Automate Conjur

What Conjur is

This is an API definition for CyberArk Conjur Open Source. You can find out more at [Conjur.org](https://www.conjur.org/).

API host: conjur.local

What HumDay can do in Conjur

24 documented operations change something in Conjur.

• POSTCreates one or more host identity tokens./host_factory_tokens
• POSTCreates a Host using the Host Factory./host_factories/hosts
• PUTChanges a user’s password./authn/{account}/password
• POSTFor applications running in Kubernetes; sends Conjur a certificate signing request (CSR) and requests a client certificate injected into the application's Kubernetes pod./authn-k8s/{service_id}/inject_client_cert
• DELETERevokes a token, immediately disabling it./host_factory_tokens/{token}
• POSTAdds data to the existing Conjur policy./policies/{account}/policy/{identifier}
• PUTLoads or replaces a Conjur policy document./policies/{account}/policy/{identifier}
• PATCHEnables or disables authenticator defined without serviceid./{authenticator}/{account}
• PUTRotates a role's API key./authn/{account}/api_key
• POSTCreates a secret value within the specified variable./secrets/{account}/{kind}/{identifier}
• POSTGets a short-lived access token for applications running in Google Cloud Platform./authn-gcp/{account}/authenticate
• POSTGets a short-lived access token for users and hosts using their LDAP identity to access the Conjur API./authn-ldap/{service_id}/{account}/{login}/authenticate
• POSTGets a signed certificate from the configured Certificate Authority service./ca/{account}/{service_id}/sign
• PATCHEnables or disables authenticator service instances./{authenticator}/{service_id}/{account}
• POSTGets a short-lived access token, which is required in the header of most subsequent API requests./authn/{account}/{login}/authenticate
• PATCHModifies an existing Conjur policy./policies/{account}/policy/{identifier}
• POSTGets a short-lived access token for applications using JSON Web Token (JWT) to access the Conjur API./authn-jwt/{service_id}/{account}/authenticate
• POSTGets a short-lived access token for applications using OpenID Connect (OIDC) to access the Conjur API./authn-oidc/{service_id}/{account}/authenticate
• DELETEDeletes an existing role membership/roles/{account}/{kind}/{identifier}
• POSTUpdate or modify an existing role membership/roles/{account}/{kind}/{identifier}
• POSTGets a short-lived access token for applications using JSON Web Token (JWT) to access the Conjur API./authn-jwt/{service_id}/{account}/{id}/authenticate
• POSTGets a short-lived access token for applications running in Kubernetes./authn-k8s/{service_id}/{account}/{login}/authenticate
• POSTGets a short-lived access token for applications running in Azure./authn-azure/{service_id}/{account}/{login}/authenticate
• POSTGet a short-lived access token for applications running in AWS./authn-iam/{service_id}/{account}/{login}/authenticate

What HumDay can read from Conjur

These are the operations a schedule or a trigger can watch.

• GETBasic information about the Conjur Enterprise server/info
• GETHealth info about conjur/health
• GETProvides information about the client making an API request./whoami
• GETFetch multiple secrets/secrets
• GETLists resources within an organization account./resources
• GETDetails about which authenticators are on the Conjur Server/authenticators
• GETGets the API key of a user given the username and password via HTTP Basic Authentication./authn/{account}/login
• GETLists resources within an organization account./resources/{account}
• GETHealth info about a given Conjur Enterprise server/remote_health/{remote}
• GETGets the Conjur API key of a user given the LDAP username and password via HTTP Basic Authentication./authn-ldap/{service_id}/{account}/login
• GETDetails whether an authentication service has been configured properly/authn-gcp/{account}/status
• GETLists resources of the same kind within an organization account./resources/{account}/{kind}
• GETGet role information/roles/{account}/{kind}/{identifier}
• GETFetches the value of a secret from the specified Secret./secrets/{account}/{kind}/{identifier}
• GETShows a description of a single resource./resources/{account}/{kind}/{identifier}
• GETShows all public keys for a resource./public_keys/{account}/{kind}/{identifier}
• GETDetails whether an authentication service has been configured properly/{authenticator}/{service_id}/{account}/status

How automating Conjur works

1. Describe the outcome. Say what you want to happen, in your own words. No node graphs, no field mapping.
2. Approve the contract. HumDay writes down exactly what it will do, what it will touch, and what it will never do. You approve it before anything is built.
3. See it proven. The program runs and shows you the result before it is allowed near your live Conjur account.
4. Grant access, then go live. You approve the specific Conjur operations it may use — and only those.

Automate Conjur with these

• Cloudflare3122 operations
• IX API IX78 operations
• N Auth nextAuth55 operations
• Credas37 operations
• Cisco PSIRT openVuln19 operations
• Users (Okta )19 operations
• 1Password Connect15 operations
• CyCAT.org14 operations
• Swagger for Patrowl Engines14 operations
• Appspot Authentiq12 operations
• Testfire AltoroJ12 operations
• hashlookup CIRCL11 operations

Categories

• Security

Questions about Conjur automation

Can HumDay connect to Conjur?

Yes. HumDay reads Conjur's own published API description and derives the operations from it, so there is no hand-built connector to wait for. 41 operations are documented.

Do I need to write code to automate Conjur?

No. You describe the outcome you want in plain words. HumDay agrees a contract with you, writes the program, and shows you a test run before anything touches your Conjur account.

What can HumDay do in Conjur?

24 of the 41 documented operations change something in Conjur, and 17 read from it. HumDay only ever uses the specific operations your approved contract needs.

Is my Conjur account safe?

Your credentials are stored encrypted and are never shown in chat, code, or logs. Every run is limited to the operations you explicitly approved, and anything that writes to Conjur is held behind that approval.

Where this came from

The operations above are read from a published API description for Conjur at raw.githubusercontent.com/cyberark/conjur-openapi-spec/main/spec/openapi.yml. Descriptions are the provider’s own words, not ours. Last published 2023-03-06.