@piiano/vault-client
Version:
Piiano Vault generated typescript client
490 lines • 26.2 kB
JavaScript
;
Object.defineProperty(exports, "__esModule", { value: true });
exports.TokensClient = void 0;
class TokensClient {
constructor(httpRequest) {
this.httpRequest = httpRequest;
}
/**
* Get token count
* Gets the number of tokens in a collection.
*
* The role performing this operation must have at least one allowing policy and no denying policies for the `stats` operation.
*
* See [identity and access management](/data-security/identity-and-access-management) for more information about how Vault uses policies to control access to data.
* @returns Count The request is successful.
* @throws ApiError
*/
getTokensCount({ collection, adhocReason, reason, customAudit, reloadCache, additionalHeaders = {}, }) {
return this.httpRequest.request({
method: 'GET',
url: '/api/pvlt/1.0/data/collections/{collection}/count/tokens',
path: {
'collection': collection,
},
headers: additionalHeaders,
query: {
'adhoc_reason': adhocReason,
'reason': reason,
'custom_audit': customAudit,
'reload_cache': reloadCache,
},
errors: {
400: `The request is invalid.`,
401: `Authentication credentials are incorrect or missing.`,
403: `The caller doesn't have the required access rights.`,
404: `The requested resource is not found.`,
405: `The operation is not allowed.`,
409: `A conflict occurs.`,
410: `Access to a resource that is no longer available occurs.`,
500: `An error occurs on the server.`,
503: `The service is unavailable.`,
},
});
}
/**
* Tokenize
* Creates a token that reference the values of an object's properties. The token ID is partially or wholly randomly-generated and, therefore, is not sensitive. Supports bulk operations.
*
* The returned token IDs are in the same order as the object IDs in the request. No tokens are created if any object IDs are invalid or not found.
*
* If this operation is called for an object ID and properties that have a token:
* - Any token tags are appended to the existing token.
* - If an expiration is specified, then the token expiry is updated. If an expiration is not specified, the token expiry is updated if the default settings result in an expiry date after the token's current expiry date.
*
* The operation can optionally include a transaction ID. This is an arbitrary string included in the request using the `transaction_id` query parameter. If a transaction ID is included, the token is associated with the transaction ID. The transaction ID can be used to retrieve the token ID by calling the [get by transaction ID](/api/operations/get-by-transaction-id) operation. A transaction ID is unique to the operation and collection. It cannot be used again on future calls to the `tokenize` operation on the same collection. If multiple tokens are created in the `tokenize` operation (bulk), all the tokens are associated with the transaction ID.
*
* The role performing this operation must have both of these:
* - The `CapTokensWriter` capability.
* - At least one allowing policy and no denying policies for the `tokenize` operation for each of the collection properties specified in the call.
*
* See [identity and access management](/data-security/identity-and-access-management) for more information about how capabilities are used to control access to operations and policies are used to control access to data.
*
* @returns TokenValue The request is successful.
* @throws ApiError
*/
tokenize({ collection, requestBody, expirationSecs, xTenantId, transactionId, adhocReason, reason, customAudit, reloadCache, additionalHeaders = {}, }) {
return this.httpRequest.request({
method: 'POST',
url: '/api/pvlt/1.0/data/collections/{collection}/tokens',
path: {
'collection': collection,
},
headers: Object.assign(Object.assign({}, additionalHeaders), { 'X-Tenant-Id': xTenantId }),
query: {
'expiration_secs': expirationSecs,
'transaction_id': transactionId,
'adhoc_reason': adhocReason,
'reason': reason,
'custom_audit': customAudit,
'reload_cache': reloadCache,
},
body: requestBody,
mediaType: 'application/json',
errors: {
400: `The request is invalid.`,
401: `Authentication credentials are incorrect or missing.`,
403: `The caller doesn't have the required access rights.`,
404: `The collection, objects, or properties aren't found or are missing.`,
405: `The operation is not allowed.`,
409: `A conflict occurs.`,
410: `Access to a resource that is no longer available occurs.`,
500: `An error occurs on the server.`,
503: `The service is unavailable.`,
},
});
}
/**
* Detokenize tokens
* Returns the object property values for tokens.
*
* The tokens returned by this operation are defined using three query parameters: `token_ids`, `object_ids`, and `tags`. The operation returns an empty response if it finds no matches. See the [Retrieve a token](/guides/tokenize-personal-data/retrieve-a-token) guide for more information about how to match tokens for this operation.
*
* The role performing this operation must have all of these:
* - The `CapTokensDetokenizer` capability.
* - Policies:
* + At least one allowing policy and no denying policies for the `detokenize` operation for each of the collection properties that are tokenized by tokens specified in the query.
* + At least one allowing policy and no denying policies for the `read` operation for each of the collection properties that are tokenized by tokens specified in the query.
*
* See [identity and access management](/data-security/identity-and-access-management) for more information about how capabilities are used to control access to operations and policies are used to control access to data.
*
* @returns DetokenizedToken The request is successful.
* @throws ApiError
*/
detokenize({ collection, objectIds, tags, tokenIds, props, options, xTenantId, adhocReason, reason, customAudit, reloadCache, additionalHeaders = {}, }) {
return this.httpRequest.request({
method: 'GET',
url: '/api/pvlt/1.0/data/collections/{collection}/tokens',
path: {
'collection': collection,
},
headers: Object.assign(Object.assign({}, additionalHeaders), { 'X-Tenant-Id': xTenantId }),
query: {
'object_ids': objectIds,
'tags': tags,
'token_ids': tokenIds,
'props': props,
'options': options,
'adhoc_reason': adhocReason,
'reason': reason,
'custom_audit': customAudit,
'reload_cache': reloadCache,
},
errors: {
400: `The request is invalid.`,
401: `Authentication credentials are incorrect or missing.`,
403: `The caller doesn't have the required access rights.`,
404: `The requested resource is not found.`,
405: `The operation is not allowed.`,
409: `A conflict occurs.`,
410: `Access to a resource that is no longer available occurs.`,
500: `An error occurs on the server.`,
503: `The service is unavailable.`,
},
});
}
/**
* Delete tokens
* Deletes tokens.
*
* The tokens deleted are those that match all the criteria in the `token_ids`, `object_ids`, `tags`, and `tenant_id` parameters. `tenant_id` is matched against the tenant ID of the object owning the token. If the token query finds no matches, the operation returns a 404 error. See [delete tokens](/guides/tokenize-personal-data/delete-a-token) for more details.
*
* The role performing this operation must have both of these:
* - The `CapTokensWriter` capability.
* - At least one allowing policy and no denying policies for the `delete` operation for the `tokens` resource of the specified collection.
*
* See [identity and access management](/data-security/identity-and-access-management) for more information about how capabilities are used to control access to operations and policies are used to control access to data.
*
* @returns any The request is successful.
* @throws ApiError
*/
deleteTokens({ collection, objectIds, tags, tokenIds, tenantId, options, xTenantId, adhocReason, reason, customAudit, reloadCache, additionalHeaders = {}, }) {
return this.httpRequest.request({
method: 'DELETE',
url: '/api/pvlt/1.0/data/collections/{collection}/tokens',
path: {
'collection': collection,
},
headers: Object.assign(Object.assign({}, additionalHeaders), { 'X-Tenant-Id': xTenantId }),
query: {
'object_ids': objectIds,
'tags': tags,
'token_ids': tokenIds,
'tenant_id': tenantId,
'options': options,
'adhoc_reason': adhocReason,
'reason': reason,
'custom_audit': customAudit,
'reload_cache': reloadCache,
},
errors: {
400: `The request is invalid.`,
401: `Authentication credentials are incorrect or missing.`,
403: `The caller doesn't have the required access rights.`,
404: `The collection or reason aren't found or are missing, the \`reason\` is set to \`other\` but no \`adhoc_reason\` is provided, no token query parameters are provided, or the query finds no matching tokens.`,
405: `The operation is not allowed.`,
409: `A conflict occurs.`,
410: `Access to a resource that is no longer available occurs.`,
500: `An error occurs on the server.`,
503: `The service is unavailable.`,
},
});
}
/**
* Update tokens
* Updates token data or token metadata `tags` and `expiration` properties.
*
* ### Update token metadata
*
* See the [Update a token](/guides/tokenize-personal-data/update-a-token) guide for more information about updating a token's metadata.
*
* ### Update token data
*
* To update token data, all the tokens must:
* * have the same token ID.
* * be token types `pci`, `pci_oneway`, or `randomized` (metadata can be updated in all token types).
*
* To update a token's data, set the `object` parameter to contain one of these:
* 1. Objects stored in Vault by providing their ID.
* 2. Fields not stored in Vault by providing a map of their properties and property values. These fields must conform to the schema of the collection specified in the request.
* 3. Ciphertext. This enables you to update a token's data with a subset of another ciphertext's properties or with a different encryption type or scope.
*
* Updates to the token's data do not change the token's metadata, token ID, ownership, or lifecycle of the token . However, the data update may affect subsequent tokenizations. For example, if a token of type `pci` with ID "X" is updated, subsequent tokenizations of the new data have the same token ID "X," while tokenizations of the previous data results in a new token ID. See [Tokenization](/data-security/tokenization) for more information on token types.
*
* :::note
* Update to the token's data overrides the entire existing data.
* :::
*
* ### Permissions
*
* The role performing this operation must have both of these:
* - The `CapTokensWriter` capability.
* - At least one allowing policy and no denying policies for the `write` operation for the `tokens` resource of the collection specified in the call.
* - Updating a token's metadata requires the `write` operation for the `tokens` resource of the collection specified in the call.
* - Updating a token's data requires the `tokenize` operation for each of the collection properties specified in the call.
* - For updating both the metadata and the data of a token, only the `tokenize` operation permission is required.
*
* See [identity and access management](/data-security/identity-and-access-management) for more information about how capabilities are used to control access to operations and policies are used to control access to data.
*
* ### Query
*
* The tokens returned by this operation are defined using three query parameters: `token_ids`, `object_ids`, and `tags`. If no tokens are matched, status code 404 is returned. See the [Retrieve a token](/guides/tokenize-personal-data/retrieve-a-token) guide for more information about how to match tokens for this operation.
*
* @returns any The request is successful.
* @throws ApiError
*/
updateTokens({ collection, requestBody, expirationSecs, objectIds, tags, tokenIds, options, xTenantId, adhocReason, reason, customAudit, reloadCache, additionalHeaders = {}, }) {
return this.httpRequest.request({
method: 'PATCH',
url: '/api/pvlt/1.0/data/collections/{collection}/tokens',
path: {
'collection': collection,
},
headers: Object.assign(Object.assign({}, additionalHeaders), { 'X-Tenant-Id': xTenantId }),
query: {
'expiration_secs': expirationSecs,
'object_ids': objectIds,
'tags': tags,
'token_ids': tokenIds,
'options': options,
'adhoc_reason': adhocReason,
'reason': reason,
'custom_audit': customAudit,
'reload_cache': reloadCache,
},
body: requestBody,
mediaType: 'application/json',
errors: {
400: `The request is invalid.`,
401: `Authentication credentials are incorrect or missing.`,
403: `The caller doesn't have the required access rights.`,
404: `The collection or reason aren't found or are missing, the \`reason\` is set to \`other\` but no \`adhoc_reason\` is provided, no token query parameters are provided, or the query finds no matching tokens.`,
405: `The operation is not allowed.`,
409: `A conflict occurs.`,
410: `Access to a resource that is no longer available occurs.`,
500: `An error occurs on the server.`,
503: `The service is unavailable.`,
},
});
}
/**
* Rotate tokens
* Generates new token IDs for a list of tokens.
*
* The role performing this operation must have both of these:
* - The `CapTokensWriter` capability.
* - At least one allowing policy and no denying policies for the `write` operation for the `tokens` resource of the specified collection.
*
* See [identity and access management](/data-security/identity-and-access-management) for more information about how capabilities are used to control access to operations and policies are used to control access to data.
*
* @returns RotatedTokens The request is successful.
* @throws ApiError
*/
rotateTokens({ tokenIds, collection, xTenantId, adhocReason, reason, customAudit, reloadCache, additionalHeaders = {}, }) {
return this.httpRequest.request({
method: 'POST',
url: '/api/pvlt/1.0/data/collections/{collection}/rotate/tokens',
path: {
'collection': collection,
},
headers: Object.assign(Object.assign({}, additionalHeaders), { 'X-Tenant-Id': xTenantId }),
query: {
'token_ids': tokenIds,
'adhoc_reason': adhocReason,
'reason': reason,
'custom_audit': customAudit,
'reload_cache': reloadCache,
},
errors: {
400: `The request is invalid.`,
401: `Authentication credentials are incorrect or missing.`,
403: `The caller doesn't have the required access rights.`,
404: `The collection, reason, or tokens aren't found or are missing or the \`reason\` is set to \`other\` but no \`adhoc_reason\` is provided.`,
405: `The operation is not allowed.`,
409: `A conflict occurs.`,
410: `Access to a resource that is no longer available occurs.`,
500: `An error occurs on the server.`,
503: `The service is unavailable.`,
},
});
}
/**
* Search tokens
* Lists tokens with their metadata.
*
* The tokens returned by this operation are defined using three query parameters: `token_ids`, `object_ids`, and `tags`. The operation returns an empty response if it finds no matches. See the [Retrieve a token](/guides/tokenize-personal-data/retrieve-a-token) guide for more information about how to match tokens for this operation.
*
* The role performing this operation must have all of these:
* - The `CapTokensReader` capability.
* - At least one allowing policy and no denying policies for the `read` operation for the `tokens` resource of the specified collection.
*
* See [identity and access management](/data-security/identity-and-access-management) for more information about how capabilities are used to control access to operations and policies are used to control access to data.
*
* @returns TokenMetadata The request is successful.
* @throws ApiError
*/
searchTokens({ collection, requestBody, options, xTenantId, adhocReason, reason, customAudit, reloadCache, additionalHeaders = {}, }) {
return this.httpRequest.request({
method: 'POST',
url: '/api/pvlt/1.0/data/collections/{collection}/query/tokens',
path: {
'collection': collection,
},
headers: Object.assign(Object.assign({}, additionalHeaders), { 'X-Tenant-Id': xTenantId }),
query: {
'options': options,
'adhoc_reason': adhocReason,
'reason': reason,
'custom_audit': customAudit,
'reload_cache': reloadCache,
},
body: requestBody,
mediaType: 'application/json',
errors: {
400: `The request is invalid.`,
401: `Authentication credentials are incorrect or missing.`,
403: `The caller doesn't have the required access rights.`,
404: `The requested resource is not found.`,
405: `The operation is not allowed.`,
409: `A conflict occurs.`,
410: `Access to a resource that is no longer available occurs.`,
500: `An error occurs on the server.`,
503: `The service is unavailable.`,
},
});
}
/**
* Get tokens by transaction ID
* Returns the list of token IDs associated with a transaction ID, an optional identifier passed to the [tokenize](/api/operations/tokenize) operation.
*
* The role performing this operation must have the `CapTransactionIdReader` capability, or another capability that matches the URL, such as the `CapDataReader` capability.
* @returns TransactionID The request is successful.
* @throws ApiError
*/
getByTransactionId({ id, collection, adhocReason, reason, customAudit, reloadCache, additionalHeaders = {}, }) {
return this.httpRequest.request({
method: 'GET',
url: '/api/pvlt/1.0/data/collections/{collection}/transaction_id/{id}',
path: {
'id': id,
'collection': collection,
},
headers: additionalHeaders,
query: {
'adhoc_reason': adhocReason,
'reason': reason,
'custom_audit': customAudit,
'reload_cache': reloadCache,
},
errors: {
400: `The request is invalid.`,
401: `Authentication credentials are incorrect or missing.`,
403: `The caller doesn't have the required access rights.`,
404: `The requested resource is not found.`,
405: `The operation is not allowed.`,
409: `A conflict occurs.`,
410: `Access to a resource that is no longer available occurs.`,
500: `An error occurs on the server.`,
503: `The service is unavailable.`,
},
});
}
/**
* Export tokens
* Internal operation that lists token details for export by the CLI.
*
* Limitations:
* - Export of tokens of type `pci_oneway` is not supported.
*
* The role performing this operation must have:
* - The `CapTokensExporter` capability.
* - At least one allowing policy and no denying policies for the `detokenize` operation for each of the collection properties that are tokenized in tokens specified in the query.
*
* See [identity and access management](/data-security/identity-and-access-management) for more information about how capabilities are used to control access to operations and policies are used to control access to data.
*
* @returns TokenDataPage The request is successful.
* @throws ApiError
*/
exportTokens({ collection, adhocReason, reason, customAudit, reloadCache, pageSize, cursor, tokenTypes, additionalHeaders = {}, }) {
return this.httpRequest.request({
method: 'GET',
url: '/api/pvlt/1.0/data/collections/{collection}/export/tokens',
path: {
'collection': collection,
},
headers: additionalHeaders,
query: {
'adhoc_reason': adhocReason,
'reason': reason,
'custom_audit': customAudit,
'reload_cache': reloadCache,
'page_size': pageSize,
'cursor': cursor,
'token_types': tokenTypes,
},
errors: {
400: `The request is invalid.`,
401: `Authentication credentials are incorrect or missing.`,
403: `The caller doesn't have the required access rights.`,
404: `The requested resource is not found.`,
405: `The operation is not allowed.`,
409: `A conflict occurs.`,
410: `Access to a resource that is no longer available occurs.`,
500: `An error occurs on the server.`,
503: `The service is unavailable.`,
},
});
}
/**
* Import tokens
* Internal operation that imports token details that were previously exported by the CLI.
*
* Limitations:
* - Import of tokens of type `pci_oneway` and `deterministic` is not supported.
* - Import of tokens of type 'pci' is supported only if the token data is not present in the Vault.
*
* The role performing this operation must have:
* - The `CapTokensImporter` capability.
* - At least one allowing policy and no denying policies for the `write` operation for the `tokens` resource of the specified collection.
*
* See [identity and access management](/data-security/identity-and-access-management) for more information about how capabilities are used to control access to operations and policies are used to control access to data.
*
* @returns ImportTokensBulkResponse The request is successful.
* However, this status doesn't indicate that the operation imported all the tokens.
* Check the response body for the status of each token.
*
* @throws ApiError
*/
importTokens({ collection, requestBody, adhocReason, reason, customAudit, reloadCache, exportKey, additionalHeaders = {}, }) {
return this.httpRequest.request({
method: 'POST',
url: '/api/pvlt/1.0/data/collections/{collection}/import/tokens',
path: {
'collection': collection,
},
headers: additionalHeaders,
query: {
'adhoc_reason': adhocReason,
'reason': reason,
'custom_audit': customAudit,
'reload_cache': reloadCache,
'export_key': exportKey,
},
body: requestBody,
mediaType: 'application/json',
errors: {
400: `The request is invalid.`,
401: `Authentication credentials are incorrect or missing.`,
403: `The caller doesn't have the required access rights.`,
404: `The requested resource is not found.`,
405: `The operation is not allowed.`,
409: `A conflict occurs.`,
410: `Access to a resource that is no longer available occurs.`,
500: `An error occurs on the server.`,
503: `The service is unavailable.`,
},
});
}
}
exports.TokensClient = TokensClient;
//# sourceMappingURL=TokensClient.js.map