Infisical Python SDK

​

Migrating to version 1.0.3 or above

1. Removal of rest: The SDK no longer exposes the entire Infisical API. This was necessary as we have moved away from using an OpenAPI generator approach. We aim to add support for more API resources in the near future. If you have any specific requests, please open an issue.
2. New response types: The 1.0.3 release uses return types that differ from the older versions. The new return types such as BaseSecret, are all exported from the Infisical SDK.
3. Property renaming: Some properties on the responses have been slightly renamed. An example of this would be that the secret_key property on the get_secret_by_name() method, that has been renamed to secretKey.

​

Requirements

​

Installation

pip install infisicalsdk

​

Getting started

from infisical_sdk import InfisicalSDKClient

# Initialize the client
client = InfisicalSDKClient(host="https://app.infisical.com")

# Authenticate (example using Universal Auth)
client.auth.universal_auth.login(
    client_id="<machine-identity-client-id>", 
    client_secret="<machine-identity-client-secret>"
)

# Use the SDK to interact with Infisical
secrets = client.secrets.list_secrets(project_id="<project-id>", environment_slug="dev", secret_path="/")

​

InfisicalSDKClient parameters

• host (str, Optional): The host URL for your Infisical instance. Defaults to https://app.infisical.com.
• token (str, Optional): Specify an authentication token to use for all requests. If provided, you won’t need to call any of the auth methods. Defaults to None
• cache_ttl (int, Optional): The SDK has built-in client-side caching for secrets, greatly improving response times. By default, secrets are cached for 1 minute (60 seconds). You can disable caching by setting cache_ttl to None, or adjust the duration in seconds as needed.

client = InfisicalSDKClient(
  host="https://app.infisical.com", # Defaults to https://app.infisical.com
  token="<optional-auth-token>", # If not set, use the client.auth() methods.
  cache_ttl = 300 # `None` to disable caching
)

​

Core methods

1. auth: Handles authentication methods.
2. secrets: Manages CRUD operations for secrets.
3. dynamic_secrets: Manages dynamic secrets and leases.
4. kms: Perform cryptographic operations with Infisical KMS.
5. folders: Manages folder-related operations.
6. agent_vault: Manages Agent Vault sessions and proxies.

​

auth

​

Universal auth

response = client.auth.universal_auth.login(
    client_id="<machine-identity-client-id>", 
    client_secret="<machine-identity-client-secret>"
)

​

AWS auth

response = client.auth.aws_auth.login(identity_id="<machine-identity-id>")

​

OIDC auth

response = client.auth.oidc_auth.login(
    identity_id="<oidc-identity-id>",
    jwt="<your-oidc-jwt-token>"
)

• identity_id (str): The ID of the OIDC identity configuration in Infisical.
• jwt (str): The OIDC JWT token obtained from your identity provider.

​

LDAP auth

response = client.auth.ldap_auth.login(
    identity_id="<machine-identity-id>",
    username="<ldap-username>",
    password="<ldap-password>"
)

• identity_id (str): The ID of the LDAP identity configuration in Infisical.
• username (str): Your LDAP username.
• password (str): Your LDAP password.

​

Token auth

response = client.auth.token_auth.login(token="<your-token>")

• token (str): The access token to authenticate with. This can be a machine identity token or a user access token.

​

secrets

​

List secrets

secrets = client.secrets.list_secrets(
    project_id="<project-id>",
    environment_slug="dev",
    secret_path="/",
    expand_secret_references=True, # Optional
    view_secret_value=True, # Optional 
    recursive=False, # Optional
    include_imports=True, # Optional
    tag_filters=[] # Optional
)

• project_id (str): The ID of your project.
• project_slug (str): The slug of your project.
• environment_slug (str): The environment in which to list secrets (e.g., “dev”).
• secret_path (str): The path to the secrets.
• expand_secret_references (bool): Whether to expand secret references.
• view_secret_value (bool): Whether or not to include the secret value in the response. If set to false, the secretValue will be masked with <hidden-by-infisical>. Defaults to true.
• recursive (bool): Whether to list secrets recursively.
• include_imports (bool): Whether to include imported secrets.
• tag_filters (List[str]): Tags to filter secrets.

• ListSecretsResponse: The response containing the list of secrets.

​

Create secret

new_secret = client.secrets.create_secret_by_name(
    secret_name="NEW_SECRET",
    project_id="<project-id>",
    secret_path="/",
    environment_slug="dev",
    secret_value="secret_value",
    secret_comment="Optional comment",
    skip_multiline_encoding=False,
    secret_reminder_repeat_days=30,  # Optional
    secret_reminder_note="Remember to update this secret",  # Optional
    secret_metadata=[{"key": "metadata_key", "value": "metadata_value"}], # Optional
    tags_ids=["tag_id_1", "tag_id_2"] # Optional
)

• secret_name (str): The name of the secret.
• project_id (str): The ID of your project.
• project_slug (str): The slug of your project.
• secret_path (str): The path to the secret.
• environment_slug (str): The environment in which to create the secret.
• secret_value (str): The value of the secret.
• secret_comment (str, optional): A comment associated with the secret.
• skip_multiline_encoding (bool, optional): Whether to skip encoding for multiline secrets.
• secret_reminder_repeat_days (Union[float, int], optional): Number of days after which to repeat secret reminders.
• secret_reminder_note (str, optional): A note for the secret reminder.
• secret_metadata (List[Dict[str, Any]], optional): Metadata associated with the secret.
• tags_ids (List[str], optional): IDs of tags to associate with the secret.

• BaseSecret: The response after creating the secret.

​

Update secret

updated_secret = client.secrets.update_secret_by_name(
    current_secret_name="EXISTING_SECRET",
    project_id="<project-id>",
    project_slug="<project-slug>",
    secret_path="/",
    environment_slug="dev",
    secret_value="new_secret_value",
    secret_comment="Updated comment",  # Optional
    skip_multiline_encoding=False,
    secret_reminder_repeat_days=30,  # Optional
    secret_reminder_note="Updated reminder note",  # Optional
    new_secret_name="NEW_NAME",  # Optional
    secret_metadata=[{"key": "metadata_key", "value": "metadata_value"}], # Optional
    tags_ids=["tag_id_1", "tag_id_2"] # Optional
)

• current_secret_name (str): The current name of the secret.
• project_id (str): The ID of your project.
• project_slug (str): The slug of your project.
• secret_path (str): The path to the secret.
• environment_slug (str): The environment in which to update the secret.
• secret_value (str, optional): The new value of the secret.
• secret_comment (str, optional): An updated comment associated with the secret.
• skip_multiline_encoding (bool, optional): Whether to skip encoding for multiline secrets.
• secret_reminder_repeat_days (Union[float, int], optional): Updated number of days after which to repeat secret reminders.
• secret_reminder_note (str, optional): An updated note for the secret reminder.
• new_secret_name (str, optional): A new name for the secret.
• secret_metadata (List[Dict[str, Any]], optional): Metadata associated with the secret.
• tags_ids (List[str], optional): IDs of tags to associate with the secret.

• BaseSecret: The response after updating the secret.

​

Get secret by name

secret = client.secrets.get_secret_by_name(
    secret_name="EXISTING_SECRET",
    project_id="<project-id>",
    environment_slug="dev",
    secret_path="/",
    expand_secret_references=True, # Optional
    view_secret_value=True, # Optional
    include_imports=True, # Optional
    version=None # Optional
)

• secret_name (str): The name of the secret.
• project_id (str): The ID of your project.
• project_slug (str): The slug of your project.
• environment_slug (str): The environment in which to retrieve the secret.
• secret_path (str): The path to the secret.
• expand_secret_references (bool): Whether to expand secret references.
• view_secret_value (bool): Whether or not to include the secret value in the response. If set to false, the secretValue will be masked with <hidden-by-infisical>. Defaults to true.
• include_imports (bool): Whether to include imported secrets.
• version (str, optional): The version of the secret to retrieve. Fetches the latest by default.

• BaseSecret: The response containing the secret.

​

Delete secret by name

deleted_secret = client.secrets.delete_secret_by_name(
    secret_name="EXISTING_SECRET",
    project_id="<project-id>",
    environment_slug="dev",
    secret_path="/"
)

• secret_name (str): The name of the secret to delete.
• project_id (str): The ID of your project.
• project_slug (str): The slug of your project.
• environment_slug (str): The environment in which to delete the secret.
• secret_path (str): The path to the secret.

• BaseSecret: The response after deleting the secret.

​

dynamic_secrets

​

Create dynamic secret

from infisical_sdk import DynamicSecretProviders

dynamic_secret = client.dynamic_secrets.create(
    name="postgres-dev",
    provider_type=DynamicSecretProviders.SQL_DATABASE,
    inputs={
        "client": "postgres",
        "host": "localhost",
        "port": 5432,
        "database": "mydb",
        "username": "admin",
        "password": "admin-password",
        "creationStatement": "CREATE USER \"{{username}}\" WITH PASSWORD '{{password}}';",
        "revocationStatement": "DROP USER \"{{username}}\";"
    },
    default_ttl="1h",
    max_ttl="24h",
    project_slug="my-project",
    environment_slug="dev",
    path="/",
    metadata=[{"key": "team", "value": "backend"}]  # Optional
)

• name (str): The name of the dynamic secret.
• provider_type (Union[DynamicSecretProviders, str]): The provider type (e.g., DynamicSecretProviders.SQL_DATABASE).
• inputs (Dict[str, Any]): The provider-specific configuration inputs. See the Dynamic Secrets API documentation for provider-specific inputs.
• default_ttl (str): The default time to live for leases (e.g., “1h”, “30m”).
• max_ttl (str): The maximum time to live for leases (e.g., “24h”).
• project_slug (str): The slug of your project.
• environment_slug (str): The environment in which to create the dynamic secret.
• path (str, optional): The path where the dynamic secret will be created. Defaults to ”/”.
• metadata (List[Dict[str, str]], optional): Optional list of metadata items with ‘key’ and ‘value’.

• DynamicSecret: The created dynamic secret.

​

Supported provider types

​

Get dynamic secret by name

dynamic_secret = client.dynamic_secrets.get_by_name(
    name="postgres-dev",
    project_slug="my-project",
    environment_slug="dev",
    path="/"
)

• name (str): The name of the dynamic secret.
• project_slug (str): The slug of your project.
• environment_slug (str): The environment in which to retrieve the dynamic secret.
• path (str, optional): The path to the dynamic secret. Defaults to ”/”.

• DynamicSecret: The dynamic secret.

​

Update dynamic secret

updated_secret = client.dynamic_secrets.update(
    name="postgres-dev",
    project_slug="my-project",
    environment_slug="dev",
    path="/",
    default_ttl="2h",  # Optional
    max_ttl="48h",  # Optional
    new_name="postgres-dev-updated",  # Optional
    inputs={"port": 5433},  # Optional - updated provider inputs
    metadata=[{"key": "team", "value": "platform"}],  # Optional
    username_template="dev-{{identity.name}}"  # Optional
)

• name (str): The current name of the dynamic secret.
• project_slug (str): The slug of your project.
• environment_slug (str): The environment in which to update the dynamic secret.
• path (str, optional): The path to the dynamic secret. Defaults to ”/”.
• default_ttl (str, optional): The new default time to live for leases.
• max_ttl (str, optional): The new maximum time to live for leases.
• new_name (str, optional): The new name for the dynamic secret.
• inputs (Dict[str, Any], optional): Updated provider-specific configuration inputs.
• metadata (List[Dict[str, str]], optional): Updated metadata list with ‘key’ and ‘value’ items.
• username_template (str, optional): The new username template for the dynamic secret.

• DynamicSecret: The updated dynamic secret.

​

Delete dynamic secret

deleted_secret = client.dynamic_secrets.delete(
    name="postgres-dev",
    project_slug="my-project",
    environment_slug="dev",
    path="/",
    is_forced=False  # Optional
)

• name (str): The name of the dynamic secret to delete.
• project_slug (str): The slug of your project.
• environment_slug (str): The environment in which to delete the dynamic secret.
• path (str, optional): The path to the dynamic secret. Defaults to ”/”.
• is_forced (bool, optional): A boolean flag to delete the dynamic secret from Infisical without trying to remove it from the external provider. Defaults to False.

• DynamicSecret: The deleted dynamic secret.

​

dynamic_secrets.leases

​

Create lease

lease_response = client.dynamic_secrets.leases.create(
    dynamic_secret_name="postgres-dev",
    project_slug="my-project",
    environment_slug="dev",
    path="/",
    ttl="30m"  # Optional
)

# Access the generated credentials
username = lease_response.data["DB_USERNAME"]
password = lease_response.data["DB_PASSWORD"]
lease_id = lease_response.lease.id

• dynamic_secret_name (str): The name of the dynamic secret to create a lease for.
• project_slug (str): The slug of your project.
• environment_slug (str): The environment in which to create the lease.
• path (str, optional): The path to the dynamic secret. Defaults to ”/”.
• ttl (str, optional): The time to live for the lease (e.g., “1h”, “30m”).

• CreateLeaseResponse: Response containing:
  • lease: The lease object with ID, expiration, and metadata.
  • dynamicSecret: The associated dynamic secret.
  • data: The generated credentials. The structure depends on the dynamic secret provider.

​

Get lease

lease = client.dynamic_secrets.leases.get(
    lease_id="<lease-id>",
    project_slug="my-project",
    environment_slug="dev",
    path="/"
)

• lease_id (str): The ID of the lease to retrieve.
• project_slug (str): The slug of your project.
• environment_slug (str): The environment in which to retrieve the lease.
• path (str, optional): The path to the dynamic secret. Defaults to ”/”.

• DynamicSecretLease: The lease with dynamicSecret included.

​

Renew lease

renewed_lease = client.dynamic_secrets.leases.renew(
    lease_id="<lease-id>",
    project_slug="my-project",
    environment_slug="dev",
    path="/",
    ttl="2h"  # Optional - new TTL
)

• lease_id (str): The ID of the lease to renew.
• project_slug (str): The slug of your project.
• environment_slug (str): The environment in which to renew the lease.
• path (str, optional): The path to the dynamic secret. Defaults to ”/”.
• ttl (str, optional): The new time to live for the lease.

• DynamicSecretLease: The renewed lease.

​

Revoke lease

revoked_lease = client.dynamic_secrets.leases.revoke(
    lease_id="<lease-id>",
    project_slug="my-project",
    environment_slug="dev",
    path="/",
    is_forced=False  # Optional
)

• lease_id (str): The ID of the lease to revoke.
• project_slug (str): The slug of your project.
• environment_slug (str): The environment in which to revoke the lease.
• path (str, optional): The path to the dynamic secret. Defaults to ”/”.
• is_forced (bool, optional): A boolean flag to revoke the lease from Infisical without trying to remove it from the external provider. Defaults to False.

• DynamicSecretLease: The revoked lease.

​

kms

​

List KMS keys

kms_keys = client.kms.list_keys(
    project_id="<project-id>",
    offset=0, # Optional
    limit=100, # Optional
    order_by=KmsKeysOrderBy.NAME, # Optional
    order_direction=OrderDirection.ASC, # Optional
    search=None # Optional
)

• project_id (str): The ID of your project.
• offset (int, optional): The offset to paginate from.
• limit (int, optional): The page size for paginating.
• order_by (KmsKeysOrderBy, optional): The key property to order the list response by.
• order_direction (OrderDirection, optional): The direction to order the list response in.
• search (str, optional): The text value to filter key names by.

• ListKmsKeysResponse: The response containing the list of KMS keys.

​

Get KMS key by ID

kms_key = client.kms.get_key_by_id(
    key_id="<key-id>"
)

• key_id (str): The ID of the key to retrieve.

• KmsKey: The specified key.

​

Get KMS key by name

kms_key = client.kms.get_key_by_name(
    key_name="my-key",
    project_id="<project-id>"
)

• key_name (str): The name of the key to retrieve.
• project_id (str): The ID of your project.

• KmsKey: The specified key.

​

Create KMS key

kms_key = client.kms.create_key(
    name="my-key",
    project_id="<project-id>",
    encryption_algorithm=SymmetricEncryption.AES_GCM_256,
    description=None # Optional
)

• name (str): The name of the key (must be slug-friendly).
• project_id (str): The ID of your project.
• encryption_algorithm (SymmetricEncryption): The encryption algorithm this key should use.
• description (str, optional): A description of your key.

• KmsKey: The newly created key.

​

Update KMS key

updated_key = client.kms.update_key(
    key_id="<key-id>",
    name="my-updated-key", # Optional
    description="Updated description", # Optional
    is_disabled=True # Optional
)

• key_id (str): The ID of the key to be updated.
• name (str, optional): The updated name of the key (must be slug-friendly).
• description (str): The updated description of the key.
• is_disabled (str): The flag to disable operations with this key.

• KmsKey: The updated key.

​

Delete KMS key

deleted_key = client.kms.delete_key(
    key_id="<key-id>"
)

• key_id (str): The ID of the key to be deleted.

• KmsKey: The deleted key.

​

Encrypt data with KMS key

encrypted_data = client.kms.encrypt_data(
    key_id="<key-id>",
    base64EncodedPlaintext="TXkgc2VjcmV0IG1lc3NhZ2U=" # must be base64 encoded
)

• key_id (str): The ID of the key to encrypt the data with.
• base64EncodedPlaintext (str): The plaintext data to encrypt (must be base64 encoded).

• str: The encrypted ciphertext.

​

Decrypt data with KMS key

decrypted_data = client.kms.decrypt_data(
    key_id="<key-id>",
    ciphertext="Aq96Ry7sMH3k/ogaIB5MiSfH+LblQRBu69lcJe0GfIvI48ZvbWY+9JulyoQYdjAx"
)

• key_id (str): The ID of the key to decrypt the data with.
• ciphertext (str): The ciphertext returned from the encrypt operation.

• str: The base64 encoded plaintext.

​

folders

​

List folders

folders = client.folders.list_folders(
    project_id="<project-id>",
    environment_slug="dev",
    path="/",
    recursive=False, # Optional
    last_secret_modified=None # Optional
)

• project_id (str): The ID of your project.
• environment_slug (str): The environment in which to list folders.
• path (str): The path to list folders from.
• recursive (bool, optional): Whether to list folders recursively from the specified path and downwards. Defaults to False.
• last_secret_modified (datetime, optional): The timestamp used to filter folders with secrets modified after the specified date. Defaults to None.

• ListFoldersResponse: The response containing the list of folders.

​

Create folder

new_folder = client.folders.create_folder(
    name="my-folder",
    environment_slug="dev",
    project_id="<project-id>",
    path="/", # Optional
    description=None # Optional
)

• name (str): The name of the folder to create.
• environment_slug (str): The slug of the environment to create the folder in.
• project_id (str): The ID of your project to create the folder in.
• path (str, optional): The path to create the folder in. Defaults to /.
• description (str, optional): An optional description label for the folder. Defaults to None.

• CreateFolderResponseItem: The response containing the created folder.

​

Get folder by ID

folder = client.folders.get_folder_by_id(
    id="<folder-id>"
)

• id (str): The ID of the folder to retrieve.

• SingleFolderResponseItem: The response containing the folder details.

​

Update folder

updated_folder = client.folders.update_folder(
    folder_id="<folder-id>",
    name="backend-api",
    project_id="<project-id>",
    environment_slug="dev",
    path="/", # Optional
    description="Secrets for the backend service" # Optional
)

• folder_id (str): The ID of the folder to update. Folders can only be updated by ID, so use list_folders to look the ID up if you only know the name.
• name (str): The new name of the folder. This is required, so pass the folder’s current name to leave it unchanged.
• project_id (str): The ID of your project.
• environment_slug (str): The slug of the environment the folder is in.
• path (str, optional): The parent path the folder is in. Defaults to /.
• description (str, optional): A new description for the folder. Omitting it leaves the existing description unchanged, so it can’t be used to clear one.

• UpdateFolderResponseItem: The response containing the updated folder.

​

Delete folder

deleted_folder = client.folders.delete_folder(
    folder_id_or_name="backend",
    project_id="<project-id>",
    environment_slug="dev",
    path="/", # Optional
    force_delete=False # Optional
)

• folder_id_or_name (str): The ID or the name of the folder to delete.
• project_id (str): The ID of your project.
• environment_slug (str): The slug of the environment the folder is in.
• path (str, optional): The parent path the folder is in. Defaults to /.
• force_delete (bool, optional): Whether to delete the folder even when it still contains secrets or subfolders. Defaults to False.

• DeleteFolderResponseItem: The response containing the deleted folder. Unlike the other folder responses, it doesn’t include a path field.

​

agent_vault.sessions

​

List sessions

from infisical_sdk import AgentVaultSessionScope, AgentVaultSessionStatus

sessions = client.agent_vault.sessions.list(
    scope=AgentVaultSessionScope.MINE, # Optional
    statuses=[AgentVaultSessionStatus.ACTIVE], # Optional
    search="nightly deploy", # Optional
    limit=20, # Optional
    offset=0 # Optional
)

• scope (Union[AgentVaultSessionScope, str], optional): whose sessions to list, either AgentVaultSessionScope.MINE ("mine") for the identity’s own sessions or AgentVaultSessionScope.ALL ("all") for every session if the identity is an admin (defaults to AgentVaultSessionScope.MINE)
• statuses (List[Union[AgentVaultSessionStatus, str]], optional): the statuses to include, from AgentVaultSessionStatus.ACTIVE ("active"), AgentVaultSessionStatus.REVOKED ("revoked"), and AgentVaultSessionStatus.EXPIRED ("expired") (defaults to all three)
• search (str, optional): text to find in each session’s label, owner name, owner email, or access bundle name
• limit (int, optional): the maximum number of sessions to return, from 1 to 100 (defaults to 20)
• offset (int, optional): the number of sessions to skip (defaults to 0)

• ListAgentVaultSessionsResponse: the sessions in sessions, and the total number of matching sessions in totalCount

​

Get session

session = client.agent_vault.sessions.get(
    session_id="<session-id>"
)

• session_id (str): the ID of the session

• AgentVaultSession: the session

​

Create session

session = client.agent_vault.sessions.create(
    access_bundle="<access-bundle-name>",
    ttl="1h", # Optional
    label="nightly deploy" # Optional
)

• access_bundle (str): the name of the access bundle that the agent can use during the session
• ttl (str, optional): how long the session lasts, as a duration of at least one minute such as 30m, 8h, or 7d, or as never for a session that doesn’t expire (defaults to 7d)
• label (str, optional): a short description of what the session is for, such as nightly deploy (up to 128 characters, without line breaks, tabs, or invisible characters)

• CreatedAgentVaultSession: the new session, with the session token in token (Infisical returns the token only once)

​

Update session label

session = client.agent_vault.sessions.update(
    session_id="<session-id>",
    label="support ticket triage"
)

• session_id (str): the ID of the session
• label (Optional[str]): the new label, or None to remove the label (up to 128 characters, without line breaks, tabs, or invisible characters)

• AgentVaultSession: the updated session

​

Revoke session

session = client.agent_vault.sessions.create(access_bundle="<access-bundle-name>", ttl="1h")
try:
    run_agent(session.token) # Your code that starts the agent with the session token
finally:
    client.agent_vault.sessions.revoke(session_id=session.id)

• session_id (str): the ID of the session

• AgentVaultSession: the revoked session, with accessBundles set to None (call get for the access bundle)

​

agent_vault.proxies

​

List proxies

proxies = client.agent_vault.proxies.list(
    search="edge", # Optional
    order_by="name", # Optional
    order_direction="asc", # Optional
    limit=20, # Optional
    offset=0 # Optional
)

• search (str, optional): text to find in proxy names
• order_by (str, optional): what to sort the proxies by, name or createdAt (defaults to createdAt)
• order_direction (str, optional): the direction to sort in, asc or desc (defaults to desc)
• limit (int, optional): the maximum number of proxies to return, from 1 to 100 (defaults to 20)
• offset (int, optional): the number of proxies to skip (defaults to 0)

• ListAgentVaultProxiesResponse: the proxies in proxies, and the total number of matching proxies in totalCount

​

Create proxy

from infisical_sdk import AgentVaultTrafficPolicy

response = client.agent_vault.proxies.create(
    name="edge-proxy",
    traffic_policy=AgentVaultTrafficPolicy.BUNDLE_HOSTS, # Optional
    allowed_hosts=["registry.npmjs.org", "pypi.org"], # Optional
    poll_interval=60 # Optional
)

• name (str): the name of the proxy, in lowercase letters, numbers, and hyphens (up to 64 characters)
• traffic_policy (Union[AgentVaultTrafficPolicy, str], optional): the proxy’s traffic policy, either AgentVaultTrafficPolicy.ANY_HOST ("any-host") to forward requests to any host or AgentVaultTrafficPolicy.BUNDLE_HOSTS ("bundle-hosts") to refuse requests to hosts that no service in the session’s access bundle covers (defaults to AgentVaultTrafficPolicy.ANY_HOST)
• allowed_hosts (Union[List[str], str], optional): hosts that agents can reach under AgentVaultTrafficPolicy.BUNDLE_HOSTS even if no service covers them, as a list or a comma-separated string (see Exceptions)
• poll_interval (int, optional): how often, in seconds, the proxy checks its sessions and settings with Infisical, from 10 to 300 (defaults to 60)

• AgentVaultProxyWithTokenResponse: the proxy in proxy, and its proxy token in proxyToken (Infisical returns the token only once)

​

Update proxy

from infisical_sdk import AgentVaultTrafficPolicy

proxy = client.agent_vault.proxies.update(
    proxy_id="<proxy-id>",
    name="edge-proxy", # Optional
    traffic_policy=AgentVaultTrafficPolicy.BUNDLE_HOSTS, # Optional
    allowed_hosts=["pypi.org"], # Optional
    poll_interval=30 # Optional
)

• proxy_id (str): the ID of the proxy
• name (str, optional): the new name of the proxy
• traffic_policy (Union[AgentVaultTrafficPolicy, str], optional): the new traffic policy
• allowed_hosts (Union[List[str], str], optional): the new exceptions, which replace the current ones
• poll_interval (int, optional): the new poll interval in seconds, from 10 to 300
• clear_allowed_hosts (bool, optional): set to True to remove every exception (raises a ValueError if you also pass allowed_hosts)

• AgentVaultProxy: the updated proxy

​

Delete proxy

proxy = client.agent_vault.proxies.delete(
    proxy_id="<proxy-id>"
)

• proxy_id (str): the ID of the proxy

• AgentVaultProxy: the deleted proxy, with values only in id and name

​

Rotate proxy token

response = client.agent_vault.proxies.rotate_token(
    proxy_id="<proxy-id>"
)

• proxy_id (str): the ID of the proxy

• AgentVaultProxyWithTokenResponse: the proxy in proxy, and the new proxy token in proxyToken (Infisical returns the token only once)

​

Revoke proxy

proxy = client.agent_vault.proxies.revoke(
    proxy_id="<proxy-id>"
)

• proxy_id (str): the ID of the proxy

• AgentVaultProxy: the revoked proxy