Skip to main content

write

The write command writes data to OpenBao at the given path (wrapper command for HTTP PUT or POST). The data can be credentials, secrets, configuration, or arbitrary data. The specific behavior of the write command is determined at the thing mounted at the path.

Data is specified as "key=value" pairs on the command line. If the value begins with an "@", then it is loaded from a file. If the value for a key is "-", OpenBao will read the value from stdin rather than the command line.

Some API fields require more advanced structures such as maps. These cannot directly be represented on the command line. However, direct control of the request parameters can be achieved by using - as the only data argument. This causes bao write to read a JSON blob containing all request parameters from stdin. This argument will be ignored if used in conjunction with any "key=value" pairs.

For a full list of examples and paths, please see the documentation that corresponds to the secrets engines in use.

Examples​

Store an arbitrary secrets in the token's cubbyhole.

$ bao write cubbyhole/git-credentials username="student01" password="p@$$w0rd"

Create a new encryption key in the transit secrets engine:

$ bao write -force transit/keys/my-key

The -force flag allows the write operation without input data. (See command options.)

API versus CLI​

Create a token with TTL set to 8 hours, limited to 3 uses, and attach admin and secops policies.

$ bao write auth/token/create policies="admin" policies="secops" ttl=8h num_uses=3

Equivalent cURL command for this operation:

$ tee request_payload.json -<<EOF
{
   "policies": ["admin", "secops"],
   "ttl": "8h",
   "num_uses": 3
}
EOF

$ curl --header "X-Vault-Token: $OPENBAO_TOKEN" \
    --request POST \
    --data @request_payload.json \
    $OPENBAO_ADDR/v1/auth/token/create

The bao write command simplifies the API call.

Since token management is a common task, OpenBao CLI provides a token command with create subcommand. The CLI command simplifies the token creation. Use the bao create command with options to set the token TTL, policies, and use limit.

$ bao token create -policy=admin -policy=secops -ttl=8h -use-limit=3
info

Syntax: The command options start with - (e.g. -ttl) while API path parameters do not (e.g. ttl). You always set the API parameters after the path you are invoking.

Usage​

The following flags are available in addition to the standard set of flags included on all commands.

Output options​

  • -field (string: "") - Print only the field with the given name. Specifying this option will take precedence over other formatting directives. The result will not have a trailing newline making it ideal for piping to other processes.

  • -format (string: "table") - Print the output in the given format. Valid formats are "table", "json", or "yaml". This can also be specified via the BAO_FORMAT environment variable.

Command options​

  • -force (bool: false) - Allow the operation to continue with no key=value pairs. This allows writing to keys that do not need or expect data. This is aliased as -f.