---
title: "POST /api/v1/dynamic-secrets"
method: POST
path: "/api/v1/dynamic-secrets"
tags: ["Dynamic Secrets"]
---

# POST /api/v1/dynamic-secrets

`POST /api/v1/dynamic-secrets`

## Request body

- object
  - `projectSlug` string, required — The slug of the project to create dynamic secret in.
  - `provider` union, required — The type of dynamic secret.
    - object
      - `type` 'sql-database', required
      - `inputs` object, required
        - `client` 'postgres' | 'mysql2' | 'oracledb' | 'mssql' | 'sap-ase' | 'vertica', required
        - `host` string, required
        - `port` number, required
        - `database` string, required
        - `username` string, required
        - `password` string, required
        - `passwordRequirements` object — Password generation requirements
          - `length` number, required
          - `required` object, required
            - `lowercase` number, required
            - `uppercase` number, required
            - `digits` number, required
            - `symbols` number, required
          - `allowedSymbols` string
        - `creationStatement` string, required
        - `revocationStatement` string, required
        - `renewStatement` string
        - `ca` string
        - `sslEnabled` boolean
        - `sslRejectUnauthorized` boolean
        - `gatewayId` string, nullable
        - `gatewayPoolId` string, nullable
    - object
      - `type` 'clickhouse', required
      - `inputs` object, required
        - `host` string, required
        - `port` number, required
        - `database` string, required
        - `username` string, required
        - `password` string, required
        - `passwordRequirements` object — Password generation requirements
          - `length` number, required
          - `required` object, required
            - `lowercase` number, required
            - `uppercase` number, required
            - `digits` number, required
            - `symbols` number, required
          - `allowedSymbols` string
        - `creationStatement` string, required
        - `revocationStatement` string, required
        - `renewStatement` string
        - `ca` string
        - `gatewayId` string, nullable
        - `gatewayPoolId` string, nullable
    - object
      - `type` 'cassandra', required
      - `inputs` object, required
        - `host` string, required
        - `port` number, required
        - `localDataCenter` string, required
        - `keyspace` string
        - `username` string, required
        - `password` string, required
        - `creationStatement` string, required
        - `revocationStatement` string, required
        - `renewStatement` string
        - `ca` string
        - `sslRejectUnauthorized` boolean
    - object
      - `type` 'sap-ase', required
      - `inputs` object, required
        - `host` string, required
        - `port` number, required
        - `database` string, required
        - `username` string, required
        - `password` string, required
        - `creationStatement` string, required
        - `revocationStatement` string, required
    - object
      - `type` 'aws-iam', required
      - `inputs` union, required
        - object
          - `method` 'access-key', required
          - `credentialType` 'iam-user' | 'temporary-credentials'
          - `accessKey` string, required
          - `secretAccessKey` string, required
          - `region` string, required
          - `awsPath` string
          - `permissionBoundaryPolicyArn` string
          - `policyDocument` string
          - `userGroups` string
          - `policyArns` string
          - `tags` object[]
            - `key` string, required
            - `value` string
        - object
          - `method` 'assume-role', required
          - `credentialType` 'iam-user' | 'temporary-credentials'
          - `roleArn` string, required
          - `region` string, required
          - `awsPath` string
          - `permissionBoundaryPolicyArn` string
          - `policyDocument` string
          - `userGroups` string
          - `policyArns` string
          - `sessionPolicyArns` string
          - `sessionPolicyDocument` string
          - `tags` object[]
            - `key` string, required
            - `value` string
        - object
          - `method` 'irsa', required
          - `credentialType` 'iam-user' | 'temporary-credentials'
          - `region` string, required
          - `awsPath` string
          - `permissionBoundaryPolicyArn` string
          - `policyDocument` string
          - `userGroups` string
          - `policyArns` string
          - `tags` object[]
            - `key` string, required
            - `value` string
    - object
      - `type` 'redis', required
      - `inputs` object, required
        - `host` string, required
        - `port` number, required
        - `username` string, required
        - `password` string
        - `creationStatement` string, required
        - `revocationStatement` string, required
        - `renewStatement` string
        - `ca` string
        - `sslRejectUnauthorized` boolean
    - object
      - `type` 'sap-hana', required
      - `inputs` object, required
        - `host` string, required
        - `port` number, required
        - `username` string, required
        - `password` string, required
        - `creationStatement` string, required
        - `revocationStatement` string, required
        - `renewStatement` string
        - `ca` string
        - `sslRejectUnauthorized` boolean
    - object
      - `type` 'aws-elasticache', required
      - `inputs` object, required
        - `clusterName` string, required
        - `accessKeyId` string, required
        - `secretAccessKey` string, required
        - `region` string, required
        - `creationStatement` string, required
        - `revocationStatement` string, required
    - object
      - `type` 'aws-memorydb', required
      - `inputs` object, required
        - `clusterName` string, required
        - `auth` object, required
          - `type` 'iam', required
          - `accessKeyId` string, required
          - `secretAccessKey` string, required
        - `region` string, required
        - `creationStatement` string, required
        - `revocationStatement` string, required
    - object
      - `type` 'mongo-db-atlas', required
      - `inputs` object, required
        - `adminPublicKey` string, required — Admin user public api key
        - `adminPrivateKey` string, required — Admin user private api key
        - `groupId` string, required — Unique 24-hexadecimal digit string that identifies your project. This is same as project id
        - `roles` object[], required
          - `collectionName` string — Collection on which this role applies.
          - `databaseName` string, required — Database to which the user is granted access privileges.
          - `roleName` string, required — Enum: "atlasAdmin" "backup" "clusterMonitor" "dbAdmin" "dbAdminAnyDatabase" "enableSharding" "read" "readAnyDatabase" "readWrite" "readWriteAnyDatabase" "<a custom role name>".Human-readable label that identifies a group of privileges assigned to a database user. This value can either be a built-in role or a custom role.
        - `scopes` object[], required
          - `name` string, required — Human-readable label that identifies the cluster or MongoDB Atlas Data Lake that this database user can access.
          - `type` string, required — Category of resource that this database user can access. Enum: CLUSTER, DATA_LAKE, STREAM
    - object
      - `type` 'elastic-search', required
      - `inputs` object, required
        - `host` string, required
        - `port` number, required
        - `roles` string[], required
        - `auth` union, required
          - object
            - `type` 'user', required
            - `username` string, required
            - `password` string, required
          - object
            - `type` 'api-key', required
            - `apiKey` string, required
            - `apiKeyId` string, required
        - `ca` string
        - `sslRejectUnauthorized` boolean
    - object
      - `type` 'mongo-db', required
      - `inputs` object, required
        - `host` string, required
        - `port` number, nullable
        - `username` string, required
        - `password` string, required
        - `database` string, required
        - `ca` string, nullable
        - `sslRejectUnauthorized` boolean
        - `roles` string[], required — Enum: "atlasAdmin" "backup" "clusterMonitor" "dbAdmin" "dbAdminAnyDatabase" "enableSharding" "read" "readAnyDatabase" "readWrite" "readWriteAnyDatabase" "<a custom role name>".Human-readable label that identifies a group of privileges assigned to a database user. This value can either be a built-in role or a custom role.
    - object
      - `type` 'rabbit-mq', required
      - `inputs` object, required
        - `host` string, required
        - `port` number, required
        - `tags` string[]
        - `username` string, required
        - `password` string, required
        - `ca` string
        - `sslRejectUnauthorized` boolean
        - `virtualHost` object, required
          - `name` string, required
          - `permissions` object, required
            - `read` string, required
            - `write` string, required
            - `configure` string, required
    - object
      - `type` 'azure-entra-id', required
      - `inputs` object, required
        - `tenantId` string, required
        - `userId` string, required
        - `email` string, required
        - `applicationId` string, required
        - `clientSecret` string, required
    - object
      - `type` 'azure-sql-database', required
      - `inputs` object, required
        - `host` string, required
        - `port` number, required
        - `database` string, required
        - `masterDatabase` string
        - `username` string, required
        - `password` string, required
        - `passwordRequirements` object — Password generation requirements
          - `length` number, required
          - `required` object, required
            - `lowercase` number, required
            - `uppercase` number, required
            - `digits` number, required
            - `symbols` number, required
          - `allowedSymbols` string
        - `masterCreationStatement` string, required
        - `creationStatement` string, required
        - `revocationStatement` string, required
        - `renewStatement` string
        - `ca` string
        - `sslEnabled` boolean
        - `sslRejectUnauthorized` boolean
        - `gatewayId` string, nullable
        - `gatewayPoolId` string, nullable
    - object
      - `type` 'ldap', required
      - `inputs` union, required
        - object
          - `url` string, required
          - `binddn` string, required
          - `bindpass` string, required
          - `ca` string
          - `sslRejectUnauthorized` boolean
          - `credentialType` 'dynamic'
          - `creationLdif` string, required
          - `revocationLdif` string, required
          - `rollbackLdif` string
        - object
          - `url` string, required
          - `binddn` string, required
          - `bindpass` string, required
          - `ca` string
          - `sslRejectUnauthorized` boolean
          - `credentialType` 'static', required
          - `rotationLdif` string, required
    - object
      - `type` 'snowflake', required
      - `inputs` object, required
        - `accountId` string, required
        - `orgId` string, required
        - `username` string, required
        - `password` string, required
        - `creationStatement` string, required
        - `revocationStatement` string, required
        - `renewStatement` string
    - object
      - `type` 'totp', required
      - `inputs` union, required
        - object
          - `configType` 'url', required
          - `url` string, uri, required
        - object
          - `configType` 'manual', required
          - `secret` string, required
          - `period` number
          - `algorithm` 'sha1' | 'sha256' | 'sha512'
          - `digits` number
    - object
      - `type` 'kubernetes', required
      - `inputs` union, required
        - object
          - `url` string
          - `clusterToken` string
          - `ca` string
          - `sslEnabled` boolean
          - `sslRejectUnauthorized` boolean
          - `credentialType` 'static', required
          - `serviceAccountName` string, required
          - `namespace` string, required
          - `gatewayId` string, nullable
          - `gatewayPoolId` string, nullable
          - `audiences` string[], required
          - `authMethod` 'gateway' | 'api'
        - object
          - `url` string, uri
          - `clusterToken` string
          - `ca` string
          - `sslEnabled` boolean
          - `sslRejectUnauthorized` boolean
          - `credentialType` 'dynamic', required
          - `namespace` string, required
          - `gatewayId` string, nullable
          - `gatewayPoolId` string, nullable
          - `audiences` string[], required
          - `roleType` 'cluster-role' | 'role', required
          - `role` string, required
          - `authMethod` 'gateway' | 'api'
    - object
      - `type` 'vertica', required
      - `inputs` object, required
        - `host` string, required
        - `port` number, required
        - `username` string, required
        - `password` string, required
        - `database` string, required
        - `gatewayId` string, nullable
        - `gatewayPoolId` string, nullable
        - `creationStatement` string, required
        - `revocationStatement` string, required
        - `passwordRequirements` object — Password generation requirements
          - `length` number, required
          - `required` object, required
            - `lowercase` number, required
            - `uppercase` number, required
            - `digits` number, required
            - `symbols` number, required
          - `allowedSymbols` string
    - object
      - `type` 'gcp-iam', required
      - `inputs` object, required
        - `serviceAccountEmail` string, email, required
        - `tokenScopes` string[] — OAuth scopes for the generated access token.
    - object
      - `type` 'github', required
      - `inputs` object, required
        - `appId` number, required — The ID of your GitHub App.
        - `installationId` number, required — The ID of the GitHub App installation.
        - `privateKey` string, required — The private key generated for your GitHub App.
    - object
      - `type` 'couchbase', required
      - `inputs` object, required
        - `url` string, uri, required — Couchbase Cloud API URL
        - `orgId` string, required — Organization ID
        - `projectId` string, required — Project ID
        - `clusterId` string, required — Cluster ID
        - `roles` string[], required — Roles to assign to the user
        - `buckets` union — Bucket configuration: '*' for all buckets, scopes, and collections or array of bucket objects with specific scopes and collections
          - string
          - object[]
            - `name` string, required — Bucket name
            - `scopes` object[] — Scopes within the bucket
              - …
        - `passwordRequirements` object — Password generation requirements for Couchbase
          - `length` number, required
          - `required` object, required
            - `lowercase` number, required
            - `uppercase` number, required
            - `digits` number, required
            - `symbols` number, required
          - `allowedSymbols` string
        - `auth` object, required
          - `apiKey` string, required — Couchbase Cloud API Key
    - object
      - `type` 'milvus', required
      - `inputs` object, required
        - `host` string, required — Milvus endpoint host; uses https when the host includes https:// or a CA is provided, http when the host includes http://, otherwise http (e.g. localhost).
        - `port` integer, required
        - `username` string, required — Admin username used to manage Milvus users and roles
        - `password` string, required — Admin password used to manage Milvus users and roles
        - `database` string — Default Milvus database used for privilege grants
        - `privileges` object[] — Privileges granted to an ephemeral role bound to the lease user. Leave empty to create the user with only the built-in public role.
          - `objectType` string, required — Milvus object type (e.g. "Collection", "Database", "Global", "User", "Cluster")
          - `objectName` string — Name of the target object, or "*" to apply to all
          - `privilege` string, required — Milvus privilege name or built-in privilege group (e.g. "Search", "COLL_RO", "DB_Admin")
          - `dbName` string — Optional database override for this privilege
        - `ca` string
        - `sslRejectUnauthorized` boolean
        - `gatewayId` string, nullable
        - `gatewayPoolId` string, nullable
    - object
      - `type` 'ssh', required
      - `inputs` object, required
        - `principals` string[], required
        - `keyAlgorithm` 'RSA_2048' | 'RSA_4096' | 'EC_prime256v1' | 'EC_secp384r1' | 'ED25519'
    - object
      - `type` 'ibm-api-connect', required
      - `inputs` object, required
        - `clientId` string, required
        - `clientSecret` string, required
        - `instanceUrl` string, uri, required
        - `apiKey` string, required
        - `orgId` string, required
        - `catalogId` string, required
        - `consumerOrgId` string, required
        - `appId` string, required
        - `gatewayId` string, nullable
        - `gatewayPoolId` string, nullable
    - object
      - `type` 'tailscale', required
      - `inputs` union, required
        - object
          - `authType` 'auth_keys', required
          - `auth` union, required
            - object
              - …
            - object
              - …
          - `tailnet` string — Tailnet identifier. Use '-' for the token owner's default tailnet.
          - `description` string — Description applied to the created key.
          - `tags` string[] — ACL tags to attach to devices (e.g. tag:ci). Required when authenticating with an OAuth token.
          - `reusable` boolean — Whether the auth key can register multiple devices.
          - `preauthorized` boolean — Whether devices registered with the key are pre-authorized.
        - object
          - `authType` 'oauth_keys', required
          - `auth` union, required
            - object
              - …
            - object
              - …
          - `tailnet` string — Tailnet identifier. Use '-' for the token owner's default tailnet.
          - `description` string — Description applied to the created OAuth client.
          - `tags` string[] — ACL tags to attach (e.g. tag:ci). Required if scopes include devices:core or auth_keys.
          - `scopes` string[], required — OAuth scopes granted to the client.
        - object
          - `authType` 'federated_keys', required
          - `auth` union, required
            - object
              - …
            - object
              - …
          - `tailnet` string — Tailnet identifier. Use '-' for the token owner's default tailnet.
          - `description` string — Description applied to the created federated identity.
          - `tags` string[] — ACL tags to attach (e.g. tag:ci). Required if scopes include devices:core or auth_keys.
          - `scopes` string[], required — OAuth scopes granted to tokens issued via this federated identity.
          - `issuer` string, required — HTTPS URL of the OIDC issuer trusted for token exchange.
          - `subject` string, required — Pattern matched against the sub claim of the OIDC identity token.
          - `audience` string — Audience for the OIDC token exchange. Tailscale auto-generates one if omitted.
  - `defaultTTL` string, required — The default TTL that will be applied for all the leases.
  - `maxTTL` string, nullable — The maximum limit a TTL can be leases or renewed.
  - `path` string — The path to create the dynamic secret in.
  - `environmentSlug` string, required — The slug of the environment to create the dynamic secret in.
  - `name` string, required — The name of the dynamic secret.
  - `metadata` object[]
    - `key` string, required
    - `value` string
  - `usernameTemplate` string

## Response `200`

Default Response

- object
  - `dynamicSecret` object, required
    - `id` string, uuid, required
    - `name` string, required
    - `version` number, required
    - `type` string, required
    - `defaultTTL` string, required
    - `maxTTL` string, nullable
    - `folderId` string, uuid, required
    - `status` string, nullable
    - `statusDetails` string, nullable
    - `createdAt` string, date-time, required
    - `updatedAt` string, date-time, required
    - `projectGatewayId` string, uuid, nullable
    - `gatewayId` string, uuid, nullable
    - `usernameTemplate` string, nullable
    - `gatewayV2Id` string, uuid, nullable
    - `gatewayPoolId` string, uuid, nullable
    - `metadata` object[]
      - `key` string, required
      - `value` string
    - `inputs` unknown

## Other responses

- `400` — Default Response
- `401` — Default Response
- `403` — Default Response
- `404` — Default Response
- `422` — Default Response
- `500` — Default Response

---

[API](https://skmtc.net/infisical/apis/infisical-api.md) · [All operations](https://skmtc.net/infisical/apis/infisical-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/infisical/infisical-api/versions/885aef3e6c11/schema)