---
title: "POST /dynamic-secret-create-k8s"
method: POST
path: "/dynamic-secret-create-k8s"
tags: ["v2"]
---

# POST /dynamic-secret-create-k8s

`POST /dynamic-secret-create-k8s`

## Request body

- DynamicSecretCreateK8s — dynamicSecretCreateK8s is a command that creates k8s dynamic secret
  - `custom-username-template` string — Customize how temporary usernames are generated using go template
  - `delete_protection` string — Protection from accidental deletion of this object [true/false]
  - `description` string — Description of the object
  - `input-rule` string[] — Agentic input rule in name=...,rule=... format (e.g. name=rule1,rule=Sanitize input) Mirrors commands.AgenticRulesParams — kept separate because ResourceDS cannot embed it (different package, different struct layout).
  - `item-custom-fields` object — Additional custom fields to associate with the item
  - `json` boolean — Set output format to JSON
  - `k8s-allowed-namespaces` string — Comma-separated list of allowed K8S namespaces for the generated ServiceAccount (relevant only for k8s-service-account-type=dynamic)
  - `k8s-cluster-ca-cert` string — K8S cluster CA certificate
  - `k8s-cluster-endpoint` string — K8S cluster URL endpoint
  - `k8s-cluster-name` string — K8S cluster name
  - `k8s-cluster-token` string — K8S cluster Bearer token
  - `k8s-namespace` string — K8S Namespace where the ServiceAccount exists.
  - `k8s-predefined-role-name` string — The pre-existing Role or ClusterRole name to bind the generated ServiceAccount to (relevant only for k8s-service-account-type=dynamic)
  - `k8s-predefined-role-type` string — Specifies the type of the pre-existing K8S role [Role, ClusterRole] (relevant only for k8s-service-account-type=dynamic)
  - `k8s-rolebinding-yaml-data` string — Content of the yaml in a Base64 format.
  - `k8s-rolebinding-yaml-def` string — Path to yaml file that contains definitions of K8S role and role binding (relevant only for k8s-service-account-type=dynamic)
  - `k8s-service-account` string — K8S ServiceAccount to extract token from.
  - `k8s-service-account-type` string — K8S ServiceAccount type [fixed, dynamic].
  - `name` string, required — Dynamic secret name
  - `output-rule` string[] — Agentic output rule in name=...,rule=... format (e.g. name=rule1,rule=Mask secrets)
  - `producer-encryption-key-name` string — Dynamic producer encryption key
  - `secure-access-allow-port-forwading` boolean — Enable Port forwarding while using CLI access
  - `secure-access-bastion-issuer` string — Deprecated. use secure-access-certificate-issuer
  - `secure-access-certificate-issuer` string — Path to the SSH Certificate Issuer for your Akeyless Secure Access
  - `secure-access-cluster-endpoint` string — The K8s cluster endpoint URL
  - `secure-access-dashboard-url` string — The K8s dashboard url
  - `secure-access-delay` integer — The delay duration, in seconds, to wait after generating just-in-time credentials. Accepted range: 0-120 seconds
  - `secure-access-enable` string — Enable/Disable secure remote access [true/false]
  - `secure-access-web` boolean — Enable Web Secure Remote Access
  - `secure-access-web-browsing` boolean — Secure browser via Akeyless's Secure Remote Access (SRA)
  - `secure-access-web-proxy` boolean — Web-Proxy via Akeyless's Secure Remote Access (SRA)
  - `tags` string[] — Add tags attached to this object
  - `target-name` string — Target name
  - `token` string — Authentication token (see `/auth` and `/configure`)
  - `uid-token` string — The universal identity token, Required only for universal_identity authentication
  - `use-gw-service-account` boolean — Use the GW's service account
  - `user-ttl` string — User TTL

## Response `201`

dynamicSecretCreateK8sResponse wraps response body.

- DynamicSecretCreateOutput
  - `dynamic_secret_details` DSProducerDetails
    - `access_token_manager_id` string
    - `acl_rules` string[]
    - `active` boolean
    - `admin_name` string
    - `admin_pwd` string
    - `admin_rotation_interval_days` integer
    - `administrative_port` string
    - `agentic_rules` AgenticRules
      - `input_rules` AgenticRule[]
        - `name` string
        - `rule` string
      - `output_rules` AgenticRule[]
        - `name` string
        - `rule` string
    - `api_key` string
    - `api_key_id` string
    - `artifactory_admin_apikey` string
    - `artifactory_admin_username` string
    - `artifactory_base_url` string
    - `artifactory_token_audience` string
    - `artifactory_token_scope` string
    - `authorization_port` string
    - `aws_access_key_id` string
    - `aws_access_mode` string
    - `aws_external_id` string
    - `aws_region` string
    - `aws_role_arns` string
    - `aws_secret_access_key` string
    - `aws_session_tags` string
    - `aws_session_token` string
    - `aws_transitive_tag_keys` string
    - `aws_user_console_access` boolean
    - `aws_user_groups` string
    - `aws_user_policies` string
    - `aws_user_programmatic_access` boolean
    - `azure_administrative_unit` string
    - `azure_app_object_id` string
    - `azure_client_id` string
    - `azure_client_secret` string
    - `azure_cloud` string
    - `azure_fixed_user_name_sub_claim_key` string
    - `azure_fixed_user_only` boolean
    - `azure_resource_group_name` string
    - `azure_resource_name` string
    - `azure_subscription_id` string
    - `azure_tenant_id` string
    - `azure_user_groups_obj_id` string
    - `azure_user_portal_access` boolean
    - `azure_user_programmatic_access` boolean
    - `azure_user_roles_template_id` string
    - `azure_username` string
    - `cassandra_creation_statements` string
    - `chef_organizations` string
    - `chef_server_access_mode` string
    - `chef_server_host_name` string
    - `chef_server_key` string
    - `chef_server_port` string
    - `chef_server_url` string
    - `chef_server_username` string
    - `chef_skip_ssl` boolean
    - `client_authentication_type` string
    - `client_certificate` string — (Optional) ClientCertificate defines the client certificate for mutual TLS. Must be base64 certificate loaded by UI using file loader field
    - `client_key_passphrase` string — (Optional) ClientKeyPassphrase defines the passphrase for the client private key
    - `client_private_key` string — (Optional) ClientPrivateKey defines the client private key for mutual TLS. Must be base64 private key loaded by UI using file loader field
    - `cloud_service_provider` string
    - `cluster_mode` boolean
    - `connection_type` string
    - `create_sync_url` string
    - `db_client_id` string
    - `db_client_secret` string
    - `db_host_name` string
    - `db_isolation_level` string
    - `db_max_idle_conns` string
    - `db_max_open_conns` string
    - `db_name` string
    - `db_port` string
    - `db_private_key` string — (Optional) Private Key in PEM format
    - `db_private_key_passphrase` string
    - `db_pwd` string
    - `db_server_certificates` string — (Optional) DBServerCertificates defines the set of root certificate authorities that clients use when verifying server certificates. If DBServerCertificates is empty, TLS uses the host's root CA set.
    - `db_server_name` string — (Optional) ServerName is used to verify the hostname on the returned certificates unless InsecureSkipVerify is given. It is also included in the client's handshake to support virtual hosting unless it is an IP address.
    - `db_tenant_id` string
    - `db_user_name` string
    - `delete_protection` boolean
    - `dynamic_secret_id` integer
    - `dynamic_secret_key` string
    - `dynamic_secret_name` string
    - `dynamic_secret_type` string
    - `eks_access_key_id` string
    - `eks_assume_role` string
    - `eks_cluster_ca_certificate` string
    - `eks_cluster_endpoint` string
    - `eks_cluster_name` string
    - `eks_region` string
    - `eks_secret_access_key` string
    - `enable_admin_rotation` boolean
    - `enable_mtls` boolean — (Optional) EnableMTLS defines if mutual TLS will be used to connect to DB
    - `enforce_replay_prevention` boolean — relevant for PRIVATE_KEY_JWT client authentication type
    - `expiration_date` string, date-time
    - `externally_provided_user` string
    - `failure_message` string
    - `fixed_user_only` string
    - `gcp_access_type` string
    - `gcp_fixed_user_claim_keyname` string
    - `gcp_key_algo` string
    - `gcp_project_id` string
    - `gcp_role_bindings` object
    - `gcp_role_names` string
    - `gcp_service_account_email` string — GCPServiceAccountEmail overrides the deprecated field from the target
    - `gcp_service_account_key` string
    - `gcp_service_account_key_base64` string
    - `gcp_service_account_key_id` string
    - `gcp_service_account_type` string
    - `gcp_tmp_service_account_name` string
    - `gcp_token_lifetime` string
    - `gcp_token_scope` string
    - `gcp_token_type` string
    - `github_app_id` integer
    - `github_app_private_key` string
    - `github_base_url` string
    - `github_installation_id` integer
    - `github_installation_token_permissions` object
    - `github_installation_token_repositories` string[]
    - `github_installation_token_repositories_ids` integer[]
    - `github_organization_name` string
    - `github_repository_path` string
    - `gitlab_access_token` string
    - `gitlab_access_type` string
    - `gitlab_certificate` string
    - `gitlab_group_name` string
    - `gitlab_project_name` string
    - `gitlab_role` string
    - `gitlab_token_scope` string[]
    - `gitlab_url` string
    - `gke_cluster_ca_certificate` string
    - `gke_cluster_endpoint` string
    - `gke_cluster_name` string
    - `gke_service_account_key` string
    - `gke_service_account_name` string
    - `google_workspace_access_mode` string
    - `google_workspace_admin_name` string
    - `google_workspace_fixed_user_name_sub_claim_key` string
    - `google_workspace_group_name` string
    - `google_workspace_group_role` string
    - `google_workspace_role_name` string
    - `google_workspace_role_scope` string
    - `grace_rotated_secret_key` string
    - `grant_types` string[]
    - `groups` string
    - `gw_cloud_identity_external_id_opt` AWSGatewayCloudIdentityExternalIdOpt
      - `generated_external_id` string
      - `is_enabled` boolean
      - `role_arn` string
    - `hanadb_creation_statements` string
    - `hanadb_revocation_statements` string
    - `host_name` string
    - `host_port` string
    - `implementation_type` string
    - `is_fixed_user` string
    - `issuer` string — relevant for CLIENT_TLS_CERTIFICATE client authentication type
    - `item_custom_fields_details` ItemCustomFieldsDetails[]
      - `field_id` integer
      - `id` integer
      - `name` string
      - `required` boolean
      - `value` string
    - `item_targets_assoc` ItemTargetAssociation[]
      - `assoc_id` string
      - `attributes` object
      - `target_id` integer
      - `target_name` string
      - `target_type` string
    - `jwks` string
    - `jwks_url` string
    - `k8s_allowed_namespaces` string — comma-separated list of allowed namespaces. Can hold just * which signifies that any namespace is allowed
    - `k8s_auth_type` string
    - `k8s_bearer_token` string
    - `k8s_client_cert_data` string — For K8s Client certificates authentication
    - `k8s_client_key_data` string
    - `k8s_cluster_ca_certificate` string
    - `k8s_cluster_endpoint` string
    - `k8s_cluster_name` string
    - `k8s_dynamic_mode` boolean — when native k8s is in dynamic mode, user can define allowed namespaces, K8sServiceAccount doesn't exist from the start and will only be created at time of getting dynamic secret value By default dynamic mode is false and producer behaves like it did before
    - `k8s_multiple_doc_yaml_temp_definition` integer[] — Yaml definition for creation of temporary objects. Field that can hold multiple docs from which following will be extracted: ServiceAccount, Role/ClusterRole and RoleBinding/ClusterRoleBinding. If ServiceAccount not specified - it will be generated automatically
    - `k8s_namespace` string
    - `k8s_role_name` string — Name of the pre-existing Role or ClusterRole to bind a generated service account to.
    - `k8s_role_type` string
    - `k8s_service_account` string
    - `last_admin_rotation` integer
    - `ldap_audience` string
    - `ldap_bind_dn` string
    - `ldap_bind_password` string
    - `ldap_certificate` string
    - `ldap_fixed_user_name_sub_claim_key` string
    - `ldap_fixed_user_type` string
    - `ldap_group_dn` string
    - `ldap_token_expiration` string
    - `ldap_url` string
    - `ldap_user_attr` string
    - `ldap_user_dn` string
    - `metadata` string
    - `mongodb_atlas_api_private_key` string
    - `mongodb_atlas_api_public_key` string
    - `mongodb_atlas_project_id` string — mongodb atlas fields
    - `mongodb_custom_data` string
    - `mongodb_db_name` string — common fields
    - `mongodb_default_auth_db` string
    - `mongodb_host_port` string
    - `mongodb_is_atlas` boolean
    - `mongodb_password` string
    - `mongodb_roles` string — common fields
    - `mongodb_scopes` string
    - `mongodb_uri_connection` string — mongodb fields
    - `mongodb_uri_options` string
    - `mongodb_username` string
    - `mssql_allowed_db_names` string — Comma-separated list of allowed DB names for runtime selection when fetching the secret value. Empty string => use target DB name only (no override allowed) "*" => any DB name is allowed One or more names => user must select one of the provided names
    - `mssql_creation_statements` string
    - `mssql_revocation_statements` string
    - `mysql_creation_statements` string
    - `mysql_revocation_statements` string
    - `openai_url` string
    - `oracle_creation_statements` string
    - `oracle_revocation_statements` string
    - `oracle_wallet_details` WalletDetails
      - `login_type` string
      - `p12_data_base64` string
      - `sso_data_base64` string
    - `organization_id` string
    - `password` string
    - `password_length` integer
    - `password_policy` string
    - `payload` string
    - `ping_url` string
    - `postgres_creation_statements` string
    - `postgres_revocation_statements` string
    - `privileged_user` string
    - `project_id` string
    - `rabbitmq_server_password` string
    - `rabbitmq_server_uri` string
    - `rabbitmq_server_user` string
    - `rabbitmq_user_conf_permission` string
    - `rabbitmq_user_read_permission` string
    - `rabbitmq_user_tags` string
    - `rabbitmq_user_vhost` string
    - `rabbitmq_user_write_permission` string
    - `rdp_fixed_user_name_sub_claim_key` string
    - `redirect_uris` string[]
    - `redshift_creation_statements` string
    - `restricted_scopes` string[]
    - `revoke_sync_url` string
    - `rotate_sync_url` string
    - `scopes` string[]
    - `secure_remote_access_details` SecureRemoteAccess
      - `account_id` string
      - `allow_port_forwarding` boolean
      - `allow_providing_external_username` boolean
      - `bastion_api` string
      - `bastion_issuer` string
      - `bastion_issuer_id` integer
      - `bastion_ssh` string
      - `block_concurrent_connections` boolean
      - `block_concurrent_connections_level` string
      - `category` string
      - `connection_delay_seconds` integer
      - `dashboard_url` string
      - `db_name` string
      - `domain` string
      - `enable` boolean
      - `endpoint` string
      - `enforce_hosts_restriction` boolean
      - `gw_cluster_id` integer
      - `host` string[]
      - `host_provider_type` string
      - `is_cli` boolean
      - `is_desktop_app` boolean
      - `is_web` boolean
      - `isolated` boolean
      - `lock_during_sra_session` boolean
      - `native` boolean
      - `rd_gateway_server` string
      - `rdp_user` string
      - `region` string
      - `rotate_after_disconnect` boolean
      - `rotate_after_disconnect_delay_mins` integer
      - `schema` string
      - `ssh_password` boolean
      - `ssh_private_key` boolean
      - `ssh_user` string
      - `status_info` ItemSraStatus
        - `count_by_host_info` object
        - `count_info` object
        - `hosts_in_use` string[]
        - `is_in_use` boolean
        - `last_used_item` string, date-time
      - `target_hosts` TargetNameWithHosts[]
        - `hosts` string[]
        - `target_name` string
      - `targets` string[]
      - `url` string
      - `use_internal_bastion` boolean
      - `web_proxy` boolean
    - `session_extension_warn_interval_min` integer
    - `sf_account` string
    - `sf_auth_mode` string
    - `sf_key_algo` string
    - `sf_user_role` string — generated users info
    - `sf_warehouse_name` string
    - `should_stop` string — TODO delete this after migration
    - `signing_algorithm` string
    - `ssl_connection_certificate` string — (Optional) SSLConnectionCertificate defines the certificate for SSL connection. Must be base64 certificate loaded by UI using file loader field
    - `ssl_connection_mode` boolean — (Optional) SSLConnectionMode defines if SSL mode will be used to connect to DB
    - `subject_dn` string
    - `tags` string[]
    - `timeout_seconds` integer
    - `use_gw_cloud_identity` boolean
    - `use_gw_service_account` boolean
    - `user_name` string
    - `user_password` string
    - `user_principal_name` string
    - `user_ttl` string
    - `username_length` integer
    - `username_policy` string
    - `username_template` string
    - `venafi_allow_subdomains` boolean
    - `venafi_allowed_domains` string[]
    - `venafi_api_key` string
    - `venafi_auto_generated_folder` string
    - `venafi_base_url` string
    - `venafi_root_first_in_chain` boolean
    - `venafi_sign_using_akeyless_pki` boolean
    - `venafi_signer_key_name` string
    - `venafi_store_private_key` boolean
    - `venafi_tpp_access_token` string
    - `venafi_tpp_client_id` string
    - `venafi_tpp_password` string — Deprecated: VenafiAccessToken and VenafiRefreshToken should be used instead
    - `venafi_tpp_refresh_token` string
    - `venafi_tpp_username` string — Deprecated: VenafiAccessToken and VenafiRefreshToken should be used instead
    - `venafi_use_tpp` boolean
    - `venafi_zone` string
    - `warn_before_user_expiration_min` integer

## Other responses

- `default` — errorResponse wraps any error to return it as a JSON object with one "error" field.

---

[API](https://skmtc.net/akeyless/apis/akeyless-api.md) · [All operations](https://skmtc.net/akeyless/apis/akeyless-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/akeyless/akeyless-api/versions/0ceb25634501/schema)