OpenBao

https://openbao.org/docs
Admin
OpenBao is a reference guide for all available features and options of OpenBao, a project focused on...
Tokens:895,589
Snippets:6,607
Trust Score:8.1
Update:3 weeks ago
Show doc for...
Tokens:
Raw
### Sample response for GET /sys/rotate/keyring/config

Source: https://openbao.org/docs/api/system/rotate/keyring-config

Example response from GET /sys/rotate/keyring/config showing the current configuration with max_operations, interval, and enabled fields.

```json
{  

  "request_id": "f3d91b4a-69bf-4aaf-b928-df7a5486c130",  

  "lease_id": "",  

  "lease_duration": 0,  

  "renewable": false,  

  "data": {  

    "max_operations": 2000000000,  

    "interval": "4320h",  

    "enabled": true  

  },  

  "warnings": null  

}  


```

--------------------------------

### Sample response for start initialization

Source: https://openbao.org/docs/api/system/init

Example JSON response containing the unseal keys, base64-encoded keys, and root token.

```json
{
  "keys": ["one", "two", "three"],
  "keys_base64": ["cR9No5cBC", "F3VLrkOo", "zIDSZNGv"],
  "root_token": "foo"
}
```

--------------------------------

### Sample payload for start initialization

Source: https://openbao.org/docs/api/system/init

Example JSON payload for POST /sys/init, specifying secret_shares and secret_threshold.

```json
{
  "secret_shares": 10,
  "secret_threshold": 5
}
```

--------------------------------

### LIST /sys/version-history response

Source: https://openbao.org/docs/api/system/version-history

Example JSON response containing the list of installed versions and their associated metadata.

```json
{

  "keys": ["1.9.0", "1.9.1", "1.9.2", "1.11.0"],

  "key_info": {

    "1.9.0": {

      "commit_date": null,

      "previous_version": null,

      "timestamp_installed": "2021-11-18T10:23:16Z"

    },

    "1.9.1": {

      "commit_date": null,

      "previous_version": "1.9.0",

      "timestamp_installed": "2021-12-13T11:09:52Z"

    },

    "1.9.2": {

      "commit_date": null,

      "previous_version": "1.9.1",

      "timestamp_installed": "2021-12-23T10:56:37Z"

    },

    "1.11.0": {

      "commit_date": "2022-05-03T08:34:11Z",

      "previous_version": null,

      "timestamp_installed": "2022-05-03T13:16:04Z"

    }

  }

}
```

--------------------------------

### GET /sys/internal/ui/mounts - Sample Response

Source: https://openbao.org/docs/api/system/internal-ui-mounts

Example JSON response showing the structure with auth and secret mounts, including type and description for each.

```json
{

  "auth": {

    "github/": {

      "description": "GitHub auth",

      "type": "github"

    }

  },

  "secret": {

    "custom-secrets/": {

      "description": "Custom secrets",

      "options": {

        "version": "2"

      },

      "type": "kv"

    }

  }

}  

```

--------------------------------

### Get OpenBao CLI help

Source: https://openbao.org/docs/commands

Displays CLI help output for the installed OpenBao version. Use `-h` as a shorthand for the same command.

```bash
$ bao help  
```

--------------------------------

### GET /sys/internal/ui/mounts/:path - Sample Response

Source: https://openbao.org/docs/api/system/internal-ui-mounts

Example JSON response for a single mount, showing fields such as accessor, config, description, path, type, and uuid.

```json
{

  "accessor": "cubbyhole_50fbe8d2",

  "config": {

    "default_lease_ttl": 0,

    "force_no_cache": false,

    "max_lease_ttl": 0

  },

  "description": "per-token private secret storage",

  "external_entropy_access": false,

  "local": true,

  "options": null,

  "path": "cubbyhole/",

  "seal_wrap": false,

  "type": "cubbyhole",

  "uuid": "4bb40403-d9ba-d2ee-087a-4c6d371db5f2"

}  

```

--------------------------------

### Get configuration - sample response

Source: https://openbao.org/docs/api/system/storage/raftautopilot

Example JSON response showing autopilot configuration fields such as cleanup_dead_servers, thresholds, max_trailing_logs, min_quorum, and server_stabilization_time.

```json
{
  "cleanup_dead_servers": false,
  "dead_server_last_contact_threshold": "24h0m0s",
  "last_contact_threshold": "10s",
  "max_trailing_logs": 1000,
  "min_quorum": 0,
  "server_stabilization_time": "10s"
}
```

--------------------------------

### Typical workflow using plugin init

Source: https://openbao.org/docs/commands/plugin/init

Shows the recommended sequence: download plugins, start the server, then enable a plugin. The `plugin init` command does not register plugins automatically.

```bash
# 1. Download plugins:
$ bao plugin init -config=openbao.hcl

# 2. Start OpenBao server:
$ bao server -config=openbao.hcl

# 3. Enable plugins:
$ bao secrets enable -path=aws secrets-aws
```

--------------------------------

### GET /sys/key-status - Sample Response

Source: https://openbao.org/docs/api/system/key-status

Example JSON response from the /sys/key-status endpoint. The term is the sequential key number, install_time is when the key was installed, and encryptions is the estimated number of encryptions made by the key.

```json
{
  "term": 3,
  "install_time": "2015-05-29T14:50:46.223692553-07:00",
  "encryptions": 74718331
}
```

--------------------------------

### Sample response for rekey progress

Source: https://openbao.org/docs/api/system/rekey-recovery-key

Example JSON response returned by the GET /sys/rekey-recovery-key/init endpoint, showing started status, nonce, threshold (t), total shares (n), progress, required progress, PGP fingerprints, backup flag, and verification_required flag. If a rekey is started, n and t define the new shares, and progress/required track the rekey completion.

```json
{
  "started": true,
  "nonce": "2dbd10f1-8528-6246-09e7-82b25b8aba63",
  "t": 3,
  "n": 5,
  "progress": 1,
  "required": 3,
  "pgp_fingerprints": ["abcd1234"],
  "backup": true,
  "verification_required": false
}
```

--------------------------------

### Build and push the init container image

Source: https://openbao.org/docs/guides/unseal/pkcs11/securosys

Builds the image with podman and pushes it to a registry. Replace x.x.x with the correct version.

```bash
# Replace x.x.x with the correct version.  

podman build --build-arg VERSION="x.x.x" --build-arg ARCH="x86_64" \

  -t primus-library:1.0.0 .  

  

podman push primus-library:1.0.0 \

  docker://registry.example.com/primus-library:1.0.0  

```

--------------------------------

### Install specific OpenBao chart version 0.4.0

Source: https://openbao.org/docs/platform/k8s/helm/run

Installs a specific version of the OpenBao Helm chart using the --version flag. This example installs version 0.4.0.

```shell
$ helm install openbao openbao/openbao --version 0.4.0  
```

--------------------------------

### Claim Mappings Example

Source: https://openbao.org/docs/auth/jwt

Example of claim_mappings configuration that copies JWT claims to metadata keys. Claims not starting with '/' are optional.

```json
{  
  "division": "organization",  
  "department": "department"  
}  
```

--------------------------------

### Download plugins using a configuration file

Source: https://openbao.org/docs/commands/plugin/init

Runs `bao plugin init` with a single configuration file. The `-config` flag is required and can be specified multiple times.

```bash
$ bao plugin init -config=/path/to/openbao.hcl
```

--------------------------------

### Start server with configuration file

Source: https://openbao.org/docs/commands/server

Starts an OpenBao server using the specified HCL configuration file. The server starts in a sealed state and must be initialized and unsealed before it can respond to requests.

```bash
$ bao server -config=/etc/openbao/config.hcl
```

--------------------------------

### Install cert-manager with Helm

Source: https://openbao.org/docs/platform/k8s/helm/examples/injector-tls-cert-manager

Adds the Jetstack Helm repository and installs cert-manager with CRDs enabled. Run these commands before proceeding with the certificate setup.

```bash
$ helm repo add jetstack https://charts.jetstack.io  

$ helm repo update  

$ helm install cert-manager jetstack/cert-manager \  

  --namespace cert-manager \  

  --create-namespace \  

  --set installCRDs=true  

```

--------------------------------

### Sample response for GET /sys/quotas/config

Source: https://openbao.org/docs/api/system/quotas-config

Example JSON response from a GET request to /sys/quotas/config, showing the current rate limit configuration and a warnings field.

```json
{

  "request_id": "259801bd-a0c9-9350-8eb9-26c91afd19c6",

  "lease_id": "",

  "lease_duration": 0,

  "renewable": false,

  "data": {

    "enable_rate_limit_audit_logging": false,

    "enable_rate_limit_response_headers": false,

    "rate_limit_exempt_paths": [

      "sys/internal/ui/mounts",

      "sys/generate-recovery-token/attempt",

      "sys/generate-recovery-token/update",

      "sys/generate-root/attempt",

      "sys/generate-root/update",

      "sys/health",

      "sys/seal-status",

      "sys/unseal"

    ]

  },

  "warnings": null

}
```

--------------------------------

### List workflows - sample response

Source: https://openbao.org/docs/api/system/workflows

Example response showing the keys of configured workflows.

```json
{  

  "keys": ["create-namespace", "reset-admin"]  

}  

```

--------------------------------

### Start initialization with curl

Source: https://openbao.org/docs/api/system/init

Sample request to initialize OpenBao using a payload file. Uses POST /sys/init.

```bash
$ curl \
    --request POST \
    --data @payload.json \
    http://127.0.0.1:8200/v1/sys/init
```

--------------------------------

### Sample response for getting a rate limit quota

Source: https://openbao.org/docs/api/system/rate-limit-quotas

Example response from a GET request, showing quota details such as rate, interval, block_interval, and inheritable flag.

```json
{

  "request_id": "d0870811-455d-3dfd-459f-aee016e6fb68",

  "lease_id": "",

  "lease_duration": 0,

  "renewable": false,

  "data": {

    "block_interval": 300,

    "interval": 2,

    "inheritable": true,

    "name": "global-rate-limiter",

    "path": "",

    "rate": 897.3,

    "role": "",

    "type": "rate-limit"

  },

  "warnings": null

}
```

--------------------------------

### Install OpenBao Go Client

Source: https://openbao.org/docs/api/libraries

Install the official OpenBao Go client library using the Go module system. This command fetches the v2 API package from the OpenBao repository.

```bash
$ go get github.com/openbao/openbao/api/v2
```

--------------------------------

### Get static credentials: sample response for GET /database/static-creds/:name

Source: https://openbao.org/docs/api/secret/databases

Example JSON response from the GET static credentials endpoint, showing the static role's current username, password, last rotation timestamp, rotation period, and TTL.

```json
{  
  "data": {  
    "username": "static-user",  
    "password": "132ae3ef-5a64-7499-351e-bfe59f3a2a21",  
    "last_openbao_rotation": "2019-05-06T15:26:42.525302-05:00",  
    "rotation_period": 30,  
    "ttl": 28  
  }  
}  

```

--------------------------------

### Static role GET response for openbao

Source: https://openbao.org/docs/api/secret/ldap

Example response from a GET request to /ldap/static-role/openbao. Shows the role's DN, last rotation timestamp, rotation period in seconds, and username.

```json
{
  "data": {
    "dn": "uid=openbao,ou=Users,dc=openbao,dc=com",
    "last_vault_rotation": "2020-02-19T11:31:53.7812-05:00",
    "rotation_period": 86400,
    "username": "openbao"
  }
}
```

--------------------------------

### Install OpenBao CSI Provider with Helm

Source: https://openbao.org/docs/platform/k8s/csi/installation

Commands to add the OpenBao Helm repository, search for the chart, and install OpenBao with the CSI provider enabled. The first command adds the repository and shows the expected output, including the chart version. The second command installs the chart with the `csi.enabled` value set to `true`, which also installs the OpenBao server and Agent Injector.

```bash
$ helm repo add openbao https://openbao.github.io/openbao-helm  

"openbao" has been added to your repositories  

  

$ helm search repo openbao/openbao  

NAME            CHART VERSION   APP VERSION             DESCRIPTION  

openbao/openbao 0.4.0           v2.0.0-alpha20240329    Official OpenBao Chart  

```

```bash
$ helm install openbao openbao/openbao --set="csi.enabled=true"  

```

--------------------------------

### Example main package for an OpenBao plugin

Source: https://openbao.org/docs/plugins/plugin-development

This code shows a minimal main package for an OpenBao plugin using the OpenBao SDK for a secrets engine or auth method. It sets up the API client, TLS configuration, and calls plugin.ServeMultiplex with a backend factory and TLS provider function. Replace 'myPlugin' with your actual plugin package.

```go
package main  

import (  
	"os"  

	hclog "github.com/hashicorp/go-hclog"  
	myPlugin "your/plugin/import/path"  

	"github.com/openbao/openbao/api/v2"  
	"github.com/openbao/openbao/sdk/v2/plugin"  
)  

func main() {  
	apiClientMeta := &api.PluginAPIClientMeta{}  
	flags := apiClientMeta.FlagSet()  
	flags.Parse(os.Args[1:])  

	tlsConfig := apiClientMeta.GetTLSConfig()  
	tlsProviderFunc := api.VaultPluginTLSProvider(tlsConfig)  

	err := plugin.ServeMultiplex(&plugin.ServeOpts{  
		BackendFactoryFunc: myPlugin.Factory,  
		TLSProviderFunc:    tlsProviderFunc,  
	})  
	if err != nil {  
		logger := hclog.New(&hclog.LoggerOptions{})  
		logger.Error("plugin shutting down", "error", err)  
		os.Exit(1)  
	}  
}  
```

--------------------------------

### GET /sys/internal/ui/mounts/:path - Sample Request

Source: https://openbao.org/docs/api/system/internal-ui-mounts

Curl command to get details for a specific mount path, using the cubbyhole mount as an example. This endpoint is authenticated and requires a valid token in the X-Vault-Token header.

```bash
$ curl \

    --header "X-Vault-Token: ..." \

    http://127.0.0.1:8200/v1/sys/internal/ui/mounts/cubbyhole  

```

--------------------------------

### Start integration test environment with make

Source: https://openbao.org/docs/auth/kerberos

Start the OpenBao Kerberos integration test environment. These commands run variations of a script that spins up a full Kerberos and LDAP environment, adds users, and executes a login from a client.

```bash
make integration
```

```bash
make dev-env
```

--------------------------------

### Prometheus metrics response for /sys/metrics

Source: https://openbao.org/docs/api/system/metrics

Example response from a GET request to /sys/metrics with format=prometheus. It shows Prometheus-format metrics for audit log requests, responses, and barrier get operations. The response is truncated with '...' at the end.

```prometheus
# HELP vault_audit_log_request vault_audit_log_request
# TYPE vault_audit_log_request summary
vault_audit_log_request{quantile="0.5"} 0.005927000194787979
vault_audit_log_request{quantile="0.9"} 0.005927000194787979
vault_audit_log_request{quantile="0.99"} 0.005927000194787979
vault_audit_log_request_sum 0.014550999738276005
vault_audit_log_request_count 2
# HELP vault_audit_log_request_failure vault_audit_log_request_failure
# TYPE vault_audit_log_request_failure counter
vault_audit_log_request_failure 0
# HELP vault_audit_log_response vault_audit_log_response
# TYPE vault_audit_log_response summary
vault_audit_log_response{quantile="0.5"} NaN
vault_audit_log_response{quantile="0.9"} NaN
vault_audit_log_response{quantile="0.99"} NaN
vault_audit_log_response_sum 0.0057669999077916145
vault_audit_log_response_count 1
# HELP vault_audit_log_response_failure vault_audit_log_response_failure
# TYPE vault_audit_log_response_failure counter
vault_audit_log_response_failure 0
# HELP vault_barrier_get vault_barrier_get
# TYPE vault_barrier_get summary
vault_barrier_get{quantile="0.5"} 0.011938000097870827
vault_barrier_get{quantile="0.9"} 0.011938000097870827
vault_barrier_get{quantile="0.99"} 0.011938000097870827
vault_barrier_get_sum 0.1814980012131855
vault_barrier_get_count 36
...

```

--------------------------------

### Initialize a rekey with verification using -verify

Source: https://openbao.org/docs/commands/operator/rekey

Initializes a rekey and activates the verification process, which requires a verification nonce to complete.

```bash
$ bao operator rekey \
    -init \
    -key-shares=15 \
    -key-threshold=9 \
    -verify
```

--------------------------------

### GET /sys/internal/counters/tokens - Sample Response

Source: https://openbao.org/docs/api/system/internal-counters

Example JSON response showing the total token count in the counters.service_tokens.total field.

```json
{
  "request_id": "75cbaa46-e741-3eba-2be2-325b1ba8f03f",
  "lease_id": "",
  "renewable": false,
  "lease_duration": 0,
  "data": {
    "counters": {
      "service_tokens": {
        "total": 1
      }
    }
  },
  "wrap_info": null,
  "warnings": null,
  "auth": null
}
```

--------------------------------

### GET /sys/internal/counters/entities - Sample Response

Source: https://openbao.org/docs/api/system/internal-counters

Example JSON response showing the total entity count in the counters.entities.total field.

```json
{
  "request_id": "75cbaa46-e741-3eba-2be2-325b1ba8f03f",
  "lease_id": "",
  "renewable": false,
  "lease_duration": 0,
  "data": {
    "counters": {
      "entities": {
        "total": 1
      }
    }
  },
  "wrap_info": null,
  "warnings": null,
  "auth": null
}
```

--------------------------------

### Sample response for POST /sys/wrapping/wrap

Source: https://openbao.org/docs/api/system/wrapping-wrap

Example response showing the wrapped token in wrap_info.token, with a TTL of 300 seconds and creation path sys/wrapping/wrap.

```json
{
  "request_id": "",
  "lease_id": "",
  "lease_duration": 0,
  "renewable": false,
  "data": null,
  "warnings": null,
  "wrap_info": {
    "token": "fb79b9d3-d94e-9eb6-4919-c559311133d6",
    "ttl": 300,
    "creation_time": "2016-09-28T14:41:00.56961496-04:00",
    "creation_path": "sys/wrapping/wrap"
  }
}
```

--------------------------------

### Login - sample response

Source: https://openbao.org/docs/api/auth/radius

Example response from a successful login. Contains the client token, accessor, policies, and metadata with the username.

```json
{  

  "lease_id": "",  

  "renewable": false,  

  "lease_duration": 0,  

  "data": null,  

  "warnings": null,  

  "auth": {  

    "client_token": "64d2a8f2-2a2f-5688-102b-e6088b76e344",  

    "accessor": "18bb8f89-826a-56ee-c65b-1736dc5ea27d",  

    "policies": ["default"],  

    "metadata": {  

      "username": "vishal"  

    },  

  },  

  "lease_duration": 7200,  

  "renewable": true  

}  

```

--------------------------------

### Sample health response (GET)

Source: https://openbao.org/docs/api/system/health

Example response from a GET request to /sys/health. Shows the health status fields including initialized, sealed, standby, replication modes, server time, version, cluster name, and cluster ID.

```json
{
  "initialized": true,
  "sealed": false,
  "standby": false,
  "replication_performance_mode": "disabled",
  "replication_dr_mode": "disabled",
  "server_time_utc": 1516639589,
  "version": "0.9.2",
  "cluster_name": "openbao-cluster-3bd69ca2",
  "cluster_id": "00af5aa8-c87d-b5fc-e82e-97cd8dfaf731"
}
```

--------------------------------

### Initialize OpenBao server

Source: https://openbao.org/docs/platform/k8s/helm/run

Initializes one OpenBao server with default key shares and key threshold, outputting unseal keys and initial root token.

```bash
$ kubectl exec -ti openbao-0 -- bao operator init  

Unseal Key 1: MBFSDepD9E6whREc6Dj+k3pMaKJ6cCnCUWcySJQymObb  

Unseal Key 2: zQj4v22k9ixegS+94HJwmIaWLBL3nZHe1i+b/wHz25fr  

Unseal Key 3: 7dbPPeeGGW3SmeBFFo04peCKkXFuuyKc8b2DuntA4VU5  

Unseal Key 4: tLt+ME7Z7hYUATfWnuQdfCEgnKA2L173dptAwfmenCdf  

Unseal Key 5: vYt9bxLr0+OzJ8m7c7cNMFj7nvdLljj0xWRbpLezFAI9  

  

Initial Root Token: s.zJNwZlRrqISjyBHFMiEca6GF  

##...  


```

--------------------------------

### List configs - example response

Source: https://openbao.org/docs/api/system/external-keys

Sample JSON response shown for the LIST request, listing config names.

```json
{
  "keys": ["my-transit-config", "my-pkcs11-config"]
}
```

--------------------------------

### kv metadata get example

Source: https://openbao.org/docs/commands/kv/metadata

Retrieves metadata for the key 'creds' and displays the metadata path, key settings, and per-version details.

```bash
$ bao kv metadata get -mount=secret creds  

=== Metadata Path ===  

secret/metadata/creds  

========== Metadata ==========  

Key                     Value  

---                     -----  

cas_required            false  

created_time            2019-06-28T15:53:30.395814Z  

current_version         5  

delete_version_after    0s  

max_versions            0  

oldest_version          0  

updated_time            2019-06-28T16:01:47.40064Z  

====== Version 1 ======  

Key              Value  

---              -----  

created_time     2019-06-28T15:53:30.395814Z  

deletion_time    n/a  

destroyed        false  

====== Version 2 ======  

Key              Value  

---              -----  

created_time     2019-06-28T16:01:36.676912Z  

deletion_time    n/a  

destroyed        false  

...  
```

--------------------------------

### Read Auth Method Tuning Configuration

Source: https://openbao.org/docs/api/system/auth

Example request to read the configuration of a specific auth path using the GET method.

```bash
$ curl \
    --header "X-Vault-Token: ..." \
    http://127.0.0.1:8200/v1/sys/auth/my-auth/tune
```

--------------------------------

### Download OCI-based plugins with bao plugin init

Source: https://openbao.org/docs/commands/plugin

Downloads and initializes OCI-based plugins configured in the server configuration file. The command outputs informational logs showing the plugin directory, the number of OCI plugins found, and per-plugin download and validation details including cached paths and hashes.

```bash
$ bao plugin init -config=/etc/openbao/openbao.hcl  

2025-09-17T21:41:35.311+0200 [INFO]  Plugin directory: /opt/openbao/plugins  

2025-09-17T21:41:35.311+0200 [INFO]  Found 2 OCI plugin(s) in configuration  

2025-09-17T21:41:35.311+0200 [INFO]  downloading plugin from OCI registry: plugin=secrets-aws url=ghcr.io/openbao/openbao-plugin-secrets-aws:v0.0.1  

2025-09-17T21:41:36.537+0200 [INFO]  found plugin binary in OCI image: plugin=secrets-aws entry=openbao-plugin-secrets-aws size=23265572  

2025-09-17T21:41:37.448+0200 [INFO]  successfully downloaded and validated plugin: plugin=secrets-aws cached_path=/opt/openbao/plugins/.oci-cache/secrets-aws/c8d23e6d/openbao-plugin-secrets-aws symlink_path=/opt/openbao/plugins/secrets-aws hash=c8d23e6d31be2a59d0c269bb7243158c4c61c5073f7ba50ce6f1a0050e023e2d  

2025-09-17T21:41:37.449+0200 [INFO]  downloading plugin from OCI registry: plugin=secrets-nomad url=ghcr.io/openbao/openbao-plugin-secrets-nomad:v0.1.3-dev2  

2025-09-17T21:41:38.838+0200 [INFO]  found plugin binary in OCI image: plugin=secrets-nomad entry=openbao-plugin-secrets-nomad size=16289976  

2025-09-17T21:41:39.657+0200 [INFO]  successfully downloaded and validated plugin: plugin=secrets-nomad cached_path=/opt/openbao/plugins/.oci-cache/secrets-nomad/b7f2db3c/openbao-plugin-secrets-nomad symlink_path=/opt/openbao/plugins/secrets-nomad hash=b7f2db3cbba3df7b4c2868c7c18e43956862b7cd69f90a96bdbba6a3013e400b  

```

--------------------------------

### Read LDAP user response

Source: https://openbao.org/docs/api/auth/ldap

Example response from the GET /auth/ldap/users/:username endpoint, showing the user's policies and groups.

```json
{
  "data": {
    "policies": [
      "admin",
      "default"
    ],
    "groups": ""
  },
  "renewable": false,
  "lease_id": ""
  "lease_duration": 0,
  "warnings": null
}
```

--------------------------------

### Initialize KMS plugin download

Source: https://openbao.org/docs/guides/upgrade/plugins

Runs plugin init to trigger the download of a new KMS plugin binary when plugin_auto_download is false.

```bash
$ bao plugin init -config=/etc/openbao/openbao.hcl  
```

--------------------------------

### Keyword/Value-format Multi-Host string

Source: https://openbao.org/docs/api/secret/databases/postgresql

Example connection_url using keyword/value format with multiple hosts. Useful for PostgreSQL setups with replication manager.

```json
{

  "connection_url": "host=hostone,hosttwo,hostthree port=5432,5432,9999 user={{username}} password={{password}} dbname=postgres"

}
```

--------------------------------

### Bootstrap the project

Source: https://openbao.org/docs/install

Downloads and compiles the necessary libraries and tools required for the OpenBao build process.

```bash
$ make bootstrap  
```

--------------------------------

### Read Kerberos Config - Sample Response

Source: https://openbao.org/docs/api/auth/kerberos

Example JSON response showing the service account and related settings. The keytab is omitted for security.

```json
{
  "auth": null,
  "warnings": null,
  "wrap_info": null,
  "data": {
    "add_group_aliases": false,
    "remove_instance_name": false,
    "service_account": "openbao_svc"
  },
  "lease_duration": 0,
  "renewable": false,
  "lease_id": ""
}
```

--------------------------------

### URI-format Multi-Host string

Source: https://openbao.org/docs/api/secret/databases/postgresql

Example connection_url using URI format with multiple hosts. Useful for PostgreSQL setups with replication manager.

```json
{

  "connection_url": "postgresql://{{username}}:{{password}}@hostone:5432,hosttwo:5432,hostthree:9999/postgres"

}
```
Tokens:
Raw