Features

Per-User Database Credentials And Rotation

Store one encrypted database credential per organization, user, and endpoint, then activate an already-provisioned replacement through a durable DBOS workflow.

Credential Routes

text

PUT    /api/v1/endpoints/{endpoint_uuid}/credentials/database
GET    /api/v1/endpoints/{endpoint_uuid}/credentials/database
DELETE /api/v1/endpoints/{endpoint_uuid}/credentials/database
GET    /api/v1/endpoints/{endpoint_uuid}/credentials/database/users
POST   /api/v1/endpoints/{endpoint_uuid}/credentials/database/rotations
GET    /api/v1/endpoints/{endpoint_uuid}/credentials/database/rotations/{rotation_id}

All routes require bearer authentication and endpoint-scoped RBAC. Passwords are accepted only by write routes, encrypted with the owning organization's key, and never returned. Credential and rotation responses carry Cache-Control: no-store.

Set A Credential

Create or replace the caller's active credential:

bash

jq -n \
  --arg db_password "$DATABASE_PASSWORD" \
  '{
    db_username: "application_user",
    db_password: $db_password,
    auth_method: "password"
  }' \
| curl -fsS "$EDEN_URL/api/v1/endpoints/$ENDPOINT_UUID/credentials/database" \
  -X PUT \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  --data-binary @- \
| jq '{endpoint_uuid, db_username, auth_method}'

Example response:

json

{
  "endpoint_uuid": "20000000-0000-0000-0000-000000000001",
  "db_username": "application_user",
  "auth_method": "password"
}

GET /endpoints/{endpoint_uuid}/credentials/database returns only the username, authentication method, and timestamps. An authorized endpoint auditor can use the /users inventory route to identify registered users without decrypting a password.

Rotate Durably

Provision the new password on the target database first. Then submit it to Eden with a stable rotation UUID:

bash

jq -n \
  --arg rotation_id "$ROTATION_ID" \
  --arg db_password "$REPLACEMENT_DATABASE_PASSWORD" \
  '{
    rotation_id: $rotation_id,
    db_username: "application_user",
    db_password: $db_password,
    auth_method: "password"
  }' \
| curl -fsS "$EDEN_URL/api/v1/endpoints/$ENDPOINT_UUID/credentials/database/rotations" \
  -X POST \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  --data-binary @- \
| jq '{rotation_id, run_id, endpoint_uuid, status}'

Example response:

json

{
  "rotation_id": "50000000-0000-0000-0000-000000000001",
  "run_id": "eden:db-credential-rotation:ORG_UUID:ROTATION_UUID",
  "endpoint_uuid": "20000000-0000-0000-0000-000000000001",
  "status": "started"
}

The first accepted request owns the rotation UUID. Reusing that UUID returns the same durable state and never replaces the staged request. Eden permits one pending or started rotation for an organization, user, and endpoint at a time.

The state machine is pending -> started -> applied|failed. Credential activation and the applied transition occur in one database transaction. Terminal states scrub the staged ciphertext, and replaying an applied workflow step is safe.

Eden activates the replacement credential in its own encrypted store. It does not create an account or change the password on the target database.

Credential Routes

Set A Credential

Rotate Durably

Related Docs