Create Vault Connection

curl --request POST \
  --url https://api.dataraven.io/v1/teams/{team_id}/vault-connections \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "name": "<string>",
  "description": "<string>",
  "access_token": "<string>",
  "client_id": "<string>",
  "client_secret": "<string>",
  "project": "<string>",
  "config": "<string>",
  "project_id": "<string>",
  "environment": "<string>",
  "secret_path": "<string>"
}
'

{
  "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "name": "<string>",
  "description": "<string>",
  "last_verified_at": "2023-11-07T05:31:56Z",
  "created_at": "2023-11-07T05:31:56Z",
  "created_by": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
}

Vault Connections

Create Vault Connection

Create a new external vault connection.

Required Role: ADMIN or OWNER

Tier Limits:

Free Tier: Maximum 1 vault connection
Pro Tier: Maximum 10 vault connections

Connects your team to an external vault provider (1Password, Doppler, or Infisical). Credentials are stored encrypted and never returned in API responses.

1Password:

Requires a service account token (starts with “ops_”)
No additional configuration needed

Doppler:

Requires a service token (starts with “dp.st.”)
Requires project and config

Infisical (Universal Auth / Machine Identity):

Create a Machine Identity in Project Settings -> Access Control -> Machine Identities
client_id: UUID from Machine Identity
client_secret: Secret string from Machine Identity
project_id: Project ID (UUID) from Project Settings -> General
environment: Environment slug (e.g., “dev”, “staging”, “prod”, “sandbox”)
Optional: secret_path (defaults to ”/”)

Example for 1Password:

{
    "name": "1Password Production",
    "vault_type": "onepassword",
    "access_token": "ops_xxx..."
}

Example for Doppler:

{
    "name": "Doppler Production",
    "vault_type": "doppler",
    "access_token": "dp.st.xxx...",
    "project": "my-project",
    "config": "production"
}

Example for Infisical:

{
    "name": "Infisical Production",
    "vault_type": "infisical",
    "client_id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
    "client_secret": "st.abc123xyz...",
    "project_id": "f1e2d3c4-b5a6-7890-abcd-ef1234567890",
    "environment": "prod",
    "secret_path": "/aws"
}

POST

teams

{team_id}

vault-connections

Create Vault Connection

curl --request POST \
  --url https://api.dataraven.io/v1/teams/{team_id}/vault-connections \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "name": "<string>",
  "description": "<string>",
  "access_token": "<string>",
  "client_id": "<string>",
  "client_secret": "<string>",
  "project": "<string>",
  "config": "<string>",
  "project_id": "<string>",
  "environment": "<string>",
  "secret_path": "<string>"
}
'

{
  "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "name": "<string>",
  "description": "<string>",
  "last_verified_at": "2023-11-07T05:31:56Z",
  "created_at": "2023-11-07T05:31:56Z",
  "created_by": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
}

Authorizations

Authorization

string

header

required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Path Parameters

team_id

string<uuid>

required

Body

application/json

Schema for creating a new vault connection.

Credentials are stored encrypted in AWS SSM Parameter Store - they are NEVER returned in API responses.

Provider-specific configuration:

1Password:

access_token: Service account token (starts with "ops_")
No additional configuration needed

Doppler:

access_token: Service token (starts with "dp.st.")
project: Doppler project slug (required)
config: Doppler config name (required)

Infisical (Universal Auth / Machine Identity):

client_id: UUID from Machine Identity
client_secret: Secret string from Machine Identity
project_id: Infisical project ID - UUID (required)
environment: Environment slug e.g., "dev", "staging", "prod", "sandbox" (required)
secret_path: Path to secrets folder, e.g., "/" or "/aws" (optional, defaults to "/")

name

string

required

Connection name

Required string length: 1 - 255

vault_type

enum<string>

required

Vault provider type (onepassword, doppler, or infisical)

Available options:

onepassword,

doppler,

infisical

description

string | null

Optional description

Maximum string length: 2000

access_token

string | null

Vault access token (required for 1Password and Doppler)

Required string length: 1 - 4096

client_id

string | null

Infisical client ID from Machine Identity (required for Infisical)

Maximum string length: 255

client_secret

string | null

Infisical client secret from Machine Identity (required for Infisical)

Maximum string length: 1000

project

string | null

Doppler project slug (required for Doppler)

Maximum string length: 255

config

string | null

Doppler config name (required for Doppler)

Maximum string length: 255

project_id

string | null

Infisical project ID (required for Infisical)

Maximum string length: 255

environment

string | null

Infisical environment slug (required for Infisical)

Maximum string length: 100

secret_path

string | null

Infisical secret path (optional, defaults to '/')

Maximum string length: 500

Response

Successful Response

Schema for vault connection response (without sensitive data).

string<uuid>

required

name

string

required

description

string | null

required

vault_type

enum<string>

required

External vault provider types for credential storage.

ONEPASSWORD: 1Password via service account SDK DOPPLER: Doppler secrets manager via service token INFISICAL: Infisical via machine identity (Universal Auth)

Available options:

onepassword,

doppler,

infisical

last_verified_at

string<date-time> | null

required

created_at

string<date-time>

required

created_by

string<uuid>

required

List Vault Connections

Get Vault Connection

Documentation Index

Authorizations

Path Parameters

Body

Response