GET List Providers

List the vault providers this engine can connect to, each with the connect form it needs and the vocabulary it uses

GEThttps://api.anakin.io/v1/wire/identity-sources/providers

Lists every vault provider this engine can connect, each describing itself: the fields its connect form needs, the ways it can authenticate, and the nouns its hierarchy uses. Read this before connecting a source rather than hardcoding a provider's fields — a provider added later shows up here with no client change.

Not user-specific, and it makes no upstream calls. Requires an X-API-Key.

This is a static index route. It is matched before /identity-sources/{id}, so providers is a reserved source ID that can never collide with a real one.

Response

200 OK

Providers are sorted by type.

{
  "status": "ok",
  "providers": [
    {
      "type": "1password",
      "display_name": "1Password",
      "auth_type": "credentials",
      "browsable": true,
      "summary": "Sign in using a saved vault item — no password stored in Wire.",
      "container_label": "Vault",
      "entry_label": "Login item",
      "methods": [
        {
          "id": "service_account",
          "label": "Service Account",
          "instructions": "Create a Service Account in 1Password (Developer Tools → Service Accounts) with read access to the vaults you want Anakin to use, then paste its token below.",
          "docs_url": "https://developer.1password.com/docs/service-accounts/get-started",
          "fields": [
            {
              "name": "token",
              "label": "Service Account Token",
              "type": "password",
              "secret": true,
              "placeholder": "ops_...",
              "pattern": "^ops_",
              "help": "Starts with “ops_”. Encrypted at rest; never displayed again.",
              "required": true
            }
          ]
        }
      ],
      "connect": { "fields": ["…same as methods[0].fields…"] }
    },
    {
      "type": "azure_key_vault",
      "display_name": "Azure Key Vault",
      "auth_type": "credentials",
      "browsable": true,
      "summary": "Sign in using a secret from your Key Vault — no password stored in Wire.",
      "container_label": "Vault",
      "entry_label": "Secret",
      "methods": [
        {
          "id": "service_principal",
          "label": "Service principal (client secret)",
          "caution": "On each Key Vault, assign the app the \"Key Vault Secrets User\" role (or a get+list access policy). This is the step most often missed — without it the connection authenticates but can't read anything.",
          "docs_url": "https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-guide",
          "fields": ["…tenant_id, client_id, client_secret, vault_urls…"]
        }
      ],
      "connect": { "fields": ["…same as methods[0].fields…"] }
    }
  ]
}

Field	Type	Description
`providers[].type`	string	Registry key. Send this as `provider` when connecting, and it's what `provider` filters on in list sources
`providers[].display_name`	string	Human label, e.g. `1Password`
`providers[].auth_type`	string	The catalog `auth_type` this provider's credentials feed. A catalog must list this in its `auth_types` for a binding to be accepted
`providers[].browsable`	boolean	Whether containers / entries can be browsed. When `false`, bind by reference instead of picking
`providers[].summary`	string	One line on what connecting this provider does. Optional
`providers[].container_label`	string	The provider's noun for a container — `Vault` for both current providers. Defaults to `Container`
`providers[].entry_label`	string	The provider's noun for an entry — `Login item` for 1Password, `Secret` for Azure Key Vault. Defaults to `Entry`
`providers[].methods`	array	The ways to authenticate to this provider, each with its own field set. Providers with one way return exactly one
`providers[].connect`	object	Mirrors `methods[0]` — present so single-method clients keep working. Prefer `methods`

methods[]

Field	Type	Description
`id`	string	Stable key. Send this as `auth_method` when connecting. Omit `auth_method` to get `methods[0]`
`label`	string	Shown when a provider offers a choice
`instructions`	string	Setup guidance to render above the fields. Optional
`caution`	string	The one step that most often goes wrong for this provider, kept out of `instructions` so a client can give it its own weight. Render it prominently — for Azure Key Vault it names the per-vault role assignment, whose omission fails silently: the credential authenticates and then reads nothing. Optional
`docs_url`	string	Link to the provider's own setup guide. Optional
`fields`	array	The inputs this method needs — see below

methods[].fields[]

Field	Type	Description
`name`	string	The key to send in the connect body. Values are top-level, not nested
`label`	string	Shown to the user
`type`	string	`text`, `password` or `textarea`
`secret`	boolean	Mask the input; never echoed back by any endpoint
`placeholder`	string	Example value. Optional
`help`	string	Hint text under the field. Optional
`pattern`	string	Validation regex, e.g. `^ops_`. Optional
`required`	boolean	Whether connect fails without it

Unknown field names are rejected, not ignored. Sending a field the chosen method doesn't declare returns UNKNOWN_CONNECT_FIELD — a typo'd name fails as a typo rather than surfacing later as a confusing upstream auth error.

If the engine has no providers registered, providers is an empty array.

Code Examples

curl https://api.anakin.io/v1/wire/identity-sources/providers \
  -H "X-API-Key: your_api_key"

import requests

response = requests.get(
    'https://api.anakin.io/v1/wire/identity-sources/providers',
    headers={'X-API-Key': 'your_api_key'},
)

for provider in response.json()['providers']:
    required = [f['name'] for f in provider['methods'][0]['fields'] if f['required']]
    print(f"{provider['type']}: needs {', '.join(required)}")

const response = await fetch(`https://api.anakin.io/v1/wire/identity-sources/providers`, {
  headers: { 'X-API-Key': 'your_api_key' }
});

const { providers } = await response.json();
for (const provider of providers) {
  const required = provider.methods[0].fields.filter((f) => f.required).map((f) => f.name);
  console.log(`${provider.type}: needs ${required.join(', ')}`);
}

Rate limit

60 requests per minute per user.

POST /v1/wire/identity-sources — connect a provider using the schema returned here
GET /v1/wire/identity-sources — list what's already connected

GET List Providers

Response

Code Examples

Rate limit

Related