Secret providers

For the administrator who sets up this service. Use an account with the rights named below.

Add a secret provider

A secret provider is only needed for secrets that are kept outside OpenBot.

curl -H "Authorization: Bearer $OPENBOT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name":"Team 1Password","credentials":{"kind":"onepassword","url":"https://connect.example.com","token":"eyJ..."}}' \
  https://api.example.com/v1/secret-providers

Kind	Fields	What it is
onepassword	url, token	A 1Password Connect server and a Connect token.
bitwarden	url, token	bw serve, the API of the Bitwarden command line tool. It works with Bitwarden and Vaultwarden. token is optional.
hashicorp	url, token, mount, namespace	The KV version 2 engine of HashiCorp Vault or OpenBao. mount is secret by default.

OpenBot only reads a secret provider. It never writes to it. OpenBot checks the token first. The token never comes out again. The API only shows its last characters. Give the token as little as you can: only the 1Password vaults or Vault paths that Bots may use. For bitwarden, the vault must be unlocked for bw serve. Keep bw serve on a private network, or put a proxy with a token in front of it.

Send "shared": true to make a shared provider of the organization. GET /v1/secret-providers lists your providers and the shared ones. GET, PATCH and DELETE /v1/secret-providers/:providerId read, change and delete one. You cannot delete a provider while items read from it.