pub struct EngineDoc {
pub provider: String,
pub mechanism: String,
pub shape: CredentialShape,
pub revocable: bool,
pub revoke_effect: String,
pub ttl: TtlDoc,
pub scoping: String,
pub root_credential: String,
pub paths: Vec<PathDoc>,
pub docs_url: Option<String>,
pub caveats: Vec<String>,
}Expand description
Everything an operator or a consumer needs to know about an engine without
leaving the API: which provider, which mechanism, what a lease is worth,
what revoke() really does, and what the server had to be trusted with.
Served at GET /v1/{mount}/help, and its operative fields are echoed in
the _doc block of every credential response.
Fields§
§provider: String§mechanism: StringThe concrete provider API being used, e.g. “GitHub App installation tokens”.
shape: CredentialShape§revocable: boolWhether revoking a lease destroys the credential the consumer holds.
Must agree with shape.revocable() — the server asserts this, because
an engine that overstates it would mislead every caller.
revoke_effect: StringWhat revoke() does in reality — including “nothing, the credential
keeps working until it expires”, which is the truth for three of the
providers here and must not be dressed up.
ttl: TtlDoc§scoping: String§root_credential: StringWhat long-lived secret the server must hold, or “none” under federation.
paths: Vec<PathDoc>§docs_url: Option<String>§caveats: Vec<String>Sharp edges worth knowing before depending on this engine.