2017-05-03 09:13:07 +00:00
---
layout: "api"
2017-09-20 20:05:00 +00:00
page_title: "Database - Secrets Engines - HTTP API"
New Docs Website (#5535)
* conversion stage 1
* correct image paths
* add sidebar title to frontmatter
* docs/concepts and docs/internals
* configuration docs and multi-level nav corrections
* commands docs, index file corrections, small item nav correction
* secrets converted
* auth
* add enterprise and agent docs
* add extra dividers
* secret section, wip
* correct sidebar nav title in front matter for apu section, start working on api items
* auth and backend, a couple directory structure fixes
* remove old docs
* intro side nav converted
* reset sidebar styles, add hashi-global-styles
* basic styling for nav sidebar
* folder collapse functionality
* patch up border length on last list item
* wip restructure for content component
* taking middleman hacking to the extreme, but its working
* small css fix
* add new mega nav
* fix a small mistake from the rebase
* fix a content resolution issue with middleman
* title a couple missing docs pages
* update deps, remove temporary markup
* community page
* footer to layout, community page css adjustments
* wip downloads page
* deps updated, downloads page ready
* fix community page
* homepage progress
* add components, adjust spacing
* docs and api landing pages
* a bunch of fixes, add docs and api landing pages
* update deps, add deploy scripts
* add readme note
* update deploy command
* overview page, index title
* Update doc fields
Note this still requires the link fields to be populated -- this is solely related to copy on the description fields
* Update api_basic_categories.yml
Updated API category descriptions. Like the document descriptions you'll still need to update the link headers to the proper target pages.
* Add bottom hero, adjust CSS, responsive friendly
* Add mega nav title
* homepage adjustments, asset boosts
* small fixes
* docs page styling fixes
* meganav title
* some category link corrections
* Update API categories page
updated to reflect the second level headings for api categories
* Update docs_detailed_categories.yml
Updated to represent the existing docs structure
* Update docs_detailed_categories.yml
* docs page data fix, extra operator page remove
* api data fix
* fix makefile
* update deps, add product subnav to docs and api landing pages
* Rearrange non-hands-on guides to _docs_
Since there is no place for these on learn.hashicorp, we'll put them
under _docs_.
* WIP Redirects for guides to docs
* content and component updates
* font weight hotfix, redirects
* fix guides and intro sidenavs
* fix some redirects
* small style tweaks
* Redirects to learn and internally to docs
* Remove redirect to `/vault`
* Remove `.html` from destination on redirects
* fix incorrect index redirect
* final touchups
* address feedback from michell for makefile and product downloads
2018-10-19 15:40:11 +00:00
sidebar_title: "Databases"
sidebar_current: "api-http-secret-databases"
2017-05-03 09:13:07 +00:00
description: |-
2017-09-20 20:05:00 +00:00
Top page for database secrets engine information
2017-05-03 09:13:07 +00:00
---
2017-09-20 20:05:00 +00:00
# Database Secrets Engine (API)
2017-05-03 09:13:07 +00:00
2017-09-20 20:05:00 +00:00
This is the API documentation for the Vault Database secrets engine. For
general information about the usage and operation of the database secrets engine,
2017-05-03 09:13:07 +00:00
please see the
2017-09-20 20:05:00 +00:00
[Vault database secrets engine documentation ](/docs/secrets/databases/index.html ).
2017-05-03 09:13:07 +00:00
2017-09-20 20:05:00 +00:00
This documentation assumes the database secrets engine is enabled at the
`/database` path in Vault. Since it is possible to enable secrets engines at any
location, please update your API calls accordingly.
2017-05-03 09:13:07 +00:00
## Configure Connection
This endpoint configures the connection string used to communicate with the
desired database. In addition to the parameters listed here, each Database
2018-01-03 15:38:55 +00:00
plugin has additional, database plugin specific, parameters for this endpoint.
2017-05-03 09:13:07 +00:00
Please read the HTTP API for the plugin you'd wish to configure to see the full
list of additional parameters.
2018-06-19 15:24:28 +00:00
~> This endpoint distinguishes between `create` and `update` ACL capabilities.
2019-03-22 16:15:37 +00:00
| Method | Path |
| :--------------------------- | :--------------------- |
| `POST` | `/database/config/:name` |
2017-05-03 09:13:07 +00:00
### Parameters
- `name` `(string: <required>)` – Specifies the name for this database
connection. This is specified as part of the URL.
- `plugin_name` `(string: <required>)` - Specifies the name of the plugin to use
for this connection.
- `verify_connection` `(bool: true)` – Specifies if the connection is verified
during initial configuration. Defaults to true.
2018-04-09 16:20:29 +00:00
- `allowed_roles` `(list: [])` - List of the roles allowed to use this connection.
Defaults to empty (no roles), if contains a "*" any role can use this connection.
- `root_rotation_statements` `(list: [])` - Specifies the database statements to be
executed to rotate the root user's credentials. See the plugin's API page for more
information on support and formatting for this parameter.
2017-05-03 09:13:07 +00:00
### Sample Payload
```json
{
"plugin_name": "mysql-database-plugin",
"allowed_roles": "readonly",
2018-04-09 16:20:29 +00:00
"connection_url": "{{username}}:{{password}}@tcp(127.0.0.1:3306)/",
"username": "root",
"password": "mysql"
2017-05-03 09:13:07 +00:00
}
```
### Sample Request
```
$ curl \
--header "X-Vault-Token: ..." \
--request POST \
--data @payload .json \
2018-03-23 15:41:51 +00:00
http://127.0.0.1:8200/v1/database/config/mysql
2017-05-03 09:13:07 +00:00
```
## Read Connection
This endpoint returns the configuration settings for a connection.
2019-03-22 16:15:37 +00:00
| Method | Path |
| :--------------------------- | :--------------------- |
| `GET` | `/database/config/:name` |
2017-05-03 09:13:07 +00:00
### Parameters
- `name` `(string: <required>)` – Specifies the name of the connection to read.
This is specified as part of the URL.
### Sample Request
```
$ curl \
--header "X-Vault-Token: ..." \
--request GET \
2018-03-23 15:41:51 +00:00
http://127.0.0.1:8200/v1/database/config/mysql
2017-05-03 09:13:07 +00:00
```
### Sample Response
```json
{
"data": {
"allowed_roles": [
"readonly"
],
"connection_details": {
2018-04-09 16:20:29 +00:00
"connection_url": "{{username}}:{{password}}@tcp(127.0.0.1:3306)/",
"username": "root"
2017-05-03 09:13:07 +00:00
},
"plugin_name": "mysql-database-plugin"
},
}
```
2018-02-22 20:27:33 +00:00
## List Connections
This endpoint returns a list of available connections. Only the connection names
are returned, not any values.
2019-03-22 16:15:37 +00:00
| Method | Path |
| :--------------------------- | :--------------------- |
| `LIST` | `/database/config` |
2018-02-22 20:27:33 +00:00
### Sample Request
```
$ curl \
--header "X-Vault-Token: ..." \
--request LIST \
2018-03-23 15:41:51 +00:00
http://127.0.0.1:8200/v1/database/config
2018-02-22 20:27:33 +00:00
```
### Sample Response
```json
{
"data": {
"keys": ["db-one", "db-two"]
}
}
```
2017-05-03 09:13:07 +00:00
## Delete Connection
This endpoint deletes a connection.
2019-03-22 16:15:37 +00:00
| Method | Path |
| :--------------------------- | :--------------------- |
| `DELETE` | `/database/config/:name` |
2017-05-03 09:13:07 +00:00
### Parameters
- `name` `(string: <required>)` – Specifies the name of the connection to delete.
This is specified as part of the URL.
### Sample Request
```
$ curl \
--header "X-Vault-Token: ..." \
--request DELETE \
2018-03-23 15:41:51 +00:00
http://127.0.0.1:8200/v1/database/config/mysql
2017-05-03 09:13:07 +00:00
```
## Reset Connection
This endpoint closes a connection and it's underlying plugin and restarts it
with the configuration stored in the barrier.
2019-03-22 16:15:37 +00:00
| Method | Path |
| :--------------------------- | :--------------------- |
| `POST` | `/database/reset/:name` |
2017-05-03 09:13:07 +00:00
### Parameters
2018-10-15 13:47:43 +00:00
- `name` `(string: <required>)` – Specifies the name of the connection to reset.
2017-05-03 09:13:07 +00:00
This is specified as part of the URL.
### Sample Request
```
$ curl \
--header "X-Vault-Token: ..." \
--request POST \
2018-03-23 15:41:51 +00:00
http://127.0.0.1:8200/v1/database/reset/mysql
2017-05-03 09:13:07 +00:00
```
2018-04-09 16:20:29 +00:00
## Rotate Root Credentials
This endpoint is used to rotate the root superuser credentials stored for
the database connection. This user must have permissions to update its own
password.
2019-03-22 16:15:37 +00:00
| Method | Path |
| :---------------------------- | :--------------------- |
| `POST` | `/database/rotate-root/:name` |
2018-04-09 16:20:29 +00:00
### Parameters
- `name` `(string: <required>)` – Specifies the name of the connection to rotate.
This is specified as part of the URL.
### Sample Request
```
$ curl \
--header "X-Vault-Token: ..." \
--request POST \
http://127.0.0.1:8200/v1/database/rotate-root/mysql
```
2017-05-03 09:13:07 +00:00
## Create Role
This endpoint creates or updates a role definition.
2018-06-19 15:24:28 +00:00
~> This endpoint distinguishes between `create` and `update` ACL capabilities.
2019-03-22 16:15:37 +00:00
| Method | Path |
| :--------------------------- | :--------------------- |
| `POST` | `/database/roles/:name` |
2017-05-03 09:13:07 +00:00
### Parameters
- `name` `(string: <required>)` – Specifies the name of the role to create. This
is specified as part of the URL.
- `db_name` `(string: <required>)` - The name of the database connection to use
2017-09-13 01:48:52 +00:00
for this role.
2017-05-03 09:13:07 +00:00
2017-05-04 18:45:27 +00:00
- `default_ttl` `(string/int: 0)` - Specifies the TTL for the leases
associated with this role. Accepts time suffixed strings ("1h") or an integer
2017-09-20 20:05:00 +00:00
number of seconds. Defaults to system/engine default TTL time.
2017-05-03 09:13:07 +00:00
2017-05-04 18:45:27 +00:00
- `max_ttl` `(string/int: 0)` - Specifies the maximum TTL for the leases
associated with this role. Accepts time suffixed strings ("1h") or an integer
2018-10-29 19:19:35 +00:00
number of seconds. Defaults to system/mount default TTL time; this value is allowed to be less than the mount max TTL (or, if not set, the system max TTL), but it is not allowed to be longer. See also [The TTL General Case ](https://www.vaultproject.io/docs/concepts/tokens.html#the-general-case ).
2017-05-03 09:13:07 +00:00
2018-04-09 16:20:29 +00:00
- `creation_statements` `(list: <required>)` – Specifies the database
2017-05-11 18:59:58 +00:00
statements executed to create and configure a user. See the plugin's API page
2017-09-13 01:48:52 +00:00
for more information on support and formatting for this parameter.
2017-05-03 09:13:07 +00:00
2018-04-09 16:20:29 +00:00
- `revocation_statements` `(list: [])` – Specifies the database statements to
2017-05-11 18:59:58 +00:00
be executed to revoke a user. See the plugin's API page for more information
2017-09-13 01:48:52 +00:00
on support and formatting for this parameter.
2017-05-03 09:13:07 +00:00
2018-04-09 16:20:29 +00:00
- `rollback_statements` `(list: [])` – Specifies the database statements to be
2017-05-03 09:13:07 +00:00
executed rollback a create operation in the event of an error. Not every
2017-05-11 18:59:58 +00:00
plugin type will support this functionality. See the plugin's API page for
2017-09-13 01:48:52 +00:00
more information on support and formatting for this parameter.
2017-05-03 09:13:07 +00:00
2018-04-09 16:20:29 +00:00
- `renew_statements` `(list: [])` – Specifies the database statements to be
2017-05-03 09:13:07 +00:00
executed to renew a user. Not every plugin type will support this
2017-05-11 18:59:58 +00:00
functionality. See the plugin's API page for more information on support and
2017-09-13 01:48:52 +00:00
formatting for this parameter.
2017-05-11 18:59:58 +00:00
2017-05-03 09:13:07 +00:00
### Sample Payload
```json
{
"db_name": "mysql",
2018-04-09 16:20:29 +00:00
"creation_statements": ["CREATE USER '{{name}}'@'%' IDENTIFIED BY '{{password}}'", "GRANT SELECT ON *.* TO '{{name}}'@'%'"],
2017-05-03 09:13:07 +00:00
"default_ttl": "1h",
"max_ttl": "24h"
}
```
### Sample Request
```
$ curl \
--header "X-Vault-Token: ..." \
--request POST \
--data @payload .json \
2018-03-23 15:41:51 +00:00
http://127.0.0.1:8200/v1/database/roles/my-role
2017-05-03 09:13:07 +00:00
```
## Read Role
This endpoint queries the role definition.
2019-03-22 16:15:37 +00:00
| Method | Path |
| :--------------------------- | :--------------------- |
| `GET` | `/database/roles/:name` |
2017-05-03 09:13:07 +00:00
### Parameters
- `name` `(string: <required>)` – Specifies the name of the role to read. This
is specified as part of the URL.
### Sample Request
```
$ curl \
--header "X-Vault-Token: ..." \
2018-03-23 15:41:51 +00:00
http://127.0.0.1:8200/v1/database/roles/my-role
2017-05-03 09:13:07 +00:00
```
### Sample Response
```json
{
"data": {
2018-04-09 16:20:29 +00:00
"creation_statements": ["CREATE ROLE \"{{name}}\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}';"], "GRANT SELECT ON ALL TABLES IN SCHEMA public TO \"{{name}}\";"],
2017-05-03 09:13:07 +00:00
"db_name": "mysql",
"default_ttl": 3600,
"max_ttl": 86400,
2018-04-09 16:20:29 +00:00
"renew_statements": [],
"revocation_statements": [],
"rollback_statements": []
2017-05-03 09:13:07 +00:00
},
}
```
## List Roles
This endpoint returns a list of available roles. Only the role names are
returned, not any values.
2019-03-22 16:15:37 +00:00
| Method | Path |
| :--------------------------- | :--------------------- |
| `LIST` | `/database/roles` |
2017-05-03 09:13:07 +00:00
### Sample Request
```
$ curl \
--header "X-Vault-Token: ..." \
--request LIST \
2018-03-23 15:41:51 +00:00
http://127.0.0.1:8200/v1/database/roles
2017-05-03 09:13:07 +00:00
```
### Sample Response
```json
{
"auth": null,
"data": {
"keys": ["dev", "prod"]
},
"lease_duration": 2764800,
"lease_id": "",
"renewable": false
}
```
## Delete Role
This endpoint deletes the role definition.
2019-03-22 16:15:37 +00:00
| Method | Path |
| :--------------------------- | :--------------------- |
| `DELETE` | `/database/roles/:name` |
2017-05-03 09:13:07 +00:00
### Parameters
- `name` `(string: <required>)` – Specifies the name of the role to delete. This
is specified as part of the URL.
### Sample Request
```
$ curl \
--header "X-Vault-Token: ..." \
--request DELETE \
2018-03-23 15:41:51 +00:00
http://127.0.0.1:8200/v1/database/roles/my-role
2017-05-03 09:13:07 +00:00
```
## Generate Credentials
This endpoint generates a new set of dynamic credentials based on the named
role.
2019-03-22 16:15:37 +00:00
| Method | Path |
| :--------------------------- | :--------------------- |
| `GET` | `/database/creds/:name` |
2017-05-03 09:13:07 +00:00
### Parameters
- `name` `(string: <required>)` – Specifies the name of the role to create
credentials against. This is specified as part of the URL.
### Sample Request
```
$ curl \
--header "X-Vault-Token: ..." \
2018-03-23 15:41:51 +00:00
http://127.0.0.1:8200/v1/database/creds/my-role
2017-05-03 09:13:07 +00:00
```
### Sample Response
```json
{
"data": {
"username": "root-1430158508-126",
"password": "132ae3ef-5a64-7499-351e-bfe59f3a2a21"
}
}
```
Combined Database Backend: Static Accounts (#6834)
* Add priority queue to sdk
* fix issue of storing pointers and now copy
* update to use copy structure
* Remove file, put Item struct def. into other file
* add link
* clean up docs
* refactor internal data structure to hide heap method implementations. Other cleanup after feedback
* rename PushItem and PopItem to just Push/Pop, after encapsulating the heap methods
* updates after feedback
* refactoring/renaming
* guard against pushing a nil item
* minor updates after feedback
* Add SetCredentials, GenerateCredentials gRPC methods to combined database backend gPRC
* Initial Combined database backend implementation of static accounts and automatic rotation
* vendor updates
* initial implementation of static accounts with Combined database backend, starting with PostgreSQL implementation
* add lock and setup of rotation queue
* vendor the queue
* rebase on new method signature of queue
* remove mongo tests for now
* update default role sql
* gofmt after rebase
* cleanup after rebasing to remove checks for ErrNotFound error
* rebase cdcr-priority-queue
* vendor dependencies with 'go mod vendor'
* website database docs for Static Role support
* document the rotate-role API endpoint
* postgres specific static role docs
* use constants for paths
* updates from review
* remove dead code
* combine and clarify error message for older plugins
* Update builtin/logical/database/backend.go
Co-Authored-By: Jim Kalafut <jim@kalafut.net>
* cleanups from feedback
* code and comment cleanups
* move db.RLock higher to protect db.GenerateCredentials call
* Return output with WALID if we failed to delete the WAL
* Update builtin/logical/database/path_creds_create.go
Co-Authored-By: Jim Kalafut <jim@kalafut.net>
* updates after running 'make fmt'
* update after running 'make proto'
* Update builtin/logical/database/path_roles.go
Co-Authored-By: Brian Kassouf <briankassouf@users.noreply.github.com>
* Update builtin/logical/database/path_roles.go
Co-Authored-By: Brian Kassouf <briankassouf@users.noreply.github.com>
* update comment and remove and rearrange some dead code
* Update website/source/api/secret/databases/index.html.md
Co-Authored-By: Jim Kalafut <jim@kalafut.net>
* cleanups after review
* Update sdk/database/dbplugin/grpc_transport.go
Co-Authored-By: Brian Kassouf <briankassouf@users.noreply.github.com>
* code cleanup after feedback
* remove PasswordLastSet; it's not used
* document GenerateCredentials and SetCredentials
* Update builtin/logical/database/path_rotate_credentials.go
Co-Authored-By: Brian Kassouf <briankassouf@users.noreply.github.com>
* wrap pop and popbykey in backend methods to protect against nil cred rotation queue
* use strings.HasPrefix instead of direct equality check for path
* Forgot to commit this
* updates after feedback
* re-purpose an outdated test to now check that static and dynamic roles cannot share a name
* check for unique name across dynamic and static roles
* refactor loadStaticWALs to return a map of name/setCredentialsWAL struct to consolidate where we're calling set credentials
* remove commented out code
* refactor to have loadstaticwals filter out wals for roles that no longer exist
* return error if nil input given
* add nil check for input into setStaticAccount
* Update builtin/logical/database/path_roles.go
Co-Authored-By: Brian Kassouf <briankassouf@users.noreply.github.com>
* add constant for queue tick time in seconds, used for comparrison in updates
* Update builtin/logical/database/path_roles.go
Co-Authored-By: Jim Kalafut <jim@kalafut.net>
* code cleanup after review
* remove misplaced code comment
* remove commented out code
* create a queue in the Factory method, even if it's never used
* update path_roles to use a common set of fields, with specific overrides for dynamic/static roles by type
* document new method
* move rotation things into a specific file
* rename test file and consolidate some static account tests
* Update builtin/logical/database/path_roles.go
Co-Authored-By: Brian Kassouf <briankassouf@users.noreply.github.com>
* Update builtin/logical/database/rotation.go
Co-Authored-By: Brian Kassouf <briankassouf@users.noreply.github.com>
* Update builtin/logical/database/rotation.go
Co-Authored-By: Brian Kassouf <briankassouf@users.noreply.github.com>
* Update builtin/logical/database/rotation.go
Co-Authored-By: Brian Kassouf <briankassouf@users.noreply.github.com>
* Update builtin/logical/database/rotation.go
Co-Authored-By: Brian Kassouf <briankassouf@users.noreply.github.com>
* Update builtin/logical/database/rotation.go
Co-Authored-By: Brian Kassouf <briankassouf@users.noreply.github.com>
* update code comments, method names, and move more methods into rotation.go
* update comments to be capitalized
* remove the item from the queue before we try to destroy it
* findStaticWAL returns an error
* use lowercase keys when encoding WAL entries
* small cleanups
* remove vestigial static account check
* remove redundant DeleteWAL call in populate queue
* if we error on loading role, push back to queue with 10 second backoff
* poll in initqueue to make sure the backend is setup and can write/delete data
* add revoke_user_on_delete flag to allow users to opt-in to revoking the static database user on delete of the Vault role. Default false
* add code comments on read-only loop
* code comment updates
* re-push if error returned from find static wal
* add locksutil and acquire locks when pop'ing from the queue
* grab exclusive locks for updating static roles
* Add SetCredentials and GenerateCredentials stubs to mockPlugin
* add a switch in initQueue to listen for cancelation
* remove guard on zero time, it should have no affect
* create a new context in Factory to pass on and use for closing the backend queue
* restore master copy of vendor dir
2019-06-19 19:45:39 +00:00
## Create Static Role
This endpoint creates or updates a static role definition. Static Roles are a
1-to-1 mapping of a Vault Role to a user in a database which are automatically
rotated based on the configured `rotation_period` . Not all databases support
Static Roles, please see the database-specific documentation.
~> This endpoint distinguishes between `create` and `update` ACL capabilities.
| Method | Path |
| :--------------------------- | :--------------------- |
| `POST` | `/database/static-roles/:name` |
### Parameters
- `name` `(string: <required>)` – Specifies the name of the role to create. This
is specified as part of the URL.
- `username` `(string: <required>)` – Specifies the database username that this
Vault role corresponds to.
- `rotation_period` `(string/int: <required>)` – Specifies the amount of time
Vault should wait before rotating the password. The minimum is 5 seconds.
- `db_name` `(string: <required>)` - The name of the database connection to use
for this role.
- `rotation_statements` `(list: [])` – Specifies the database statements to be
executed to rotate the password for the configured database user. Not every
plugin type will support this functionality. See the plugin's API page for
more information on support and formatting for this parameter.
### Sample Payload
```json
{
"db_name": "mysql",
"username": "static-database-user",
"rotation_statements": ["ALTER USER "{{name}}" WITH PASSWORD '{{password}}';"],
"rotation_period": "1h"
}
```
### Sample Request
```
$ curl \
--header "X-Vault-Token: ..." \
--request POST \
--data @payload .json \
http://127.0.0.1:8200/v1/database/static-roles/my-static-role
```
## Read Static Role
This endpoint queries the static role definition.
| Method | Path |
| :--------------------------- | :--------------------- |
| `GET` | `/database/static-roles/:name` |
### Parameters
- `name` `(string: <required>)` – Specifies the name of the static role to read.
This is specified as part of the URL.
### Sample Request
```
$ curl \
--header "X-Vault-Token: ..." \
http://127.0.0.1:8200/v1/database/static-roles/my-static-role
```
### Sample Response
```json
{
"data": {
"db_name": "mysql",
"username":"static-user",
"rotation_statements": ["ALTER USER "{{name}}" WITH PASSWORD '{{password}}';"],
"rotation_period":"1h",
},
}
```
## List Static Roles
This endpoint returns a list of available static roles. Only the role names are
returned, not any values.
| Method | Path |
| :--------------------------- | :--------------------- |
| `LIST` | `/database/static-roles` |
### Sample Request
```
$ curl \
--header "X-Vault-Token: ..." \
--request LIST \
http://127.0.0.1:8200/v1/database/static-roles
```
### Sample Response
```json
{
"auth": null,
"data": {
"keys": ["dev-static", "prod-static"]
}
}
```
## Delete Static Role
This endpoint deletes the static role definition and revokes the database user.
| Method | Path |
| :--------------------------- | :--------------------- |
| `DELETE` | `/database/static-roles/:name` |
### Parameters
- `name` `(string: <required>)` – Specifies the name of the static role to
delete. This is specified as part of the URL.
### Sample Request
```
$ curl \
--header "X-Vault-Token: ..." \
--request DELETE \
http://127.0.0.1:8200/v1/database/static-roles/my-role
```
## Get Static Credentials
This endpoint returns the current credentials based on the named static role.
| Method | Path |
| :--------------------------- | :--------------------- |
| `GET` | `/database/static-creds/:name` |
### Parameters
- `name` `(string: <required>)` – Specifies the name of the static role to get
credentials for. This is specified as part of the URL.
### Sample Request
```
$ curl \
--header "X-Vault-Token: ..." \
http://127.0.0.1:8200/v1/database/static-creds/my-static-role
```
### Sample Response
```json
{
"data": {
"username": "static-user",
"password": "132ae3ef-5a64-7499-351e-bfe59f3a2a21"
"last_vault_rotation": "2019-05-06T15:26:42.525302-05:00",
"rotation_period": 30,
"ttl": 28,
}
}
```
## Rotate Static Role Credentials
This endpoint is used to rotate the Static Role credentials stored for a given
role name. While Static Roles are rotated automatically by Vault at configured
rotation periods, users can use this endpoint to manually trigger a rotation to
change the stored password and reset the TTL of the Static Role's password.
| Method | Path |
| :---------------------------- | :--------------------- |
| `POST` | `/database/rotate-role/:name` |
### Parameters
- `name` `(string: <required>)` – Specifies the name of the Static Role to
trigger the password rotation for. The name is specified as part of the URL.
### Sample Request
```
$ curl \
--header "X-Vault-Token: ..." \
--request POST \
http://127.0.0.1:8200/v1/database/rotate-role/my-static-role
```