<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Performing Machine Identity Management

## Secrets Management

### HashiCorp Vault API

| Endpoint | Method | Description |
|----------|--------|-------------|
| `/v1/secret/data/{path}` | GET | Read secret |
| `/v1/secret/data/{path}` | POST | Create/update secret |
| `/v1/sys/leases/lookup` | POST | Look up lease info |
| `/v1/sys/leases/revoke` | POST | Revoke lease |
| `/v1/pki/issue/{role}` | POST | Issue certificate |
| `/v1/pki/crl` | GET | Get certificate revocation list |

### AWS Secrets Manager

| API | Description |
|-----|-------------|
| `GetSecretValue` | Retrieve secret |
| `RotateSecret` | Trigger rotation |
| `ListSecrets` | List all secrets |
| `DescribeSecret` | Get secret metadata with rotation status |

## Certificate Management

### ACME Protocol (Let's Encrypt)

| Endpoint | Method | Description |
|----------|--------|-------------|
| `/directory` | GET | ACME server metadata |
| `/acme/new-order` | POST | Request certificate |
| `/acme/finalize` | POST | Submit CSR for signing |
| `/acme/cert` | POST | Download certificate |

### Certificate Transparency

| Log | URL | Purpose |
|-----|-----|---------|
| Google Argon | ct.googleapis.com/logs/argon2024 | CT log monitoring |
| Cloudflare Nimbus | ct.cloudflare.com/logs/nimbus2024 | CT log monitoring |
| crt.sh | crt.sh/?q=%.example.com | Certificate search |

## SPIFFE/SPIRE

### SPIRE Server API

| RPC | Description |
|-----|-------------|
| `BatchCreateEntry` | Register workload identities |
| `ListEntries` | List registered workloads |
| `GetBundle` | Get trust bundle |
| `MintX509SVID` | Issue X.509 SVID |
| `MintJWTSVID` | Issue JWT SVID |

### Workload API (Unix Socket)

| RPC | Description |
|-----|-------------|
| `FetchX509SVID` | Get X.509 identity document |
| `FetchJWTSVID` | Get JWT identity document |
| `FetchX509Bundles` | Get trust bundles |
| `ValidateJWTSVID` | Validate JWT token |
