Secrets Management

Introduction

The Client Secret API is used to manage secrets of SLB Authenticator confidential clients and allows applications to:

Create a secret for an existing client
Get the list of secrets of a client
Rotate secret (Create a new secret and revoke an existing secret)
Revoke a secret

Authorization Token

All these APIs expect SLB Authenticator CCG token and the audience of the token should be a626328313944601ba26cd1ffbaf6a53 and does not require any whitelisting.

Note:

The subject of the token should be the clientID to which you want to manage secrets for.
Secrets that are created using these APIs will work just like a secret that was generated during client creation i.e. it can be used in Client Credential Grant.

Secret Management APIs

Create a Secret

This API allows to create a secret for a SLB Authenticator Confidential Client.

POST /v1/clients/{clientID}/secrets

A secret will be created for the given client. The following are three sample cURL and outputs for generating a secret for client.

Case	Sample cURL	Sample Output
Case 1: When a user wants to create a secret for client. For example, when a user wants to create a new secret for confidential client with clientID '01729e667abd48e3bba47afea66f5a57'.	curl --location --request POST 'https://api.delfi.slb.com/auth/client/v1/clients/01729e667abd48e3bba47afea66f5a57/secrets' \ --header 'accept: application/json' \ --header 'Content-Type: application/json' \ --header 'AppKey: your-appkey' \ --header 'Authorization: Bearer your-ccg-token' \ --data-raw '{ "secretName": "second secret" }'	{ "secretId": "d358e35b50b44075b7c2570171edaa07", "secretName": "second secret", "secretValue": "3c4a6854c6fc4ebf80585bb0d7c5bbbd3a7e06915a5e727f0" }
Case 2: When a user wants to create a secret for client and subject of the token is not '01729e667abd48e3bba47afea66f5a57' For example, when a user wants to create a new secret for confidential client with clientID '01729e667abd48e3bba47afea66f5a57'.	curl --location --request POST 'https://api.delfi.slb.com/auth/client/v1/clients/01729e667abd48e3bba47afea66f5a57/secrets' \ --header 'accept: application/json' \ --header 'Content-Type: application/json' \ --header 'AppKey: your-appkey' \ --header 'Authorization: Bearer your-ccg-token' \ --data-raw '{ "secretName": "second secret" }'	{ "Message": "UnAuthorized" }
Case 3: When a user wants to create a secret for client. For example, when a user wants to create a thirteenth secret for confidential client with clientID '01729e667abd48e3bba47afea66f5a57'	curl --location --request POST 'https://api.delfi.slb.com/auth/client/v1/clients/01729e667abd48e3bba47afea66f5a57/secrets' \ --header 'accept: application/json' \ --header 'Content-Type: application/json' \ --header 'AppKey: your-appkey' \ --header 'Authorization: Bearer your-ccg-token' \ --data-raw '{ "secretName": "thirteenth secret" }'	{ "Message": "Maximum number of secrets reached for the given client" }

Get Secrets

This API is used to list the secrets of SLB Authenticator Confidential Client. Secret that was generated during client creation is not yet included in Get secrets response GET /v1/clients/{clientID}/secrets

Sample cURL	Sample Output
curl --location --request GET 'https://api.delfi.slb.com/auth/client/v1/clients/01729e667abd48e3bba47afea66f5a57/secrets' \ --header 'accept: application/json' \ --header 'Content-Type: application/json' \ --header 'AppKey: your-appkey' \ --header 'Authorization: Bearer your-ccg-token'	{ "secrets": [ { "secretId": "a58cffd4518b4f5881297aea3995c987", "secretName": "frist secret" }, { "secretId": "d358e35b50b44075b7c2570171edaa07", "secretName": "second secret" } ] }

Rotate Secret

A new secret will be created for the given client and given secretId will be revoked. The following are three sample cURL and outputs for performing a secret rotation for client.

PUT /v1/clients/{clientID}/secrets

Case	Sample cURL	Sample Output
Case 1: When a user tries to perform secret rotation for client. For example, when a user wants to create a new secret for confidential client with clientID '01729e667abd48e3bba47afea66f5a57' and revokes an existing secret with id a58cffd4518b4f5881297aea3995c987 and it's name is 'final secret' .	curl --location --request PUT 'https://api.delfi.slb.com/auth/client/v1/clients/01729e667abd48e3bba47afea66f5a57/secrets' \ --header 'accept: application/json' \ --header 'Content-Type: application/json' \ --header 'AppKey: your-appkey' \ --header 'Authorization: Bearer your-ccg-token' \ --data-raw '{ "secretName": "new secret", "existingSecretId": "a58cffd4518b4f5881297aea3995c987" }'	{ "revokedSecretId": "a58cffd4518b4f5881297aea3995c987", "revokedSecretName": "first secret", "secretId": "5af2359d489e4c7aa96f96b87f6482ab", "secretName": "rotated secret", "secretValue": "2ed3f97189d70befadd8d26282dee693492f8bf52994483c7" }
Case 2: When a user tries to perform secret rotation for client. For example, when a user wants to create a new secret for confidential client with clientID '01729e667abd48e3bba47afea66f5a57' and secret with id a58cffd4518b4f5881297aea3995c987 does not exist.	curl --location --request PUT 'https://api.delfi.slb.com/auth/client/v1/clients/01729e667abd48e3bba47afea66f5a57/secrets' \ --header 'accept: application/json' \ --header 'Content-Type: application/json' \ --header 'AppKey: your-appkey' \ --header 'Authorization: Bearer your-ccg-token' \ --data-raw '{ "secretName": "rotated secret", "existingSecretId": "a58cffd4518b4f5881297aea3995c987" }'	{ "Message": "Secret Not Found" }

Revoke Secret

Revoke a specific secret for a client. After revoking that secret value cannot be used in CCG.

DELETE /v1/clients/{clientID}/secrets/{secretID}

Sample cURL	Sample Output
curl --location --request DELETE 'https://api.delfi.slb.com/auth/client/v1/clients/01729e667abd48e3bba47afea66f5a57/secrets/d358e35b50b44075b7c2570171edaa07' \ --header 'accept: application/json' \ --header 'Content-Type: application/json' \ --header 'AppKey: your-appkey' \ --header 'Authorization: Bearer your-ccg-token'	{ "id": "d358e35b50b44075b7c2570171edaa07", "message": "Revoked" }

Limitations

There are mainly 2 limitations:

At any point of time a confidential client can only have maximum of 12 secrets. New secret cannot be created once the limit is reached.
Secret Value will be available only when secret creation is happened (Create and Rotate) and is not stored anywhere and cannot be retrieved.
Cannot modify secret that was created during client creation.