{"_id":"@azerothian/infisical","name":"@azerothian/infisical","dist-tags":{"latest":"0.1.0"},"versions":{"0.1.0":{"name":"@azerothian/infisical","version":"0.1.0","description":"TypeScript SDK for Infisical v2 API","main":"./dist/index.js","module":"./dist/index.mjs","types":"./dist/index.d.ts","exports":{".":{"import":{"types":"./dist/index.d.mts","default":"./dist/index.mjs"},"require":{"types":"./dist/index.d.ts","default":"./dist/index.js"}}},"publishConfig":{"access":"public"},"dependencies":{"cross-fetch":"^4.1.0"},"repository":{"type":"git","url":"git+https://github.com/Azerothian/node-infisical.git"},"keywords":["infisical","secrets","sdk","api"],"scripts":{"build":"tsup","typecheck":"tsc --noEmit","test":"vitest run","test:watch":"vitest","test:e2e":"vitest run --config vitest.config.e2e.ts","test:e2e:watch":"vitest --config vitest.config.e2e.ts","e2e:up":"docker compose -f docker-compose.e2e.yml up -d","e2e:down":"docker compose -f docker-compose.e2e.yml down -v","prepublishOnly":"npm run build","release":"./scripts/release.sh patch","release:patch":"./scripts/release.sh patch","release:minor":"./scripts/release.sh minor","release:major":"./scripts/release.sh major"},"devDependencies":{"@types/node":"^20.0.0","tsup":"^8.0.0","typescript":"^5.3.0","vitest":"^1.0.0"},"engines":{"node":">=18"},"license":"MIT","gitHead":"afa6c7196ac2defb98b1617fb42e7c188241643d","_id":"@azerothian/infisical@0.1.0","bugs":{"url":"https://github.com/Azerothian/node-infisical/issues"},"homepage":"https://github.com/Azerothian/node-infisical#readme","_nodeVersion":"24.12.0","_npmVersion":"11.6.2","dist":{"integrity":"sha512-5vOnRim6c3GAUwgxOrdj0Alxo8Ob1ruY426SjKYlmbkzLptCccZnbzDwgzHd24vmyKGY5T0ljs1HdmfGuJQ+9A==","shasum":"536da502b42c9042018f779bd76e93ed7557e595","tarball":"https://registry.npmjs.org/@azerothian/infisical/-/infisical-0.1.0.tgz","fileCount":8,"unpackedSize":844784,"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEUCIAcuMFI5o+URFXOTLt+ni5G5ddC/GreVOm+Iw/P2i3WDAiEA7QvpsUzHE3P8HJ0vXWEWvVKEBqoVGIeoEr6pNGhCASc="}]},"_npmUser":{"name":"matthew.m.mckenzie","email":"matthew.m.mckenzie@gmail.com"},"directories":{},"maintainers":[{"name":"matthew.m.mckenzie","email":"matthew.m.mckenzie@gmail.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/infisical_0.1.0_1770204374072_0.3181806360859838"},"_hasShrinkwrap":false}},"time":{"created":"2026-02-04T11:26:13.967Z","0.1.0":"2026-02-04T11:26:14.236Z","modified":"2026-02-04T11:26:14.521Z"},"maintainers":[{"name":"matthew.m.mckenzie","email":"matthew.m.mckenzie@gmail.com"}],"description":"TypeScript SDK for Infisical v2 API","homepage":"https://github.com/Azerothian/node-infisical#readme","keywords":["infisical","secrets","sdk","api"],"repository":{"type":"git","url":"git+https://github.com/Azerothian/node-infisical.git"},"bugs":{"url":"https://github.com/Azerothian/node-infisical/issues"},"license":"MIT","readme":"# @azerothian/infisical\n\n[](https://www.npmjs.com/package/@azerothian/infisical)\n[](https://opensource.org/licenses/MIT)\n\nA TypeScript SDK for the [Infisical](https://infisical.com) API. Provides typed access to secrets management, identity authentication, PKI, KMS, and all other Infisical platform features.\n\n- Zero dependencies (uses native `fetch`)\n- Supports Node.js 18+\n- Full TypeScript type definitions\n- ESM and CommonJS builds\n- Two-step authentication with auto-renewal\n\n## Table of Contents\n\n- [Installation](#installation)\n- [Quick Start](#quick-start)\n- [Authentication](#authentication)\n - [Login Methods](#login-methods)\n - [Auth Modes & Permissions](#auth-modes--permissions)\n - [Auto-Renewal](#auto-renewal)\n - [Auth State Inspection](#auth-state-inspection)\n- [Architecture](#architecture)\n - [Login Flow](#login-flow)\n - [Auto-Renewal Flow](#auto-renewal-flow)\n - [Auth Mode Check Flow](#auth-mode-check-flow)\n- [Configuration](#configuration)\n- [Error Handling](#error-handling)\n- [Releasing](#releasing)\n- [API Reference](#api-reference)\n - [MFA](#mfa)\n - [MFA Sessions](#mfa-sessions)\n - [Users](#users)\n - [Password](#password)\n - [Service Tokens](#service-tokens)\n - [Organizations](#organizations)\n - [Organization Identities](#organization-identities)\n - [Identities](#identities)\n - [Identity Access Tokens](#identity-access-tokens)\n - [Identity Auth](#identity-auth)\n - [Projects](#projects)\n - [Secrets](#secrets)\n - [Secret Folders](#secret-folders)\n - [Secret Imports](#secret-imports)\n - [Secret Sharing](#secret-sharing)\n - [Secret Syncs](#secret-syncs)\n - [Webhooks](#webhooks)\n - [PKI Certificate Authorities](#pki-certificate-authorities)\n - [PKI Certificate Templates](#pki-certificate-templates)\n - [PKI Alerts](#pki-alerts)\n - [PKI Certificates](#pki-certificates)\n - [KMS](#kms)\n - [Integration Auth](#integration-auth)\n - [App Connections](#app-connections)\n - [Admin](#admin)\n - [Org Admin](#org-admin)\n\n---\n\n## Installation\n\n```bash\nnpm install @azerothian/infisical\n```\n\n## Quick Start\n\n```typescript\nimport { InfisicalClient } from \"@azerothian/infisical\";\n\nconst client = new InfisicalClient();\n\nawait client.login({\n universalAuth: { clientId: \"YOUR_CLIENT_ID\", clientSecret: \"YOUR_CLIENT_SECRET\" }\n});\n\nconst secrets = await client.secrets.list({\n projectId: \"my-project-id\",\n environment: \"production\",\n});\n\nconsole.log(secrets);\n```\n\n## Authentication\n\nThe SDK uses a **two-step authentication** model. First, construct the client. Then, call `client.login()` with one of 12 identity auth methods. The returned access token is stored internally and sent automatically with every subsequent request.\n\n### Login Methods\n\nPass exactly one auth method key to `client.login()`:\n\n```typescript\n// Universal Auth (client ID + secret)\nawait client.login({ universalAuth: { clientId: \"...\", clientSecret: \"...\" } });\n\n// Token Auth\nawait client.login({ tokenAuth: { identityId: \"...\" } });\n\n// AWS Auth\nawait client.login({ awsAuth: { identityId: \"...\", iamHttpRequestMethod: \"...\", iamRequestBody: \"...\", iamRequestHeaders: \"...\" } });\n\n// GCP Auth\nawait client.login({ gcpAuth: { identityId: \"...\", jwt: \"...\" } });\n\n// Azure Auth\nawait client.login({ azureAuth: { identityId: \"...\", jwt: \"...\" } });\n\n// Kubernetes Auth\nawait client.login({ kubernetesAuth: { identityId: \"...\", jwt: \"...\" } });\n\n// OIDC Auth\nawait client.login({ oidcAuth: { identityId: \"...\", jwt: \"...\" } });\n\n// JWT Auth\nawait client.login({ jwtAuth: { identityId: \"...\", jwt: \"...\" } });\n\n// LDAP Auth\nawait client.login({ ldapAuth: { identityId: \"...\", username: \"...\", password: \"...\" } });\n\n// TLS Certificate Auth\nawait client.login({ tlsCertAuth: { identityId: \"...\", clientCertificate: \"...\" } });\n\n// OCI Auth\nawait client.login({ ociAuth: { identityId: \"...\", userOcid: \"...\", requestHeaders: \"...\" } });\n\n// AliCloud Auth\nawait client.login({ alicloudAuth: { identityId: \"...\", stsToken: \"...\", identityArn: \"...\" } });\n```\n\n### Auth Modes & Permissions\n\nEach resource category in the SDK is restricted to a set of allowed auth modes. If you call a resource method with an incompatible mode, the SDK throws an `AuthenticationError` before making any network request.\n\n| Resource Category | Allowed Auth Modes |\n|---|---|\n| `secrets`, `secretFolders`, `secretImports` | IAT, JWT, ST |\n| `projects`, `organizations`, `organizationIdentities` | IAT, JWT |\n| `identities`, `identityAuth`, `identityAccessTokens` | IAT, JWT |\n| `pki`, `kms`, `secretTags` | IAT, JWT |\n| `appConnections`, `secretSyncs`, `integrationAuth` | IAT, JWT |\n| `admin`, `orgAdmin` | JWT only |\n| `secretSharing`, `webhooks` | JWT only |\n| `users`, `mfa`, `mfaSessions` | JWT only |\n| `serviceTokens`, `password` | JWT only |\n\n**IAT** = Identity Access Token (set by `client.login()`), **JWT** = User JWT, **ST** = Service Token (deprecated).\n\n```typescript\nimport { AuthenticationError } from \"@azerothian/infisical\";\n\ntry {\n // login() sets mode to \"identityAccessToken\"\n await client.login({ universalAuth: { clientId: \"...\", clientSecret: \"...\" } });\n // admin requires JWT -- this will throw\n await client.admin.getConfig();\n} catch (error) {\n if (error instanceof AuthenticationError) {\n console.error(`Auth mode \"${error.currentMode}\" not allowed`);\n console.error(\"Allowed modes:\", error.allowedModes);\n }\n}\n```\n\n### Auto-Renewal\n\nWhen you authenticate via `client.login()`, the SDK stores the credentials and the token's `expiresIn` value. If a request is made within **30 seconds** of the token's expiry, the SDK transparently re-authenticates using the same credentials that were originally passed to `login()`.\n\nConcurrent requests that hit the renewal window share a single renewal promise, so only one re-authentication call is made regardless of how many requests are in flight.\n\n### Auth State Inspection\n\n```typescript\nclient.isAuthenticated // true if login() has been called and not yet logged out\nclient.authMode // \"identityAccessToken\" | \"jwt\" | \"apiKey\" | \"serviceToken\" | null\nclient.logout() // clears auth state, token, and renewal function\n```\n\n## Architecture\n\n### Login Flow\n\n```mermaid\nsequenceDiagram\n participant App\n participant Client as InfisicalClient\n participant AM as AuthManager\n participant IAR as Identity Auth Resource\n participant API as Infisical API\n participant AS as AuthState\n\n App->>Client: new InfisicalClient({ baseUrl })\n App->>Client: login({ universalAuth: { clientId, clientSecret } })\n Client->>AM: login(params)\n AM->>IAR: universal.login({ clientId, clientSecret })\n IAR->>API: POST /api/v1/auth/universal-auth/login\n API-->>IAR: { accessToken, expiresIn }\n IAR-->>AM: LoginResponse\n AM->>AS: setAuth({ mode: \"identityAccessToken\", accessToken }, expiresIn)\n AM->>AS: setRenewFn(loginFn)\n AM-->>Client: LoginResponse\n Client-->>App: LoginResponse\n```\n\n### Auto-Renewal Flow\n\n```mermaid\nsequenceDiagram\n participant App\n participant Resource as SecretsResource\n participant HTTP as HttpClient\n participant AS as AuthState\n participant IAR as Identity Auth Resource\n participant API as Infisical API\n\n App->>Resource: secrets.list({ projectId, environment })\n Resource->>Resource: requireAuth()\n Resource->>HTTP: get(\"/api/v4/secrets\", query)\n HTTP->>AS: ensureValid()\n\n alt Token expired (within 30s of expiry)\n AS->>IAR: loginFn() [re-authenticate]\n IAR->>API: POST /api/v1/auth/.../login\n API-->>IAR: { accessToken, expiresIn }\n IAR-->>AS: LoginResponse\n AS->>AS: setAuth(newToken, newExpiry)\n end\n\n AS-->>HTTP: valid\n HTTP->>API: GET /api/v4/secrets (with Bearer token)\n API-->>HTTP: secrets data\n HTTP-->>Resource: typed response\n Resource-->>App: ListSecretsResponse\n```\n\n### Auth Mode Check Flow\n\n```mermaid\nflowchart TD\n A[Client calls resource method] --> B{requireAuth}\n B --> C{Is authenticated?}\n C -->|No| D[Throw AuthenticationError
'Not authenticated']\n C -->|Yes| E{Auth mode allowed
for this resource?}\n E -->|No| F[Throw AuthenticationError
'Mode X not allowed']\n E -->|Yes| G[Proceed with request]\n G --> H{ensureValid}\n H --> I{Token near expiry?}\n I -->|Yes| J[Auto-renew token]\n J --> K[Execute HTTP request]\n I -->|No| K\n```\n\n## Configuration\n\n```typescript\nconst client = new InfisicalClient({\n // Optional: base URL (defaults to https://app.infisical.com)\n baseUrl: \"https://self-hosted.example.com\",\n\n // Optional: request timeout in milliseconds (defaults to 30000)\n timeout: 60_000,\n\n // Optional: additional headers sent with every request\n headers: { \"X-Custom-Header\": \"value\" },\n\n // Optional: custom fetch implementation\n fetch: customFetchFn,\n});\n```\n\n## Error Handling\n\nAll API errors are thrown as typed error classes. Network-level failures throw `InfisicalNetworkError`. Auth-mode violations throw `AuthenticationError` before any network call is made.\n\n```typescript\nimport {\n InfisicalApiError,\n InfisicalNetworkError,\n AuthenticationError,\n BadRequestError,\n UnauthorizedError,\n ForbiddenError,\n NotFoundError,\n ValidationError,\n RateLimitError,\n InternalServerError,\n} from \"@azerothian/infisical\";\n\ntry {\n await client.secretFolders.getById({ id: \"non-existent\" });\n} catch (error) {\n if (error instanceof AuthenticationError) {\n console.error(`Auth mode \"${error.currentMode}\" not allowed`);\n console.error(\"Allowed modes:\", error.allowedModes);\n } else if (error instanceof NotFoundError) {\n console.error(\"Folder not found:\", error.message);\n console.error(\"Request ID:\", error.requestId);\n } else if (error instanceof UnauthorizedError) {\n console.error(\"Invalid credentials\");\n } else if (error instanceof RateLimitError) {\n console.error(\"Rate limited, retry later\");\n } else if (error instanceof InfisicalApiError) {\n console.error(`API error ${error.statusCode}: ${error.message}`);\n } else if (error instanceof InfisicalNetworkError) {\n console.error(\"Network failure:\", error.message, error.cause);\n }\n}\n```\n\n| Error Class | HTTP Status | Description |\n|---|---|---|\n| `AuthenticationError` | N/A | Not authenticated, or auth mode not allowed for resource |\n| `BadRequestError` | 400 | Malformed request |\n| `UnauthorizedError` | 401 | Missing or invalid credentials |\n| `ForbiddenError` | 403 | Insufficient permissions |\n| `NotFoundError` | 404 | Resource not found |\n| `ValidationError` | 422 | Request body validation failed |\n| `RateLimitError` | 429 | Too many requests |\n| `InternalServerError` | 500 | Server-side error |\n| `InfisicalApiError` | Other | Catch-all for other HTTP error codes |\n| `InfisicalNetworkError` | N/A | Connection failure, timeout, DNS error |\n\n## Releasing\n\nReleases are handled by the release script which automates version bumping, git tagging, GitHub releases, and npm publishing.\n\n```bash\n# Patch release (0.1.0 -> 0.1.1)\nnpm run release:patch\n\n# Minor release (0.1.0 -> 0.2.0)\nnpm run release:minor\n\n# Major release (0.1.0 -> 1.0.0)\nnpm run release:major\n```\n\nThe release script (`scripts/release.sh`) performs the following steps:\n\n1. Validates clean working tree on `master` branch\n2. Runs the full test suite\n3. Bumps the version in `package.json` and creates a git commit + tag (`vX.Y.Z`)\n4. Builds the dist output\n5. Pushes the commit and tag to `origin`\n6. Creates a GitHub release with auto-generated release notes\n7. Publishes the package to npm\n\n**Prerequisites:**\n- Authenticated with npm (`npm login`)\n- Authenticated with GitHub CLI (`gh auth login`)\n- On the `master` branch with no uncommitted changes\n\n---\n\n## API Reference\n\n### Auth Legend\n\nThe **Auth** column in the tables below uses these abbreviations:\n\n| Abbreviation | Meaning |\n|---|---|\n| **IAT** | Identity Access Token (`identityAccessToken` mode) |\n| **JWT** | User JWT (`jwt` mode) |\n| **API** | User API Key (`apiKey` mode) |\n| **ST** | Service Token (`serviceToken` mode) -- deprecated |\n| **None** | No authentication required (login endpoints) |\n\n---\n\n### MFA\n\nMulti-factor authentication management for user sessions.\n\n**Accessor:** `client.mfa`\n\n| Method | HTTP | Path | Auth | Description |\n|---|---|---|---|---|\n| `resendToken()` | POST | `/auth/mfa/send` | JWT | Resend MFA verification token |\n| `checkTotp()` | GET | `/auth/mfa/check/totp` | JWT | Check TOTP MFA status |\n| `checkWebAuthn()` | GET | `/auth/mfa/check/webauthn` | JWT | Check WebAuthn MFA status |\n| `verify(params)` | POST | `/auth/mfa/verify` | JWT | Verify MFA token |\n| `verifyRecoveryCode(params)` | POST | `/auth/mfa/verify/recovery-code` | JWT | Verify MFA recovery code |\n\n---\n\n### MFA Sessions\n\nManage MFA session verification.\n\n**Accessor:** `client.mfaSessions`\n\n| Method | HTTP | Path | Auth | Description |\n|---|---|---|---|---|\n| `verify(params)` | POST | `/api/v2/mfa-sessions/{mfaSessionId}/verify` | JWT | Verify an MFA session |\n| `getStatus(params)` | GET | `/api/v2/mfa-sessions/{mfaSessionId}/status` | JWT | Get MFA session status |\n\n---\n\n### Users\n\nManage the authenticated user's profile, API keys, sessions, and settings.\n\n**Accessor:** `client.users`\n\n| Method | HTTP | Path | Auth | Description |\n|---|---|---|---|---|\n| `getMe()` | GET | `/api/v2/users/me` | JWT | Get current user profile |\n| `deleteMe()` | DELETE | `/api/v2/users/me` | JWT | Delete current user account |\n| `updateName(params)` | PATCH | `/api/v2/users/me/name` | JWT | Update display name |\n| `updateMfa(params)` | PATCH | `/api/v2/users/me/mfa` | JWT | Update MFA settings |\n| `updateAuthMethods(params)` | PUT | `/api/v2/users/me/auth-methods` | JWT | Set allowed auth methods |\n| `updateEmail(params)` | PATCH | `/api/v2/users/me/email` | JWT | Change email address |\n| `requestEmailChangeOtp(params)` | POST | `/api/v2/users/me/email-change/otp` | JWT | Request OTP for email change |\n| `sendEmailVerificationCode(params)` | POST | `/api/v2/users/me/emails/code` | JWT | Send email verification code |\n| `verifyEmailVerificationCode(params)` | POST | `/api/v2/users/me/emails/verify` | JWT | Verify email code |\n| `listOrganizations()` | GET | `/api/v2/users/me/organizations` | JWT | List user's organizations |\n| `listApiKeys()` | GET | `/api/v2/users/me/api-keys` | JWT | List user API keys |\n| `createApiKey(params)` | POST | `/api/v2/users/me/api-keys` | JWT | Create a new API key |\n| `deleteApiKey(apiKeyDataId)` | DELETE | `/api/v2/users/me/api-keys/{apiKeyDataId}` | JWT | Delete an API key |\n| `listSessions()` | GET | `/api/v2/users/me/sessions` | JWT | List active sessions |\n| `revokeAllSessions()` | DELETE | `/api/v2/users/me/sessions` | JWT | Revoke all sessions |\n| `revokeSession(sessionId)` | DELETE | `/api/v2/users/me/sessions/{sessionId}` | JWT | Revoke a specific session |\n\n---\n\n### Password\n\nPassword reset operations.\n\n**Accessor:** `client.password`\n\n| Method | HTTP | Path | Auth | Description |\n|---|---|---|---|---|\n| `reset(params)` | POST | `/api/v2/password/password-reset` | None | Reset password (unauthenticated, via email token) |\n| `resetAuthenticated(params)` | POST | `/api/v2/password/user/password-reset` | JWT | Reset password while logged in |\n\n---\n\n### Service Tokens\n\nManage service tokens (deprecated -- use machine identities instead).\n\n**Accessor:** `client.serviceTokens`\n\n| Method | HTTP | Path | Auth | Description |\n|---|---|---|---|---|\n| `get()` | GET | `/api/v2/service-token` | JWT, ST | Get current service token details |\n| `create(params)` | POST | `/api/v2/service-token` | JWT | Create a new service token |\n| `delete(serviceTokenId)` | DELETE | `/api/v2/service-token/{serviceTokenId}` | JWT | Delete a service token |\n\n---\n\n### Organizations\n\nManage organizations, memberships, and related resources.\n\n**Accessor:** `client.organizations`\n\n| Method | HTTP | Path | Auth | Description |\n|---|---|---|---|---|\n| `create(params)` | POST | `/api/v2/organizations` | JWT, IAT | Create an organization |\n| `delete(params)` | DELETE | `/api/v2/organizations/{orgId}` | JWT, IAT | Delete an organization |\n| `upgradePrivilegeSystem()` | POST | `/api/v2/organizations/privilege-system-upgrade` | JWT, IAT | Upgrade privilege system |\n| `listMemberships(params)` | GET | `/api/v2/organizations/{orgId}/memberships` | JWT, IAT | List org members |\n| `getMembership(params)` | GET | `/api/v2/organizations/{orgId}/memberships/{membershipId}` | JWT, IAT | Get a membership |\n| `updateMembership(params)` | PATCH | `/api/v2/organizations/{orgId}/memberships/{membershipId}` | JWT, IAT | Update a membership |\n| `deleteMembership(params)` | DELETE | `/api/v2/organizations/{orgId}/memberships/{membershipId}` | JWT, IAT | Remove a member |\n| `bulkDeleteMemberships(params)` | DELETE | `/api/v2/organizations/{orgId}/memberships` | JWT, IAT | Remove multiple members |\n| `listProjectMembershipsByOrgMembership(params)` | GET | `/api/v2/organizations/{orgId}/memberships/{membershipId}/project-memberships` | JWT, IAT | List project memberships for an org member |\n| `listProjects(params)` | GET | `/api/v2/organizations/{orgId}/workspaces` | JWT, IAT | List org projects |\n\n---\n\n### Organization Identities\n\nList machine identities within an organization.\n\n**Accessor:** `client.organizationIdentities`\n\n| Method | HTTP | Path | Auth | Description |\n|---|---|---|---|---|\n| `list(params)` | GET | `/api/v2/organizations/{orgId}/identity-memberships` | JWT, IAT | List identity memberships in an org |\n\n---\n\n### Identities\n\nCRUD operations for machine identities.\n\n**Accessor:** `client.identities`\n\n| Method | HTTP | Path | Auth | Description |\n|---|---|---|---|---|\n| `create(params)` | POST | `/api/v1/identities` | JWT, IAT | Create an identity |\n| `update(params)` | PATCH | `/api/v1/identities/{identityId}` | JWT, IAT | Update an identity |\n| `delete(params)` | DELETE | `/api/v1/identities/{identityId}` | JWT, IAT | Delete an identity |\n| `get(params)` | GET | `/api/v1/identities/{identityId}` | JWT, IAT | Get identity details |\n| `listProjectMemberships(params)` | GET | `/api/v1/identities/{identityId}/identity-memberships` | JWT, IAT | List project memberships for an identity |\n| `search(params)` | GET | `/api/v1/organizations/{organizationId}/identities` | JWT, IAT | Search identities in an org |\n\n---\n\n### Identity Access Tokens\n\nRenew and revoke machine identity access tokens.\n\n**Accessor:** `client.identityAccessTokens`\n\n| Method | HTTP | Path | Auth | Description |\n|---|---|---|---|---|\n| `renew(params)` | POST | `/api/v1/auth/token/renew` | IAT | Renew an access token |\n| `revoke(params)` | POST | `/api/v1/auth/token/revoke` | IAT | Revoke an access token |\n\n---\n\n### Identity Auth\n\nAuthentication methods for machine identities. Each sub-resource follows a consistent pattern: a `login()` method that requires no authentication (it returns a token), and `attach`/`update`/`get`/`revoke` methods for managing the auth configuration on an identity.\n\nAll identity auth sub-resources are accessed via `client.identityAuth.`.\n\n#### Universal Auth\n\n**Accessor:** `client.identityAuth.universal`\n\n| Method | HTTP | Path | Auth | Description |\n|---|---|---|---|---|\n| `login(params)` | POST | `/api/v1/auth/universal-auth/login` | None | Authenticate with client ID and secret |\n| `attach(params)` | POST | `/api/v1/auth/universal-auth/identities/{identityId}` | JWT, IAT | Attach universal auth to an identity |\n| `update(params)` | PATCH | `/api/v1/auth/universal-auth/identities/{identityId}` | JWT, IAT | Update universal auth config |\n| `get(params)` | GET | `/api/v1/auth/universal-auth/identities/{identityId}` | JWT, IAT | Get universal auth config |\n| `revoke(params)` | DELETE | `/api/v1/auth/universal-auth/identities/{identityId}` | JWT, IAT | Remove universal auth from identity |\n| `createClientSecret(params)` | POST | `/api/v1/auth/universal-auth/identities/{identityId}/client-secrets` | JWT, IAT | Create a client secret |\n| `listClientSecrets(params)` | GET | `/api/v1/auth/universal-auth/identities/{identityId}/client-secrets` | JWT, IAT | List client secrets |\n| `getClientSecret(params)` | GET | `/api/v1/auth/universal-auth/identities/{identityId}/client-secrets/{clientSecretId}` | JWT, IAT | Get a client secret |\n| `revokeClientSecret(params)` | DELETE | `/api/v1/auth/universal-auth/identities/{identityId}/client-secrets/{clientSecretId}` | JWT, IAT | Revoke a client secret |\n\n**Example: Authenticate with Universal Auth**\n\n```typescript\nimport { InfisicalClient } from \"@azerothian/infisical\";\n\nconst client = new InfisicalClient();\n\n// login() calls POST /api/v1/auth/universal-auth/login, stores the token,\n// and sets up auto-renewal.\nconst response = await client.login({\n universalAuth: {\n clientId: \"YOUR_CLIENT_ID\",\n clientSecret: \"YOUR_CLIENT_SECRET\",\n },\n});\n\nconsole.log(\"Authenticated, token expires in\", response.expiresIn, \"seconds\");\n\n// All subsequent calls use the stored token automatically.\nconst folders = await client.secretFolders.list({\n projectId: \"project-id\",\n environment: \"production\",\n path: \"/\",\n});\n```\n\n#### Token Auth\n\n**Accessor:** `client.identityAuth.token`\n\n| Method | HTTP | Path | Auth | Description |\n|---|---|---|---|---|\n| `login(params)` | POST | `/api/v1/auth/token/login` | None | Authenticate with a token |\n| `attach(params)` | POST | `/api/v1/auth/token/identities/{identityId}` | JWT, IAT | Attach token auth |\n| `update(params)` | PATCH | `/api/v1/auth/token/identities/{identityId}` | JWT, IAT | Update token auth config |\n| `get(params)` | GET | `/api/v1/auth/token/identities/{identityId}` | JWT, IAT | Get token auth config |\n| `revoke(params)` | DELETE | `/api/v1/auth/token/identities/{identityId}` | JWT, IAT | Remove token auth |\n| `createToken(params)` | POST | `/api/v1/auth/token/identities/{identityId}/tokens` | JWT, IAT | Create a token |\n| `listTokens(params)` | GET | `/api/v1/auth/token/identities/{identityId}/tokens` | JWT, IAT | List tokens |\n| `getToken(params)` | GET | `/api/v1/auth/token/identities/{identityId}/tokens/{tokenId}` | JWT, IAT | Get a token |\n| `updateToken(params)` | PATCH | `/api/v1/auth/token/identities/{identityId}/tokens/{tokenId}` | JWT, IAT | Update a token |\n| `revokeToken(params)` | DELETE | `/api/v1/auth/token/identities/{identityId}/tokens/{tokenId}` | JWT, IAT | Revoke a token |\n\n#### AWS Auth\n\n**Accessor:** `client.identityAuth.aws`\n\n| Method | HTTP | Path | Auth | Description |\n|---|---|---|---|---|\n| `login(params)` | POST | `/api/v1/auth/aws-auth/login` | None | Authenticate via AWS IAM |\n| `attach(params)` | POST | `/api/v1/auth/aws-auth/identities/{identityId}` | JWT, IAT | Attach AWS auth |\n| `update(params)` | PATCH | `/api/v1/auth/aws-auth/identities/{identityId}` | JWT, IAT | Update AWS auth config |\n| `get(params)` | GET | `/api/v1/auth/aws-auth/identities/{identityId}` | JWT, IAT | Get AWS auth config |\n| `revoke(params)` | DELETE | `/api/v1/auth/aws-auth/identities/{identityId}` | JWT, IAT | Remove AWS auth |\n\n#### GCP Auth\n\n**Accessor:** `client.identityAuth.gcp`\n\n| Method | HTTP | Path | Auth | Description |\n|---|---|---|---|---|\n| `login(params)` | POST | `/api/v1/auth/gcp-auth/login` | None | Authenticate via GCP |\n| `attach(params)` | POST | `/api/v1/auth/gcp-auth/identities/{identityId}` | JWT, IAT | Attach GCP auth |\n| `update(params)` | PATCH | `/api/v1/auth/gcp-auth/identities/{identityId}` | JWT, IAT | Update GCP auth config |\n| `get(params)` | GET | `/api/v1/auth/gcp-auth/identities/{identityId}` | JWT, IAT | Get GCP auth config |\n| `revoke(params)` | DELETE | `/api/v1/auth/gcp-auth/identities/{identityId}` | JWT, IAT | Remove GCP auth |\n\n#### Azure Auth\n\n**Accessor:** `client.identityAuth.azure`\n\n| Method | HTTP | Path | Auth | Description |\n|---|---|---|---|---|\n| `login(params)` | POST | `/api/v1/auth/azure-auth/login` | None | Authenticate via Azure AD |\n| `attach(params)` | POST | `/api/v1/auth/azure-auth/identities/{identityId}` | JWT, IAT | Attach Azure auth |\n| `update(params)` | PATCH | `/api/v1/auth/azure-auth/identities/{identityId}` | JWT, IAT | Update Azure auth config |\n| `get(params)` | GET | `/api/v1/auth/azure-auth/identities/{identityId}` | JWT, IAT | Get Azure auth config |\n| `revoke(params)` | DELETE | `/api/v1/auth/azure-auth/identities/{identityId}` | JWT, IAT | Remove Azure auth |\n\n#### Kubernetes Auth\n\n**Accessor:** `client.identityAuth.kubernetes`\n\n| Method | HTTP | Path | Auth | Description |\n|---|---|---|---|---|\n| `login(params)` | POST | `/api/v1/auth/kubernetes-auth/login` | None | Authenticate via Kubernetes SA token |\n| `attach(params)` | POST | `/api/v1/auth/kubernetes-auth/identities/{identityId}` | JWT, IAT | Attach Kubernetes auth |\n| `update(params)` | PATCH | `/api/v1/auth/kubernetes-auth/identities/{identityId}` | JWT, IAT | Update Kubernetes auth config |\n| `get(params)` | GET | `/api/v1/auth/kubernetes-auth/identities/{identityId}` | JWT, IAT | Get Kubernetes auth config |\n| `revoke(params)` | DELETE | `/api/v1/auth/kubernetes-auth/identities/{identityId}` | JWT, IAT | Remove Kubernetes auth |\n\n#### OIDC Auth\n\n**Accessor:** `client.identityAuth.oidc`\n\n| Method | HTTP | Path | Auth | Description |\n|---|---|---|---|---|\n| `login(params)` | POST | `/api/v1/auth/oidc-auth/login` | None | Authenticate via OIDC provider |\n| `attach(params)` | POST | `/api/v1/auth/oidc-auth/identities/{identityId}` | JWT, IAT | Attach OIDC auth |\n| `update(params)` | PATCH | `/api/v1/auth/oidc-auth/identities/{identityId}` | JWT, IAT | Update OIDC auth config |\n| `get(params)` | GET | `/api/v1/auth/oidc-auth/identities/{identityId}` | JWT, IAT | Get OIDC auth config |\n| `revoke(params)` | DELETE | `/api/v1/auth/oidc-auth/identities/{identityId}` | JWT, IAT | Remove OIDC auth |\n\n#### JWT Auth\n\n**Accessor:** `client.identityAuth.jwt`\n\n| Method | HTTP | Path | Auth | Description |\n|---|---|---|---|---|\n| `login(params)` | POST | `/api/v1/auth/jwt-auth/login` | None | Authenticate via external JWT |\n| `attach(params)` | POST | `/api/v1/auth/jwt-auth/identities/{identityId}` | JWT, IAT | Attach JWT auth |\n| `update(params)` | PATCH | `/api/v1/auth/jwt-auth/identities/{identityId}` | JWT, IAT | Update JWT auth config |\n| `get(params)` | GET | `/api/v1/auth/jwt-auth/identities/{identityId}` | JWT, IAT | Get JWT auth config |\n| `revoke(params)` | DELETE | `/api/v1/auth/jwt-auth/identities/{identityId}` | JWT, IAT | Remove JWT auth |\n\n#### LDAP Auth\n\n**Accessor:** `client.identityAuth.ldap`\n\n| Method | HTTP | Path | Auth | Description |\n|---|---|---|---|---|\n| `login(params)` | POST | `/api/v1/auth/ldap-auth/login` | None | Authenticate via LDAP |\n| `attach(params)` | POST | `/api/v1/auth/ldap-auth/identities/{identityId}` | JWT, IAT | Attach LDAP auth |\n| `update(params)` | PATCH | `/api/v1/auth/ldap-auth/identities/{identityId}` | JWT, IAT | Update LDAP auth config |\n| `get(params)` | GET | `/api/v1/auth/ldap-auth/identities/{identityId}` | JWT, IAT | Get LDAP auth config |\n| `revoke(params)` | DELETE | `/api/v1/auth/ldap-auth/identities/{identityId}` | JWT, IAT | Remove LDAP auth |\n\n#### TLS Certificate Auth\n\n**Accessor:** `client.identityAuth.tlsCert`\n\n| Method | HTTP | Path | Auth | Description |\n|---|---|---|---|---|\n| `login(params)` | POST | `/api/v1/auth/tls-cert-auth/login` | None | Authenticate via TLS client certificate |\n| `attach(params)` | POST | `/api/v1/auth/tls-cert-auth/identities/{identityId}` | JWT, IAT | Attach TLS cert auth |\n| `update(params)` | PATCH | `/api/v1/auth/tls-cert-auth/identities/{identityId}` | JWT, IAT | Update TLS cert auth config |\n| `get(params)` | GET | `/api/v1/auth/tls-cert-auth/identities/{identityId}` | JWT, IAT | Get TLS cert auth config |\n| `revoke(params)` | DELETE | `/api/v1/auth/tls-cert-auth/identities/{identityId}` | JWT, IAT | Remove TLS cert auth |\n\n#### OCI Auth\n\n**Accessor:** `client.identityAuth.oci`\n\n| Method | HTTP | Path | Auth | Description |\n|---|---|---|---|---|\n| `login(params)` | POST | `/api/v1/auth/oci-auth/login` | None | Authenticate via Oracle Cloud Infrastructure |\n| `attach(params)` | POST | `/api/v1/auth/oci-auth/identities/{identityId}` | JWT, IAT | Attach OCI auth |\n| `update(params)` | PATCH | `/api/v1/auth/oci-auth/identities/{identityId}` | JWT, IAT | Update OCI auth config |\n| `get(params)` | GET | `/api/v1/auth/oci-auth/identities/{identityId}` | JWT, IAT | Get OCI auth config |\n| `revoke(params)` | DELETE | `/api/v1/auth/oci-auth/identities/{identityId}` | JWT, IAT | Remove OCI auth |\n\n#### AliCloud Auth\n\n**Accessor:** `client.identityAuth.alicloud`\n\n| Method | HTTP | Path | Auth | Description |\n|---|---|---|---|---|\n| `login(params)` | POST | `/api/v1/auth/alicloud-auth/login` | None | Authenticate via Alibaba Cloud |\n| `attach(params)` | POST | `/api/v1/auth/alicloud-auth/identities/{identityId}` | JWT, IAT | Attach AliCloud auth |\n| `update(params)` | PATCH | `/api/v1/auth/alicloud-auth/identities/{identityId}` | JWT, IAT | Update AliCloud auth config |\n| `get(params)` | GET | `/api/v1/auth/alicloud-auth/identities/{identityId}` | JWT, IAT | Get AliCloud auth config |\n| `revoke(params)` | DELETE | `/api/v1/auth/alicloud-auth/identities/{identityId}` | JWT, IAT | Remove AliCloud auth |\n\n---\n\n### Projects\n\nManage projects (workspaces), their environments, roles, tags, and trusted IPs.\n\n**Accessor:** `client.projects`\n\n| Method | HTTP | Path | Auth | Description |\n|---|---|---|---|---|\n| `get(params)` | GET | `/api/v1/workspace/{projectId}` | JWT, IAT | Get project details |\n| `update(params)` | PATCH | `/api/v1/workspace/{projectId}` | JWT, IAT | Update project settings |\n| `delete(params)` | DELETE | `/api/v1/workspace/{projectId}` | JWT, IAT | Delete a project |\n| `listMemberships(params)` | GET | `/api/v1/workspace/{projectId}/memberships` | JWT, IAT | List project members |\n| `listEnvironments(params)` | GET | `/api/v1/workspace/{projectId}/environments` | JWT, IAT | List environments |\n| `createEnvironment(params)` | POST | `/api/v1/workspace/{projectId}/environments` | JWT, IAT | Create an environment |\n| `updateEnvironment(params)` | PATCH | `/api/v1/workspace/{projectId}/environments/{environmentId}` | JWT, IAT | Update an environment |\n| `deleteEnvironment(params)` | DELETE | `/api/v1/workspace/{projectId}/environments/{environmentId}` | JWT, IAT | Delete an environment |\n| `listRoles(params)` | GET | `/api/v1/workspace/{projectId}/roles` | JWT, IAT | List project roles |\n| `listTags(params)` | GET | `/api/v1/workspace/{projectId}/tags` | JWT, IAT | List project tags |\n\n---\n\n### Secrets\n\nManage secrets within project environments.\n\n**Accessor:** `client.secrets`\n\n| Method | HTTP | Path | Auth | Description |\n|---|---|---|---|---|\n| `list(params)` | GET | `/api/v4/secrets` | JWT, IAT, ST | List secrets in an environment |\n| `getByName(params)` | GET | `/api/v4/secrets/{secretName}` | JWT, IAT, ST | Get a secret by name |\n| `getById(params)` | GET | `/api/v4/secrets/id/{secretId}` | JWT, IAT, ST | Get a secret by ID |\n| `create(params)` | POST | `/api/v4/secrets/{secretName}` | JWT, IAT, ST | Create a secret |\n| `update(params)` | PATCH | `/api/v4/secrets/{secretName}` | JWT, IAT, ST | Update a secret |\n| `delete(params)` | DELETE | `/api/v4/secrets/{secretName}` | JWT, IAT, ST | Delete a secret |\n| `batchCreate(params)` | POST | `/api/v4/secrets/batch` | JWT, IAT, ST | Batch create secrets |\n| `batchUpdate(params)` | PATCH | `/api/v4/secrets/batch` | JWT, IAT, ST | Batch update secrets |\n| `batchDelete(params)` | DELETE | `/api/v4/secrets/batch` | JWT, IAT, ST | Batch delete secrets |\n| `move(params)` | POST | `/api/v4/secrets/move` | JWT, IAT, ST | Move secrets between paths |\n| `getAccessList(params)` | GET | `/api/v1/secrets/{secretName}/access-list` | JWT, IAT, ST | Get access list for a secret |\n\n---\n\n### Secret Folders\n\nManage folders within project environments for organizing secrets.\n\n**Accessor:** `client.secretFolders`\n\n| Method | HTTP | Path | Auth | Description |\n|---|---|---|---|---|\n| `create(params)` | POST | `/api/v2/folders` | JWT, IAT | Create a folder |\n| `update(params)` | PATCH | `/api/v2/folders/{folderId}` | JWT, IAT | Update a folder |\n| `updateBatch(params)` | PATCH | `/api/v2/folders/batch` | JWT, IAT | Batch update folders |\n| `delete(params)` | DELETE | `/api/v2/folders/{folderIdOrName}` | JWT, IAT | Delete a folder |\n| `list(params)` | GET | `/api/v2/folders` | JWT, IAT | List folders |\n| `getById(params)` | GET | `/api/v2/folders/{id}` | JWT, IAT | Get a folder by ID |\n\n**Example: Create and list folders**\n\n```typescript\n// Create a folder\nawait client.secretFolders.create({\n projectId: \"project-id\",\n environment: \"production\",\n path: \"/\",\n name: \"database-secrets\",\n});\n\n// List folders\nconst folders = await client.secretFolders.list({\n projectId: \"project-id\",\n environment: \"production\",\n path: \"/\",\n});\n```\n\n---\n\n### Secret Imports\n\nImport secrets from one environment/path into another.\n\n**Accessor:** `client.secretImports`\n\n| Method | HTTP | Path | Auth | Description |\n|---|---|---|---|---|\n| `create(params)` | POST | `/api/v2/secret-imports` | JWT, IAT | Create a secret import |\n| `update(params)` | PATCH | `/api/v2/secret-imports/{secretImportId}` | JWT, IAT | Update a secret import |\n| `delete(params)` | DELETE | `/api/v2/secret-imports/{secretImportId}` | JWT, IAT | Delete a secret import |\n| `resyncReplication(params)` | POST | `/api/v2/secret-imports/{secretImportId}/replication-resync` | JWT, IAT | Resync replicated import |\n| `list(params)` | GET | `/api/v2/secret-imports` | JWT, IAT | List secret imports |\n| `get(params)` | GET | `/api/v2/secret-imports/{secretImportId}` | JWT, IAT | Get a secret import |\n| `getRawSecrets(params)` | GET | `/api/v2/secret-imports/secrets` | JWT, IAT | Get raw imported secrets |\n\n---\n\n### Secret Sharing\n\nCreate and manage shared secrets with expiration and access controls.\n\n**Accessor:** `client.secretSharing`\n\n| Method | HTTP | Path | Auth | Description |\n|---|---|---|---|---|\n| `create(params)` | POST | `/api/v1/secret-sharing` | JWT, IAT | Create a shared secret |\n| `delete(params)` | DELETE | `/api/v1/secret-sharing/{sharedSecretId}` | JWT, IAT | Delete a shared secret |\n| `list()` | GET | `/api/v1/secret-sharing` | JWT, IAT | List shared secrets |\n| `get(params)` | GET | `/api/v1/secret-sharing/{sharedSecretId}` | Mixed | Get a shared secret (public access may be allowed) |\n\n---\n\n### Secret Syncs\n\nSynchronize secrets to external destinations (AWS Parameter Store, Vercel, GitHub, etc.).\n\n**Accessor:** `client.secretSyncs`\n\n| Method | HTTP | Path | Auth | Description |\n|---|---|---|---|---|\n| `create(params)` | POST | `/api/v1/secret-syncs/{destination}` | JWT, IAT | Create a sync |\n| `update(params)` | PATCH | `/api/v1/secret-syncs/{destination}/{syncId}` | JWT, IAT | Update a sync |\n| `delete(params)` | DELETE | `/api/v1/secret-syncs/{destination}/{syncId}` | JWT, IAT | Delete a sync |\n| `get(params)` | GET | `/api/v1/secret-syncs/{destination}/{syncId}` | JWT, IAT | Get sync details |\n| `list(params)` | GET | `/api/v1/secret-syncs/{destination}` | JWT, IAT | List syncs for a destination |\n| `trigger(params)` | POST | `/api/v1/secret-syncs/{destination}/{syncId}/sync` | JWT, IAT | Trigger a sync manually |\n\n---\n\n### Webhooks\n\nManage project webhooks for secret change notifications.\n\n**Accessor:** `client.webhooks`\n\n| Method | HTTP | Path | Auth | Description |\n|---|---|---|---|---|\n| `create(params)` | POST | `/api/v1/webhooks` | JWT, IAT | Create a webhook |\n| `update(params)` | PATCH | `/api/v1/webhooks/{webhookId}` | JWT, IAT | Update a webhook |\n| `delete(params)` | DELETE | `/api/v1/webhooks/{webhookId}` | JWT, IAT | Delete a webhook |\n| `list(params)` | GET | `/api/v1/webhooks` | JWT, IAT | List webhooks |\n| `test(params)` | POST | `/api/v1/webhooks/{webhookId}/test` | JWT, IAT | Send a test webhook |\n\n---\n\n### PKI Certificate Authorities\n\nList PKI certificate authorities.\n\n**Accessor:** `client.pki.ca`\n\n| Method | HTTP | Path | Auth | Description |\n|---|---|---|---|---|\n| `list(params)` | GET | `/api/v2/pki/ca` | JWT, IAT | List certificate authorities |\n\n---\n\n### PKI Certificate Templates\n\nManage certificate templates for issuing and signing certificates.\n\n**Accessor:** `client.pki.templates`\n\n| Method | HTTP | Path | Auth | Description |\n|---|---|---|---|---|\n| `create(params)` | POST | `/api/v2/pki/certificate-templates` | JWT, IAT | Create a certificate template |\n| `update(params)` | PATCH | `/api/v2/pki/certificate-templates/{templateName}` | JWT, IAT | Update a template |\n| `delete(params)` | DELETE | `/api/v2/pki/certificate-templates/{templateName}` | JWT, IAT | Delete a template |\n| `get(params)` | GET | `/api/v2/pki/certificate-templates/{templateName}` | JWT, IAT | Get a template |\n| `list(params)` | GET | `/api/v2/pki/certificate-templates` | JWT, IAT | List templates |\n| `issueCertificate(params)` | POST | `/api/v2/pki/certificate-templates/{templateName}/issue-certificate` | JWT, IAT | Issue a certificate |\n| `signCertificate(params)` | POST | `/api/v2/pki/certificate-templates/{templateName}/sign-certificate` | JWT, IAT | Sign a CSR |\n\n---\n\n### PKI Alerts\n\nManage PKI certificate expiration alerts.\n\n**Accessor:** `client.pki.alerts`\n\n| Method | HTTP | Path | Auth | Description |\n|---|---|---|---|---|\n| `create(params)` | POST | `/api/v2/pki/alerts` | JWT, IAT | Create an alert |\n| `list(params)` | GET | `/api/v2/pki/alerts` | JWT, IAT | List alerts |\n| `get(params)` | GET | `/api/v2/pki/alerts/{alertId}` | JWT, IAT | Get an alert |\n| `update(params)` | PATCH | `/api/v2/pki/alerts/{alertId}` | JWT, IAT | Update an alert |\n| `delete(params)` | DELETE | `/api/v2/pki/alerts/{alertId}` | JWT, IAT | Delete an alert |\n| `listCertificates(params)` | GET | `/api/v2/pki/alerts/{alertId}/certificates` | JWT, IAT | List certificates for an alert |\n| `previewCertificates(params)` | POST | `/api/v2/pki/alerts/preview/certificates` | JWT, IAT | Preview certificates matching alert criteria |\n\n---\n\n### PKI Certificates\n\nManage PKI certificates: create, retrieve, renew, revoke, and configure.\n\n**Accessor:** `client.pki.certificates`\n\n| Method | HTTP | Path | Auth | Description |\n|---|---|---|---|---|\n| `create(params)` | POST | `/api/v1/pki/certificates` | JWT, IAT | Create a certificate |\n| `get(params)` | GET | `/api/v1/pki/certificates/{certificateId}` | JWT, IAT | Get certificate details |\n| `getBody(params)` | GET | `/api/v1/pki/certificates/{certificateId}/certificate` | JWT, IAT | Get certificate body (PEM) |\n| `getBundle(params)` | GET | `/api/v1/pki/certificates/{certificateId}/bundle` | JWT, IAT | Get certificate bundle |\n| `getPrivateKey(params)` | GET | `/api/v1/pki/certificates/{certificateId}/private-key` | JWT, IAT | Get certificate private key |\n| `renew(params)` | POST | `/api/v1/pki/certificates/{certificateId}/renew` | JWT, IAT | Renew a certificate |\n| `revoke(params)` | POST | `/api/v1/pki/certificates/{certificateId}/revoke` | JWT, IAT | Revoke a certificate |\n| `delete(params)` | DELETE | `/api/v1/pki/certificates/{certificateId}` | JWT, IAT | Delete a certificate |\n| `updateConfig(params)` | PATCH | `/api/v1/pki/certificates/{certificateId}/config` | JWT, IAT | Update certificate config |\n\n---\n\n### KMS\n\nKey Management Service for encrypting and decrypting data with managed keys.\n\n**Accessor:** `client.kms`\n\n| Method | HTTP | Path | Auth | Description |\n|---|---|---|---|---|\n| `createKey(params)` | POST | `/api/v1/kms/keys` | JWT, IAT | Create an encryption key |\n| `updateKey(params)` | PATCH | `/api/v1/kms/keys/{keyId}` | JWT, IAT | Update key metadata |\n| `deleteKey(params)` | DELETE | `/api/v1/kms/keys/{keyId}` | JWT, IAT | Delete a key |\n| `getKey(params)` | GET | `/api/v1/kms/keys/{keyId}` | JWT, IAT | Get key details |\n| `listKeys(params)` | GET | `/api/v1/kms/keys` | JWT, IAT | List keys |\n| `encrypt(params)` | POST | `/api/v1/kms/keys/{keyId}/encrypt` | JWT, IAT | Encrypt data |\n| `decrypt(params)` | POST | `/api/v1/kms/keys/{keyId}/decrypt` | JWT, IAT | Decrypt data |\n\n**Example: Encrypt and decrypt data**\n\n```typescript\n// Create a key\nconst key = await client.kms.createKey({\n projectId: \"project-id\",\n name: \"my-encryption-key\",\n});\n\n// Encrypt\nconst encrypted = await client.kms.encrypt({\n keyId: key.id,\n plaintext: \"sensitive-data\",\n});\n\n// Decrypt\nconst decrypted = await client.kms.decrypt({\n keyId: key.id,\n ciphertext: encrypted.ciphertext,\n});\n```\n\n---\n\n### Integration Auth\n\nManage authentication credentials for third-party integrations.\n\n**Accessor:** `client.integrationAuth`\n\n| Method | HTTP | Path | Auth | Description |\n|---|---|---|---|---|\n| `create(params)` | POST | `/api/v1/integration-auth/access-token` | JWT, IAT | Create integration auth with access token |\n| `get(params)` | GET | `/api/v1/integration-auth/{integrationAuthId}` | JWT, IAT | Get integration auth details |\n| `delete(params)` | DELETE | `/api/v1/integration-auth/{integrationAuthId}` | JWT, IAT | Delete integration auth |\n| `list(params)` | GET | `/api/v1/integration-auth` | JWT, IAT | List integration auths |\n\n---\n\n### App Connections\n\nManage connections to external applications.\n\n**Accessor:** `client.appConnections`\n\n| Method | HTTP | Path | Auth | Description |\n|---|---|---|---|---|\n| `create(params)` | POST | `/api/v1/app-connections/{app}` | JWT, IAT | Create a connection |\n| `update(params)` | PATCH | `/api/v1/app-connections/{app}/{connectionId}` | JWT, IAT | Update a connection |\n| `delete(params)` | DELETE | `/api/v1/app-connections/{app}/{connectionId}` | JWT, IAT | Delete a connection |\n| `get(params)` | GET | `/api/v1/app-connections/{app}/{connectionId}` | JWT, IAT | Get connection details |\n| `list(params)` | GET | `/api/v1/app-connections/{app}` | JWT, IAT | List connections for an app |\n\n---\n\n### Admin\n\nSuper admin endpoints for managing the Infisical instance: configuration, user management, organization management, identity management, integrations, encryption, cache, and usage reports.\n\n**Accessor:** `client.admin`\n\n| Method | HTTP | Path | Auth | Description |\n|---|---|---|---|---|\n| `bootstrap(params)` | POST | `/api/v1/admin/bootstrap` | None | Bootstrap a new Infisical instance |\n| `signup(params)` | POST | `/api/v1/admin/signup` | None | Admin sign up |\n| `getConfig()` | GET | `/api/v1/admin/config` | None | Get server configuration |\n| `updateConfig(params)` | PATCH | `/api/v1/admin/config` | JWT, IAT | Update server configuration |\n| `listUsers(params?)` | GET | `/api/v1/admin/user-management/users` | JWT, IAT | List all users |\n| `deleteUser(params)` | DELETE | `/api/v1/admin/user-management/users/{userId}` | JWT, IAT | Delete a user |\n| `deleteUsers(params)` | DELETE | `/api/v1/admin/user-management/users` | JWT, IAT | Bulk delete users |\n| `grantAdminAccess(params)` | PATCH | `/api/v1/admin/user-management/users/{userId}/admin-access` | JWT, IAT | Grant super admin access to a user |\n| `revokeAdminAccess(params)` | DELETE | `/api/v1/admin/user-management/users/{userId}/admin-access` | JWT, IAT | Revoke super admin access from a user |\n| `listOrganizations(params?)` | GET | `/api/v1/admin/organization-management/organizations` | JWT, IAT | List all organizations |\n| `createOrganization(params)` | POST | `/api/v1/admin/organization-management/organizations` | JWT, IAT | Create an organization |\n| `deleteOrganization(params)` | DELETE | `/api/v1/admin/organization-management/organizations/{organizationId}` | JWT, IAT | Delete an organization |\n| `deleteOrgMembership(params)` | DELETE | `/api/v1/admin/organization-management/organizations/{organizationId}/memberships/{membershipId}` | JWT, IAT | Remove a member from an organization |\n| `resendOrgInvite(params)` | POST | `/api/v1/admin/organization-management/organizations/{organizationId}/memberships/{membershipId}/resend-invite` | JWT, IAT | Resend an organization invite |\n| `joinOrganization(params)` | POST | `/api/v1/admin/organization-management/organizations/{organizationId}/access` | JWT | Join an organization as admin |\n| `listIdentities(params?)` | GET | `/api/v1/admin/identity-management/identities` | JWT, IAT | List all identities |\n| `revokeIdentitySuperAdmin(params)` | DELETE | `/api/v1/admin/identity-management/identities/{identityId}/super-admin-access` | JWT, IAT | Revoke super admin access from an identity |\n| `getIntegrations()` | GET | `/api/v1/admin/integrations` | JWT, IAT | Get admin integrations (Slack, Teams, GitHub) |\n| `getEncryptionStrategies()` | GET | `/api/v1/admin/encryption-strategies` | JWT, IAT | List encryption strategies |\n| `updateEncryptionStrategy(params)` | PATCH | `/api/v1/admin/encryption-strategies` | JWT, IAT | Update encryption strategy |\n| `getEnvOverrides()` | GET | `/api/v1/admin/env-overrides` | JWT, IAT | Get environment variable overrides |\n| `invalidateCache(params)` | POST | `/api/v1/admin/invalidate-cache` | JWT, IAT | Invalidate server cache |\n| `getCacheStatus()` | GET | `/api/v1/admin/invalidating-cache-status` | JWT, IAT | Get cache invalidation status |\n| `generateUsageReport()` | POST | `/api/v1/admin/usage-report/generate` | JWT, IAT | Generate a usage report (CSV) |\n\n---\n\n### Org Admin\n\nOrganization admin endpoints for managing projects across the organization.\n\n**Accessor:** `client.orgAdmin`\n\n| Method | HTTP | Path | Auth | Description |\n|---|---|---|---|---|\n| `listProjects(params?)` | GET | `/api/v1/org-admin/projects` | JWT, IAT | List all projects in the organization |\n| `grantProjectAccess(params)` | POST | `/api/v1/org-admin/projects/{projectId}/grant-admin-access` | JWT | Grant admin access to a project |\n\n---\n\n## License\n\nMIT\n","readmeFilename":"README.md","_rev":"1-dc655d773829f3b2fbf8cefd219404c6"}