Configure native integrations via API

How to use Infisical API to sync secrets to external secret managers

The Infisical API allows you to create programmatic integrations that connect with third-party secret managers to synchronize secrets from Infisical.

This guide will primarily demonstrate the process using AWS Secret Store Manager (AWS SSM), but the steps are generally applicable to other secret management integrations.

For details on setting up AWS SSM synchronization and understanding its prerequisites, refer to the AWS SSM integration setup documentation.

1

Authenticate with AWS SSM

Authentication is required for all integrations. Use the Integration Auth API with the following parameters to authenticate.

integration

string

required

Set this parameter to aws-secret-manager.

workspaceId

string

required

The Infisical project ID for the integration.

accessId

string

required

The AWS IAM User Access ID.

accessToken

string

required

The AWS IAM User Access Secret Key.

Request

curl --request POST \
    --url https://app.infisical.com/api/v1/integration-auth/access-token \
    --header 'Authorization: <authorization>' \
    --header 'Content-Type: application/json' \
    --data '{
    "workspaceId": "<workspaceid>",
    "integration": "aws-secret-manager",
    "accessId": "<aws iam user access id>",
    "accessToken": "<aws iam user access secret key>"
}'

2

Configure the Synchronization Setup

Once authentication between AWS SSM and Infisical is established, you can configure the synchronization behavior. This involves specifying the source (environment and secret path in Infisical) and the destination in SSM to which the secrets will be synchronized.

Use the integration API with the following parameters to configure the sync source and destination.

integrationAuthId

string

required

The ID of the integration authentication object used with AWS, obtained from the previous API response.

isActive

boolean

Indicates whether the integration should be active or inactive.

app

string

required

The secret name for saving in AWS SSM, which can be arbitrarily chosen.

region

string

required

The AWS region where the SSM is located, e.g., us-east-1.

sourceEnvironment

string

required

The Infisical environment slug from which secrets will be synchronized, e.g., dev.

secretPath

string

required

The Infisical folder path from which secrets will be synchronized, e.g., /some/path. The root path is /.

Request

curl --request POST \
    --url https://app.infisical.com/api/v1/integration \
    --header 'Authorization: <authorization>' \
    --header 'Content-Type: application/json' \
    --data '{
    "integrationAuthId": "<integrationauthid>",
    "sourceEnvironment": "<sourceenvironment>",
    "secretPath": "<secret-path, default is '/' >",
    "app": "<app>",
    "region": "<aws-ssm-region>"
}'

Congratulations! You have successfully set up an integration to synchronize secrets from Infisical with AWS SSM. For more information, view the integration API reference.