Vault

The Vault securely stores passwords, API keys, certificates and key pairs that calculations and smart events need. Values are encrypted in the database, and templates refer to them only by name, so secrets are never displayed anywhere. The Vault is available to administrators. Open it in Administration › Vault.

Secrets

Creating a secret

1. On the Secrets tab, click Create secret.
2. Fill in the name, the value and optionally a description.
3. Click Create.

Secret actions

Open the menu with the three-dot icon at the end of the row.

Showing the value

In the Show secret dialog, the value is hidden. Reveal it with the eye icon, or copy it to the clipboard with the button next to the field. The dialog does not save anything; close it with the cross.

Changing the value

In the Edit secret dialog, you can change only the value. The name and description are read-only. The original value is not displayed; the Value field is empty and required. Enter the new value and click Save. Calculations and smart events that use the secret start using the new value immediately; you do not need to change anything else.

If you need to change the name or description, create a new secret and delete the old one.

Deleting a secret

After you select Delete, TAS displays the confirmation “Do you really want to delete the vault item…”. A secret that is still in use cannot be deleted. TAS checks task calculations in all templates and smart event parameters. If it finds the secret anywhere, it refuses the deletion with a message that the secret is still in use. First remove all references to the secret, then delete it.

Using secrets in templates

You refer to a secret by its name; you never write the value into the template.

Both syntaxes work for secrets, certificates and secrets from external sources.

Certificates

The Certificates tab contains uploaded certificates and key pairs generated in the Vault. All administrators can see it.

The other columns are Name, Description and Inserted by. The row menu contains the Show and Delete actions. As with secrets, only the person who added the item and the superadministrator can see them. A certificate cannot be edited. Upload a new version under the same name.

Uploading a certificate

1. Click Upload certificate.
2. Use the Choose file button to select a file with the .pem, .cer, .crt or .der extension.
3. Check the name. TAS prefills it from the file name without the extension.
4. Optionally add a description and click Upload.

If the file does not contain a valid X.509 certificate, TAS rejects it and does not save the certificate.

Generating a key pair

A key pair is useful for integrations that work with signing or encryption. The private key stays in the Vault; you hand the public key over to the other party.

1. Click Generate key pair.
2. Enter a name and choose the algorithm and format.
3. Click Generate key pair.

After generation, the dialog stays open and shows the names of both saved keys and the public key value with a copy button. The private key is not displayed in the dialog. Close the dialog with the Close button. You will then find both keys in the list of certificates.

External sources

Only the superadministrator can see the External sources tab. It contains secrets that are not stored in the database but are set by the server administrator in environment variables in the form TAS_SECRET_<NÁZEV>. The secret name is the part after the prefix. The list shows only the name; the superadministrator can display the value with the Show action. Secrets from external sources cannot be created, changed or deleted in TAS. In calculations and smart events, they are used in the same way as other secrets.

Related: API access, Authentication, Smart events, Calculations.