Keycyte PAM 3.2 · Administrator Guide

Secrets API

The Secrets API lets an application read a credential from the Keycyte PAM password vault at run time, instead of keeping the password in a configuration file or an environment variable. It is the only Keycyte PAM API intended for customer applications; the other endpoints under /api/ serve the Admin Panel and are not a public contract.

How Access Is Controlled

• The caller is a service identity. The application authenticates as a Keycyte PAM user that holds the SERVICE role. A user with only the SERVICE role cannot sign in to the Admin Panel, the Client Panel or SSH/RDP sessions, so a leaked API key cannot become an interactive session.
• Password roles decide what the caller can read. A service identity sees exactly the accounts that its password roles grant, including the schedule window of those roles. There is no separate permission model and no MASTER shortcut.
• One secret per call. There are no bulk reads. The account list returns metadata only, never secret values.
• Read only. The API cannot create, change, rotate or verify accounts, and cannot read personal (private) vaults or password history.

For how to create a service identity and issue its API keys, see Service Identities. To grant accounts to it, add it to password roles; see Password Roles.

Authentication

Every request is signed with an HMAC-SHA256 HTTP signature, using the key ID and secret of an API key issued to the service identity.

• The request carries a Date header and an Authorization: Signature ... header.
• The signature covers the request method and path ((request-target)) and the Date header, so a signed request cannot be replayed against another endpoint.
• The Date header must be within about 300 seconds of the server time. Keep the clock of the calling host synchronized with NTP.
• Only hmac-sha256 is accepted.
• A key can be limited to a list of client IP addresses and can have an expiry date, which is enforced with no grace period.

The exact header format is described in Secrets API Reference.

Auditing

Every call is written to the System log, successful or refused, with the calling key ID, the account, and the reason text that the caller sent, if any. Secret values are never written to the log.

Integration Files

The API Keys dialog of a service identity in the Admin Panel links to an integration guide (/admin/docs/secrets-api.html) and to the OpenAPI specification (/admin/docs/secrets-api.yaml) served by your Keycyte PAM server.