ii. Configuration

Additional configuration for Policy Gate

Configuration (POST /config)

The policies field accepts a list of Vault/OpenBao Policies, that will be assigned to the claimed Vault/OpenBao token.

Request

curl --header "X-Vault-Token: <admin-token>" \
    --request POST \
    http://127.0.0.1:8200/v1/auth/plugin/config \
    --data @payload.json

Payload

{
    [...] // fields already documented in 'HTTP API Reference' page
    "policies": ["db-admin", "aws-admin", "ci-secrets-writeonly"]
}

The db-admin, aws-admin and ci-secrets-writeonly are Policy names existing in the Vault/OpenBao instance.

This configuration will allow auth/plugin/claim endpoint to issue a Vault/OpenBao token with these policies assigned and bound to the Entity thaat issued the Access Request.