Conjur API

by conjur.local

API keyHTTPSSecurity

Overview

This is an API definition for CyberArk Conjur Open Source. You can find out more at [Conjur.org](https://www.conjur.org/).

Conjur is a security API from conjur.local. Requests are authenticated with an API key. It is served over HTTPS. Its OpenAPI description documents 41 endpoints.

At a glance

Authentication: API key
HTTPS: Yes
CORS: Unknown
Category: Security
Base URL: http://conjur.local
Version: 5.3.0
Endpoints: 41
OpenAPI: Specification ↗
Spec updated: 2023-03-06

Make a first request

Replace the placeholders; the documentation says exactly where credentials go.

cURL

curl -X GET "http://conjur.local/authenticators" \
  -H "Accept: application/json" \
  -H "X-API-Key: YOUR_API_KEY"

JavaScript

const response = await fetch("http://conjur.local/authenticators", {
  method: "GET",
  headers: {
    "Accept": "application/json",
    "X-API-Key": "YOUR_API_KEY",
  },
});
const data = await response.json();
console.log(data);

Python

import requests

response = requests.request(
    "GET",
    "http://conjur.local/authenticators",
    headers={
    "Accept": "application/json",
    "X-API-Key": "YOUR_API_KEY",
    },
    timeout=30,
)
print(response.json())

Endpoints

Method	Path	What it does
GET	`/authenticators`	Details about which authenticators are on the Conjur Server
POST	`/authn-azure/{service_id}/{account}/{login}/authenticate`	Gets a short-lived access token for applications running in Azure.
POST	`/authn-gcp/{account}/authenticate`	Gets a short-lived access token for applications running in Google Cloud Platform.
GET	`/authn-gcp/{account}/status`	Details whether an authentication service has been configured properly
POST	`/authn-iam/{service_id}/{account}/{login}/authenticate`	Get a short-lived access token for applications running in AWS.
POST	`/authn-jwt/{service_id}/{account}/authenticate`	Gets a short-lived access token for applications using JSON Web Token (JWT) to access the Conjur API.
POST	`/authn-jwt/{service_id}/{account}/{id}/authenticate`	Gets a short-lived access token for applications using JSON Web Token (JWT) to access the Conjur API. Covers the case of use of optional URL parameter "ID"
POST	`/authn-k8s/{service_id}/inject_client_cert`	For applications running in Kubernetes; sends Conjur a certificate signing request (CSR) and requests a client certificate injected into the application's Kuber
POST	`/authn-k8s/{service_id}/{account}/{login}/authenticate`	Gets a short-lived access token for applications running in Kubernetes.
GET	`/authn-ldap/{service_id}/{account}/login`	Gets the Conjur API key of a user given the LDAP username and password via HTTP Basic Authentication.
POST	`/authn-ldap/{service_id}/{account}/{login}/authenticate`	Gets a short-lived access token for users and hosts using their LDAP identity to access the Conjur API.
POST	`/authn-oidc/{service_id}/{account}/authenticate`	Gets a short-lived access token for applications using OpenID Connect (OIDC) to access the Conjur API.
PUT	`/authn/{account}/api_key`	Rotates a role's API key.
GET	`/authn/{account}/login`	Gets the API key of a user given the username and password via HTTP Basic Authentication.
PUT	`/authn/{account}/password`	Changes a user’s password.
POST	`/authn/{account}/{login}/authenticate`	Gets a short-lived access token, which is required in the header of most subsequent API requests.
POST	`/ca/{account}/{service_id}/sign`	Gets a signed certificate from the configured Certificate Authority service.
GET	`/health`	Health info about conjur
POST	`/host_factories/hosts`	Creates a Host using the Host Factory.
POST	`/host_factory_tokens`	Creates one or more host identity tokens.
DELETE	`/host_factory_tokens/{token}`	Revokes a token, immediately disabling it.
GET	`/info`	Basic information about the Conjur Enterprise server
POST	`/policies/{account}/policy/{identifier}`	Adds data to the existing Conjur policy.
PUT	`/policies/{account}/policy/{identifier}`	Loads or replaces a Conjur policy document.
PATCH	`/policies/{account}/policy/{identifier}`	Modifies an existing Conjur policy.
GET	`/public_keys/{account}/{kind}/{identifier}`	Shows all public keys for a resource.
GET	`/remote_health/{remote}`	Health info about a given Conjur Enterprise server
GET	`/resources`	Lists resources within an organization account.
GET	`/resources/{account}`	Lists resources within an organization account.
GET	`/resources/{account}/{kind}`	Lists resources of the same kind within an organization account.
GET	`/resources/{account}/{kind}/{identifier}`	Shows a description of a single resource.
GET	`/roles/{account}/{kind}/{identifier}`	Get role information
POST	`/roles/{account}/{kind}/{identifier}`	Update or modify an existing role membership
DELETE	`/roles/{account}/{kind}/{identifier}`	Deletes an existing role membership
GET	`/secrets`	Fetch multiple secrets
GET	`/secrets/{account}/{kind}/{identifier}`	Fetches the value of a secret from the specified Secret.
POST	`/secrets/{account}/{kind}/{identifier}`	Creates a secret value within the specified variable.
GET	`/whoami`	Provides information about the client making an API request.
PATCH	`/{authenticator}/{account}`	Enables or disables authenticator defined without service_id.
PATCH	`/{authenticator}/{service_id}/{account}`	Enables or disables authenticator service instances.
GET	`/{authenticator}/{service_id}/{account}/status`	Details whether an authentication service has been configured properly

Questions

Does the Conjur API need an API key?

Yes. The Conjur API uses API key authentication; the documentation explains how to get credentials.

Does the Conjur API support HTTPS?

Yes, the Conjur API is served over HTTPS.

How many endpoints does the Conjur API have?

Its OpenAPI description lists 41 endpoints in version 5.3.0. All of them are shown on this page.

What are alternatives to the Conjur API?

Other Security APIs include Microsoft Security Response Center (MSRC), National Vulnerability Database, Cisco PSIRT openVuln API, Shodan, BitWarden.

Compare alternatives →

Microsoft Security Response Center (MSRC)

Security

Programmatic interfaces to engage with the Microsoft Security Response Center (MSRC)

No auth

National Vulnerability Database

Security

U.S. National Vulnerability Database

No auth

Cisco PSIRT openVuln API

Security

The Cisco Product Security Incident Response Team (PSIRT) openVuln API is a RESTful API that allows customers to obtain Cisco Security Vulnerability information in different machine-consumable formats. APIs are important for customers because they allow their technical staff and programmers to build tools that help them do their job more effectively (in this case, to keep up with security vulnerability information). For more information about the Cisco PSIRT openVuln API visit https://developer.cisco.com/site/PSIRT/discover/overview For detail steps on how to use the API go to:https://developer.cisco.com/site/PSIRT/get-started/getting-started.gsp This is a beta release of a swagger YAML for the Cisco PSIRT openVuln API To access the API sign in with your Cisco CCO account at http://apiconsole.cisco.com and register an application to recieve a client_id and a client_secret You can then get your token using curl or any other method you prefer. 'curl -s -k -H "Content-Type: application/x-www-form-urlencoded" -X POST -d "client_id=<your_client_id>" -d "client_secret=<your_client_secret>" -d "grant_type=client_credentials" https://cloudsso.cisco.com/as/token.oauth2' You will receive an access token as demonstrated in the following example: '{"access_token":"I7omWtBDAieSiUX3shOxNJfuy4J6","token_type":"Bearer","expires_in":3599}' In Swagger, click on Change Authentication enter the text "I7omWtBDAieSiUX3shOxNJfuy4J6" (which is the token you received) then click on "Try this operation"

OAuth19 endpoints