Vault actions

Every Vault action

• OCI Vault: Back Up KeyBack up an Oracle Cloud master encryption key (resolved via the vault's management endpoint) to an Object Storage bucket or a pre-authenticated URI.
• OCI Vault: Back Up VaultBack up an Oracle Cloud Vault (optionally including its keys) to an Object Storage bucket or a pre-authenticated URI.
• OCI Vault: Cancel Key DeletionCancel a scheduled deletion of an Oracle Cloud master encryption key (resolved via the vault's management endpoint), restoring it from pending-deletion.
• OCI Vault: Cancel Key Version DeletionCancel a pending deletion of a key version in an Oracle Cloud vault (resolved via the vault's management endpoint), returning it to an enabled state.
• OCI Vault: Cancel Secret DeletionCancel a pending secret deletion in an Oracle Cloud vault, returning the secret to ACTIVE before its scheduled deletion time elapses.
• OCI Vault: Cancel Secret Version DeletionCancel a pending deletion of a single secret version in an Oracle Cloud vault, returning it to the secret before its scheduled deletion time elapses.
• OCI Vault: Cancel Vault DeletionCancel a scheduled deletion of an Oracle Cloud Vault, restoring it to its active state.
• OCI Vault: Create KeyCreate a master encryption key in an Oracle Cloud vault: used to encrypt/decrypt data and protect secrets. Pick the algorithm (AES/RSA/ECDSA); for ECDSA choose the curve. Defaults to a SOFTWARE-protected key; poll Get Key until ENABLED.
• OCI Vault: Create Key VersionCreate a new key version for a master encryption key in an Oracle Cloud vault (resolved via the vault's management endpoint), rotating the key's active material.
• OCI Vault: Create SecretStore a new secret in an Oracle Cloud vault, encrypted under a master key. The content must be base64-encoded. Poll Get Secret until ACTIVE, then retrieve it with Get Secret Bundle.
• OCI Vault: Create VaultCreate an Oracle Cloud Vault: the container for master encryption keys and secrets. A DEFAULT vault is shared, VIRTUAL_PRIVATE is dedicated. Returns the OCID immediately in a CREATING state; poll Get Vault until ACTIVE.
• OCI Vault: Create Vault ReplicaReplicate an Oracle Cloud Vault into another region in the same realm: an asynchronous operation.
• OCI Vault: DecryptDecrypt ciphertext with the master key that produced it, via the vault's crypto endpoint. Pass the base64 ciphertext returned by Encrypt; the recovered plaintext comes back base64-encoded.
• OCI Vault: Delete Vault ReplicaRemove a cross-region replica of an Oracle Cloud Vault: asynchronous; OCI tears the replica down in the background.
• OCI Vault: Disable KeyDisable a master encryption key in an Oracle Cloud vault so it can no longer encrypt, decrypt, or protect secrets until re-enabled. Resolved via the vault's management endpoint.
• OCI Vault: Enable KeyRe-enable a disabled master encryption key in an Oracle Cloud vault (resolved via the vault's management endpoint), returning it to the ENABLED state so it can be used again.
• OCI Vault: EncryptEncrypt data (≤ 4KB) with a master key via the vault's crypto endpoint. The plaintext must be base64-encoded; the ciphertext returns base64-encoded: feed it to Decrypt to recover the data. For larger data, use Generate Data Encryption Key.
• OCI Vault: Export KeyWrap and export a master key's material via the vault's crypto endpoint. The key must have been created exportable. Supply your own RSA wrapping public key (PEM); the material returns encrypted with it, so only the matching private key can unwrap it. RSA_OAEP_AES_SHA256 uses AES key-wrap; RSA_OAEP_SHA256 wraps the material directly.
• OCI Vault: Generate Data Encryption KeyGenerate a data encryption key (DEK) under a master key, via the vault's crypto endpoint: for envelope encryption of larger data. The DEK returns wrapped (encrypted) with the master key as the ciphertext; the plaintext DEK is included only when Include Plaintext Key is on.
• OCI Vault: Get KeyFetch a single master encryption key from an Oracle Cloud vault by its OCID (resolved via the vault's management endpoint).
• OCI Vault: Get Key VersionFetch a single key version of a master encryption key in an Oracle Cloud vault (resolved via the vault's management endpoint).
• OCI Vault: Get SecretFetch a secret's metadata by OCID (name, vault, key, current version, lifecycle state). Does not return the secret value: use Get Secret Bundle for that.
• OCI Vault: Get Secret BundleRetrieve the contents of a secret (its base64-encoded value plus version metadata) from an Oracle Cloud vault. Defaults to the current version; pass a version number or stage (CURRENT/PENDING/LATEST/PREVIOUS/DEPRECATED) to fetch a specific one.
• OCI Vault: Get Secret Bundle by NameRetrieve the contents of a secret (its base64-encoded value plus version metadata) by the secret's name within an Oracle Cloud vault. Defaults to the current version; pass a version number or stage (CURRENT/PENDING/LATEST/PREVIOUS/DEPRECATED) to fetch a specific one.
• OCI Vault: Get Secret VersionFetch the metadata for one version of a secret: its stages, content type and creation time. This is version metadata, not the secret value; retrieve the content with Get Secret Bundle.
• OCI Vault: Get VaultFetch a single Oracle Cloud Vault by OCID: its type, lifecycle state, and its management and crypto endpoints.
• OCI Vault: Get Vault UsageReport how many keys and key versions a Vault holds: HSM and software counts, across all compartments (excluding deleted).
• OCI Vault: Get Wrapping KeyFetch an Oracle Cloud vault's RSA wrapping key (resolved via the vault's management endpoint): use its public key to wrap external key material before importing it with Import Key.
• OCI Vault: List Key VersionsList the versions of a master encryption key in an Oracle Cloud vault (resolved via the vault's management endpoint). Walks pagination up to a safe cap.
• OCI Vault: List KeysList the master encryption keys in an Oracle Cloud vault (resolved via the vault's management endpoint), in a compartment. Walks pagination up to a safe cap.
• OCI Vault: List Secret Bundle VersionsList all bundle versions of a secret in an Oracle Cloud vault: each version's number, name, rotation stages and creation time, from the secrets-retrieval endpoint. Walks pagination up to a safe cap.
• OCI Vault: List Secret VersionsList the versions of a single Oracle Cloud vault secret, newest first, showing each version's number, rotation stages and creation time. Walks pagination up to a safe cap.
• OCI Vault: List SecretsList the secrets in an Oracle Cloud compartment, optionally filtered to a single vault and/or an exact secret name. Walks pagination up to a safe cap.
• OCI Vault: List Vault ReplicasList the cross-region replicas of an Oracle Cloud Vault. Walks pagination up to a safe cap.
• OCI Vault: List VaultsList the Oracle Cloud Vaults in a compartment. Walks pagination up to a safe cap.
• OCI Vault: Move Key to CompartmentMove an Oracle Cloud master encryption key (resolved via its vault's management endpoint) into a different compartment.
• OCI Vault: Move Secret to CompartmentMove a secret from its current compartment into another compartment within the same Oracle Cloud tenancy.
• OCI Vault: Move Vault to CompartmentMove an Oracle Cloud Vault into a different compartment by OCID.
• OCI Vault: Restore KeyRestore a master encryption key into an Oracle Cloud vault from an Object Storage backup (a bucket or a pre-authenticated URI). Creates a new key.
• OCI Vault: Restore VaultRestore an Oracle Cloud Vault from an Object Storage backup into a new vault: supply either the bucket location (namespace, bucket, object) or a pre-authenticated request URI. Returns the OCID immediately; poll Get Vault until ACTIVE.
• OCI Vault: Schedule Key DeletionSchedule a master encryption key in an Oracle Cloud vault for deletion: it moves to pending-deletion and is removed at the chosen time (7, 30 days out; 30 days by default) unless cancelled first. Resolved via the vault's management endpoint.
• OCI Vault: Schedule Key Version DeletionSchedule a specific version of an Oracle Cloud master key for deletion: it moves to pending-deletion and is removed at the chosen time (7, 30 days out; 30 days by default) unless cancelled first.
• OCI Vault: Schedule Secret DeletionSchedule the deletion of a secret in an Oracle Cloud vault: OCI removes it at the chosen time (or the earliest permissible time if none is given), and it stays cancellable until then.
• OCI Vault: Schedule Secret Version DeletionSchedule a specific version of a secret in an Oracle Cloud vault for deletion: it moves to pending-deletion and is removed at the chosen time (7, 30 days out; 30 days by default) unless cancelled first.
• OCI Vault: Schedule Vault DeletionSchedule an Oracle Cloud Vault for deletion: it moves to pending-deletion and is removed at the chosen time (7, 30 days out; 30 days by default) unless cancelled first.
• OCI Vault: SignSign a message (or its digest) with a master key via the vault's crypto endpoint. The message must be base64-encoded (≤ 4KB); the signature returns base64-encoded: verify it with Verify. For large data, hash it and sign the DIGEST.
• OCI Vault: Update KeyUpdate a master encryption key in an Oracle Cloud vault: change its display name and/or replace its freeform tags (resolved via the vault's management endpoint).
• OCI Vault: Update SecretUpdate an Oracle Cloud secret's description or tags, and optionally set new base64-encoded content: which creates a new secret version.
• OCI Vault: Update VaultUpdate an Oracle Cloud Vault's display name and/or its free-form tags, addressed by OCID.
• OCI Vault: Verify SignatureVerify a cryptographic signature against a message via the vault's crypto endpoint. Provide the base64 message (or its digest), the base64 signature, and the same key, signing algorithm and message type that produced it. Returns is_valid true or false.

Also in Oracle Cloud