API · v1 · stabil
CODEMETA OSDeveloper Center
Konsole öffnen
Entity · vault_employee_keys

Vault Employee Key Schema

Schema-ID
vault_employee_key
Collection
vault_employee_keys
Permissions
  • Lesenemployee_profile_view
  • Anlegenemployee_profile_create
  • Ändernemployee_profile_edit
  • Löschenemployee_profile_delete

Felder

Vault Employee Key Schema

vault_employee_keys4 Permissions

Multi-recipient wrap of an employee data-encryption key (DEK)

employeeProfileIduuiderforderlich

UUID of the employee_profile this key belongs to

keyVersionintegererforderlich

Increments on rotation. Encrypted documents/contracts reference the version that produced their ciphertext.

≥ 1Default: 1read-only
memberKeysobject[]erforderlich

Per-recipient wraps of the DEK. Recipients are users, teams (e.g. HR group), or roles (e.g. payroll_manage).

Default: []read-only
typestringerforderlich
Werte
userteamrole
idstringerforderlich

For type=user: user UUID; type=team: team UUID; type=role: permission string (e.g. "payroll_manage")

max 200 Zeichen
wrappedKeystringerforderlich

Base64-encoded ECDH-wrapped DEK

max 1024 Zeichen
ephemeralPublicKeystringoptional

Base64-encoded ephemeral public key used during wrap

max 1024 Zeichennullable
relationshipstringoptional

Why this recipient was added — drives auto-revoke when the relationship ends.

Werte
selfmanagerhrpayrollrecoverymanual
nullable
addedAtdatetimeoptional
nullable
addedByuuidoptional
nullable
groupKeyVersionintegeroptional

Version of the team/role group key used for the wrap, if applicable

nullable
needsRewrapbooleanoptional

Lazy-rewrap flag — set when manager/HR membership changes; client refreshes wraps on next access.

Default: false
lastRotatedAtdatetimeoptional
read-onlynullable
lastRotatedByuuidoptional
read-onlynullable

Standard-Endpoints

Diese Resource folgt dem generischen CRUD-Vertrag der Plattform. Lesen Sie die Konventionen für Pagination, Idempotenz, Optimistic Locking und Audit. Die wichtigsten Endpoints:

  • GET /api/v1/vault_employee_keys — Liste, paginiert + filterbar
  • GET /api/v1/vault_employee_keys/<id> — Einzelne Entity
  • POST /api/v1/vault_employee_keys — Anlegen
  • PATCH /api/v1/vault_employee_keys/<id> — Teil-Update
  • DELETE /api/v1/vault_employee_keys/<id> — Soft-Delete
  • GET /api/v1/vault_employee_keys/<id>/timeline — Audit + Aktivitäten

Suche