Qdrant database plugin HTTP API

The Qdrant database plugin is one of the supported plugins for the database secrets engine. It generates dynamic credentials using Qdrant's Granular Access API Keys (HS256-signed JWTs) and provides stateful token revocation via Qdrant's value_exists claim.

Configure connection

In addition to the parameters defined by the Database Secrets Engine, this plugin has a number of parameters to further configure a connection.

Method	Path
POST	/database/config/:name

Parameters

• url (string: <required>) – Specifies the http(s)://host:port of the Qdrant server OpenBao connects to.

• api_key (string: <required>) – Specifies the master admin API key used to verify reachability against /readyz and sign dynamic JWT tokens using HS256.

• validation_collection (string: "openbao_users") – Specifies the collection used for stateful token validation (value_exists). OpenBao creates this collection automatically if it does not already exist.

• ca_cert (string: "") – Specifies a PEM-encoded CA certificate (or bundle) used to validate the server's TLS certificate.

• ca_path (string: "") – Specifies a filesystem path to a PEM-encoded CA certificate (or bundle) used to validate the server's TLS certificate.

• client_cert (string: "") – Specifies a PEM-encoded client certificate to present for mTLS. Must be set together with client_key.

• client_key (string: "") – Specifies the PEM-encoded private key corresponding to client_cert. Must be set together with client_cert.

• insecure (bool: false) – Skips verification of the server's TLS certificate when connecting. Intended for development only.

• username_template (string: "") – Template used to generate unique usernames for dynamic credentials. Defaults to: {{ printf "v-%s-%s-%s-%s" (.DisplayName | truncate 8) (.RoleName | truncate 8) (random 20) (unix_time) | truncate 63 }}.

Sample payload

{
  "plugin_name": "qdrant-database-plugin",
  "allowed_roles": "app",
  "url": "https://qdrant.example.com:6333",
  "api_key": "topsecret"
}

Sample request

$ curl \
    --header "X-Vault-Token: ..." \
    --request POST \
    --data @payload.json \
    http://127.0.0.1:8200/v1/database/config/qdrant

Statements

Dynamic roles use creation_statements to configure the permissions of the issued Granular Access API Key (JWT):

• creation_statements (list: <required>) – Specifies the collection-level or global permissions for the generated JWT. Can be specified as a JSON object with an "access" array, an array of collection objects, or shorthand strings:

  {
    "access": [
      {
        "collection": "my_collection",
        "access": "rw"
      }
    ]
  }

  Valid access levels are r (read-only) and rw (read-write) for collections, or global r (read) and m (manage).

• Dynamic roles (bao write database/roles/:name followed by bao read database/creds/:name) issue a unique username and a signed jwt_token (returned in the password field). OpenBao inserts a validation point into the openbao_users collection and embeds the value_exists claim in the JWT.

• When the lease expires or is revoked (bao lease revoke), OpenBao calls DeleteUser, deleting the validation point from Qdrant so the token is immediately rejected by Qdrant's stateful validation.