response body to create secret locks

{
  "secret_id" : "0cf4addb-7a90-410b-a3a7-a15bbe2b7909",
  "secret_group_id" : "d8371728-95c8-4c12-b2af-1af98adb9e41",
  "secret_type" : "arbitrary",
  "versions" : [ {
    "version_id" : "7bf3814d-58f8-4df8-9cbd-f6860e4ca973",
    "version_alias" : "current",
    "locks" : [ "lock-3", "lock-4" ],
    "payload_available" : true
  }, {
    "version_id" : "5bf89b0c-df55-c8d5-7ad6-8816951c6784",
    "version_alias" : "previous",
    "locks" : [ "lock-example-1", "lock-example-2" ],
    "payload_available" : true
  } ]
}

Command options

--id (string)

The ID of the secret. Required.

Length must be 36 characters. The value must match regular expression /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/.

--name ([]string)

Specify the names of the secret locks to be deleted.

The list items must match regular expression /^[a-zA-Z]{1}[a-zA-Z0-9-_.]{1,63}$/. The maximum length is 1000 items. The minimum length is 1 item.

Example

ibmcloud secrets-manager secret-locks-bulk-delete \
    --id 0b5571f7-21e6-42b7-91c5-3f5ac9793a46 \
    --name lock-example-1

Example output

Example of response body to create secret locks

{
  "secret_id" : "0cf4addb-7a90-410b-a3a7-a15bbe2b7909",
  "secret_group_id" : "d8371728-95c8-4c12-b2af-1af98adb9e41",
  "secret_type" : "arbitrary",
  "versions" : [ {
    "version_id" : "7bf3814d-58f8-4df8-9cbd-f6860e4ca973",
    "version_alias" : "current",
    "locks" : [ "lock-3", "lock-4" ],
    "payload_available" : true
  }, {
    "version_id" : "5bf89b0c-df55-c8d5-7ad6-8816951c6784",
    "version_alias" : "previous",
    "locks" : [ "lock-example-1", "lock-example-2" ],
    "payload_available" : true
  } ]
}

Command options

--secret-id (string)

The ID of the secret. Required.

Length must be 36 characters. The value must match regular expression /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/.

--id (string)

The ID of the secret version. Required.

The maximum length is 36 characters. The minimum length is 7 characters. The value must match regular expression /^([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}|current|previous)$/.

--offset (int64)

The number of locks to skip.

The default value is 0. The maximum value is 1000. The minimum value is 0.

--limit (int64)

The number of secrets with locks to list.

The default value is 25. The maximum value is 100. The minimum value is 1.

--sort (string)

Sort a collection of locks by the specified field in ascending order. To sort in descending order use the - character.

The maximum length is 17 characters. The minimum length is 4 characters. The value must match regular expression /^-?(created_at|updated_at|name)$/.

--search (string)

Filter locks that contain the specified string in the field "name".

The maximum length is 128 characters. The minimum length is 2 characters. The value must match regular expression /(.*?)/.

--all-pages (bool)

Invoke multiple requests to display all pages of the collection for secret-version-locks.

Example

ibmcloud secrets-manager secret-version-locks \
    --secret-id 0b5571f7-21e6-42b7-91c5-3f5ac9793a46 \
    --id eb4cf24d-9cae-424b-945e-159788a5f535 \
    --offset 0 \
    --limit 10 \
    --sort name \
    --search example

Example output

Example response for listing secret version locks

{
  "first" : {
    "href" : "https://us-south.secrets-maanger.cloud.ibm.com/88b75b20-aa21-4174-85c9-1feb3cc93c9a/api/v2/secrets/0cf4addb-7a90-410b-a3a7-a15bbe2b7909/versions/7bf3814d-58f8-4df8-9cbd-f6860e4ca973/locks?limit=50"
  },
  "previous" : {
    "href" : "https://us-south.secrets-maanger.cloud.ibm.com/88b75b20-aa21-4174-85c9-1feb3cc93c9a/api/v2/secrets/0cf4addb-7a90-410b-a3a7-a15bbe2b7909/versions/7bf3814d-58f8-4df8-9cbd-f6860e4ca973/locks?offset=50&limit=50"
  },
  "last" : {
    "href" : "https://us-south.secrets-maanger.cloud.ibm.com/88b75b20-aa21-4174-85c9-1feb3cc93c9a/api/v2/secrets/0cf4addb-7a90-410b-a3a7-a15bbe2b7909/versions/7bf3814d-58f8-4df8-9cbd-f6860e4ca973/locks?offset=200&limit=50"
  },
  "limit" : 50,
  "locks" : [ {
    "attributes" : {
      "key" : "value"
    },
    "created_at" : "2022-06-27T11:58:15Z",
    "created_by" : "iam-ServiceId-e4a2f0a4-3c76-4bef-b1f2-fbeae11c0f21",
    "description" : "lock for consumer 1.",
    "name" : "lock-example-1",
    "secret_group_id" : "d8371728-95c8-4c12-b2af-1af98adb9e41",
    "secret_id" : "0cf4addb-7a90-410b-a3a7-a15bbe2b7909",
    "secret_version_alias" : "current",
    "secret_version_id" : "7bf3814d-58f8-4df8-9cbd-f6860e4ca973",
    "updated_at" : "2022-10-05T21:33:11Z"
  } ],
  "next" : {
    "href" : "https://us-south.secrets-maanger.cloud.ibm.com/88b75b20-aa21-4174-85c9-1feb3cc93c9a/api/v2/secrets/0cf4addb-7a90-410b-a3a7-a15bbe2b7909/versions/7bf3814d-58f8-4df8-9cbd-f6860e4ca973/locks?offset=150&limit=50"
  },
  "offset" : 100,
  "total_count" : 1
}

Command options

--secret-id (string)

The ID of the secret. Required.

Length must be 36 characters. The value must match regular expression /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/.

--id (string)

The ID of the secret version. Required.

The maximum length is 36 characters. The minimum length is 7 characters. The value must match regular expression /^([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}|current|previous)$/.

--locks (SecretLockPrototype[])

The locks data to be attached to a secret version. Required.

The maximum length is 1000 items. The minimum length is 0 items.

Provide a JSON string option or specify a JSON file to read from by providing a filepath option that begins with a @, for example, --locks=@path/to/file.json.

--mode (string)

Set the lock mode. Allowable values: remove_previous, and remove_previous_and_delete. Use remove_previous to create a lock that clears existing locks with matching names. Use remove_previous_and_delete to also delete data from the previous version.

Allowable values are: remove_previous, remove_previous_and_delete.

Example

ibmcloud secrets-manager secret-version-locks-bulk-create \
    --secret-id 0b5571f7-21e6-42b7-91c5-3f5ac9793a46 \
    --id eb4cf24d-9cae-424b-945e-159788a5f535 \
    --locks '[{"name": "lock-example-1", "description": "lock for consumer 1", "attributes": {"anyKey": "anyValue"}}]' \
    --mode remove_previous

Example output

Example of response body to create secret locks

{
  "secret_id" : "0cf4addb-7a90-410b-a3a7-a15bbe2b7909",
  "secret_group_id" : "d8371728-95c8-4c12-b2af-1af98adb9e41",
  "secret_type" : "arbitrary",
  "versions" : [ {
    "version_id" : "7bf3814d-58f8-4df8-9cbd-f6860e4ca973",
    "version_alias" : "current",
    "locks" : [ "lock-3", "lock-4" ],
    "payload_available" : true
  }, {
    "version_id" : "5bf89b0c-df55-c8d5-7ad6-8816951c6784",
    "version_alias" : "previous",
    "locks" : [ "lock-example-1", "lock-example-2" ],
    "payload_available" : true
  } ]
}

Command options

--secret-id (string)

The ID of the secret. Required.

Length must be 36 characters. The value must match regular expression /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/.

--id (string)

The ID of the secret version. Required.

The maximum length is 36 characters. The minimum length is 7 characters. The value must match regular expression /^([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}|current|previous)$/.

--name ([]string)

Specify the names of the secret locks to be deleted.

The list items must match regular expression /^[a-zA-Z]{1}[a-zA-Z0-9-_.]{1,63}$/. The maximum length is 1000 items. The minimum length is 1 item.

Example

ibmcloud secrets-manager secret-version-locks-bulk-delete \
    --secret-id 0b5571f7-21e6-42b7-91c5-3f5ac9793a46 \
    --id eb4cf24d-9cae-424b-945e-159788a5f535 \
    --name lock-example-1

Example output

Example of response body to create secret locks

{
  "secret_id" : "0cf4addb-7a90-410b-a3a7-a15bbe2b7909",
  "secret_group_id" : "d8371728-95c8-4c12-b2af-1af98adb9e41",
  "secret_type" : "arbitrary",
  "versions" : [ {
    "version_id" : "7bf3814d-58f8-4df8-9cbd-f6860e4ca973",
    "version_alias" : "current",
    "locks" : [ "lock-3", "lock-4" ],
    "payload_available" : true
  }, {
    "version_id" : "5bf89b0c-df55-c8d5-7ad6-8816951c6784",
    "version_alias" : "previous",
    "locks" : [ "lock-example-1", "lock-example-2" ],
    "payload_available" : true
  } ]
}

Command options

--configuration-prototype (ConfigurationPrototype)

A JSON containing the required details for creating a configuration. This JSON option can instead be provided by setting individual fields with other options. It is mutually exclusive with those options.

Provide a JSON string option or specify a JSON file to read from by providing a filepath option that begins with a @, for example, --configuration-prototype=@path/to/file.json.

--config-type (string)

The configuration type. This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

Allowable values are: public_cert_configuration_dns_cloud_internet_services, public_cert_configuration_dns_classic_infrastructure, public_cert_configuration_ca_lets_encrypt, private_cert_configuration_root_ca, private_cert_configuration_intermediate_ca, private_cert_configuration_template, iam_credentials_configuration, custom_credentials_configuration.

--name (string)

A human-readable unique name to assign to your configuration. This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

The maximum length is 128 characters. The minimum length is 2 characters. The value must match regular expression /^[A-Za-z0-9_][A-Za-z0-9_]*(?:_*-*\\.*[A-Za-z0-9]*)*[A-Za-z0-9]+$/.

--public-cert-cloud-internet-services-apikey (string)

An IBM Cloud API key that can list domains in your Cloud Internet Services instance and add DNS records. This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

The maximum length is 128 characters. The minimum length is 0 characters. The value must match regular expression /(.*?)/.

--public-cert-cloud-internet-services-crn (string)

A CRN that uniquely identifies an IBM Cloud resource. This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

The maximum length is 512 characters. The minimum length is 9 characters. The value must match regular expression /^crn:v[0-9](:([A-Za-z0-9-._~!$&'()*+,;=@\/]|%[0-9A-Z]{2})*){8}$/.

--public-cert-classic-infrastructure-username (string)

The username that is associated with your classic infrastructure account. This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

The maximum length is 128 characters. The minimum length is 2 characters. The value must match regular expression /(.*?)/.

--public-cert-classic-infrastructure-password (string)

Your classic infrastructure API key. This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

The maximum length is 128 characters. The minimum length is 2 characters. The value must match regular expression /(.*?)/.

--public-cert-lets-encrypt-environment (string)

The configuration of the Let's Encrypt CA environment. This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

Allowable values are: production, staging.

--public-cert-lets-encrypt-private-key (string)

The PEM-encoded private key of your Let's Encrypt account. This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

The maximum length is 100000 characters. The minimum length is 50 characters. The value must match regular expression /(^-----BEGIN PRIVATE KEY-----.*?)|(^-----BEGIN RSA PRIVATE KEY-----.*?)/.

--public-cert-lets-encrypt-preferred-chain (string)

The preferred chain with an issuer that matches this Subject Common Name. This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

The maximum length is 30 characters. The minimum length is 2 characters. The value must match regular expression /(.*?)/.

--private-cert-crypto-key (PrivateCertificateCryptoKey)

The data that is associated with a cryptographic key in JSON format. This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

Provide a JSON string option or specify a JSON file to read from by providing a filepath option that begins with a @, for example, --private-cert-crypto-key=@path/to/file.json.

--private-cert-max-ttl (string)

The maximum time-to-live (TTL) for certificates that are created by this CA. This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

The maximum length is 10 characters. The minimum length is 2 characters. The value must match regular expression /^[0-9]+[s,m,h,d]{0,1}$/.

--private-cert-crl-expiry (string)

The time until the certificate revocation list (CRL) expires. This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

The maximum length is 10 characters. The minimum length is 2 characters. The value must match regular expression /^[0-9]+[s,m,h,d]{0,1}$/.

--private-cert-crl-disabled (bool)

This field disables or enables certificate revocation list (CRL) building. This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

--private-cert-crl-distribution-points-encoded (bool)

This field determines whether to encode the certificate revocation list (CRL) distribution points in the certificates that are issued by this certificate authority. This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

--private-cert-issuing-certificate-urls-encoded (bool)

This field determines whether to encode the URL of the issuing certificate in the certificates that are issued by this certificate authority. This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

--certificate-common-name (string)

The Common Name (CN) represents the server name that is protected by the SSL certificate. This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

The maximum length is 128 characters. The minimum length is 4 characters. The value must match regular expression /(.*?)/.

--certificate-alt-names ([]string)

With the Subject Alternative Name field, you can specify additional hostnames to be protected by a single SSL certificate. This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

The list items must match regular expression /^(.*?)$/. The maximum length is 99 items. The minimum length is 0 items.

--private-cert-ip-sans (string)

The IP Subject Alternative Names to define for the CA certificate, in a comma-delimited list. This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

The maximum length is 2048 characters. The minimum length is 2 characters. The value must match regular expression /(.*?)/.

--private-cert-uri-sans (string)

The URI Subject Alternative Names to define for the CA certificate, in a comma-delimited list. This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

The maximum length is 2048 characters. The minimum length is 2 characters. The value must match regular expression /(.*?)/.

--private-cert-other-sans ([]string)

The custom Object Identifier (OID) or UTF8-string Subject Alternative Names to define for the CA certificate. This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

The list items must match regular expression /(.*?)/. The maximum length is 100 items. The minimum length is 0 items.

--private-cert-ttl (string)

The requested time-to-live (TTL) for certificates that are created by this CA. This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

The maximum length is 10 characters. The minimum length is 2 characters. The value must match regular expression /^[0-9]+[s,m,h,d]{0,1}$/.

--private-cert-format (string)

The format of the returned data. This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

Allowable values are: pem, pem_bundle.

--private-cert-private-key-format (string)

The format of the generated private key. This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

The default value is der. Allowable values are: der, pkcs8.

--private-cert-private-key-type (string)

The type of private key to generate. This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

Allowable values are: rsa, ec.

--private-cert-private-key-bits (int64)

The number of bits to use to generate the private key. This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

The maximum value is 4096. The minimum value is 224.

--private-cert-max-path-length (int64)

The maximum path length to encode in the generated certificate. -1 means no limit. This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

The maximum value is 10. The minimum value is -1.

--private-cert-exclude-cn-from-sans (bool)

This parameter controls whether the common name is excluded from Subject Alternative Names (SANs). This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

--private-cert-permitted-dns-domains ([]string)

The allowed DNS domains or subdomains for the certificates that are to be signed and issued by this CA certificate. This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

The list items must match regular expression /(.*?)/. The maximum length is 100 items. The minimum length is 0 items.

--private-cert-subject-organizational-unit ([]string)

The Organizational Unit (OU) values to define in the subject field of the resulting certificate. This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

The list items must match regular expression /(.*?)/. The maximum length is 10 items. The minimum length is 0 items.

--private-cert-subject-organization ([]string)

The Organization (O) values to define in the subject field of the resulting certificate. This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

The list items must match regular expression /(.*?)/. The maximum length is 10 items. The minimum length is 0 items.

--private-cert-subject-country ([]string)

The Country (C) values to define in the subject field of the resulting certificate. This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

The list items must match regular expression /(.*?)/. The maximum length is 10 items. The minimum length is 0 items.

--private-cert-subject-locality ([]string)

The Locality (L) values to define in the subject field of the resulting certificate. This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

The list items must match regular expression /(.*?)/. The maximum length is 10 items. The minimum length is 0 items.

--private-cert-subject-province ([]string)

The Province (ST) values to define in the subject field of the resulting certificate. This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

The list items must match regular expression /(.*?)/. The maximum length is 10 items. The minimum length is 0 items.

--private-cert-subject-street-address ([]string)

The street address values to define in the subject field of the resulting certificate. This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

The list items must match regular expression /(.*?)/. The maximum length is 10 items. The minimum length is 0 items.

--private-cert-subject-postal-code ([]string)

The postal code values to define in the subject field of the resulting certificate. This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

The list items must match regular expression /(.*?)/. The maximum length is 10 items. The minimum length is 0 items.

--private-cert-serial-number (string)

The requested value for the serialNumber (https://datatracker.ietf.org/doc/html/rfc4519#section-2.31) attribute that is in the certificate's distinguished name (DN). This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

The maximum length is 64 characters. The minimum length is 32 characters. The value must match regular expression /[^a-fA-F0-9]/.

--private-cert-signing-method (string)

The signing method to use with this certificate authority to generate private certificates. This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

Allowable values are: internal, external.

--private-cert-issuer (string)

The distinguished name that identifies the entity that signed and issued the certificate. This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

The maximum length is 128 characters. The minimum length is 2 characters. The value must match regular expression /(.*?)/.

--private-cert-ca-name (string)

The name of the intermediate certificate authority. This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

The maximum length is 128 characters. The minimum length is 2 characters. The value must match regular expression /^[A-Za-z0-9][A-Za-z0-9]*(?:_?-?\\.?[A-Za-z0-9]+)*$/.

--private-cert-allowed-secret-groups (string)

This field scopes the creation of private certificates to only the secret groups that you specify. This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

The maximum length is 1024 characters. The minimum length is 2 characters. The value must match regular expression /(.*?)/.

--private-cert-allow-localhost (bool)

This field indicates whether to allow localhost to be included as one of the requested common names. This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

--private-cert-allowed-domains ([]string)

The domains to define for the certificate template. This property is used along with the allow_bare_domains and allow_subdomains options. This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

The list items must match regular expression /(.*?)/. The maximum length is 100 items. The minimum length is 0 items.

--private-cert-allowed-domains-template (bool)

This field indicates whether to allow the domains that are supplied in the allowed_domains field to contain access control list (ACL) templates. This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

--private-cert-allow-bare-domains (bool)

This field indicates whether to allow clients to request private certificates that match the value of the actual domains on the final certificate. This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

--private-cert-allow-subdomains (bool)

This field indicates whether to allow clients to request private certificates with common names (CN) that are subdomains of the CNs that are allowed by the other certificate template options. This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

--private-cert-allow-glob-domains (bool)

This field indicates whether to allow glob patterns in the names that are specified in the allowed_domains field. This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

--private-cert-allow-wildcard (bool)

This field indicates whether the issuance of certificates with RFC 6125 wildcards in the CN field. This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

--private-cert-allow-any-name (bool)

This field indicates whether to allow clients to request a private certificate that matches any common name. This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

--private-cert-enforce-hostname (bool)

This field indicates whether to enforce only valid hostnames for common names, DNS Subject Alternative Names, and the host section of email addresses. This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

--private-cert-allow-ip-sans (bool)

This field indicates whether to allow clients to request a private certificate with IP Subject Alternative Names. This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

--private-cert-allowed-uri-sans ([]string)

The URI Subject Alternative Names to allow for private certificates. This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

The list items must match regular expression /(.*?)/. The maximum length is 100 items. The minimum length is 0 items.

--private-cert-allowed-other-sans ([]string)

The custom Object Identifier (OID) or UTF8-string Subject Alternative Names (SANs) to allow for private certificates. This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

The list items must match regular expression /(.*?)/. The maximum length is 100 items. The minimum length is 0 items.

--private-cert-server-flag (bool)

This field indicates whether private certificates are flagged for server use. This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

--private-cert-client-flag (bool)

This field indicates whether private certificates are flagged for client use. This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

--private-cert-code-signing-flag (bool)

This field indicates whether private certificates are flagged for code signing use. This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

--private-cert-email-protection-flag (bool)

This field indicates whether private certificates are flagged for email protection use. This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

--private-cert-key-usage ([]string)

The allowed key usage constraint to define for private certificates. This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

The list items must match regular expression /^[a-zA-Z]+$/. The maximum length is 100 items. The minimum length is 0 items.

--private-cert-ext-key-usage ([]string)

The allowed extended key usage constraint on private certificates. This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

The list items must match regular expression /^[a-zA-Z]+$/. The maximum length is 100 items. The minimum length is 0 items.

--private-cert-ext-key-usage-oids ([]string)

A list of extended key usage Object Identifiers (OIDs). This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

The list items must match regular expression /(.*?)/. The maximum length is 100 items. The minimum length is 0 items.

--private-cert-use-csr-common-name (bool)

this field determines whether to use the common name (CN) from a certificate signing request (CSR). This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

--private-cert-use-cse-sans (bool)

this field determines whether to use the Subject Alternative Names (SANs) from a certificate signing request (CSR). This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

--private-cert-require-cn (bool)

This field indicates whether to require a common name to create a private certificate. This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

--private-cert-policy-identifiers ([]string)

A list of policy Object Identifiers (OIDs). This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

The list items must match regular expression /(.*?)/. The maximum length is 100 items. The minimum length is 0 items.

--private-cert-basic-constraints-valid-for-non-ca (bool)

This field indicates whether to mark the Basic Constraints extension of an issued private certificate as valid for non-CA certificates. This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

--private-cert-not-before-duration (string)

The duration in seconds by which to backdate the not_before property of an issued private certificate. This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

The maximum length is 10 characters. The minimum length is 2 characters. The value must match regular expression /^[0-9]+[s,m,h,d]{0,1}$/.

--iam-credentials-apikey (string)

The API key that is used to set the iam_credentials engine. This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

The maximum length is 60 characters. The minimum length is 5 characters. The value must match regular expression /^(?:[A-Za-z0-9_\\-]{4})*(?:[A-Za-z0-9_\\-]{2}==|[A-Za-z0-9_\\-]{3}=)?$/.

--iam-credentials-apikey-disabled (bool)

This parameter indicates whether the API key configuration is disabled. This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

The default value is false.

--custom-credentials-apikey-ref (string)

The IAM credentials secret ID that is used to set up a custom credentials configuration. This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

Length must be 36 characters. The value must match regular expression /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.

--custom-credentials-code-engine (CustomCredentialsConfigurationCodeEngine)

The parameters required to configure Code Engine. This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

Provide a JSON string option or specify a JSON file to read from by providing a filepath option that begins with a @, for example, --custom-credentials-code-engine=@path/to/file.json.

--configuration-task-timeout (string)

Specifies the maximum allowed time for a Code Engine task to be completed. After this time elapses, the task state will changed to failed. The minimum value is 5 minutes and the maximum value is 24 hours. Default task time out is 10 minutes. The value can be either an integer that specifies the number of seconds, or the string representation of a duration, such as 10m or 2h. This option provides a value for a sub-field of the JSON option 'configuration-prototype'. It is mutually exclusive with that option.

The maximum length is 6 characters. The minimum length is 1 character. The value must match regular expression /^[0-9]+[s,m,h,d]{0,1}$/.

Example

Example request

ibmcloud secrets-manager configuration-create --config-type=private_cert_configuration_root_ca \
  --name=example-root-CA --certificate-common-name=example.com  --private-cert-max-ttl=7365

ibmcloud secrets-manager configuration-create --config-type=private_cert_configuration_root_ca   --name=example-root-CA-HSM \
--certificate-common-name=example.com  --private-cert-max-ttl=73654 \
--private-cert-crypto-key='{ "provider": { "type": "hyper_protect_crypto_services", "instance_crn": "crn:v1:bluemix:public:hs-crypto:us-south:a/791f3fb10486421e97aa8512f18b7e65:b49ad24d-81d4-5ebc-b9b9-b0937d1c84d5::","pin_iam_credentials_secret_id": "14a7aff4-432d-11dc-a0f0-56a5b473394f", "private_keystore_id": "14a7aff4-432d-11dc-a0f0-56a5b473394f" }, "label": "cli-created", "allow_generate_key": true }'

ibmcloud secrets-manager configuration-create \
  --configuration-prototype='{"config_type": "private_cert_configuration_root_ca", "name": "example-root-CA", "max_ttl": "43830h", "crl_expiry": "72h", "crl_disable": false, "crl_distribution_points_encoded": true, "issuing_certificates_urls_encoded": true, "common_name": "example.com", "alt_names": ["alt-name-1","alt-name-2"], "ip_sans": "127.0.0.1", "uri_sans": "https://www.example.com/test", "other_sans": ["1.2.3.5.4.3.201.10.4.3;utf8:test@example.com"], "ttl": "2190h", "format": "pem", "private_key_format": "der", "key_type": "rsa", "key_bits": 4096, "max_path_length": -1, "exclude_cn_from_sans": false, "permitted_dns_domains": ["exampleString"], "ou": ["exampleString"], "organization": ["exampleString"], "country": ["exampleString"], "locality": ["exampleString"], "province": ["exampleString"], "street_address": ["exampleString"], "postal_code": ["exampleString"], "serial_number": "d9:be:fe:35:ba:09:42:b5:35:ba:09:42:b5"}'

Command options

--offset (int64)

The number of configurations to skip.

The default value is 0. The maximum value is 1000. The minimum value is 0.

--limit (int64)

The number of configurations to list.

The default value is 200. The maximum value is 1000. The minimum value is 1.

--sort (string)

Sort a collection of configurations by the specified field in ascending order. To sort in descending order use the - character.

The maximum length is 17 characters. The minimum length is 2 characters. The value must match regular expression /^-?(config_type|secret_type|name)$/.

--search (string)

Filter configurations that contain the specified string in one or more of the fields: "name", "config_type", "secret_type".

The maximum length is 128 characters. The minimum length is 2 characters. The value must match regular expression /(.*?)/.

--secret-types ([]string)

Filter configurations by secret types. Provide one or more of the following secret types: IAM_CREDENTIALS, PUBLIC_CERT, PRIVATE_CERT, or CUSTOM_CREDENTIALS.

Allowable list items are: iam_credentials, private_cert, public_cert, custom_credentials. The maximum length is 4 items. The minimum length is 0 items.

--all-pages (bool)

Invoke multiple requests to display all pages of the collection for configurations.

Example

ibmcloud secrets-manager configurations \
    --offset 0 \
    --limit 10 \
    --sort config_type \
    --search example \
    --secret-types iam_credentials,private_cert,public_cert,custom_credentials

Example output

Example response for configuring metadata collection

{
  "first" : {
    "href" : "https://something.com"
  },
  "next" : {
    "href" : "https://something.com"
  },
  "previous" : {
    "href" : "https://something.com"
  },
  "last" : {
    "href" : "https://something.com"
  },
  "limit" : 25,
  "offset" : 0,
  "configurations" : [ {
    "config_type" : "public_cert_configuration_ca_lets_encrypt",
    "created_at" : "2022-06-27T11:58:15Z",
    "created_by" : "iam-ServiceId-e4a2f0a4-3c76-4bef-b1f2-fbeae11c0f21",
    "lets_encrypt_environment" : "production",
    "name" : "lets-encrypt-config",
    "secret_type" : "public_cert",
    "updated_at" : "2022-10-05T21:33:11Z"
  }, {
    "config_type" : "public_cert_configuration_dns_cloud_internet_services",
    "created_at" : "2022-06-27T11:58:15Z",
    "created_by" : "iam-ServiceId-e4a2f0a4-3c76-4bef-b1f2-fbeae11c0f21",
    "name" : "cloud-internet-services-config",
    "secret_type" : "public_cert",
    "updated_at" : "2022-10-05T21:33:11Z"
  }, {
    "config_type" : "public_cert_configuration_dns_classic_infrastructure",
    "created_at" : "2022-06-27T11:58:15Z",
    "created_by" : "iam-ServiceId-e4a2f0a4-3c76-4bef-b1f2-fbeae11c0f21",
    "name" : "classic-infrastructure-config",
    "secret_type" : "public_cert",
    "updated_at" : "2022-10-05T21:33:11Z"
  }, {
    "common_name" : "ibm.com",
    "config_type" : "private_cert_configuration_root_ca",
    "created_at" : "2022-11-08T11:22:19Z",
    "created_by" : "iam-ServiceId-1ba95813-1b0f-45c1-b46c-969a5fda08d1",
    "expiration_date" : "2030-03-31T01:13:07Z",
    "key_bits" : 2048,
    "key_type" : "rsa",
    "name" : "internal-root",
    "secret_type" : "private_cert",
    "status" : "configured",
    "updated_at" : "2022-11-08T11:22:19Z"
  }, {
    "common_name" : "ibm.com",
    "config_type" : "private_cert_configuration_intermediate_ca",
    "created_at" : "2022-11-08T11:22:19Z",
    "created_by" : "iam-ServiceId-1ba95813-1b0f-45c1-b46c-969a5fda08d1",
    "expiration_date" : "2030-03-31T01:13:07Z",
    "issuer" : "internal-root",
    "name" : "example-intermediate-CA",
    "key_bits" : 2048,
    "key_type" : "rsa",
    "secret_type" : "private_cert",
    "status" : "configured",
    "updated_at" : "2022-11-08T11:22:19Z"
  }, {
    "certificate_authority" : "inter-1",
    "config_type" : "private_cert_configuration_template",
    "created_at" : "2022-11-08T11:22:23Z",
    "created_by" : "iam-ServiceId-8e54a866-476b-46cd-ba05-dbeae5f1d984",
    "name" : "example-certificate-template",
    "secret_type" : "private_cert",
    "updated_at" : "2022-11-08T11:22:23Z"
  }, {
    "api_key_ref" : "a2f9c2e4-a3a8-c508-2bed-fcb7c26843ca",
    "code_engine" : {
      "job_name" : "code-engine-job-name",
      "project_id" : "12345678-5120-4a18-832a-4ba122496633",
      "region" : "us-south"
    },
    "code_engine_key_ref" : "sm-access-24bc230d-9855-4825-99b5-ac78be81959c",
    "config_type" : "custom_credentials_configuration",
    "created_at" : "2025-03-23T08:35:29.27Z",
    "created_by" : "IBMid-000002CM7E",
    "name" : "my_config",
    "schema" : {
      "credentials" : [ {
        "format" : "type:string",
        "name" : "token"
      } ],
      "parameters" : [ {
        "env_variable_name" : "SM_USER_NAME_VALUE",
        "format" : "type:string",
        "name" : "user_name"
      }, {
        "env_variable_name" : "SM_SCOPE_VALUE",
        "format" : "type:enum[admin|user]",
        "name" : "scope"
      }, {
        "env_variable_name" : "SM_EXPIRES_VALUE",
        "format" : "type:integer",
        "name" : "expires"
      } ]
    },
    "secret_type" : "custom_credentials",
    "task_timeout" : "10m",
    "updated_at" : "2025-03-23T08:35:29.27Z"
  } ],
  "total_count" : 7
}

Default JMESPath

A JMESPath query will be applied to this output of this command by default, if one is not provided by the user. The exact query will depend on the scenario and the output format requested. You can see the condition for each default JMESPath query in the following table:

If a custom JMESPath query is provided, it will replace any of the JMESPath in the table above.

Command options

--name (string)

The name of the configuration. Required.

The maximum length is 128 characters. The minimum length is 2 characters. The value must match regular expression /^[A-Za-z0-9_][A-Za-z0-9_]*(?:_*-*\.*[A-Za-z0-9]*)*[A-Za-z0-9]+$/.

--config-type (string)

The configuration type of this configuration - use this header to resolve 300 error responses.

Allowable values are: public_cert_configuration_dns_cloud_internet_services, public_cert_configuration_dns_classic_infrastructure, public_cert_configuration_ca_lets_encrypt, private_cert_configuration_root_ca, private_cert_configuration_intermediate_ca, private_cert_configuration_template, iam_credentials_configuration, custom_credentials_configuration.

Example

ibmcloud secrets-manager configuration \
    --name configuration-name \
    --config-type public_cert_configuration_dns_cloud_internet_services

Command options

--name (string)

The name of the configuration. Required.

The maximum length is 128 characters. The minimum length is 2 characters. The value must match regular expression /^[A-Za-z0-9_][A-Za-z0-9_]*(?:_*-*\.*[A-Za-z0-9]*)*[A-Za-z0-9]+$/.

--configuration-patch (generic map)

JSON Merge-Patch content for update_configuration. This JSON option can instead be provided by setting individual fields with other options. It is mutually exclusive with those options.

Provide a JSON string option or specify a JSON file to read from by providing a filepath option that begins with a @, for example, --configuration-patch=@path/to/file.json.

--config-type (string)

The configuration type of this configuration - use this header to resolve 300 error responses.

Allowable values are: public_cert_configuration_dns_cloud_internet_services, public_cert_configuration_dns_classic_infrastructure, public_cert_configuration_ca_lets_encrypt, private_cert_configuration_root_ca, private_cert_configuration_intermediate_ca, private_cert_configuration_template, iam_credentials_configuration, custom_credentials_configuration.

--api-key (string)

An IBM Cloud API key that can create and manage service IDs. The API key must be assigned the Editor platform role on the Access Groups Service and the Operator platform role on the IAM Identity Service. For more information, see the docs. This option provides a value for a sub-field of the JSON option 'configuration-patch'. It is mutually exclusive with that option.

The maximum length is 60 characters. The minimum length is 5 characters.

--iam-credentials-apikey-disabled (bool)

This parameter indicates whether the API key configuration is disabled. This option provides a value for a sub-field of the JSON option 'configuration-patch'. It is mutually exclusive with that option.

--private-cert-max-ttl (string)

The maximum time-to-live (TTL) for certificates that are created by this CA. This option provides a value for a sub-field of the JSON option 'configuration-patch'. It is mutually exclusive with that option.

The maximum length is 10 characters. The minimum length is 2 characters. The value must match regular expression /^[0-9]+[s,m,h,d]{0,1}$/.

--private-cert-crl-expiry (string)

The time until the certificate revocation list (CRL) expires. This option provides a value for a sub-field of the JSON option 'configuration-patch'. It is mutually exclusive with that option.

The maximum length is 10 characters. The minimum length is 2 characters. The value must match regular expression /^[0-9]+[s,m,h,d]{0,1}$/.

--private-cert-crl-disabled (bool)

This field disables or enables certificate revocation list (CRL) building. This option provides a value for a sub-field of the JSON option 'configuration-patch'. It is mutually exclusive with that option.

--private-cert-crl-distribution-points-encoded (bool)

This field determines whether to encode the certificate revocation list (CRL) distribution points in the certificates that are issued by this certificate authority or this field determines whether to encode the certificate revocation list (CRL) distribution points in the certificates that are issued by this certificate authority. This option provides a value for a sub-field of the JSON option 'configuration-patch'. It is mutually exclusive with that option.

--private-cert-issuing-certificate-urls-encoded (bool)

This field determines whether to encode the URL of the issuing certificate in the certificates that are issued by this certificate authority or this field determines whether to encode the URL of the issuing certificate in the certificates that are issued by this certificate authority. This option provides a value for a sub-field of the JSON option 'configuration-patch'. It is mutually exclusive with that option.

--private-cert-allowed-secret-groups (string)

This field scopes the creation of private certificates to only the secret groups that you specify. This option provides a value for a sub-field of the JSON option 'configuration-patch'. It is mutually exclusive with that option.

The maximum length is 1024 characters. The minimum length is 2 characters. The value must match regular expression /(.*?)/.

--private-cert-ttl (string)

The requested time-to-live (TTL) for certificates that are created by this CA. This option provides a value for a sub-field of the JSON option 'configuration-patch'. It is mutually exclusive with that option.

The maximum length is 10 characters. The minimum length is 2 characters. The value must match regular expression /^[0-9]+[s,m,h,d]{0,1}$/.

--private-cert-allow-localhost (bool)

This field indicates whether to allow 'localhost' to be included as one of the requested common names. This option provides a value for a sub-field of the JSON option 'configuration-patch'. It is mutually exclusive with that option.

--private-cert-allowed-domains ([]string)

The domains to define for the certificate template. This property is used along with the 'allow_bare_domains' and 'allow_subdomains' options. This option provides a value for a sub-field of the JSON option 'configuration-patch'. It is mutually exclusive with that option.

The list items must match regular expression /(.*?)/. The maximum length is 100 items. The minimum length is 0 items.

--private-cert-allowed-domains-template (bool)

This field indicates whether to allow the domains that are supplied in the 'allowed_domains' field to contain access control list (ACL) templates. This option provides a value for a sub-field of the JSON option 'configuration-patch'. It is mutually exclusive with that option.

--private-cert-allow-bare-domains (bool)

This field indicates whether to allow clients to request private certificates that match the value of the actual domains on the final certificate. This option provides a value for a sub-field of the JSON option 'configuration-patch'. It is mutually exclusive with that option.

--private-cert-allow-subdomains (bool)

This field indicates whether to allow clients to request private certificates with common names (CN) that are subdomains of the CNs that are allowed by the other certificate template options. This option provides a value for a sub-field of the JSON option 'configuration-patch'. It is mutually exclusive with that option.

--private-cert-allow-glob-domains (bool)

This field indicates whether to allow glob patterns in the names that are specified in the 'allowed_domains' field. This option provides a value for a sub-field of the JSON option 'configuration-patch'. It is mutually exclusive with that option.

--private-cert-allow-any-name (bool)

This field indicates whether to allow clients to request a private certificate that matches any common name. This option provides a value for a sub-field of the JSON option 'configuration-patch'. It is mutually exclusive with that option.

--private-cert-enforce-hostname (bool)

This field indicates whether to enforce only valid hostnames for common names, DNS Subject Alternative Names, and the host section of email addresses. This option provides a value for a sub-field of the JSON option 'configuration-patch'. It is mutually exclusive with that option.

--private-cert-allow-ip-sans (bool)

This field indicates whether to allow clients to request a private certificate with IP Subject Alternative Names. This option provides a value for a sub-field of the JSON option 'configuration-patch'. It is mutually exclusive with that option.

--private-cert-allowed-uri-sans ([]string)

The URI Subject Alternative Names to allow for private certificates. This option provides a value for a sub-field of the JSON option 'configuration-patch'. It is mutually exclusive with that option.

The list items must match regular expression /(.*?)/. The maximum length is 100 items. The minimum length is 0 items.

--private-cert-allowed-other-sans ([]string)

The custom Object Identifier (OID) or UTF8-string Subject Alternative Names (SANs) to allow for private certificates. This option provides a value for a sub-field of the JSON option 'configuration-patch'. It is mutually exclusive with that option.

The list items must match regular expression /(.*?)/. The maximum length is 100 items. The minimum length is 0 items.

--private-cert-server-flag (bool)

This field indicates whether private certificates are flagged for server use. This option provides a value for a sub-field of the JSON option 'configuration-patch'. It is mutually exclusive with that option.

--private-cert-client-flag (bool)

This field indicates whether private certificates are flagged for client use. This option provides a value for a sub-field of the JSON option 'configuration-patch'. It is mutually exclusive with that option.

--private-cert-code-signing-flag (bool)

This field indicates whether private certificates are flagged for code signing use. This option provides a value for a sub-field of the JSON option 'configuration-patch'. It is mutually exclusive with that option.

--private-cert-email-protection-flag (bool)

This field indicates whether private certificates are flagged for email protection use. This option provides a value for a sub-field of the JSON option 'configuration-patch'. It is mutually exclusive with that option.

--private-cert-private-key-type (string)

The type of private key to generate. This option provides a value for a sub-field of the JSON option 'configuration-patch'. It is mutually exclusive with that option.

Allowable values are: rsa, ec.

--private-cert-private-key-bits (int64)

The number of bits to use to generate the private key. This option provides a value for a sub-field of the JSON option 'configuration-patch'. It is mutually exclusive with that option.

The maximum value is 4096. The minimum value is 224.

--private-cert-key-usage ([]string)

The allowed key usage constraint to define for private certificates. This option provides a value for a sub-field of the JSON option 'configuration-patch'. It is mutually exclusive with that option.

The list items must match regular expression /^[a-zA-Z]+$/. The maximum length is 100 items. The minimum length is 0 items.

--private-cert-ext-key-usage ([]string)

The allowed extended key usage constraint on private certificates. This option provides a value for a sub-field of the JSON option 'configuration-patch'. It is mutually exclusive with that option.

The list items must match regular expression /^[a-zA-Z]+$/. The maximum length is 100 items. The minimum length is 0 items.

--private-cert-ext-key-usage-oids ([]string)

A list of extended key usage Object Identifiers (OIDs). This option provides a value for a sub-field of the JSON option 'configuration-patch'. It is mutually exclusive with that option.

The list items must match regular expression /(.*?)/. The maximum length is 100 items. The minimum length is 0 items.

--private-cert-use-csr-common-name (bool)

this field determines whether to use the common name (CN) from a certificate signing request (CSR). This option provides a value for a sub-field of the JSON option 'configuration-patch'. It is mutually exclusive with that option.

--private-cert-use-cse-sans (bool)

this field determines whether to use the Subject Alternative Names (SANs) from a certificate signing request (CSR). This option provides a value for a sub-field of the JSON option 'configuration-patch'. It is mutually exclusive with that option.

--private-cert-subject-organizational-unit ([]string)

The Organizational Unit (OU) values to define in the subject field of the resulting certificate. This option provides a value for a sub-field of the JSON option 'configuration-patch'. It is mutually exclusive with that option.

The list items must match regular expression /(.*?)/. The maximum length is 10 items. The minimum length is 0 items.

--private-cert-subject-organization ([]string)

The Organization (O) values to define in the subject field of the resulting certificate. This option provides a value for a sub-field of the JSON option 'configuration-patch'. It is mutually exclusive with that option.

The list items must match regular expression /(.*?)/. The maximum length is 10 items. The minimum length is 0 items.

--private-cert-subject-country ([]string)

The Country (C) values to define in the subject field of the resulting certificate. This option provides a value for a sub-field of the JSON option 'configuration-patch'. It is mutually exclusive with that option.

The list items must match regular expression /(.*?)/. The maximum length is 10 items. The minimum length is 0 items.

--private-cert-subject-locality ([]string)

The Locality (L) values to define in the subject field of the resulting certificate. This option provides a value for a sub-field of the JSON option 'configuration-patch'. It is mutually exclusive with that option.

The list items must match regular expression /(.*?)/. The maximum length is 10 items. The minimum length is 0 items.

--private-cert-subject-province ([]string)

The Province (ST) values to define in the subject field of the resulting certificate. This option provides a value for a sub-field of the JSON option 'configuration-patch'. It is mutually exclusive with that option.

The list items must match regular expression /(.*?)/. The maximum length is 10 items. The minimum length is 0 items.

--private-cert-subject-street-address ([]string)

The street address values to define in the subject field of the resulting certificate. This option provides a value for a sub-field of the JSON option 'configuration-patch'. It is mutually exclusive with that option.

The list items must match regular expression /(.*?)/. The maximum length is 10 items. The minimum length is 0 items.

--private-cert-subject-postal-code ([]string)

The postal code values to define in the subject field of the resulting certificate. This option provides a value for a sub-field of the JSON option 'configuration-patch'. It is mutually exclusive with that option.

The list items must match regular expression /(.*?)/. The maximum length is 10 items. The minimum length is 0 items.

--private-cert-requested-serial-number (string)

This field is deprecated. You can ignore its value. This option provides a value for a sub-field of the JSON option 'configuration-patch'. It is mutually exclusive with that option.

The maximum length is 64 characters. The minimum length is 32 characters. The value must match regular expression /[^a-fA-F0-9]/.

--private-cert-require-cn (bool)

This field indicates whether to require a common name to create a private certificate. This option provides a value for a sub-field of the JSON option 'configuration-patch'. It is mutually exclusive with that option.

--private-cert-policy-identifiers ([]string)

A list of policy Object Identifiers (OIDs). This option provides a value for a sub-field of the JSON option 'configuration-patch'. It is mutually exclusive with that option.

The list items must match regular expression /(.*?)/. The maximum length is 100 items. The minimum length is 0 items.

--private-cert-basic-constraints-valid-for-non-ca (bool)

This field indicates whether to mark the Basic Constraints extension of an issued private certificate as valid for non-CA certificates. This option provides a value for a sub-field of the JSON option 'configuration-patch'. It is mutually exclusive with that option.

--private-cert-not-before-duration (string)

The duration in seconds by which to backdate the 'not_before' property of an issued private certificate. This option provides a value for a sub-field of the JSON option 'configuration-patch'. It is mutually exclusive with that option.

The maximum length is 10 characters. The minimum length is 2 characters. The value must match regular expression /^[0-9]+[s,m,h,d]{0,1}$/.

--public-cert-lets-encrypt-environment (string)

The configuration of the Let's Encrypt CA environment. This option provides a value for a sub-field of the JSON option 'configuration-patch'. It is mutually exclusive with that option.

Allowable values are: production, staging.

--public-cert-lets-encrypt-private-key (string)

The PEM-encoded private key of your Let's Encrypt account. This option provides a value for a sub-field of the JSON option 'configuration-patch'. It is mutually exclusive with that option.

The maximum length is 100000 characters. The minimum length is 50 characters. The value must match regular expression /(^-----BEGIN PRIVATE KEY-----.*?)|(^-----BEGIN RSA PRIVATE KEY-----.*?)/.

--public-cert-lets-encrypt-preferred-chain (string)

The preferred chain with an issuer that matches this Subject Common Name. This option provides a value for a sub-field of the JSON option 'configuration-patch'. It is mutually exclusive with that option.

The maximum length is 30 characters. The minimum length is 2 characters. The value must match regular expression /(.*?)/.

--public-cert-cloud-internet-services-apikey (string)

An IBM Cloud API key that can list domains in your Cloud Internet Services instance and add DNS records. This option provides a value for a sub-field of the JSON option 'configuration-patch'. It is mutually exclusive with that option.

The maximum length is 128 characters. The minimum length is 0 characters. The value must match regular expression /(.*?)/.

--cloud-internet-services-crn (string)

A CRN that uniquely identifies an IBM Cloud resource. This option provides a value for a sub-field of the JSON option 'configuration-patch'. It is mutually exclusive with that option.

The maximum length is 512 characters. The minimum length is 9 characters. The value must match regular expression /^crn:v[0-9](:([A-Za-z0-9-._~!$&'()*+,;=@\/]|%[0-9A-Z]{2})*){8}$/.

--public-cert-classic-infrastructure-username (string)

The username that is associated with your classic infrastructure account. This option provides a value for a sub-field of the JSON option 'configuration-patch'. It is mutually exclusive with that option.

The maximum length is 128 characters. The minimum length is 2 characters. The value must match regular expression /(.*?)/.

--public-cert-classic-infrastructure-password (string)

Your classic infrastructure API key. This option provides a value for a sub-field of the JSON option 'configuration-patch'. It is mutually exclusive with that option.

The maximum length is 128 characters. The minimum length is 2 characters. The value must match regular expression /(.*?)/.

--configuration-task-timeout (string)

Specifies the maximum allowed time for a Code Engine task to be completed. After this time elapses, the task state will changed to failed. The minimum value is 5 minutes and the maximum value is 24 hours. Default task time out is 10 minutes. The value can be either an integer that specifies the number of seconds, or the string representation of a duration, such as '10m' or '2h'. This option provides a value for a sub-field of the JSON option 'configuration-patch'. It is mutually exclusive with that option.

The maximum length is 6 characters. The minimum length is 1 character. The value must match regular expression /^[0-9]+[s,m,h,d]{0,1}$/.

Example

ibmcloud secrets-manager configuration-update \
    --name configuration-name \
    --config-type public_cert_configuration_dns_cloud_internet_services \
    --public-cert-cloud-internet-services-apikey 5ipu_ykv0PMp2MhxQnDMn7VzrkSlBwi3BOI8uthi_EXZ \
    --cloud-internet-services-crn crn:v1:bluemix:public:internet-svcs:global:a/128e84fcca45c1224aae525d31ef2b52:009a0357-1460-42b4-b903-10580aba7dd8::

Command options

--name (string)

The name of the configuration. Required.

The maximum length is 128 characters. The minimum length is 2 characters. The value must match regular expression /^[A-Za-z0-9_][A-Za-z0-9_]*(?:_*-*\.*[A-Za-z0-9]*)*[A-Za-z0-9]+$/.

--config-type (string)

The configuration type of this configuration - use this header to resolve 300 error responses.

Allowable values are: public_cert_configuration_dns_cloud_internet_services, public_cert_configuration_dns_classic_infrastructure, public_cert_configuration_ca_lets_encrypt, private_cert_configuration_root_ca, private_cert_configuration_intermediate_ca, private_cert_configuration_template, iam_credentials_configuration, custom_credentials_configuration.

Example

ibmcloud secrets-manager configuration-delete \
    --name configuration-name \
    --config-type public_cert_configuration_dns_cloud_internet_services

Command options

--name (string)

The name of the configuration. Required.

The maximum length is 128 characters. The minimum length is 2 characters. The value must match regular expression /^[A-Za-z0-9_][A-Za-z0-9_]*(?:_*-*\.*[A-Za-z0-9]*)*[A-Za-z0-9]+$/.

--config-action-prototype (ConfigurationActionPrototype)

The request body to specify the properties of the action to create a configuration. This JSON option can instead be provided by setting individual fields with other options. It is mutually exclusive with those options.

Provide a JSON string option or specify a JSON file to read from by providing a filepath option that begins with a @, for example, --config-action-prototype=@path/to/file.json.

--config-type (string)

The configuration type of this configuration - use this header to resolve 300 error responses.

Allowable values are: public_cert_configuration_dns_cloud_internet_services, public_cert_configuration_dns_classic_infrastructure, public_cert_configuration_ca_lets_encrypt, private_cert_configuration_root_ca, private_cert_configuration_intermediate_ca, private_cert_configuration_template, iam_credentials_configuration, custom_credentials_configuration.

--config-action-action-type (string)

The type of configuration action. This option provides a value for a sub-field of the JSON option 'config-action-prototype'. It is mutually exclusive with that option.

Allowable values are: private_cert_configuration_action_rotate_crl, private_cert_configuration_action_sign_intermediate, private_cert_configuration_action_sign_csr, private_cert_configuration_action_set_signed, private_cert_configuration_action_revoke_ca_certificate, private_cert_configuration_action_rotate_intermediate.

--certificate-common-name (string)

The Common Name (CN) represents the server name that is protected by the SSL certificate. This option provides a value for a sub-field of the JSON option 'config-action-prototype'. It is mutually exclusive with that option.

The maximum length is 128 characters. The minimum length is 4 characters. The value must match regular expression /(.*?)/.

--certificate-alt-names ([]string)

With the Subject Alternative Name field, you can specify additional hostnames to be protected by a single SSL certificate. This option provides a value for a sub-field of the JSON option 'config-action-prototype'. It is mutually exclusive with that option.

The list items must match regular expression /^(.*?)$/. The maximum length is 99 items. The minimum length is 0 items.

--private-cert-ip-sans (string)

The IP Subject Alternative Names to define for the CA certificate, in a comma-delimited list. This option provides a value for a sub-field of the JSON option 'config-action-prototype'. It is mutually exclusive with that option.

The maximum length is 2048 characters. The minimum length is 2 characters. The value must match regular expression /(.*?)/.

--private-cert-uri-sans (string)

The URI Subject Alternative Names to define for the CA certificate, in a comma-delimited list. This option provides a value for a sub-field of the JSON option 'config-action-prototype'. It is mutually exclusive with that option.

The maximum length is 2048 characters. The minimum length is 2 characters. The value must match regular expression /(.*?)/.

--private-cert-other-sans ([]string)

The custom Object Identifier (OID) or UTF8-string Subject Alternative Names to define for the CA certificate. This option provides a value for a sub-field of the JSON option 'config-action-prototype'. It is mutually exclusive with that option.

The list items must match regular expression /(.*?)/. The maximum length is 100 items. The minimum length is 0 items.

--private-cert-ttl (string)

The time-to-live (TTL) to assign to a private certificate. This option provides a value for a sub-field of the JSON option 'config-action-prototype'. It is mutually exclusive with that option.

The maximum length is 10 characters. The minimum length is 2 characters. The value must match regular expression /^[0-9]+[s,m,h,d]{0,1}$/.

--private-cert-format (string)

The format of the returned data. This option provides a value for a sub-field of the JSON option 'config-action-prototype'. It is mutually exclusive with that option.

Allowable values are: pem, pem_bundle.

--private-cert-max-path-length (int64)

The maximum path length to encode in the generated certificate. -1 means no limit. This option provides a value for a sub-field of the JSON option 'config-action-prototype'. It is mutually exclusive with that option.

The maximum value is 10. The minimum value is -1.

--private-cert-exclude-cn-from-sans (bool)

This parameter controls whether the common name is excluded from Subject Alternative Names (SANs). This option provides a value for a sub-field of the JSON option 'config-action-prototype'. It is mutually exclusive with that option.

--private-cert-permitted-dns-domains ([]string)

The allowed DNS domains or subdomains for the certificates that are to be signed and issued by this CA certificate. This option provides a value for a sub-field of the JSON option 'config-action-prototype'. It is mutually exclusive with that option.

The list items must match regular expression /(.*?)/. The maximum length is 100 items. The minimum length is 0 items.

--config-action-use-csr-values (bool)

This field indicates whether to use values from a certificate signing request (CSR) to complete a private_cert_configuration_action_sign_csr action. If it is set to true, then:

1. Subject information, including names and alternate names, are preserved from the CSR rather than by using the values that are provided in the other parameters to this operation.

2. Any key usage, for example, non-repudiation, that is requested in the CSR are added to the basic set of key usages used for CA certificates that are signed by the intermediate authority.

3. Extensions that are requested in the CSR are copied into the issued private certificate. This option provides a value for a sub-field of the JSON option 'config-action-prototype'. It is mutually exclusive with that option.

--private-cert-subject-organizational-unit ([]string)

The Organizational Unit (OU) values to define in the subject field of the resulting certificate. This option provides a value for a sub-field of the JSON option 'config-action-prototype'. It is mutually exclusive with that option.

The list items must match regular expression /(.*?)/. The maximum length is 10 items. The minimum length is 0 items.

--private-cert-subject-organization ([]string)

The Organization (O) values to define in the subject field of the resulting certificate. This option provides a value for a sub-field of the JSON option 'config-action-prototype'. It is mutually exclusive with that option.

The list items must match regular expression /(.*?)/. The maximum length is 10 items. The minimum length is 0 items.

--private-cert-subject-country ([]string)

The Country (C) values to define in the subject field of the resulting certificate. This option provides a value for a sub-field of the JSON option 'config-action-prototype'. It is mutually exclusive with that option.

The list items must match regular expression /(.*?)/. The maximum length is 10 items. The minimum length is 0 items.

--private-cert-subject-locality ([]string)

The Locality (L) values to define in the subject field of the resulting certificate. This option provides a value for a sub-field of the JSON option 'config-action-prototype'. It is mutually exclusive with that option.

The list items must match regular expression /(.*?)/. The maximum length is 10 items. The minimum length is 0 items.

--private-cert-subject-province ([]string)

The Province (ST) values to define in the subject field of the resulting certificate. This option provides a value for a sub-field of the JSON option 'config-action-prototype'. It is mutually exclusive with that option.

The list items must match regular expression /(.*?)/. The maximum length is 10 items. The minimum length is 0 items.

--private-cert-subject-street-address ([]string)

The street address values to define in the subject field of the resulting certificate. This option provides a value for a sub-field of the JSON option 'config-action-prototype'. It is mutually exclusive with that option.

The list items must match regular expression /(.*?)/. The maximum length is 10 items. The minimum length is 0 items.

--private-cert-subject-postal-code ([]string)

The postal code values to define in the subject field of the resulting certificate. This option provides a value for a sub-field of the JSON option 'config-action-prototype'. It is mutually exclusive with that option.

The list items must match regular expression /(.*?)/. The maximum length is 10 items. The minimum length is 0 items.

--private-cert-serial-number (string)

The requested value for the serialNumber (https://datatracker.ietf.org/doc/html/rfc4519#section-2.31) attribute that is in the certificate's distinguished name (DN). This option provides a value for a sub-field of the JSON option 'config-action-prototype'. It is mutually exclusive with that option.

The maximum length is 64 characters. The minimum length is 32 characters. The value must match regular expression /[^a-fA-F0-9]/.

--private-cert-csr (string)

The certificate signing request. This option provides a value for a sub-field of the JSON option 'config-action-prototype'. It is mutually exclusive with that option.

The maximum length is 4096 characters. The minimum length is 2 characters. The value must match regular expression /^(-{5}BEGIN.+?-{5}[\\s\\S]+-{5}END.+?-{5}[\\s]*)$/.

--config-action-intermediate-certificate-authority (string)

The name of the intermediate certificate authority configuration. This option provides a value for a sub-field of the JSON option 'config-action-prototype'. It is mutually exclusive with that option.

The maximum length is 128 characters. The minimum length is 2 characters. The value must match regular expression /^[A-Za-z0-9_][A-Za-z0-9_]*(?:_*-*\\.*[A-Za-z0-9]*)*[A-Za-z0-9]+$/.

--imported-cert-certificate (string)

The PEM-encoded contents of your certificate. This option provides a value for a sub-field of the JSON option 'config-action-prototype'. It is mutually exclusive with that option.

The maximum length is 100000 characters. The minimum length is 50 characters. The value must match regular expression /(-{5}BEGIN.+?-{5}[\\s\\S]+-{5}END.+?-{5}[\\s]*)/.

Examples

ibmcloud secrets-manager configuration-action-create \
    --name configuration-name \
    --config-action-prototype '{"action_type": "private_cert_configuration_action_rotate_crl"}' \
    --config-type public_cert_configuration_dns_cloud_internet_services

Alternatively, granular options are available for the sub-fields of JSON string options:

ibmcloud secrets-manager configuration-action-create \
    --name configuration-name \
    --config-type public_cert_configuration_dns_cloud_internet_services \
    --config-action-action-type private_cert_configuration_action_rotate_crl

Command options

--event-notifications-instance-crn (string)

A CRN that uniquely identifies an IBM Cloud resource. Required.

The maximum length is 512 characters. The minimum length is 9 characters. The value must match regular expression /^crn:v[0-9](:([A-Za-z0-9-._~!$&'()*+,;=@\/]|%[0-9A-Z]{2})*){8}$/.

--event-notifications-source-name (string)

The name that is displayed as a source that is in your Event Notifications instance. Required.

The maximum length is 256 characters. The minimum length is 2 characters. The value must match regular expression /(.*?)/.

--event-notifications-source-description (string)

An optional description for the source that is in your Event Notifications instance.

The maximum length is 1024 characters. The minimum length is 0 characters. The value must match regular expression /(.*?)/.

Example

ibmcloud secrets-manager notifications-registration-create \
    --event-notifications-instance-crn crn:v1:bluemix:public:event-notifications:us-south:a/22018f3c34ff4ff193698d15ca316946:578ad1a4-2fd8-4e66-95d5-79a842ba91f8:: \
    --event-notifications-source-name 'My Secrets Manager' \
    --event-notifications-source-description 'Optional description of this source in an Event Notifications instance.'

Example output

Example Notifications registration configuration details for Event Notifications.

{
  "event_notifications_instance_crn" : "crn:v1:bluemix:public:event-notifications:us-south:a/22018f3c34ff4ff193698d15ca316946:578ad1a4-2fd8-4e66-95d5-79a842ba91f8::"
}

Example

ibmcloud secrets-manager notifications-registration

Example output

Example Notifications registration configuration details for Event Notifications.

{
  "event_notifications_instance_crn" : "crn:v1:bluemix:public:event-notifications:us-south:a/22018f3c34ff4ff193698d15ca316946:578ad1a4-2fd8-4e66-95d5-79a842ba91f8::"
}

Example

ibmcloud secrets-manager notifications-registration-delete

Example

ibmcloud secrets-manager notifications-registration-test