passwords API · Marula PSA docs

API reference

12 operations in passwords. Raw spec: openapi.json.

GET/api/v1/passwords

GET /api/passwords — vault browser rows; never carries secrets.

Parameters

Name	In	Type	Required	Description
`client_id`	query	—	No
`global`	query	—	No	`true` = org-level entries only.

Responses

Status	Description
`200`

Security: bearer

POST/api/v1/passwords

POST /api/passwords — instant-first (IF1/IF2); seals the secret before the claim so a crypto failure never consumes an idempotency key.

Request body

CreatePasswordRequest

Responses

Status	Description
`200`
`409`	idempotency key reused
`422`	title/secret rejected

Security: bearer

GET/api/v1/passwords/{id}

GET /api/passwords/{id}

Parameters

Name	In	Type	Required	Description
`id`	path	string	Yes

Responses

Status	Description
`200`
`404`	entry not visible in scope

Security: bearer

PATCH/api/v1/passwords/{id}

PATCH /api/passwords/{id} — instant-first; a present `secret` rotates the ciphertext and archives the previous one to history in-commit.

Parameters

Name	In	Type	Required	Description
`id`	path	string	Yes

Request body

UpdatePasswordRequest

Responses

Status	Description
`200`
`404`	entry not visible in scope
`409`	idempotency key reused
`422`	validation error

Security: bearer

DELETE/api/v1/passwords/{id}

DELETE /api/passwords/{id} — the vault is deletion-capable; history cascade-deletes. Emits `password.deleted`.

Parameters

Name	In	Type	Required	Description
`id`	path	string	Yes

Responses

Status	Description
`200`	deleted
`404`	entry not visible in scope

Security: bearer

GET/api/v1/passwords/{id}/history

GET /api/passwords/{id}/history — change ledger metadata (the ciphertexts are retained for forensic re-derivation, never exposed).

Parameters

Name	In	Type	Required	Description
`id`	path	string	Yes

Responses

Status	Description
`200`

Security: bearer

GET/api/v1/passwords/{id}/links

GET /api/passwords/{id}/links

Parameters

Name	In	Type	Required	Description
`id`	path	string	Yes

Responses

Status	Description
`200`

Security: bearer

POST/api/v1/passwords/{id}/links

POST /api/passwords/{id}/links

Parameters

Name	In	Type	Required	Description
`id`	path	string	Yes

Request body

CreateLinkRequest

Responses

Status	Description
`200`
`404`	password or link target not visible in scope

Security: bearer

POST/api/v1/passwords/{id}/reveal

POST /api/passwords/{id}/reveal — the ONLY plaintext path. Requires `passwords:edit`, runs inside the org tx so the reveal event commits atomically with the read, and the response is the sole carrier of the decrypted secret.

Parameters

Name	In	Type	Required	Description
`id`	path	string	Yes

Responses

Status	Description
`200`
`403`	reveal requires passwords:edit
`404`	entry not visible in scope

Security: bearer

GET/api/v1/passwords/{id}/share-links

GET /api/passwords/{id}/share-links

Parameters

Name	In	Type	Required	Description
`id`	path	string	Yes

Responses

Status	Description
`200`

Security: bearer

POST/api/v1/passwords/{id}/share-links

POST /api/passwords/{id}/share-links — one-time link for the legacy byte-compatible entry surface (the same token posture as records).

Parameters

Name	In	Type	Required	Description
`id`	path	string	Yes

Request body

CreateSecretShareLinkRequest

Responses

Status	Description
`201`
`404`	entry not visible in scope
`422`	expiry/label rejected

Security: bearer

DELETE/api/v1/passwords/{id}/share-links/{share_id}

DELETE /api/passwords/{id}/share-links/{share_id}

Parameters

Name	In	Type	Required	Description
`id`	path	string	Yes
`share_id`	path	string	Yes

Responses

Status	Description
`200`
`404`

Security: bearer