Update Database Role

PATCH

/vault/v1/workspaces/{workspace}/engines/qibdo/databaseroles/{id}

const url = 'https://example.com/vault/v1/workspaces/example/engines/qibdo/databaseroles/example';
const options = {method: 'PATCH', headers: {'Content-Type': 'application/json'}, body: '{}'};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request PATCH \
  --url https://example.com/vault/v1/workspaces/example/engines/qibdo/databaseroles/example \
  --header 'Content-Type: application/json' \
  --data '{}'

Updates a database role’s statements and/or TTLs. Re-runs the dry-run on every update: even unchanged statements get re-validated to catch schema drift on the target database.

Parameters

Path Parameters

workspace

required

string

The workspace the role belongs to.

required

string

The unique identifier of the role to update.

Query Parameters

update_mask

string format: field-mask

Fields to update. Omit for implied mask (all populated fields). Use * for full replacement of the mutable fields.

Request Body^required

application/json

QibdoDatabaseRole resource: a workspace-scoped, Qibdo-managed database role definition. Carries the creation + revocation SQL templates that the vault will execute when issuing or revoking dynamic database credentials. Qibdo is the single source of truth; the vault receives a derived projection via POST /v1/database/roles/{name} after the templates have been dry-run validated against the target database.

object

The unique identifier of the database role (UUID).

stringOutput only

workspace_id

The workspace this role belongs to (UUID, weak reference to taxonomy.workspaces).

stringOutput only

name

Workspace-unique human-readable role name. Mirrored as the role name on the vault side.

stringOutput only

db_engine

Target database engine.

string format: enum Output only

Allowed values: DB_ENGINE_UNSPECIFIED DB_ENGINE_POSTGRES DB_ENGINE_MYSQL DB_ENGINE_MSSQL DB_ENGINE_MONGODB DB_ENGINE_ORACLE DB_ENGINE_REDSHIFT DB_ENGINE_CASSANDRA

connection_ref

Reference to the target database connection (engine-specific opaque string, e.g., the vault’s database connection name or a JDBC URL key in the JdbcConnectionRegistry).

stringOutput only

creation_statements

SQL statements executed at credential issuance. Engine-specific placeholders ({{name}}, {{password}}, {{expiration}}) are honoured. Capped to bound storage in vault.database_roles and prevent abuse: at most 64 statements, each at most 8 KiB.

Array<string>Output only

revocation_statements

SQL statements executed at credential revocation ({{name}} placeholder). Same caps as creation_statements.

Array<string>Output only

default_ttl

Default time-to-live applied to credentials issued under this role.

stringOutput only

/^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$/

max_ttl

Maximum total lifetime any credential under this role can hold.

stringOutput only

/^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$/

create_time

Timestamp when the row was created (server-managed).

string format: date-time Output only

update_time

Timestamp when the row was last modified (server-managed).

string format: date-time Output only

location_id

Weak reference to a topology Location: where this resource resides. Defaults to the global location when omitted at creation and is immutable thereafter. Only the global location is available in this release.

stringOutput only

Responses

200

application/json

Vault Operation

An acknowledgment of a mutation request, carrying tracking metadata, errors, and warnings. Follows GCP’s Operations pattern (AIP-151).

object

Operation ID

Unique identifier for this operation.

stringOutput only

resource_id

Resource ID

The ID of the resource affected by this operation. May be empty for vault-level lifecycle operations such as snapshot.

stringOutput only

resource_type

Resource Type

The type of resource (e.g., “com.qibdo.cloud.vault:secret”).

stringOutput only

operation_type

Operation Type

The kind of mutation that was requested.

string format: enum Output only

Allowed values: VAULT_OPERATION_TYPE_UNSPECIFIED VAULT_OPERATION_TYPE_CREATE VAULT_OPERATION_TYPE_UPDATE VAULT_OPERATION_TYPE_DELETE VAULT_OPERATION_TYPE_ADD_VERSION VAULT_OPERATION_TYPE_DISABLE_VERSION VAULT_OPERATION_TYPE_DESTROY_VERSION VAULT_OPERATION_TYPE_SCHEDULE_DESTROY_VERSION VAULT_OPERATION_TYPE_ROTATE VAULT_OPERATION_TYPE_ENCRYPT VAULT_OPERATION_TYPE_DECRYPT VAULT_OPERATION_TYPE_SIGN VAULT_OPERATION_TYPE_VERIFY VAULT_OPERATION_TYPE_HMAC VAULT_OPERATION_TYPE_RE_ENCRYPT VAULT_OPERATION_TYPE_GENERATE_DATA_ENCRYPTION_KEY VAULT_OPERATION_TYPE_GENERATE_RANDOM_BYTES VAULT_OPERATION_TYPE_ISSUE VAULT_OPERATION_TYPE_REVOKE VAULT_OPERATION_TYPE_RENEW VAULT_OPERATION_TYPE_BULK_REVOKE VAULT_OPERATION_TYPE_SNAPSHOT VAULT_OPERATION_TYPE_RESTORE VAULT_OPERATION_TYPE_ROOT_KEY_ROTATION VAULT_OPERATION_TYPE_WRAP VAULT_OPERATION_TYPE_UNWRAP VAULT_OPERATION_TYPE_ROTATE_SECRET_ID VAULT_OPERATION_TYPE_AUTHENTICATE VAULT_OPERATION_TYPE_REGISTER_DATABASE_ROLE VAULT_OPERATION_TYPE_UPDATE_DATABASE_ROLE VAULT_OPERATION_TYPE_DELETE_DATABASE_ROLE VAULT_OPERATION_TYPE_REGISTER_PKI_ROLE VAULT_OPERATION_TYPE_UPDATE_PKI_ROLE VAULT_OPERATION_TYPE_DELETE_PKI_ROLE VAULT_OPERATION_TYPE_AUTHORIZE

status

Status

Current lifecycle state of the operation.

string format: enum Output only

Allowed values: VAULT_OPERATION_STATUS_UNSPECIFIED VAULT_OPERATION_STATUS_PENDING VAULT_OPERATION_STATUS_RUNNING VAULT_OPERATION_STATUS_DONE VAULT_OPERATION_STATUS_ERROR

insert_time

Insert Time

When the operation was first created.

string format: date-time Output only

start_time

Start Time

When the operation started executing.

string format: date-time Output only

end_time

End Time

When the operation completed (either successfully or with errors).

string format: date-time Output only

errors

Errors

Business rule errors encountered during the operation.

Array<object>Output only

Operation Error

A structured error returned inside an operation when a business rule fails.

object

code

Error Code

Numeric identifier following the S_SSS_EEE convention.

integer format: uint32 Output only

description

Description

Human-readable explanation of the error.

stringOutput only

reason

Reason

Machine-readable error identifier in UPPER_SNAKE form — the same dispatch key google.rpc.ErrorInfo.reason carries on the synchronous error plane.

stringOutput only

warnings

Warnings

Non-fatal notices about the operation.

Array<object>Output only

Operation Warning

A non-fatal notice attached to an operation. The operation still completed; the warning surfaces unsupported features or capability gaps in the underlying engine.

object

code

Warning Code

Numeric identifier following the S_SSS_EEE convention.

integer format: uint32 Output only

description

Description

Human-readable explanation of the warning.

stringOutput only

progress

Progress

Percentage of completion (0-100).

integer format: int32 Output only

scope_type

Scope Type

The category of scope the operation ran in or was triggered from. VAULT_SCOPE_TYPE_UNSPECIFIED when the operation is not scoped.

string format: enum Output only

Allowed values: VAULT_SCOPE_TYPE_UNSPECIFIED VAULT_SCOPE_TYPE_PLATFORM VAULT_SCOPE_TYPE_ORGANISATION VAULT_SCOPE_TYPE_WORKSPACE VAULT_SCOPE_TYPE_GROUP

scope_id

Scope ID

The resource this operation was scoped to — for example, when scope_type is VAULT_SCOPE_TYPE_WORKSPACE this is the workspace id. Empty for VAULT_SCOPE_TYPE_PLATFORM, which has no scoped resource, and when unscoped.

stringOutput only

principal_id

Principal ID

Who performed or triggered the operation, whether a person or a machine account. Always populated: platform-driven work records the reserved system principal, so every audit record names an actor.

stringOutput only

trace_id

Trace ID

W3C trace id, for correlating this operation with the traces and log lines of the request that caused it. Empty when the operation ran with no trace context — a scheduled or event-driven action rather than a request.

stringOutput only

Example

{
  "operation_type": "VAULT_OPERATION_TYPE_UNSPECIFIED",
  "status": "VAULT_OPERATION_STATUS_UNSPECIFIED",
  "scope_type": "VAULT_SCOPE_TYPE_UNSPECIFIED"
}

default

Default error response

application/json

The Status type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by gRPC. Each Status message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the API Design Guide.

object

code

The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code].

integer format: int32

message

A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client.

string

details

A list of messages that carry the error details. There is a common set of message types for APIs to use.

Array<object>

Contains an arbitrary serialized message along with a @type that describes the type of the serialized message.

object

@type

The type of the serialized message.

string

key

additional properties

any

Example ^generated

{
  "code": 1,
  "message": "example",
  "details": [
    {
      "@type": "example"
    }
  ]
}

Update Database Role

Parameters

Path Parameters

Query Parameters

Request Body required

Responses

200

Example

default

Example generated

Request Body^required

Example ^generated