Weaviate database plugin HTTP API

The Weaviate database plugin is one of the supported plugins for the database secrets engine. It generates dynamic credentials using Weaviate's User Management and RBAC APIs, creating database users, assigning custom roles, and deleting users upon lease expiration.

Configure connection

In addition to the parameters defined by the Database Secrets Engine, this plugin has a number of parameters to further configure a connection.

Method	Path
POST	/database/config/:name

Parameters

• url (string: <required>) – Specifies the http(s)://host:8080 of the Weaviate server OpenBao connects to.

• api_key (string: "") – Specifies the admin API key used by OpenBao to authenticate against Weaviate's /v1/.well-known/ready endpoint and call Weaviate's User Management and RBAC APIs (/v1/users/db/... and /v1/authz/users/...).

• ca_cert (string: "") – Specifies a PEM-encoded CA certificate (or bundle) used to validate the server's TLS certificate.

• ca_path (string: "") – Specifies a filesystem path to a PEM-encoded CA certificate (or bundle) used to validate the server's TLS certificate.

• client_cert (string: "") – Specifies a PEM-encoded client certificate to present for mTLS. Must be set together with client_key.

• client_key (string: "") – Specifies the PEM-encoded private key corresponding to client_cert. Must be set together with client_cert.

• insecure (bool: false) – Skips verification of the server's TLS certificate when connecting. Intended for development only.

• username_template (string: "") – Template used to generate unique usernames for dynamic credentials. Defaults to: {{ printf "v-%s-%s-%s-%s" (.DisplayName | truncate 8) (.RoleName | truncate 8) (random 20) (unix_time) | truncate 63 }}.

Sample payload

{
  "plugin_name": "weaviate-database-plugin",
  "allowed_roles": "app",
  "url": "https://weaviate.example.com:8080",
  "api_key": "admin-key"
}

Sample request

$ curl \
    --header "X-Vault-Token: ..." \
    --request POST \
    --data @payload.json \
    http://127.0.0.1:8200/v1/database/config/weaviate

Statements

Dynamic roles use creation_statements to configure the roles assigned to the generated Weaviate user:

• creation_statements (list: <required>) – Specifies the roles assigned to the user in Weaviate. Can be specified as a JSON object with "roles" and/or "custom_roles", or a JSON array of role names:

  {
    "roles": ["viewer"],
    "custom_roles": [
      {
        "name": "customrole",
        "permissions": [
          {
            "action": "read_data",
            "collections": {
              "collection": "Products"
            }
          }
        ]
      }
    ]
  }

• Dynamic roles (bao write database/roles/:name followed by bao read database/creds/:name) issue a unique username and a dynamic Weaviate API key (returned in the password field).

• When the lease expires or is revoked (bao lease revoke), OpenBao calls DeleteUser, deleting the user from Weaviate (DELETE /v1/users/db/{user_id}).