--- title: "List AI Gateway Vaults" method: GET path: "/v1/ai-gateways/{gatewayId}/vaults" tags: ["AI Gateway Vaults"] --- # List AI Gateway Vaults `GET /v1/ai-gateways/{gatewayId}/vaults` **Pre-release Endpoint** This endpoint is currently in beta and is subject to change. Returns a list of vaults associated with the AI Gateway. ## Query parameters - `page[size]` integer - `page[after]` string ## Response `200` A paginated list of AI Gateway Vaults. - object - `data` AIGatewayVault[], required - union — **Pre-release Feature** This feature is currently in beta and is subject to change. Configuration for an AI Gateway Vault. - object — **Pre-release Feature** This feature is currently in beta and is subject to change. - `id` string, uuid, required — Contains a unique identifier used for this resource. - `created_at` string, date-time, required — An ISO-8601 timestamp representation of entity creation date. - `updated_at` string, date-time, required — An ISO-8601 timestamp representation of entity update date. - `name` string, required — Identifier for an AI Gateway entity. In some cases, this may be the entity name or ID. - `description` string — The description of the Vault. - `labels` PublicLabels — Public labels store information about an entity that can be used for filtering a list of objects. Public labels are intended to store **PUBLIC** metadata. Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_". - `managed_by` ManagedBy — Stores information about what manages this entity, such as the tool or system responsible for its lifecycle (for example, `terraform`). Keys must be 1–63 characters long and start with an alphanumeric character. - `type` 'konnect', required - `config` object, required - `config_store_id` string, required — The ID of the Konnect Config Store that contains the secrets. - object — **Pre-release Feature** This feature is currently in beta and is subject to change. - `id` string, uuid, required — Contains a unique identifier used for this resource. - `created_at` string, date-time, required — An ISO-8601 timestamp representation of entity creation date. - `updated_at` string, date-time, required — An ISO-8601 timestamp representation of entity update date. - `name` string, required — Identifier for an AI Gateway entity. In some cases, this may be the entity name or ID. - `description` string — The description of the Vault. - `labels` PublicLabels — Public labels store information about an entity that can be used for filtering a list of objects. Public labels are intended to store **PUBLIC** metadata. Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_". - `managed_by` ManagedBy — Stores information about what manages this entity, such as the tool or system responsible for its lifecycle (for example, `terraform`). Keys must be 1–63 characters long and start with an alphanumeric character. - `type` 'env', required - `config` object, required — **Pre-release Feature** This feature is currently in beta and is subject to change. - `base64_decode` boolean — Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets. - `prefix` string — The prefix for the environment variable that the value will be stored in. - object — **Pre-release Feature** This feature is currently in beta and is subject to change. - `id` string, uuid, required — Contains a unique identifier used for this resource. - `created_at` string, date-time, required — An ISO-8601 timestamp representation of entity creation date. - `updated_at` string, date-time, required — An ISO-8601 timestamp representation of entity update date. - `name` string, required — Identifier for an AI Gateway entity. In some cases, this may be the entity name or ID. - `description` string — The description of the Vault. - `labels` PublicLabels — Public labels store information about an entity that can be used for filtering a list of objects. Public labels are intended to store **PUBLIC** metadata. Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_". - `managed_by` ManagedBy — Stores information about what manages this entity, such as the tool or system responsible for its lifecycle (for example, `terraform`). Keys must be 1–63 characters long and start with an alphanumeric character. - `type` 'aws', required - `config` object, required — **Pre-release Feature** This feature is currently in beta and is subject to change. - `base64_decode` boolean — Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets. - `neg_ttl` integer — Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. - `resurrect_ttl` integer — Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. - `ttl` integer — Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. - `assume_role_arn` string — The ARN of the role to assume when retrieving secrets from AWS Secrets Manager. - `endpoint_url` string — The endpoint URL of the AWS Secrets Manager service. If not specified, the default is https://secretsmanager.{region}.amazonaws.com. You can override this by specifying a complete URL including the http/https scheme. - `region` string — The AWS region where your vault is located. - `role_session_name` string, required — The session name used when assuming a role. - `sts_endpoint_url` string — A custom STS endpoint URL used for IAM role assumption. Overrides the default https://sts.amazonaws.com or regional variant https://sts..amazonaws.com. Include the full http/https scheme. Only specify this if using a private VPC endpoint for STS. - object — **Pre-release Feature** This feature is currently in beta and is subject to change. - `id` string, uuid, required — Contains a unique identifier used for this resource. - `created_at` string, date-time, required — An ISO-8601 timestamp representation of entity creation date. - `updated_at` string, date-time, required — An ISO-8601 timestamp representation of entity update date. - `name` string, required — Identifier for an AI Gateway entity. In some cases, this may be the entity name or ID. - `description` string — The description of the Vault. - `labels` PublicLabels — Public labels store information about an entity that can be used for filtering a list of objects. Public labels are intended to store **PUBLIC** metadata. Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_". - `managed_by` ManagedBy — Stores information about what manages this entity, such as the tool or system responsible for its lifecycle (for example, `terraform`). Keys must be 1–63 characters long and start with an alphanumeric character. - `type` 'gcp', required - `config` object, required — **Pre-release Feature** This feature is currently in beta and is subject to change. - `base64_decode` boolean — Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets. - `neg_ttl` integer — Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. - `resurrect_ttl` integer — Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. - `ttl` integer — Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. - `project_id` string, required — The project ID from your Google API Console. You can find it by visiting your Google API Console and selecting “Manage all projects” in the projects list. - object — **Pre-release Feature** This feature is currently in beta and is subject to change. - `id` string, uuid, required — Contains a unique identifier used for this resource. - `created_at` string, date-time, required — An ISO-8601 timestamp representation of entity creation date. - `updated_at` string, date-time, required — An ISO-8601 timestamp representation of entity update date. - `name` string, required — Identifier for an AI Gateway entity. In some cases, this may be the entity name or ID. - `description` string — The description of the Vault. - `labels` PublicLabels — Public labels store information about an entity that can be used for filtering a list of objects. Public labels are intended to store **PUBLIC** metadata. Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_". - `managed_by` ManagedBy — Stores information about what manages this entity, such as the tool or system responsible for its lifecycle (for example, `terraform`). Keys must be 1–63 characters long and start with an alphanumeric character. - `type` 'azure', required - `config` object, required — **Pre-release Feature** This feature is currently in beta and is subject to change. - `base64_decode` boolean — Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets. - `neg_ttl` integer — Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. - `resurrect_ttl` integer — Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. - `ttl` integer — Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. - `credentials_prefix` string — The prefix for the credentials stored in the Azure Key Vault. - `vault_uri` string, required — The URI from which the vault is reachable. This value can be found in your Azure Key Vault Dashboard under the Vault URI entry. - `location` string, required — Each Azure geography includes one or more regions that meet specific data residency and compliance requirements. - `client_id` string — The client ID for your registered application. You can find this in the Azure Dashboard under App Registrations. - `tenant_id` string — The DirectoryId and TenantId are the same: both refer to the GUID representing your Azure Active Directory tenant. Microsoft documentation and products may use either term depending on context. - `type` 'secrets', required - object — **Pre-release Feature** This feature is currently in beta and is subject to change. - `id` string, uuid, required — Contains a unique identifier used for this resource. - `created_at` string, date-time, required — An ISO-8601 timestamp representation of entity creation date. - `updated_at` string, date-time, required — An ISO-8601 timestamp representation of entity update date. - `name` string, required — Identifier for an AI Gateway entity. In some cases, this may be the entity name or ID. - `description` string — The description of the Vault. - `labels` PublicLabels — Public labels store information about an entity that can be used for filtering a list of objects. Public labels are intended to store **PUBLIC** metadata. Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_". - `managed_by` ManagedBy — Stores information about what manages this entity, such as the tool or system responsible for its lifecycle (for example, `terraform`). Keys must be 1–63 characters long and start with an alphanumeric character. - `type` 'conjur', required - `config` object, required — **Pre-release Feature** This feature is currently in beta and is subject to change. - `base64_decode` boolean — Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets. - `neg_ttl` integer — Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. - `resurrect_ttl` integer — Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. - `ttl` integer — Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. - `account` string, required — The CyberArk Secrets Manager organization account name. - `api_key` string — The API key of the workload identity. - `endpoint_url` string, required — The CyberArk Secrets Manager backend URL to connect with. Accepts http or https protocols. - `login` string, required — The login name of the workload identity. - object — **Pre-release Feature** This feature is currently in beta and is subject to change. - `id` string, uuid, required — Contains a unique identifier used for this resource. - `created_at` string, date-time, required — An ISO-8601 timestamp representation of entity creation date. - `updated_at` string, date-time, required — An ISO-8601 timestamp representation of entity update date. - `name` string, required — Identifier for an AI Gateway entity. In some cases, this may be the entity name or ID. - `description` string — The description of the Vault. - `labels` PublicLabels — Public labels store information about an entity that can be used for filtering a list of objects. Public labels are intended to store **PUBLIC** metadata. Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_". - `managed_by` ManagedBy — Stores information about what manages this entity, such as the tool or system responsible for its lifecycle (for example, `terraform`). Keys must be 1–63 characters long and start with an alphanumeric character. - `type` 'hcv', required - `config` union, required — **Pre-release Feature** This feature is currently in beta and is subject to change. Configuration for an AI Gateway Vault. - HashiCorpVaultTokenConfig — **Pre-release Feature** This feature is currently in beta and is subject to change. - `base64_decode` boolean — Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets. - `neg_ttl` integer — Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. - `resurrect_ttl` integer — Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. - `ttl` integer — Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. - `host` string, required — The hostname of your HashiCorp vault. - `port` integer, required — The port number of your HashiCorp vault. - `mount` string, required — The mount point. - `kv` 'v1' | 'v2' — The secrets engine version. - `protocol` 'http' | 'https' — The protocol to connect with. - `ssl_verify` boolean — Whether to verify the TLS certificate of the vault when connecting. - `namespace` string — Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully. - `auth_method` 'token', required - `token` string — The token string to be used for authentication. - HashiCorpVaultCertConfig — **Pre-release Feature** This feature is currently in beta and is subject to change. - `base64_decode` boolean — Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets. - `neg_ttl` integer — Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. - `resurrect_ttl` integer — Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. - `ttl` integer — Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. - `host` string, required — The hostname of your HashiCorp vault. - `port` integer, required — The port number of your HashiCorp vault. - `mount` string, required — The mount point. - `kv` 'v1' | 'v2' — The secrets engine version. - `protocol` 'http' | 'https' — The protocol to connect with. - `ssl_verify` boolean — Whether to verify the TLS certificate of the vault when connecting. - `namespace` string — Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully. - `auth_method` 'cert', required - `cert` string, required — The client certificate. - `key` string — The key for the client certificate. - `role_name` string — The trusted certificate role name. - HashiCorpVaultOauth2Config — **Pre-release Feature** This feature is currently in beta and is subject to change. - `base64_decode` boolean — Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets. - `neg_ttl` integer — Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. - `resurrect_ttl` integer — Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. - `ttl` integer — Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. - `host` string, required — The hostname of your HashiCorp vault. - `port` integer, required — The port number of your HashiCorp vault. - `mount` string, required — The mount point. - `kv` 'v1' | 'v2' — The secrets engine version. - `protocol` 'http' | 'https' — The protocol to connect with. - `ssl_verify` boolean — Whether to verify the TLS certificate of the vault when connecting. - `namespace` string — Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully. - `auth_method` 'jwt', required - `role` string, required — The configured role name in HashiCorp Vault for JWT auth. When creating the role in HashiCorp Vault, make sure that the `role_type` is `jwt` and the `token_policies` have permissions to read the secrets. - `token_endpoint` string, required — The OAuth2 token endpoint for Hashicorp Vault's OAuth2 auth method. - `client_id` string, required — The OAuth2 client ID. - `client_secret` string — The OAuth2 client secret. - `audiences` string — Comma-separated list of OAuth2 audiences. - HashiCorpVaultAppRoleConfig — **Pre-release Feature** This feature is currently in beta and is subject to change. - `base64_decode` boolean — Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets. - `neg_ttl` integer — Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. - `resurrect_ttl` integer — Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. - `ttl` integer — Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. - `host` string, required — The hostname of your HashiCorp vault. - `port` integer, required — The port number of your HashiCorp vault. - `mount` string, required — The mount point. - `kv` 'v1' | 'v2' — The secrets engine version. - `protocol` 'http' | 'https' — The protocol to connect with. - `ssl_verify` boolean — Whether to verify the TLS certificate of the vault when connecting. - `namespace` string — Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully. - `auth_method` 'approle', required - `path` string — Path for enabling the AppRole auth method. Single leading/trailing slashes are trimmed. - `response_wrapping` boolean — Whether the secret ID is a response-wrapping token. When true, Kong unwraps the token to get the actual secret ID. Note: tokens can only be unwrapped once; distribute them individually to Kong nodes. - `role_id` string — Specifies the AppRole role ID in HashiCorp Vault. Either `role_id` or `secret_id_file` must be set. - `secret_id` string — Defines the AppRole’s secret ID in HashiCorp Vault. - `secret_id_file` string — Path to a file containing the AppRole secret ID. Either `role_id` or `secret_id_file` must be set. - HashiCorpVaultKubernetesConfig — **Pre-release Feature** This feature is currently in beta and is subject to change. - `base64_decode` boolean — Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets. - `neg_ttl` integer — Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. - `resurrect_ttl` integer — Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. - `ttl` integer — Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. - `host` string, required — The hostname of your HashiCorp vault. - `port` integer, required — The port number of your HashiCorp vault. - `mount` string, required — The mount point. - `kv` 'v1' | 'v2' — The secrets engine version. - `protocol` 'http' | 'https' — The protocol to connect with. - `ssl_verify` boolean — Whether to verify the TLS certificate of the vault when connecting. - `namespace` string — Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully. - `auth_method` 'kubernetes', required - `role` string — Role assigned to the Kubernetes service account. - `path` string — Path for enabling the Kubernetes auth method. Single leading/trailing slashes are trimmed. - `api_token_file` string — Path to the Kubernetes service account token file. - HashiCorpVaultGcpIAMConfig — **Pre-release Feature** This feature is currently in beta and is subject to change. - `base64_decode` boolean — Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets. - `neg_ttl` integer — Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. - `resurrect_ttl` integer — Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. - `ttl` integer — Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. - `host` string, required — The hostname of your HashiCorp vault. - `port` integer, required — The port number of your HashiCorp vault. - `mount` string, required — The mount point. - `kv` 'v1' | 'v2' — The secrets engine version. - `protocol` 'http' | 'https' — The protocol to connect with. - `ssl_verify` boolean — Whether to verify the TLS certificate of the vault when connecting. - `namespace` string — Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully. - `auth_method` 'gcp_iam', required - `role` string, required — The role to use for GCP IAM auth. - `service_account` string, required — The GCP service account for GCE auth. - `jwt_exp` integer, required — The JWT expiration time in seconds for GCP auth (0-900) - HashiCorpVaultGcpGCEConfig — **Pre-release Feature** This feature is currently in beta and is subject to change. - `base64_decode` boolean — Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets. - `neg_ttl` integer — Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. - `resurrect_ttl` integer — Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. - `ttl` integer — Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. - `host` string, required — The hostname of your HashiCorp vault. - `port` integer, required — The port number of your HashiCorp vault. - `mount` string, required — The mount point. - `kv` 'v1' | 'v2' — The secrets engine version. - `protocol` 'http' | 'https' — The protocol to connect with. - `ssl_verify` boolean — Whether to verify the TLS certificate of the vault when connecting. - `namespace` string — Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully. - `auth_method` 'gcp_gce', required - `role` string, required — The role to use for GCP GCE auth. - `login_path` string — The login path for GCP auth in HashiCorp Vault. - HashiCorpVaultAwsEC2Config — **Pre-release Feature** This feature is currently in beta and is subject to change. - `base64_decode` boolean — Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets. - `neg_ttl` integer — Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. - `resurrect_ttl` integer — Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. - `ttl` integer — Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. - `host` string, required — The hostname of your HashiCorp vault. - `port` integer, required — The port number of your HashiCorp vault. - `mount` string, required — The mount point. - `kv` 'v1' | 'v2' — The secrets engine version. - `protocol` 'http' | 'https' — The protocol to connect with. - `ssl_verify` boolean — Whether to verify the TLS certificate of the vault when connecting. - `namespace` string — Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully. - `auth_method` 'aws_ec2', required - `role` string, required — The role to use for AWS EC2 auth. - `nonce` string, required — The nonce for AWS EC2 auth. - `login_path` string — The login path for AWS auth in HashiCorp Vault. - HashiCorpVaultAwsIAMConfig — **Pre-release Feature** This feature is currently in beta and is subject to change. - `base64_decode` boolean — Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets. - `neg_ttl` integer — Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. - `resurrect_ttl` integer — Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. - `ttl` integer — Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. - `host` string, required — The hostname of your HashiCorp vault. - `port` integer, required — The port number of your HashiCorp vault. - `mount` string, required — The mount point. - `kv` 'v1' | 'v2' — The secrets engine version. - `protocol` 'http' | 'https' — The protocol to connect with. - `ssl_verify` boolean — Whether to verify the TLS certificate of the vault when connecting. - `namespace` string — Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully. - `auth_method` 'aws_iam', required - `role` string, required — The role to use for AWS IAM auth. - `region` string, required — The AWS region for auth. - `login_path` string — The login path for AWS auth in HashiCorp Vault. - `access_key_id` string — The AWS access key ID for IAM auth. If not provided, the default credentials provider chain is used. If set, `secret_access_key` must also be set. - `secret_access_key` string — The AWS secret access key for IAM auth. If not provided, the default credentials provider chain is used. If set, `access_key_id` must also be set. - `sts_endpoint_url` string — The AWS STS endpoint URL used by Kong Gateway when signing the GetCallerIdentity request for AWS IAM authentication. If not provided, defaults to the standard STS endpoint for the specified region. This setting only affects the STS endpoint that Kong Gateway itself contacts - it does not influence which STS endpoint HashiCorp Vault uses on its side. - `assume_role_arn` string — The ARN of the role to assume for AWS IAM authentication. If set, `role_session_name` must also be set. - `role_session_name` string — The session name to use when assuming a role for AWS IAM authentication. If set, `assume_role_arn` must also be set. - HashiCorpVaultAzureConfig — **Pre-release Feature** This feature is currently in beta and is subject to change. - `base64_decode` boolean — Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets. - `neg_ttl` integer — Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. - `resurrect_ttl` integer — Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. - `ttl` integer — Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. - `host` string, required — The hostname of your HashiCorp vault. - `port` integer, required — The port number of your HashiCorp vault. - `mount` string, required — The mount point. - `kv` 'v1' | 'v2' — The secrets engine version. - `protocol` 'http' | 'https' — The protocol to connect with. - `ssl_verify` boolean — Whether to verify the TLS certificate of the vault when connecting. - `namespace` string — Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully. - `auth_method` 'azure', required - `role` string, required — The role to use for Azure auth. - `login_path` string — The login path for Azure auth in HashiCorp Vault - `meta` CursorMeta, required — Pagination metadata. - `page` CursorMetaPage, required - `first` string, path — URI to the first page - `last` string, path — URI to the last page - `next` string, path, nullable, required — URI to the next page - `previous` string, path, nullable, required — URI to the previous page - `size` number, required — Requested page size ## Other responses - `401` — Unauthorized - `403` — Forbidden - `404` — Not Found - `429` — Too Many Requests --- [API](https://skmtc.net/kong/apis/konnect-api-go-sdk.md) · [All operations](https://skmtc.net/kong/apis/konnect-api-go-sdk/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/kong/konnect-api-go-sdk/revisions/f920f418f552/schema)