Access Management Commands

You can use the access management commands to manage wallets and endpoint groups.

okv manage-access endpoint-group add-endpoint

The okv manage-access endpoint-group add-endpoint command adds an existing endpoint to an endpoint group.

Required Authorization

Key Administrator role or the Manage Endpoint Group object privilege for the endpoint group

Syntax

okv manage-access endpoint-group add-endpoint --endpoint-group endpoint_group_name --endpoint endpoint_member

JSON Input File Template

{
  "service" : {
    "category" : "manage-access",
    "resource" : "endpoint-group",
    "action" : "add-endpoint",
    "options" : {
      "endpointGroup" : "#VALUE",
      "endpoint" : "#VALUE"
    }
  }
}

Parameters

Parameter/Template Parameter Required? Description
--endpoint-group / endpointGroup Required

Name of the endpoint group.

To find existing endpoint groups, run the okv manage-access endpoint-group list command.

--endpoint / endpoint Required

Name of the endpoint.

To find existing endpoints, run the okv admin endpoint list command.

JSON Example

  1. Generate JSON input for the okv manage-access endpoint-group add-endpoint command:

    okv manage-access endpoint-group add-endpoint --generate-json-input

    The generated JSON input is displayed as shown in the earlier section JSON Input File Template.

  2. Save the generated input to a file (for example, add_ep_to_group.json) and then edit it to add the endpoint to an endpoint group:

    {
  "service" : {
    "category" : "manage-access",
    "resource" : "endpoint-group",
    "action" : "add-endpoint",
    "options" : {
      "endpointGroup" : "epg_hr",
      "endpoint" : "hr_db_ep"
    }
  }
}

  3. Run the okv manage-access endpoint-group add-endpoint command using the generated JSON file:

    okv manage-access endpoint-group add-endpoint --from-json add_ep_to_group.json

    Output similar to the following appears:

    {
  "result" : "Success"
}

okv manage-access endpoint-group check-status

The okv manage-access endpoint-group check-status command checks the naming conflict resolution status of an endpoint group in a multi-master cluster.

This command is meant primarily for multi-master cluster environments. However, it is valid for other deployments and can be used to check the existence of an endpoint group.

Required Authorization

Key Administrator role or the Manage Endpoint Group object privilege for the endpoint group

Syntax

okv manage-access endpoint-group check-status --endpoint-group endpoint_group_name|--locator-id UUID

JSON Input File Template

{
  "service" : {
    "category" : "manage-access",
    "resource" : "endpoint-group",
    "action" : "check-status",
    "options" : {
      "endpointGroup" : "#VALUE",
      "locatorID" : "#VALUE"
    }
  }
}

Parameters

Parameter/Template Parameter Required? Description
--endpoint_group / -endpointGroup or --locator-id / locatorID Required

The name of the endpoint group or the locator ID (universally unique ID (UUID)) of the endpoint group that you want to check. The --locator-id / locatorID is required only if you are using a multi-master cluster environment.

You must specify either the --endpoint-group / endpointGroup value or the --locator-id / locatorID value, not both.

To find existing endpoint groups, run the okv manage-access endpoint-group list command.

To find the locator ID, check the output from the okv manage-access endpoint-group create command that was used to create this endpoint group.

JSON Example

  1. Generate JSON input for the okv manage-access endpoint-group check-status command:

    okv manage-access endpoint-group check-status --generate-json-input

    The generated JSON input is displayed as shown in the earlier section JSON Input File Template.

  2. Save the generated input to a file (for example, check-status_epg.json) and then edit it so that you can check the endpoint group’s status. Specify either the endpointGroup value or the locatorID value, but not both:

    {
  "service" : {
    "category" : "manage-access",
    "resource" : "endpoint-group",
    "action" : "check-status",
    "options" : {
      "locatorID" : "67E0906F-95EE-4A95-A496-D7DAEA5EDC5F"
    }
  }
}

  3. Run the okv manage-access endpoint-group check-status command using the generated JSON file:

    okv manage-access endpoint-group check-status --from-json check-status_epg.json

    Output similar to the following appears:

    {
  "result" : "Success",
  "value" : {
    "status" : "ACTIVE",
    "endpointGroup" : "EPG_HR"
  }
}

    Output includes the name of the endpoint group if the endpoint group object is in ACTIVE state. The endpoint group name shown here may be different from what was specified at the endpoint group creation time. If the endpoint groups with the same name are created on multiple cluster nodes, then Oracle Key Vault performs naming conflict resolution and it renames all but one endpoint groups by appending _OKVnode-id to the endpoint group name. For example, if you named the endpoint group EPG_HR, and there is a naming conflict, then the name could be EPG_HR_OKV01.

    On deployments other than multi-master cluster, this command returns Success if the endpoint group exists and output does not include entries showing the endpoint group name and its state.

okv manage-access endpoint-group create

The okv manage-access endpoint-group create command creates a new endpoint group.

Required Authorization

Key Administrator role or Create Endpoint Group system privilege

Syntax

okv manage-access endpoint-group create --endpoint-group endpoint_group_name --description "endpoint group description" --unique TRUE|FALSE

JSON Input File Template

{
  "service" : {
    "category" : "manage-access",
    "resource" : "endpoint-group",
    "action" : "create",
    "options" : {
      "endpointGroup" : "#VALUE",
      "description" : "#VALUE",
      "unique" : "#TRUE|FALSE"
    }
  }
}

Parameters

Parameter/Template Parameter Required? Description
--endpoint-group / endpointGroup Required

Name of the endpoint group. See Naming Guidelines for Objects.

To find existing endpoint groups, run the okv manage-access endpoint-group list command.

--description / description Optional A user-friendly description of the endpoint group enclosed within double quotation marks
--unique / unique Optional

Applies to a multi-master cluster environment only. This --unique parameter creates the endpoint group as a unique endpoint group. In a multi-master cluster, it is possible that an endpoint group with the same name could be created from two different nodes. If that happens, then the endpoint group names may conflict. The Oracle Key Vault conflict resolution scheme will keep one endpoint group with the given name and rename other endpoint groups with the conflicting names to a name using this format: given_epg_name_OKVnode_id.

Valid settings are as follows:

  • TRUE appends _OKVnode_id to the given name and thus prevent the conflict for this wallet name. The endpoint group is immediately usable.
  • FALSE (default) causes Oracle Key Vault to begin a checking process to find if the endpoint group name is unique. A unique ID is returned. You can use this ID to check the status of the endpoint group creation, whether it is in progress (PENDING) or complete (ACTIVE). If the status is PENDING, then it is not yet usable, so any actions performed on the endpoint group will fail. If the status is ACTIVE, then the endpoint group is usable. To check the status, run the okv admin endpoint-group check-status command. If the name that you provided is already used in another node, then the name for this endpoint group will have _OKVxx appended to it. For example, if you named the endpoint group epg12, and there is a naming conflict, the name could be EPG12_OKV01.

JSON Example

  1. Generate JSON input for the okv manage-access endpoint-group create command:

    okv manage-access endpoint-group create --generate-json-input

    The generated JSON input is displayed as shown in the earlier section JSON Input File Template.

  2. Save the generated input to a file (for example, create_epg.json) and then edit it so that you can create the endpoint group:

    {
  "service" : {
    "category" : "manage-access",
    "resource" : "endpoint-group",
    "action" : "create",
    "options" : {
      "endpointGroup" : "epg_hr",
      "description" : "HR endpoint group",
      "unique" : "FALSE"
    }
  }
}

  3. Run the okv manage-access endpoint-group create command using the generated JSON file:

    okv manage-access endpoint-group create --from-json create_epg.json

    Output for a multi-master cluster environment appears similar to the following:

    {
  "result" : "Success",
  "value" : {
    "status" : "PENDING",
    "locatorID" : "67E0906F-95EE-4A95-A496-D7DAEA5EDC5F"
  }
}

    You can use the locatorID from this output with the okv manage-access endpoint-group check-status command to display the current state of the endpoint group object. If the object status is ACTIVE, then this command also displays the object name after the conflict-name resolution.

okv manage-access endpoint-group delete

The okv manage-access endpoint-group delete command deletes an endpoint group.

Required Authorization

Key Administrator role or the Manage Endpoint Group object privilege for the endpoint group

Syntax

okv manage-access endpoint-group delete --endpoint-group endpoint_group_name

JSON Input File Template

{
  "service" : {
    "category" : "manage-access",
    "resource" : "endpoint-group",
    "action" : "delete",
    "options" : {
      "endpointGroup" : "#VALUE"
    }
  }
}

Parameters

Parameter/Template Parameter Required? Description
--endpoint-group / endpointGroup Required

Name of the endpoint group.

To find existing endpoint groups, run the okv manage-access endpoint-group list command.

JSON Example

  1. Generate JSON input for the okv manage-access endpoint-group delete command:

    okv manage-access endpoint-group delete --generate-json-input

    The generated JSON input is displayed as shown in the earlier section JSON Input File Template.

  2. Save the generated input to a file (for example, delete_epg.json) and then edit it so that you can delete the endpoint group:

    {
  "service" : {
    "category" : "manage-access",
    "resource" : "endpoint-group",
    "action" : "delete",
    "options" : {
      "endpointGroup" : "epg_hr"
    }
  }
}

  3. Run the okv manage-access endpoint-group delete command using the generated JSON file:

    okv manage-access endpoint-group delete --from-json delete_epg.json

    Output similar to the following appears:

    {
  "result" : "Success"
}

okv manage-access endpoint-group get

The okv manage-access endpoint-group get command retrieves detailed information about an endpoint group, such as its member endpoints and wallet access.

Required Authorization

Key Administrator role or the Manage Endpoint Group object privilege for the endpoint group

Syntax

okv manage-access endpoint-group get --endpoint-group endpoint_group_name

JSON Input File Template

{
  "service" : {
    "category" : "manage-access",
    "resource" : "endpoint-group",
    "action" : "get",
    "options" : {
      "endpointGroup" : "#VALUE"
    }
  }
}

Parameters

Parameter/Template Parameter Required? Description
--endpoint-group / endpointGroup Required

Name of the endpoint group.

To find existing endpoint groups, run the okv manage-access endpoint-group list command.

JSON Example

  1. Generate JSON input for the okv manage-access endpoint-group get command:

    okv manage-access endpoint-group get --generate-json-input

    The generated JSON input is displayed as shown in the earlier section JSON Input File Template.

  2. Save the generated input to a file (for example, get_ep_group.json) and then edit it to specify the endpoint group:

    {
  "service" : {
    "category" : "manage-access",
    "resource" : "endpoint-group",
    "action" : "get",
    "options" : {
      "endpointGroup" : "hr_ep_grp"
    }
  }
}

  3. Run the okv manage-access endpoint-group get command using the generated JSON file:

    okv manage-access endpoint-group get --from-json get_ep_group.json

    Output similar to the following appears:

    {
  "result" : "Success",
  "value" : {
    "createdBy" : "OKVADMIN",
    "creationTime" : "2021-07-14 13:09:14",
    "description" : "",
    "endpointGroup" : "HR_EP_GRP",
    "endpointGroupMembers" : [ {
      "description" : "",
      "endpoint" : "HR_DB_EP_1"
    }, {
      "description" : "",
      "endpoint" : "HR_DB_EP_2"
    } ],
    "walletAccess" : [ {
      "access" : "RO_MW",
      "wallet" : "hr_wallet"
    } ]
  }
}

okv manage-access endpoint-group list

The okv manage-access endpoint-group list command retrieves a list of endpoint groups and their associated information.

Required Authorization

Key Administrator role or the Manage Endpoint Group object privilege for the endpoint group

Syntax

okv manage-access endpoint-group list --limit number_of_endpoints

JSON Input File Template

{
  "service" : {
    "category" : "manage-access",
    "resource" : "endpoint-group",
    "action" : "list",
    "options" : {
      "limit" : "#VALUE"
    }
  }
}

Parameters

Parameter/Template Parameter Required? Description
--limit / limit Optional

Number of endpoint groups to list.

Enter any whole number from 1 and higher. If the limit is specified, then Oracle Key Vault fetches the number of endpoint groups up to the specified limit. If the limit is not specified, then Oracle Key Vault fetches up to 10,000 endpoint groups. If you specify a value that is greater than 10,000, then Oracle Key Vault will attempt to fetch those many endpoint groups, depending on the server, client, and network resources. In the output that you retrieve, the fetchedObjectCount value lists the actual number of endpoint groups that are fetched. For example, if you specify 100 as the limit but there are only 50 endpoint groups fetched, then Oracle Key Vault sets fetchedObjectCount to 50. If you omit this parameter, then Oracle Key Vault retrieves up to 10,000 endpoint groups. For another example, if the limit is 100 and fetchedObjectCount is 100, then this means that there are more endpoint groups. To fetch all endpoint groups, you need to run this command with an increased value for the --limit parameter. If fetchedObjectCount is less than the specified limit, then it means that you have retrieved all the available endpoint groups.

JSON Example

  1. Generate JSON input for the okv manage-access endpoint-group list command:

    okv manage-access endpoint-group list --generate-json-input

    The generated JSON input is displayed as shown in the earlier section JSON Input File Template.

  2. Save the generated input to a file (for example, list_ep_groups.json) and then edit it to specify the number of records for the output:

    {
  "service" : {
    "category" : "manage-access",
    "resource" : "endpoint-group",
    "action" : "list",
    "options" : {
      "limit" : "3"
    }
  }
}

  3. Run the okv manage-access endpoint-group list command using the generated JSON file:

    okv manage-access endpoint-group list --from-json list_ep_groups.json

    Output similar to the following appears:

    {
  "result" : "Success",
  "value" : {
    "endpointGroups" : [ {
      "createdBy" : "OKVADMIN",
      "creationTime" : "2021-07-14 13:09:14",
      "description" : "",
      "endpointGroup" : "EPG_HR"
    }, {
      "createdBy" : "OKVADMIN",
      "creationTime" : "2021-07-16 19:29:03",
      "description" : "",
      "endpointGroup" : "SALES_DB_EPG"
    }, {
      "createdBy" : "OKVADMIN",
      "creationTime" : "2021-07-16 19:29:17",
      "description" : "",
      "endpointGroup" : "ORDERS_DB_EPG"
    } ]
  }
}

okv manage-access endpoint-group remove-endpoint

The okv manage-access endpoint-group remove-endpoint command removes an endpoint from an endpoint group.

Required Authorization

Key Administrator role or the Manage Endpoint Group object privilege for the endpoint group

Syntax

okv manage-access endpoint-group remove-endpoint --endpoint-group endpoint_group_name --endpoint endpoint_name

JSON Input File Template

{
  "service" : {
    "category" : "manage-access",
    "resource" : "endpoint-group",
    "action" : "remove-endpoint",
    "options" : {
      "endpointGroup" : "#VALUE",
      "endpoint" : "#VALUE"
    }
  }
}

Parameters

Parameter/Template Parameter Required? Description
--endpoint-group / endpointGroup Required

Name of the endpoint group that you want to remove.

To find existing endpoints, run the okv admin endpoint list command.

--endpoint / endpoint Required

Name of the endpoint that is associated with the endpoint group.

To find existing endpoints, run the okv admin endpoint list command.

JSON Example

  1. Generate JSON input for the okv manage-access endpoint-group remove-endpoint command:

    okv manage-access endpoint-group remove-endpoint --generate-json-input

    The generated JSON input is displayed as shown in the earlier section JSON Input File Template.

  2. Save the generated input to a file (for example, remove_ep_from_epg.json) and then edit it to remove the endpoint from the endpoint group:

    {
  "service" : {
    "category" : "manage-access",
    "resource" : "endpoint-group",
    "action" : "remove-endpoint",
    "options" : {
      "endpointGroup" : "epg_hr",
      "endpoint" : "hr_db_ep"
    }
  }
}

  3. Run the okv manage-access endpoint-group remove-endpoint command using the generated JSON file:

    okv manage-access endpoint-group remove-endpoint --from-json remove_ep_from_epg.json

    Output similar to the following appears:

    {
  "result" : "Success"
}

okv manage-access endpoint-group update

The okv manage-access endpoint-group update command changes the name and description of an endpoint group, and can be used to ensure that the endpoint group name is unique.

Required Authorization

Key Administrator role or the Manage Endpoint Group object privilege for the endpoint group

Syntax

okv manage-access endpoint-group update --endpoint-group endpoint_group_name --description "description" --name new_endpoint_group_name --unique TRUE|FALSE

JSON Input File Template

{
  "service" : {
    "category" : "manage-access",
    "resource" : "endpoint-group",
    "action" : "update",
    "options" : {
      "endpointGroup" : "#VALUE",
      "name" : "#VALUE",
      "description" : "#VALUE",
      "unique" : "#TRUE|FALSE"
    }
  }
}

Parameters

Parameter/Template Parameter Required? Description
--endpoint-group / endpointGroup Required

Current name of the endpoint group.

To find existing endpoint groups, run the okv manage-access endpoint-group list command.

--description / description Optional A user-friendly description of the endpoint group enclosed within double quotation marks
--name / name Optional New endpoint group name. See Naming Guidelines for Objects.
--unique / unique Optional

Applies to a multi-master cluster environment only. This --unique parameter creates the endpoint group as a unique endpoint group. In a multi-master cluster, it is possible that an endpoint group with the same name could be created from two different nodes. If that happens, then the endpoint group names may conflict. The Oracle Key Vault conflict resolution scheme will keep one endpoint group with the given name and rename other endpoint groups with the conflicting names to a name using this format: given_epg_name_OKVnode_id.

Valid settings are as follows:

  • TRUE appends _OKVnode_id to the given name and thus prevent the conflict for this wallet name. The endpoint group is immediately usable.
  • FALSE (default) causes Oracle Key Vault to begin a checking process to find if the endpoint group name is unique. A unique ID is returned. You can use this ID to check the status of the endpoint group creation, whether it is in progress (PENDING) or complete (ACTIVE). If the status is PENDING, then it is not yet usable, so any actions performed on the endpoint group will fail. If the status is ACTIVE, then the endpoint group is usable. To check the status, run the okv admin endpoint-group check_status command. If the name that you provided is already used in another node, then the name for this endpoint group will have _OKVxx appended to it. For example, if you named the endpoint group epg12, and there is a naming conflict, the name could be EPG12_OKV01.

JSON Example

  1. Generate JSON input for the okv manage-access endpoint-group update command:

    okv manage-access endpoint-group update --generate-json-input

    The generated JSON input is displayed as shown in the earlier section JSON Input File Template.

  2. Save the generated input to a file (for example, epg_update.json) and then edit it so that you can update the endpoint group:

    {
  "service" : {
    "category" : "manage-access",
    "resource" : "endpoint-group",
    "action" : "update",
    "options" : {
      "endpointGroup" : "epg_hr",
      "name" : "epg_hr_global",
      "description" : "Global HR Endpoint Group",
      "unique" : "FALSE"
    }
  }
}

  3. Run the okv manage-access endpoint-group update command using the generated JSON file:

    okv manage-access endpoint-group update --from-json epg_update.json

    Output similar to the following appears:

    {
  "result" : "Success",
  "value" : {
    "status" : "PENDING",
    "locatorID" : "67E0906F-95EE-4A95-A496-D7DAEA5EDC5F"
  }
}

    This example shows the output for renaming an endpoint group in a multi-master cluster. On renaming, an endpoint group is placed into the PENDING state for the duration of the naming conflict resolution.

    You can use the locatorID from this output with the okv manage-access endpoint-group check-status command to display the current state of the endpoint group object. If the object status is ACTIVE, then this command also displays the object name after the conflict-name resolution.

    Unless you renamed the endpoint group in a multi-master cluster, the status and locatorID entries are not included in the output.

okv manage-access wallet add-access

The okv manage-access wallet add-access command grants an endpoint or an endpoint group a level of access to a wallet.

This command uses a user name and password for the authentication.

Required Authorization

Key Administrator role or manage wallet (MW) permission on the wallet

Syntax

okv manage-access wallet add-access --wallet wallet_name --endpoint endpoint_name|--endpoint-group endpoint_group_name --access RO|RM|RO_MW|RM_MW

JSON Input File Template

{
  "service": {
    "category": "manage-access",
    "resource": "wallet",
    "action": "add-access",
    "options": {
      "wallet": "#VALUE",
      "endpointGroup": "#VALUE",
      "endpoint": "#VALUE",
      "access": "#RO|RM|RO_MW|RM_MW"
    }
  }
}

Parameters

Parameter/Template Parameter Required? Description
--wallet / wallet Required Wallet name. To find the names of existing wallets to which you have access, run the okv manage-access wallet list command.

--endpoint / endpoint

or

--endpoint-group / endpointGroup

 Required

Name of the endpoint or endpoint group. You can only specify either an endpoint or an endpoint group, but not both.

To find registered endpoints, run the okv admin endpoint list command. To find endpoint groups, run okv manage-access endpoint-group list.

--access / access Required

Enter one of the following values:

  • RO for read-only access
  • RM for read-and-modify access
  • RO_MW for read-only and manage-wallet access
  • RM_MW for read-and-modify and manage-wallet access

JSON Example

  1. Generate JSON input for the okv manage-access wallet add-access command:

    okv manage-access wallet add-access --generate-json-input

    The generated JSON input is displayed as shown in the earlier section JSON Input File Template.

  2. Save the generated input to a file (for example, add_access_wallet.json) and then edit it so that you can add wallet access to the endpoint settings or the endpoint group, but not both. The following example shows wallet access to an endpoint only:

    {
  "service": {
    "category": "manage-access",
    "resource": "wallet",
    "action": "add-access",
    "options": {
      "wallet": "hr_wallet",
      "endpoint": "hr_db_ep",
      "access": "RO"
    }
  }
}

  3. Run the okv manage-access wallet add-access command using the generated JSON file:

    okv manage-access wallet add-access --from-json add_access_wallet.json

    Output similar to the following appears:

    {
  "result": "Success"
}

okv manage-access wallet add-object

The okv manage-access wallet add-object command adds a security object to a wallet.

This command uses a user name and password for the authentication.

Required Authorization

Key Administrator role or have read-modify permission on the object and manage wallet (MW) permission on the wallet.

Syntax

okv manage-access wallet add-object --wallet wallet_name --uuid uuid

JSON Input File Template

{
  "service" : {
    "category" : "manage-access",
    "resource" : "wallet",
    "action" : "add-object",
    "options" : {
      "wallet" : "#VALUE",
      "uuid" : "#VALUE"
    }
  }
}

Parameters

Parameter/Template Parameter Required? Description
--wallet / wallet Required Wallet name. To find the names of existing wallets to which you have access, run the okv manage-access wallet list command.
--uuid / uuid Required

Universally unique ID (UUID) of the security object.

To find the unique identifier for the object, in the Oracle Key Vault management console, click the Keys & Wallets tab, and then click Keys & Secrets in the left navigation window. In the Keys & Secrets table, check the Unique Identifier column.

JSON Example

  1. Generate JSON input for the okv manage-access wallet add-object command:

    okv manage-access wallet add-object --generate-json-input

    The generated JSON input is displayed as shown in the earlier section JSON Input File Template.

  2. Save the generated input to a file (for example, add_obj_wallet.json) and then edit it to specify the object to add to the wallet:

    {
  "service" : {
    "category" : "manage-access",
    "resource" : "wallet",
    "action" : "add-object",
    "options" : {
      "wallet" : "hr_wallet",
      "uuid" : "7432AED6-6628-4F43-BF7C-9D30023A4301"
    }
  }
}

  3. Run the okv manage-access wallet add-object command using the generated JSON file:

    okv manage-access wallet add-object --from-json add_object_wallet.json

    Output similar to the following appears:

    {
  "result": "Success"
}

okv manage-access wallet check-status

The okv manage-access wallet check-status command checks the naming conflict resolution status of a wallet in a multi-master cluster.

This command is meant primarily for multi-master cluster environments. However, it is valid for other deployments and can be used to check the existence of a wallet.

This command uses a user name and password for the authentication.

Required Authorization

None, but the user only gets the status for the wallets to which he or she has access.

Syntax

okv manage-access wallet check-status --wallet wallet_name|--locator-id UUID

JSON Input File Template

{
  "service" : {
    "category" : "manage-access",
    "resource" : "wallet",
    "action" : "check-status",
    "options" : {
      "wallet" : "#VALUE",
      "locatorID" : "#VALUE"
    }
  }
}

Parameters

Parameter/Template Parameter Required? Description
--wallet / wallet or --locator-id / locatorID Optional

The name of the wallet or the locator ID (universally unique ID (UUID)) of the wallet that you want to check. The --locator-id / locatorID is required only if you are using a multi-master cluster environment.

You must specify either the --wallet / wallet value or the --locator-id / locatorID value, not both.

To find the names of existing wallets to which you have access, run the okv manage-access wallet list command.

To find the locator ID, check the output of the okv manage-access wallet create command that was used to create this wallet.

JSON Example

  1. Generate JSON input for the okv manage-access wallet check-status command:

    okv manage-access wallet check-status --generate-json-input

    The generated JSON input is displayed as shown in the earlier section JSON Input File Template.

  2. Save the generated input to a file (for example, check_wallet.json) and then edit it so that you can check the status of the wallet. Specify either the wallet value or the locatorID value, but not both:

    {
  "service" : {
    "category" : "manage-access",
    "resource" : "wallet",
    "action" : "check-status",
    "options" : {
      "locatorID" : "81800CE6-6AAF-4EF5-A0FD-446ED6625F6A"
    }
  }
}

  3. Run the okv manage-access wallet check-status command using the generated JSON file:

    okv manage-access wallet check-status --from-json check_wallet.json

    Output similar to the following appears:

    {
  "result" : "Success",
  "value" : {
    "status" : "ACTIVE",
    "wallet" : "hr_wallet"
  }
}

    Output includes the name of the wallet if the wallet object is in ACTIVE state. The wallet name shown here may be different from what was specified at the wallet creation time. If the wallets with the same name are created on multiple cluster nodes, Oracle Key Vault performs naming conflict resolution and it renames all but one wallets by appending _OKVnode-id to the wallet name. For example, if you named the wallet HR_WALLET, and there is a naming conflict, the name could be HR_WALLET_OKV01.

    On deployments other than multi-master cluster, this command returns Success if the wallet exists and output does not include entries showing the wallet name and its state.

okv manage-access wallet create

The okv manage-access wallet create command creates a wallet.

This command uses a user name and password for the authentication.

Required Authorization

None

Syntax

okv manage-access wallet create [--description <description>] [--ssh-server-host-user <ssh-server-host-user>] [--type <type>] [--unique <unique>] --wallet <wallet>

JSON Input File Template

{
  "service" : {
    "category" : "manage-access",
    "resource" : "wallet",
    "action" : "create",
    "options" : {
      "wallet" : "#VALUE",
      "type" : "#GENERAL|SSH_SERVER",
      "description" : "#VALUE",
      "unique" : "#TRUE|FALSE",
      "sshServerHostUser" : "#VALUE"
    }
  }
}

Parameters

Parameter / Template Parameter Required? Description
--wallet / wallet Required Wallet name. To find the names of existing wallets to which you have access, run the okv manage-access wallet list command. Ensure that you follow the naming guidelines for objects.
--description / description Optional A user-friendly description for the wallet, enclosed within double quotation marks
--unique / unique Optional Applies to a multi-master cluster environment only. This --unique parameter creates the wallet as a unique wallet. In a multi-master cluster, it is possible that a wallet with the same name could be created from two different nodes. If that happens, then the wallet names may conflict.

The Oracle Key Vault conflict resolution scheme will keep one wallet with the given name and rename other wallets with the conflicting names to a name using this format: given_wallet_name_OKV node_id.
Valid settings are as follows:

- TRUE appends _OKV node_id to the given name and thus prevents the conflict for this wallet name. The wallet is immediately usable.
- FALSE causes Oracle Key Vault to begin a checking process to find if the wallet name is unique. A unique ID is returned. You can use this ID to check the status of the wallet creation, whether it is in progress (PENDING) or complete (ACTIVE). If the status is PENDING, then it is not yet usable, so any actions performed on the wallet will fail.

If the status is ACTIVE, then confirm the name of the wallet after Oracle Key Vault performs name resolution for this name by executing the okv manage-access wallet check-status command. If the name that you provided is already used in another node, then the name for this wallet will have _OKV xx appended to it. For example, if you named the wallet wallet12, and there is a naming conflict, the name could be WALLET12_OKV01.

If the name that you provided has no naming conflicts, then it will be accepted as the wallet name without any changes.
--ssh-server-host-user / sshServerHostUser Optional The user on the SSH Server for whom this wallet is intended to authorize SSH access. It can be used only for SSH_SERVER type wallet.
--type / type Optional The type of wallet to create:

- GENERAL: Holds any type of security object. This is the default value.
- SSH_SERVER: Holds SSH public keys and is associated with Oracle Key Vault SSH Server endpoint.

JSON Example

  1. Generate JSON input for the okv manage-access wallet create command:

    okv manage-access wallet create --generate-json-input

    The generated JSON input is displayed as shown in the earlier section JSON Input File Template.

  2. Save the generated input to a file (for example, create_wallet.json) and then edit it so that you can create the wallet:

    {
  "service" : {
    "category" : "manage-access",
    "resource" : "wallet",
    "action" : "create",
    "options" : {
      "wallet" : "hr_wallet",
      "description" : "wallet for HR endpoint",
      "unique" : "FALSE"
    }
  }
}

  3. Run the okv manage-access wallet create command using the generated JSON file:

    okv manage-access wallet create --from-json create_wallet.json

    Output for a multi-master cluster environment appears as follows:

    {
  "result" : "Success",
  "value" : {
    "status" : "PENDING",
    "locatorID" : "81800CE6-6AAF-4EF5-A0FD-446ED6625F6A"
  }
}

    You can use the locatorID from this output with the okv manage-access wallet check-status command to display the current state of the wallet object. If the object status is ACTIVE, then this command also displays the object name after the conflict-name resolution.

Related Topics

okv manage-access wallet delete

The okv manage-access wallet delete command deletes a wallet.

This command uses a user name and password for the authentication.

Required Authorization

Key Administrator role or manage wallet (MW) permission on the wallet

Syntax

okv manage-access wallet delete --wallet wallet_name

JSON Input File Template

{
  "service" : {
    "category" : "manage-access",
    "resource" : "wallet",
    "action" : "delete",
    "options" : {
      "wallet" : "#VALUE"
    }
  }
}

Parameters

Parameter/Template Parameter Required? Description
--wallet / wallet Required Wallet name. To find the names of existing wallets to which you have access, run the okv manage-access wallet list command.

JSON Example

  1. Generate JSON input for the okv manage-access wallet delete command:
okv manage-access wallet delete --generate-json-input
The generated JSON input is displayed as shown in the earlier section **JSON Input File Template**.

  1. Save the generated input to a file (for example, del_wallet.json) and then edit it to specify the wallet to delete from Oracle Key Vault:

    {
  "service" : {
    "category" : "manage-access",
    "resource ": "wallet",
    "action" : "delete",
    "options" : {
      "wallet" : "hr_wallet"
    }
  }
}

  2. Run the okv manage-access wallet delete command using the generated JSON file:

    okv manage-access wallet delete --from-json del_wallet.json

    Output similar to the following appears:

    {
  "result" : "Success"
}

okv manage-access wallet get

The okv manage-access wallet get command retrieves information about a specified wallet, such as the default wallet name and the wallet access.

This command uses a user name and password for the authentication.

Required Authorization

None

Syntax

okv manage-access wallet get --wallet wallet_name

JSON Input File Template

{
  "service" : {
    "category" : "manage-access",
    "resource" : "wallet",
    "action" : "get",
    "options" : {
      "wallet" : "#VALUE"
    }
  }
}

Parameters

Parameter/Template Parameter Required? Description
--wallet / wallet Required Wallet name. To find the names of existing wallets to which you have access, run the okv manage-access wallet list command.

JSON Example

  1. Generate JSON input for the okv manage-access wallet get command:

    okv manage-access wallet get --generate-json-input

    The generated JSON input is displayed as shown in the earlier section JSON Input File Template.

  2. Save the generated input to a file (for example, get_wallet.json) and then edit it to specify the name of the wallet:

    {
  "service" : {
    "category" : "manage-access",
    "resource" : "wallet",
    "action" : "get",
    "options" : {
      "wallet" : "hr_wallet"
    }
  }
}

  3. Run the okv manage-access wallet get command using the generated JSON file:

    okv manage-access wallet get --from-json get_wallet.json

    Output similar to the following appears:

    {
  "result" : "Success",
  "value" : {
    "createdBy" : "OKVADMIN",
    "creationTime" : "2025-07-30 19:40:59",
    "description" : "",
    "type" : "GENERAL",
    "wallet" : "hr_wallet",
    "walletAccess" : {
      "endpointAccess" : [ {
        "access" : "RO_MW",
        "defaultWallet" : "",
        "subjectName" : "HR_DB_EP1",
        "type" : "Direct"
      }, {
        "access" : "RO",
        "defaultWallet" : "TRUE",
        "subjectName" : "HR_DB_EP2",
        "type" : "Direct"
      } ],
      "endpointGroupAccess" : [ {
        "access" : "RO_MW",
        "subjectName" : "HR_DB_EPG"
      } ],
      "userAccess" : [ {
        "access" : "RO",
        "subjectName" : "Paul Hill"
      } ],
      "userGroupAccess" : [ {
        "access" : "RO",
        "subjectName" : "HR_GROUP_1"
      } ]
    }
  }
}

okv manage-access wallet get-default

The okv manage-access wallet get-default command gets the default wallet that has been associated with an endpoint.

This command uses a user name and password for the authentication.

Required Authorization

None, but the default wallet information for the endpoint is returned if the user has some level of access on that wallet.

Syntax

okv manage-access wallet get-default --endpoint endpoint_name

JSON Input File Template

{
  "service" : {
    "category" : "manage-access",
    "resource" : "wallet",
    "action" : "get-default",
    "options" : {
      "endpoint" : "#VALUE"
    }
  }
}

Parameters

Parameter/Template Parameter Required? Description
--endpoint / endpoint Required

Name of the endpoint.

To find existing endpoints, run the okv admin endpoint list command.

JSON Example

  1. Generate JSON input for the okv manage-access wallet get-default command:

    okv manage-access wallet get-default --generate-json-input

    The generated JSON input is displayed as shown in the earlier section JSON Input File Template.

  2. Save the generated input to a file (for example, get_def_wallet.json) and then edit it to retrieve the default wallet that is associated with the specified endpoint:

    {
  "service" : {
    "category" : "manage-access",
    "resource" : "wallet",
    "action" : "get-default",
    "options" : {
      "endpoint" : "hr_db_ep"
    }
  }
}

  3. Run the okv manage-access wallet get-default command using the generated JSON file:

    okv manage-access wallet get-default --from-json get_def_wallet.json

    Output similar to the following appears:

    {
  "result" : "Success",
  "value" : {
    "defaultWallet" : "HR_WALLET"
  }
}

okv manage-access wallet list

The okv manage-access wallet list command lists wallets on which some level of access is granted to the user.

Required Authorization

None

Syntax

okv manage-access wallet list --limit number_of_wallets

JSON Input File Template

{
  "service" : {
    "category" : "manage-access",
    "resource" : "wallet",
    "action" : "list",
    "options" : {
      "type" : "#GENERAL|SSH_SERVER",
      "limit" : "#VALUE"
    }
  }
}

Parameters

Parameter/Template Parameter Required? Description
--limit / limit Optional

Number of wallets to list.

Enter any whole number from 1 and higher. If the limit is specified, then Oracle Key Vault fetches the number of wallets up to the specified limit. If the limit is not specified, then Oracle Key Vault fetches up to 10,000 wallets. If you specify a value that is greater than 10,000, then Oracle Key Vault will attempt to fetch those many wallets, depending on the server, client, and network resources. In the output that you retrieve, the fetchedObjectCount value lists the actual number of wallets that are fetched. For example, if you specify 100 as the limit but there are only 50 wallets fetched, then Oracle Key Vault sets fetchedObjectCount to 50. If you omit this parameter, then Oracle Key Vault retrieves up to 10,000 wallets. For another example, if the limit is 100 and fetchedObjectCount is 100, then this means that there are more wallets. To fetch all wallets, you need to run this command with an increased value for the --limit parameter. If fetchedObjectCount is less than the specified limit, then it means that you have retrieved all the available wallets.

--type / type Optional

Type of the wallet. The allowed values are:

  • GENERAL
  • SSH_SERVER

You can also specify a combination of comma separated values. The filter is applied to each value independently, and the combined results returned effectively supporting an OR operation.

JSON Example

  1. Generate JSON input for the okv manage-access wallet list command:

    okv manage-access wallet list --generate-json-input

    The generated JSON input is displayed as shown in the earlier section JSON Input File Template.

  2. Save the generated input to a file (for example, list_wallets.json) and then edit it to specify the number of records:

    {
  "service" : {
    "category" : "manage-access",
    "resource" : "wallet",
    "action" : "list",
    "options" : {
      "limit" : "3"
    }
  }
}

  3. Run the okv manage-access wallet list command using the generated JSON file:

    okv manage-access wallet list --from-json list_wallets.json

    Output similar to the following appears:

    {
  "result" : "Success",
  "value" : {
    "fetchedObjectCount" : "3",
    "wallets" : [ {
      "createdBy" : "OKVADMIN",
      "creationTime" : "2021-07-13 15:22:02",
      "description" : "",
      "wallet" : "HR_WALLET",
      "type" : "GENERAL"
    }, {
      "createdBy" : "OKVADMIN",
      "creationTime" : "2021-07-30 19:40:59",
      "description" : "",
      "wallet" : "sales_wallet",
      "type" : "GENERAL"
    }, {
      "createdBy" : "OKVADMIN",
      "creationTime" : "2021-09-13 04:55:06",
      "description" : "",
      "wallet" : "ORDERS_WALLET",
      "type" : "GENERAL"
    } ]
  }
}

okv manage-access wallet list-endpoint-wallets

The okv manage-access wallet list-endpoint-wallets command lists the wallets that are associated with an endpoint.

This command uses a user name and password for the authentication.

Required Authorization

None, but this command returns information about only those wallets on which user has some level of access.

Syntax

okv manage-access wallet list-endpoint-wallets --endpoint endpoint_name

JSON Input File Template

{
  "service" : {
    "category" : "manage-access",
    "resource" : "wallet",
    "action" : "list-endpoint-wallets",
    "options" : {
      "endpoint" : "#VALUE",
      "limit" : "#VALUE"
    }
  }
}

Parameters

Parameter/Template Parameter Required? Description
--endpoint / endpoint Required

The name of the endpoint.

To find existing endpoints, run the okv admin endpoint list command.

JSON Example

  1. Generate JSON input for the okv manage-access wallet list-endpoint-wallets command:

    okv manage-access wallet list-endpoint-wallets --generate-json-input

    The generated JSON input is displayed as shown in the earlier section JSON Input File Template.

  2. Save the generated input to a file (for example, list_ep_wallets.json) and then edit it so that you can find the wallets that are associated with the specified endpoint:

    {
  "service" : {
    "category" : "manage-access",
    "resource" : "wallet",
    "action" : "list-endpoint-wallets",
    "options" : {
      "endpoint" : "hr_db_ep"
    }
  }
}

  3. Run the okv manage-access wallet list-endpoint-wallets command using the generated JSON file:

    okv manage-access wallet list-endpoint-wallets --from-json list_ep_wallets.json

    Output similar to the following appears:

    {
  "result" : "Success",
  "value" : {
    "wallets" : [ "WALLET10", "WALLET11" ]
  }
}

okv manage-access wallet list-objects

The okv manage-access wallet list-objects command retrieves the security objects that are members of the specified wallet.

Required Authorization

The user must have some level of access on the wallet.

Syntax

okv manage-access wallet  list-objects [--exclude-wallet-membership  <exclude-wallet-membership>]
[--limit <limit>] [--state  <state>] [--type <type>] --wallet <wallet>

JSON Input File Template

{
  "service" : {
    "category" : "manage-access",
    "resource" : "wallet",
    "action" : "list-objects",
    "options" : {
      "wallet" : "#VALUE",
      "state" : "#PRE-ACTIVE|ACTIVE|DEACTIVATED|COMPROMISED|DESTROYED|DESTROYED_COMPROMISED",
      "type" : "#CERTIFICATE|OPAQUE|PRIVATE_KEY|PUBLIC_KEY|SECRET|SYMMETRIC_KEY",
      "limit" : "#VALUE",
      "excludeWalletMembership" : "#TRUE|FALSE"
    }
  }
}

Parameters

Parameter/Template Parameter Required? Description
--wallet / wallet Required Wallet name. To find the names of existing wallets to which you have access, run the okv manage-access wallet list command.
--limit / limit Optional

Number of objects to list for the specified wallet.

Enter any whole number from 1 and higher. If the limit is specified, then Oracle Key Vault fetches the number of objects up to the specified limit. If the limit is not specified, then Oracle Key Vault fetches up to 10,000 objects. If you specify a value that is greater than 10,000, then Oracle Key Vault will attempt to fetch that value, depending on the server, client, and network resources. In the output that you retrieve, the fetchedObjectCount value lists the actual number of objects that are fetched. For example, if you specify 100 as the limit but there are only 50 objects fetched, then Oracle Key Vault sets fetchedObjectCount to 50. If you omit this parameter, then Oracle Key Vault retrieves up to 10,000 objects. For another example, if the limit is 100 and fetchedObjectCount is 100, then this means that there are more objects. To fetch all objects, you need to run this command with an increased value for the --limit parameter. If fetchedObjectCount is less than the specified limit, then it means that you have retrieved all the available objects.

--exclude-wallet-membership / excludeWalletMembership Optional

Controls whether wallet membership information for each object is include in the output.

  • TRUE excludes the wallet membership information for each object. Excluding the wallet membership information may improve the performance of this command if the wallet has large number of objects.
  • FALSE (default) includes the wallet membership information for each object.
--type / type Optional

Type of the security object. The allowed values are:

  • CERTIFICATE
  • OPAQUE
  • PRIVATE_KEY
  • PUBLIC_KEY
  • SECRET
  • SYMMETRIC_KEY

You can also specify a combination of comma separated values. The filter is applied to each value independently, and the combined results returned effectively supporting an OR operation.

--state / state Optional

State of the security object. The allowed values are:

  • PRE-ACTIVE
  • ACTIVE
  • DEACTIVATED
  • COMPROMISED
  • DESTROYED
  • DESTROYED_COMPROMISED

You can also specify a combination of comma separated values. The filter is applied to each value independently, and the combined results returned effectively supporting an OR operation.

JSON Example

  1. Generate JSON input for the okv manage-access wallet list-objects command:

    okv manage-access wallet list-objects --generate-json-input

    The generated JSON input is displayed as shown in the earlier section JSON Input File Template.

  2. Save the generated input to a file (for example, list_wallet_obj.json) and then edit it to specify a number of objects for the wallet:

    {
  "service" : {
    "category" : "manage-access",
    "resource" : "wallet",
    "action" : "list-objects",
    "options" : {
      "wallet" : "hr_wallet",
      "limit" : "2",
      "excludeWalletMembership" : "FALSE"
    }
  }
}

  3. Run the okv manage-access wallet list-objects command using the generated JSON file:

    okv manage-access wallet list-objects --from-json list_wallet_obj.json

    Output similar to the following appears:

    {
  "result" : "Success",
  "value" : {
    "fetchedObjectCount" : "2",
    "managedObjects" : [ {
      "creatingEndpoint" : "HR_DB_EP",
      "creationDate" : "2021-07-26 20:19:32",
      "deactivationDate" : "2029-12-25 15:11:11",
      "displayName" : "X.509 Certificate: DN EMAILADDRESS=psmith@example.com, CN=vienna, OU=Security, O=Oracle, L=Reston, ST=VA, C=US",
      "name" : "ps1009",
      "protectStopDate" : "2029-12-25 15:11:11",
      "state" : "Pre-Active",
      "type" : "Certificate",
      "uuid" : "975F17DF-11C1-4F16-BFBC-28E9C200C99F",
      "walletMembership" : [ "hr_wallet" ]
    }, {
      "creatingEndpoint" : "EMP_DB_EP",
      "creationDate" : "2021-06-30 21:01:48",
      "deactivationDate" : "",
      "displayName" : "Symmetric Key: Name psc7",
      "name" : "ps100,ps3,psa5,psb6,psc7",
      "protectStopDate" : "",
      "state" : "Active",
      "type" : "Symmetric Key",
      "uuid" : "7432AED6-6628-4F43-BF7C-9D30023A4301",
      "walletMembership" : [ "hr_wallet" ]
    } ]
  }
}

okv manage-access wallet list-objects-wallets

The okv manage-access wallet list-object-wallets command lists the wallets that contain a security object. You can identify the object by its UUID or its name attribute value. When you specify a name, the command also returns the object’s UUID.

The command returns information only for objects and wallets accessible to the user running the command.

Required Authorization

None

Syntax

okv manage-access wallet list-object-wallets --uuid uuid --name name

JSON Input File Template

okv manage-access wallet list-object-wallets --generate-json-input
{
  "service" : {
    "category" : "manage-access",
    "resource" : "wallet",
    "action" : "list-object-wallets",
    "options" : {
      "uuid" : "#VALUE",
      "name" : "#VALUE"
    }
  }
}

Parameters

You must specify a value for either the uuid or name, but not both.

Parameter/Template Parameter Required? Description
--uuid / uuid Required if name is not specified Universally unique ID (UUID) of the security object.
--name / name Required if UUID is not specified Name of the security object. When you specify a name, the command also returns the object’s UUID.
For Oracle Database TDE master encryption keys, specify the name attribute value in the format ORACLE.TDE.HSM.MK.06<MasterKeyIdentifier>, where ORACLE.TDE.HSM.MK.06 is the prefix and <MasterKeyIdentifier> is the 32-character hexadecimal TDE master key identifier (MKID). For example, if the master key identifier is MKID 1F1E1D1C1B1A10191817161514131210, the name attribute value is ORACLE.TDE.HSM.MK.061F1E1D1C1B1A10191817161514131210.

JSON Example

  1. Generate the JSON input for the okv manage-access wallet list-objects-wallets command:

    okv manage-access wallet list-object-wallets --generate-json-input

    The generated JSON input is displayed as shown in the earlier section JSON Input File Template.

  2. Save the generated input to a file (for example, list_object_by_wallet.json) and then edit it to find the TDE key’s UUID and wallet memberships. Note: Specify either the uuid value or the name value, but not both.

    Sample input containing UUID value

    {
  "service" : {
    "category" : "manage-access",
    "resource" : "wallet",
    "action" : "list-object-wallets",
    "options" : {
      "uuid" : "23ED3089-B341-43BF-8FB3-432ADFC7511F"
    }
  }
}

    Sample input containing name value

    {
  "service" : {
    "category" : "manage-access",
    "resource" : "wallet",
    "action" : "list-object-wallets",
    "options" : {
      "name" : "ORACLE.TDE.HSM.MK.061F1E1D1C1B1A10191817161514131210"
    }
  }
}

  3. Run the okv manage-access wallet list-objects-wallets command using the generated JSON file:

    okv manage-access wallet list-objects-wallets --from-json list_object_by_wallet.json

    Output similar to the following appears:

    {
  "result" : "Success",
  "value" : {
    "uuid": "23ED3089-B341-43BF-8FB3-432ADFC7511F",
    "wallets" : [ "okv_rac_wallet1" ]
  }
}

okv manage-access wallet remove-access

The okv manage-access wallet remove-access command removes the access that an endpoint or an endpoint group has to a wallet.

This command uses a user name and password for the authentication.

Required Authorization

Key Administrator role or manage wallet (MW) permission on the wallet

Syntax

okv manage-access wallet remove-access --wallet wallet_name --endpoint endpoint_name|--endpoint-group endpoint_group_name

JSON Input File Template

{
  "service" : {
    "category" : "manage-access",
    "resource" : "wallet",
    "action" : "remove-access",
    "options" : {
      "wallet" : "#VALUE",
      "endpointGroup" : "#VALUE",
      "endpoint" : "#VALUE"
    }
  }
}

Parameters

Parameter/Template Parameter Required? Description
--wallet / wallet Required Wallet name. To find the names of existing wallets to which you have access, run the okv manage-access wallet list command.

--endpoint / endpoint

or

--endpoint-group / endpointGroup

 Required

Name of the endpoint or endpoint group.

To find existing endpoints, run the okv admin endpoint list command. To find endpoint groups, run okv manage-access endpoint-group list.

JSON Example

  1. Generate JSON input for the okv manage-access wallet remove-access command:

    okv manage-access wallet remove-access --generate-json-input

    The generated JSON input is displayed as shown in the earlier section JSON Input File Template. The JSON input includes wallet access settings for both endpoints and endpoint groups.

  2. Save the generated input to a file (for example, remove_wallet_access_ep.json) and then edit it to remove wallet access from the endpoint or an endpoint group, but not both. The following example shows how to remove access from an endpoint:

    {
  "service" : {
    "category" : "manage-access",
    "resource" : "wallet",
    "action" : "remove-access",
    "options" : {
      "wallet" : "hr_wallet",
      "endpoint" : "hr_db_ep"
    }
  }
}

  3. Run the okv manage-access wallet remove-access command using the generated JSON file:

    okv manage-access wallet remove-access --from-json remove_wallet_access_ep.json

    Output similar to the following appears:

    {
  "result" : "Success"
}

okv manage-access wallet remove-object

The okv manage-access wallet remove-object command removes a security object from a wallet.

This command uses a user name and password for the authentication.

Required Authorization

Key Administrator role or have read-modify permission on the object and manage wallet (MW) permission on the wallet.

Syntax

okv manage-access wallet remove-object --wallet wallet_name --uuid uuid

JSON Input File Template

{
  "service" : {
    "category" : "manage-access",
    "resource" : "wallet",
    "action" : "remove-object",
    "options" : {
      "wallet" : "#VALUE",
      "uuid" : "#VALUE"
    }
  }
}

Parameters

Parameter/Template Parameter Required? Description
--wallet / wallet Required Wallet name. To find the names of existing wallets to which you have access, run the okv manage-access wallet list command.
--uuid / uuid Required

Universally unique ID (UUID) of the security object.

To find the unique identifier for the object, in the Oracle Key Vault management console, click the Keys & Wallets tab, and then click Keys & Secrets in the left navigation window. In the Keys & Secrets table, check the Unique Identifier column.

JSON Example

  1. Generate JSON input for the okv manage-access wallet remove-object command:

    okv manage-access wallet remove-object --generate-json-input

    The generated JSON input is displayed as shown in the earlier section JSON Input File Template.

  2. Save the generated input to a file (for example, remove_wallet_obj.json) and then edit it to specify the object to be removed from the wallet:

    {
  "service" : {
    "category" : "manage-access",
    "resource" : "wallet",
    "action" : "remove-object",
    "options" : {
      "wallet" : "hr_wallet",
      "uuid" : "7432AED6-6628-4F43-BF7C-9D30023A4301"
    }
  }
}

  3. Run the okv manage-access wallet remove-object command using the generated JSON file:

    okv manage-access wallet remove-object --from-json remove_wallet_obj.json

    Output similar to the following appears:

    {
  "result": "Success"
}

okv manage-access wallet set-default

The okv manage-access wallet set-default command sets the default wallet for an endpoint.

This command uses a user name and password for the authentication.

Required Authorization

Key Administrator role or Manage Endpoint privilege for the endpoint and Full Wallet privileges on the wallet

Syntax

okv manage-access wallet set-default --wallet wallet_name --endpoint endpoint_name

JSON Input File Template

{
  "service" : {
    "category" : "manage-access",
    "resource" : "wallet",
    "action" : "set-default",
    "options" : {
      "wallet" : "#VALUE",
      "endpoint" : "#VALUE",
      "unique" : "#TRUE|FALSE"
    }
  }
}

Parameters

Parameter/Template Parameter Required? Description
--wallet / wallet Required Wallet name. To find the names of existing wallets to which you have access, run the okv manage-access wallet list command.
--endpoint / endpoint Required

Name of the endpoint.

To find existing endpoints, run the okv admin endpoint list command.

JSON Example

  1. Generate the JSON input for the okv manage-access wallet set-default command:

    okv manage-access wallet set-default --generate-json-input

    The generated JSON input is displayed as shown in the earlier section JSON Input File Template.

  2. Save the generated input to a file (for example, set_def_wallet.json) and then edit it to set the default wallet for the endpoint:

    {
  "service" : {
    "category" : "manage-access",
    "resource" : "wallet",
    "action" : "set-default",
    "options" : {
      "wallet" : "hr_wallet",
      "endpoint" : "hr_db_ep"
    }
  }
}

  3. Run the okv manage-access wallet set-default command using the generated JSON file:

    okv manage-access wallet set-default --from-json set_def_wallet.json

    Output similar to the following appears:

    {
  "result" : "Success"
}

okv manage-access wallet update

The okv manage-access wallet update command updates a wallet.

This command uses a user name and password for the authentication.

Required Authorization

Key Administrator role or manage wallet (MW) permission on the wallet

Syntax

new_wallet_name

JSON Input File Template

{
  "service" : {
    "category" : "manage-access",
    "resource" : "wallet",
    "action" : "update",
    "options" : {
      "wallet" : "#VALUE",
      "name" : "#VALUE",
      "description" : "#VALUE",
      "unique" : "#TRUE|FALSE"
    }
  }
}

Parameters

Parameter/Template Parameter Required? Description
--wallet / wallet Required Wallet name. To find the names of existing wallets to which you have access, run the okv manage-access wallet list command.
--name / name Optional A new name for the wallet. See Naming Guidelines for Objects.
--description / description Optional A user-friendly description for the wallet, enclosed within double quotation marks
--unique / unique Optional

Applies to a multi-master cluster environment only. This --unique parameter creates the wallet as a unique wallet. In a multi-master cluster, it is possible that a wallet with the same name could be created from two different nodes. If that happens, then the wallet names may conflict. The Oracle Key Vault conflict resolution scheme will keep one wallet with the given name and rename other wallets with the conflicting names to a name using this format: given_wallet_name_OKVnode_id.

Valid settings are as follows:

  • TRUE appends _OKVnode_id to the given name and thus prevent the conflict for this wallet name. The wallet is immediately usable.
  • FALSE causes Oracle Key Vault to begin a checking process to find if the wallet name is unique. A unique ID is returned. You can use this ID to check the status of the wallet creation, whether it is in progress (PENDING) or complete (ACTIVE). If the status is PENDING, then it is not yet usable, so any actions performed on the wallet will fail. If the status is ACTIVE, then confirm the name of the wallet after Oracle Key Vault performs name resolution for this name by executing the okv manage-access wallet check-status command. If the name that you provided is already used in another node, then the name for this wallet will have _OKVxx appended to it. For example, if you named the wallet wallet12, and there is a naming conflict, the name could be WALLET12_OKV01.

JSON Example

  1. Generate JSON input for the okv manage-access wallet update command:

    okv manage-access wallet update --generate-json-input

    The generated JSON input is displayed as shown in the earlier section JSON Input File Template.

  2. Save the generated input to a file (for example, update_wallet.json) and then edit it to update the name and description of a wallet. This example shows how to update the name of a wallet:

    {
  "service" : {
    "category" : "manage-access",
    "resource" : "wallet",
    "action" : "update",
    "options" : {
      "wallet" : "hr_wallet",
      "name" : "global_hr_wallet",
      "unique" : "FALSE"
    }
  }
}

  3. Run the okv manage-access wallet update command using the generated JSON file:

    okv manage-access wallet update --from-json update_wallet.json

    Output similar to the following appears:

    {
  "result" : "Success",
  "value" : {
    "status" : "PENDING",
    "locatorID" : "81800CE6-6AAF-4EF5-A0FD-446ED6625F6A"
  }
}

    This example shows the output for renaming a wallet in a multi-master cluster. On renaming, a wallet is placed into the PENDING state for the duration of the naming conflict resolution.

    The status and locatorID entries are included in the output only when you rename the wallet in a multi-master cluster.

Related Topics

okv manage-access wallet update-access

The okv manage-access wallet update-access command updates the level of access that an endpoint or an endpoint group has to a wallet.

This command uses a user name and password for the authentication.

Required Authorization

Key Administrator role or manage wallet (MW) permission on the wallet

Syntax

okv manage-access wallet update-access --wallet wallet_name --endpoint endpoint_name|--endpoint-group endpoint_group_name --access RO|RM|RO_MW|RM_MW

JSON Input File Template

{
  "service" : {
    "category" : "manage-access",
    "resource" : "wallet",
    "action" : "update-access",
    "options" : {
      "wallet" : "#VALUE",
      "endpointGroup" : "#VALUE",
      "endpoint" : "#VALUE",
      "access" : "#RO|RM|RO_MW|RM_MW"
    }
  }
}

Parameters

Parameter/Template Parameter Required? Description
--wallet / wallet Required Wallet name. To find the names of existing wallets to which you have access, run the okv manage-access wallet list command.

--endpoint / endpoint

or

--endpoint-group / endpointGroup

 Required Name of the endpoint or endpoint group. You can only specify either an endpoint or an endpoint group, but not both. To find existing endpoints, run the okv admin endpoint list command. To find endpoint groups, run okv manage-access endpoint-group list.
--access / access Required

Enter one of the following values:

  • RO for read-only access
  • RM for read-and-modify access
  • RO_MW for read-only and manage-wallet access
  • RM_MW for read-and-modify and manage-wallet access

JSON Example

  1. Generate JSON input for the okv manage-access wallet update-access command:

    okv manage-access wallet update-access --generate-json-input

    The generated JSON input is displayed as shown in the earlier section JSON Input File Template. The JSON input includes wallet access settings for both endpoints and endpoint groups.

  2. Save the generated input to a file (for example, update_wallet_access_ep.json) and then edit it to update wallet access to an endpoint group or an endpoint, but not both. This example shows how to update access of a wallet to an endpoint:

    {
  "service" : {
    "category" : "manage-access",
    "resource" : "wallet",
    "action" : "update-access",
    "options" : {
      "wallet" : "hr_wallet",
      "endpoint" : "hr_db_ep",
      "access" : "RM"
    }
  }
}

  3. Run the okv manage-access wallet update-access command using the generated JSON file:

    okv manage-access wallet update-access --from-json update_wallet_access_ep.json

    Output similar to the following appears:

    {
  "result" : "Success"
}