Vaults API

Manage credential vaults and service bindings.

Credential vaults isolate secrets by upstream service. Each vault binds encrypted credentials to specific hostnames via service bindings, and ICAP only injects when the request host matches. All endpoints require authentication withvaults:read or vaults:write scope (or credentials:read /credentials:write for secret management).

List Vaults

GET/api/proxies/:id/vaults

bash

curl https://proxies.ai/api/proxies/proxy-id/vaults \
  -H "Authorization: Bearer cifp_your_api_key"

Create Vault

POST/api/proxies/:id/vaults

bash

curl -X POST https://proxies.ai/api/proxies/proxy-id/vaults \
  -H "Authorization: Bearer cifp_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{"name": "OpenAI production", "description": "Production OpenAI keys"}'

Get Vault Detail

GET/api/proxies/:id/vaults/:vaultId

Returns vault metadata, secret names (not values), and service bindings.

Update Vault

PATCH/api/proxies/:id/vaults/:vaultId

bash

curl -X PATCH https://proxies.ai/api/proxies/proxy-id/vaults/vault-id \
  -H "Authorization: Bearer cifp_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{"description": "Updated description"}'

Delete Vault

DELETE/api/proxies/:id/vaults/:vaultId

Deletes the vault, its encrypted secret values (proxy-first), and all service bindings. Returns 409 if the proxy is not running.

Vault Secrets

GET/api/vaults/:vaultId/secrets

POST/api/vaults/:vaultId/secrets

DELETE/api/vaults/:vaultId/secrets/:secretId

bash

# Store a secret in a vault
curl -X POST https://proxies.ai/api/vaults/vault-id/secrets \
  -H "Authorization: Bearer cifp_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{"name": "OPENAI_API_KEY", "value": "sk-proj-..."}'

Secret values are encrypted with AES-256-GCM and never returned by the API.

Service Bindings

GET/api/vaults/:vaultId/services

POST/api/vaults/:vaultId/services

DELETE/api/vaults/:vaultId/services/:bindingId

bash

# Add a predefined service binding
curl -X POST https://proxies.ai/api/vaults/vault-id/services \
  -H "Authorization: Bearer cifp_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{"template": "openai"}'

# Add a custom binding
curl -X POST https://proxies.ai/api/vaults/vault-id/services \
  -H "Authorization: Bearer cifp_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{
    "template": "custom",
    "targetHost": "api.custom-service.com",
    "headerName": "X-API-Key",
    "headerFormat": "{token}"
  }'

Deleting a binding contacts the sidecar first to remove the encrypted mapping before deleting the control-plane row. Returns 409 if the proxy is not running.

Required Scopes

Scope	Endpoints
`vaults:read`	GET vaults, GET vault detail, GET service bindings
`vaults:write`	POST/PATCH/DELETE vaults, POST/DELETE service bindings
`credentials:read`	GET vault secrets
`credentials:write`	POST/DELETE vault secrets