Issue a just-in-time request

post/vault_proxy/jit

Locked

If you don't have a preconfigured proxy configuration set up in the dashboard or are working on an integration in active development, you may invoke the vault proxy "just-in-time" (JIT) to send and receive data to a target destination provided inline.

The request body may contain "vault proxy tokens," which are hydrated with decrypted data from the provided user's vault. More information on vault proxy tokens can be found here.

Request

Headers

x-fp-id·

optional string

When proxy requests are on behalf of a single footprint vault, you can omit the fp_id_ prefix on token identifiers, and just use id.x or custom.y instead of fp_id_xyz.id.x or fp_id_xyz.custom.y. Similarly, if specifying proxy configuration ingress rules from a stored configuration the corresponding token must be assigned just-in-time via a headers. i.e: x-fp-id: fp_id_abc

x-fp-path-and-query·

optional string

Egress destination URL path and query string to append.

x-fp-proxy-access-reason·

optional string

Access reason for any egress decryption operations during the proxy request.

x-fp-proxy-client-cert·

optional string

Base64 encoded PEM client certificate to use (required if using key).

x-fp-proxy-client-key·

optional string

Base64 encoded PEM client key to use (required if using cert).

x-fp-proxy-fwd-·

optional string

Headers with this x-fp-proxy-fwd-* prefix are forwarded to the proxy egress, with the prefix stripped. For example x-fp-proxy-fwd-MYHEADER: hello world sends MYHEADER: hello world to the destination.

x-fp-proxy-ingress-content-type·

optional string

Content-type for the proxy ingress.

x-fp-proxy-ingress-rule·

optional string

Configure one more ingress rules. For example: x-fp-proxy-ingress-rule: fp_id_abc.custom.credit_card_number=$.data.card.number or x-fp-proxy-ingress-rule: fp_id_abc.custom.credit_card_exp=$.data.card.expiration

x-fp-proxy-method·

optional string

HTTP Method VERB for the proxy destination request (defaults to POST).

x-fp-proxy-pin-cert·

optional string

Configure one or more base64 encoded PEM server certificates to validate and pin proxy destination TLS connections.

x-fp-proxy-target-url·

string

Target proxy destination URL.

Body

Request body to be used in the vault proxy. The body may contain any number of "vault proxy tokens,", which are hydrated with the decrypted data from provided users' vaults.

POST /vault_proxy/jit

1curl -X POST https://api.onefootprint.com/vault_proxy/jit \
2  -u sk_test_xxxxx: \
3  -H 'x-fp-proxy-target-url: https://acmebankprocessor.com/api/process_transaction' \
4  -d '{
5    "name": "{{ fp_id_Ih14yI0tMugEe5kdpnC0cl.id.first_name | to_uppercase }} {{ fp_id_Ih14yI0tMugEe5kdpnC0cl.id.last_name | to_uppercase }}",
6    "dob": "{{ fp_id_Ih14yI0tMugEe5kdpnC0cl.id.dob }}"
7  }'