id: vault
name: HashiCorp Vault
version: 1.0.0
description: "HashiCorp Vault (KV v2 + sys API) — secrets management for playbooks: read, write, delete and list secrets, list mounts, and look up the current token. Vault-token authentication; stdlib-only, no extra Python dependencies."
changelog: "1.0.0 — Initial release: read/write/delete/list secrets, list mounts, lookup token."
category: cloud

# Per-instance configuration. The token is sent as the 'X-Vault-Token' header.
# kv_mount is the KV v2 mount point used by the secret commands.
config_schema:
  properties:
    base_url:
      type: string
      description: "Vault URL (e.g. https://vault.example.com:8200)"
    token:
      type: string
      description: "Vault token"
      x-soar-sensitive: true
    kv_mount:
      type: string
      description: "KV v2 mount point (default 'secret')"
      default: "secret"
    insecure:
      type: boolean
      description: "Trust any TLS certificate (not secure)"
      default: false
  required:
    - base_url
    - token

commands:
  - id: read_secret
    name: vault-read-secret
    description: "Read a secret from the KV v2 store."
    inputs_schema:
      properties:
        path: { type: string, description: "Secret path within the KV mount (e.g. app/db)" }
      required: [path]
    outputs_schema: { properties: {} }
  - id: write_secret
    name: vault-write-secret
    description: "Write (create/update) a secret in the KV v2 store."
    inputs_schema:
      properties:
        path: { type: string, description: "Secret path" }
        data_json: { type: string, description: "Secret key/values as a JSON object" }
      required: [path, data_json]
    outputs_schema: { properties: {} }
  - id: delete_secret
    name: vault-delete-secret
    description: "Delete a secret (all versions/metadata) from the KV v2 store."
    inputs_schema:
      properties:
        path: { type: string, description: "Secret path" }
      required: [path]
    outputs_schema: { properties: {} }
  - id: list_secrets
    name: vault-list-secrets
    description: "List secret keys under a path."
    risk: read
    inputs_schema:
      properties:
        path: { type: string, description: "Path to list (empty for the mount root)" }
      required: []
    outputs_schema: { properties: {} }
  - id: list_mounts
    name: vault-list-mounts
    description: "List secret engine mounts."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }
  - id: lookup_token
    name: vault-lookup-token
    description: "Look up the current token's metadata and policies."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }

  - id: test_connection
    name: vault-test-connection
    description: "Verify connectivity and the token (used by the Test button)."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }