Secrets provider

Included from Basic tiersecrets:multi-vaultpacks:secrets-awspacks:secrets-azure

A secrets provider is one registered secrets-backend connection — an OpenBao or HashiCorp Vault endpoint, an AWS Secrets Manager region or an Azure Key Vault — through which the platform resolves, stores and encrypts secret values. Records are created and updated by platform admins; the credential half is write-only (reads serve credential_set), and a test verb records per-connection health. The first enabled provider is base platform; enabling further providers requires the secrets:multi-vault feature, and the cloud kinds are pack-gated. Served by the v2 SecretsProviderService (list/get/create/update/delete/test, plus the scope-binding verbs).

SecretsProvider

SecretsProvider is one registered secrets-backend connection.

Field	Type	Meaning
address	string	The vault endpoint URL.
auth_method	string	The auth method: "token" | "userpass" | "approle" (the vault kinds), "access-key" (aws-secrets-manager: an IAM access key pair) or "client-secret" (azure-key-vault: Microsoft Entra ID client credentials). The method's secret half (token / password / secret id / secret access key / client secret) rides the write-only credential seam; reads serve credential_set.
cipher_stacking	boolean	Whether values written through /api/secrets/store are cipher-stacked — encrypted again by the server's codec on top of the backend's own at-rest encryption (default true, the upstream default).
code	string	The unique estate identifier (vocabulary). Lowercase letters, digits, '-' and '_', starting alphanumeric.
created_at	timestamp	When the record was created.
credential_ref	string	The provider-qualified secret-vault:// @/ reference the auth credential lives at (reference-first custody) — an address in ANOTHER enabled provider's vault, never a value. Empty on a record whose credential is stored inline (encrypted at rest).
credential_set	boolean	Whether a credential is stored; the value itself is write-only.
display_name	string	The human name the GUI renders ("Production OpenBao").
enabled	boolean	The single enabled provider is the estate's default resolution source. A disabled provider resolves nothing and says so.
id	string	The record's identity.
kind	string	The backend kind: "openbao" | "hashicorp-vault" | "aws-secrets-manager" | "azure-key-vault". The vault kinds share the HTTP API today but are distinct kinds so posture, defaults and future divergence stay per-kind; the kind set is open by construction. Cloud kinds are pack-gated: "aws-secrets-manager" requires the packs:secrets-aws entitlement to create or enable, "azure-key-vault" packs:secrets-azure.
kv_version	integer	The KV secrets-engine version: 1 or 2.
last_test_at	timestamp	Per-connection health, recorded by the test verb: when it last ran, whether it succeeded, and the failure reason (never credential material). last_test_at is unset until the first test.
last_test_error	string	The most recent test's failure reason; empty when it succeeded or none ran.
last_test_success	boolean	Whether the most recent test succeeded.
mount_path	string	The KV secrets-engine mount path; empty means the engine default ("secrets").
password_length	integer	Length of server-generated secret values; 0 uses the endpoint default.
resolution	string	Where references routed to this provider are read: server (the default — the server resolves them before dispatch) or runner (the runner and the agent SDK resolve them at Prepare through their own provider configuration; the server stores no credential for it, never reads it, and refuses its own *_ref fields that route to it).
rate_limit_mints_per_minute	integer	The provider's rate budget on the token-mint lane: vault token mints per minute the platform meters itself to. A positive integer is this provider's own budget; 0 inherits the estate default secrets.default_rate_limit (itself unset = unbounded); -1 is unlimited at this provider even when the estate default is bounded; anything below -1 is refused.
rate_limit_reads_per_second	integer	The provider's rate budget on the read lane: KV reads per second the platform meters its calls to this provider at, on the server for a server provider and on every runner for a runner provider. A positive integer is this provider's own budget; 0 inherits the estate default secrets.default_rate_limit (itself unset = unbounded); -1 is unlimited at this provider even when the estate default is bounded; anything below -1 is refused. Steps past the budget wait in a bounded queue; a 429 is honoured with Retry-After; sustained refusal opens the provider's circuit breaker.
region	string	The AWS region the Secrets Manager endpoint lives in (e.g. "ap-southeast-2"). aws-secrets-manager kind only; for that kind the address becomes an optional endpoint-URL override (empty derives the endpoint from the region).
role_id	string	The AppRole role id (not a secret; the secret id is the credential). approle method only.
ssl_ca_cert	string	A CA certificate file path trusted for the vault connection — the same ssl_ca_cert option the runner lane honours; empty uses the system roots.
ssl_verify	boolean	Whether the vault's TLS certificate is verified (default true; false is an explicit operator opt-out for port-forwarded/self-signed endpoints).
tenant_id	string	The Microsoft Entra ID tenant id the client credentials authenticate against. azure-key-vault kind only; for that kind the address is the vault URL (https://.vault.azure.net, required).
updated_at	timestamp	When the record was last updated.
username	string	The non-secret identity half: the userpass username, the IAM access key id (access-key method), or the Entra ID application (client) id (client-secret method).

Related pages

• opschain docs secrets-providers — the component page: kinds, custody, health and the multi-vault gate.
• opschain docs resources/secrets_binding — which provider serves which subtree.
• opschain docs packs-secrets-aws and opschain docs packs-secrets-azure — the cloud-kind entitlements.
• opschain docs resources/secret — the per-value resolve/store/encrypt outcomes.