`key`
@@ -612,6 +909,7 @@ Use the `{customerAdministration {secret}}` query to retrieve secrets along with
"customerAdministration": {
"secret": {
"description": "ZXY",
+ "isSharable": false,
"key": "Test2",
"namespace": null,
"retrievedValue": {
@@ -1666,6 +1964,10 @@ mutation {
Use the `{customerAdministration {secrets}}` query to retrieve a list of secrets available in the account or organization. You can retrieve secrets that are scoped only for your current account or organization.
+
+The list includes all secrets in the scope, including sharable secrets you may not have permission to access. Access permissions are enforced when you retrieve the secret value using the [Retrieve a secret](#retrieve-secret) operation.
+
+
@@ -1790,6 +2092,7 @@ Use the `{customerAdministration {secrets}}` query to retrieve a list of secrets
The details of the listed secrets, including:
* `description`: The description of the secret, if available.
* `isDeleted`: Indicates whether the secret is in a soft-delete state or not.
+ * `isSharable`: Indicates whether the secret is a [sharable secret](#sharable-secrets) with fine-grained access control.
* `key`: The key of the secret.
* `latestVersion`: The latest version number of the secret.
* `metadata`: Metadata associated with the secret, if any.
@@ -1828,6 +2131,7 @@ Use the `{customerAdministration {secrets}}` query to retrieve a list of secrets
{
"description": "ZXY",
"isDeleted": false,
+ "isSharable": false,
"key": "test2",
"latestVersion": 1,
"metadata": {
@@ -1840,6 +2144,7 @@ Use the `{customerAdministration {secrets}}` query to retrieve a list of secrets
{
"description": "XYZ",
"isDeleted": false,
+ "isSharable": false,
"key": "test2",
"latestVersion": 0,
"metadata": {
@@ -1852,6 +2157,7 @@ Use the `{customerAdministration {secrets}}` query to retrieve a list of secrets
{
"description": "CBA",
"isDeleted": false,
+ "isSharable": false,
"key": "test1",
"latestVersion": 1,
"metadata": {
@@ -1870,7 +2176,589 @@ Use the `{customerAdministration {secrets}}` query to retrieve a list of secrets
-
+
+
+After creating a sharable secret, you can grant specific permissions to users, groups, system identities, or system identity groups. Use the `authorizationManagementGrantAccess` mutation to share your secret with authorized entities.
+
+
+The secret owner (creator), organization admins, or users with the `secret.create.grants` capability can grant access to a sharable secret.
+
+
+#### Input attributes
+
+
+
+
+ |
+ **Attribute name**
+ |
+
+ **Data type**
+ |
+
+ **Description**
+ |
+
+
+
+
+ |
+ `grantAccessOptions` (Required)
+ |
+
+ Object
+ |
+
+ Contains the grant configuration with two main components:
+ * `entityAccessGrants`: Defines the secret and the role to grant
+ * `grantee`: Specifies who receives access
+ |
+
+
+ |
+ `entityAccessGrants.entity.id` (Required)
+ |
+
+ String
+ |
+
+ The unique ID of the secret. The format is `namespace::partition::entry_key_secret`.
+
+ For example, if you created a secret with key `prod-api-key` in account `12345` with namespace `production`, the entity ID is: `production::account-12345::prod-api-key`. If no namespace was provided, use an empty string: `::account-12345::prod-api-key`.
+ |
+
+
+ |
+ `entityAccessGrants.entity.type` (Required)
+ |
+
+ String
+ |
+
+ The entity type. For secrets, this is always `secret`.
+ |
+
+
+ |
+ `entityAccessGrants.roleId` (Required)
+ |
+
+ String
+ |
+
+ The unique ID of the role to grant. To find available role IDs, use the NerdGraph API explorer to query roles with scope `secret`. Common roles include Secret Owner (full control) and Secret Reader (read-only access).
+ |
+
+
+ |
+ `grantee.id` (Required)
+ |
+
+ String
+ |
+
+ The unique ID of the user, group, system identity, or system identity group receiving access.
+ |
+
+
+ |
+ `grantee.type` (Required)
+ |
+
+ Enum
+ |
+
+ The type of grantee. Valid values:
+ * `USER`: Individual user
+ * `GROUP`: User group
+ * `SYSTEM_IDENTITY`: System identity (for automated processes)
+ * `SYSTEM_IDENTITY_GROUP`: System identity group
+ |
+
+
+
+
+#### Sample query:
+
+```graphql
+mutation {
+ authorizationManagementGrantAccess(
+ grantAccessOptions: {
+ entityAccessGrants: {
+ entity: {
+ id: "production::account-1::prod-api-key",
+ type: "secret"
+ },
+ roleId: "role-id-for-secret-reader"
+ },
+ grantee: {
+ id: "system-identity-id-abc123",
+ type: SYSTEM_IDENTITY
+ }
+ }
+ ) {
+ roles {
+ id
+ roleId
+ }
+ }
+}
+```
+
+### Response
+
+
+
+
+ |
+ **Attribute name**
+ |
+
+ **Description**
+ |
+
+
+
+
+ |
+ `roles`
+ |
+
+ An array of role assignments created by the grant operation, including:
+ * `id`: The unique identifier of the grant
+ * `roleId`: The role ID that was granted
+ |
+
+
+
+
+#### Sample response:
+
+```json
+{
+ "data": {
+ "authorizationManagementGrantAccess": {
+ "roles": [
+ {
+ "id": "grant-id-xyz789",
+ "roleId": "role-id-for-secret-reader"
+ }
+ ]
+ }
+ }
+}
+```
+
+
+To revoke access to a sharable secret, use the `authorizationManagementRevokeAccess` mutation.
+
+
+
+
+
+
+Use the `authorizationManagementRevokeAccess` mutation to remove access from users, groups, system identities, or system identity groups that were previously granted access to your sharable secret.
+
+
+The secret owner (creator), organization admins, or users with the appropriate revoke permission can remove access to a sharable secret.
+
+
+#### Input attributes
+
+
+
+
+ |
+ **Attribute name**
+ |
+
+ **Data type**
+ |
+
+ **Description**
+ |
+
+
+
+
+ |
+ `grantAccessOptions` (Required)
+ |
+
+ Object
+ |
+
+ Contains the revoke configuration with the same structure as the grant operation.
+ |
+
+
+ |
+ `entityAccessGrants.entity.id` (Required)
+ |
+
+ String
+ |
+
+ The unique ID of the secret in the format `namespace::partition::entry_key_secret`.
+ |
+
+
+ |
+ `entityAccessGrants.entity.type` (Required)
+ |
+
+ String
+ |
+
+ The entity type. For secrets, this is always `secret`.
+ |
+
+
+ |
+ `entityAccessGrants.roleId` (Required)
+ |
+
+ String
+ |
+
+ The unique ID of the role to revoke.
+ |
+
+
+ |
+ `grantee.id` (Required)
+ |
+
+ String
+ |
+
+ The unique ID of the user, group, system identity, or system identity group from which to revoke access.
+ |
+
+
+ |
+ `grantee.type` (Required)
+ |
+
+ Enum
+ |
+
+ The type of grantee. Valid values: `USER`, `GROUP`, `SYSTEM_IDENTITY`, `SYSTEM_IDENTITY_GROUP`.
+ |
+
+
+
+
+#### Sample query:
+
+```graphql
+mutation {
+ authorizationManagementRevokeAccess(
+ grantAccessOptions: {
+ entityAccessGrants: {
+ entity: {
+ id: "production::account-12345::prod-api-key",
+ type: "secret"
+ }
+ roleId: "role-id-for-secret-reader"
+ }
+ grantee: {
+ id: "system-identity-id-abc123",
+ type: SYSTEM_IDENTITY
+ }
+ }
+ ) {
+ roles {
+ id
+ roleId
+ }
+ }
+}
+```
+
+### Response
+
+
+
+
+ |
+ **Attribute name**
+ |
+
+ **Description**
+ |
+
+
+
+
+ |
+ `roles`
+ |
+
+ An array of role information related to the revoked grant.
+ |
+
+
+
+
+#### Sample response:
+
+```json
+{
+ "data": {
+ "authorizationManagementRevokeAccess": {
+ "roles": [
+ {
+ "id": "grant-id-xyz789",
+ "roleId": "role-id-for-secret-reader"
+ }
+ ]
+ }
+ }
+}
+```
+
+
+
+
+
+Use the `customerAdministration/entityGrants` query to see which users, groups, system identities, or system identity groups have been granted access to your sharable secret.
+
+
+This query returns only explicit grants made directly on the secret. It does not show implied access or permissions inherited from parent scopes.
+
+
+#### Input attributes
+
+
+
+
+ |
+ **Attribute name**
+ |
+
+ **Data type**
+ |
+
+ **Description**
+ |
+
+
+
+
+ |
+ `iamParent.id` (Required)
+ |
+
+ String
+ |
+
+ The ID of the account or organization where the secret is stored.
+ |
+
+
+ |
+ `iamParent.scope` (Required)
+ |
+
+ Enum
+ |
+
+ The parent scope type. Valid values: `ACCOUNT`, `ORGANIZATION`.
+ |
+
+
+ |
+ `entity.id` (Optional)
+ |
+
+ String
+ |
+
+ The unique ID of the secret in the format `namespace::partition::entry_key_secret`. When provided, only grants for this specific secret are returned.
+ |
+
+
+ |
+ `entity.type` (Required)
+ |
+
+ String
+ |
+
+ The entity type. For secrets, this is always `secret`.
+ |
+
+
+ |
+ `member.id` (Optional)
+ |
+
+ String
+ |
+
+ Filter grants by the ID of a specific user, group, system identity, or system identity group.
+ |
+
+
+ |
+ `member.type` (Optional)
+ |
+
+ Enum
+ |
+
+ The type of member to filter by. Valid values: `USER`, `GROUP`, `SYSTEM_IDENTITY`, `SYSTEM_IDENTITY_GROUP`.
+ |
+
+
+
+
+#### Sample query:
+
+```graphql
+{
+ customerAdministration {
+ entityGrants(
+ filter: {
+ iamParent: {
+ id: { eq: "12345" }
+ scope: { eq: ACCOUNT }
+ }
+ entity: {
+ id: { eq: "production::account-12345::prod-api-key" }
+ type: { eq: "secret" }
+ }
+ }
+ cursor: ""
+ ) {
+ items {
+ targetEntity {
+ id
+ }
+ member {
+ memberId
+ memberType
+ }
+ id
+ role {
+ name
+ id
+ }
+ }
+ nextCursor
+ }
+ }
+}
+```
+
+### Response
+
+
+
+
+ |
+ **Attribute name**
+ |
+
+ **Description**
+ |
+
+
+
+
+ |
+ `items`
+ |
+
+ An array of grant objects, each containing:
+ * `targetEntity.id`: The entity ID of the secret
+ * `member.memberId`: The ID of the user, group, system identity, or system identity group
+ * `member.memberType`: The type of member (USER, GROUP, SYSTEM_IDENTITY, or SYSTEM_IDENTITY_GROUP)
+ * `id`: The unique identifier of the grant (use this to revoke access)
+ * `role.name`: The name of the role granted
+ * `role.id`: The unique identifier of the role
+ |
+
+
+ |
+ `nextCursor`
+ |
+
+ The cursor value for pagination. Use this value in the next query to retrieve additional results.
+ |
+
+
+
+
+#### Sample response:
+
+```json
+{
+ "data": {
+ "customerAdministration": {
+ "entityGrants": {
+ "items": [
+ {
+ "targetEntity": {
+ "id": "production::account-12345::prod-api-key"
+ },
+ "member": {
+ "memberId": "system-identity-id-abc123",
+ "memberType": "SYSTEM_IDENTITY"
+ },
+ "id": "grant-id-xyz789",
+ "role": {
+ "name": "Secret Reader",
+ "id": "role-id-for-secret-reader"
+ }
+ }
+ ],
+ "nextCursor": null
+ }
+ }
+ }
+}
+```
+
+
+
+
+
+## Related topics [#related-topics]
+
+
+
+ Get started with New Relic's GraphQL API
+
+
+ Use the NerdGraph API explorer to test queries and mutations
+
+
+ Create and manage user groups with custom roles
+
+
+ Use secrets in infrastructure agent configuration
+
+
|