Lease Operations
resource: lease — manage leases on dynamic secrets, 3 operations
What a lease is here: this resource manages leases on dynamic secrets
issued by some other Vault engine (database, AWS, PKI, etc.) earlier in the workflow — a
lease ID you already hold. This resource does not itself provide a way to create a lease;
that happens when the originating engine issues the dynamic secret.
renew
Extends a lease on a dynamic secret, e.g. a database credential Vault issued earlier in the workflow.
| Field | Type | Required | Description |
|---|---|---|---|
leaseID | text | ✓ Yes | The lease ID to renew. |
incrementSeconds | number | No | Requested TTL extension. |
Example response:
{ "leaseID": "database/creds/readonly/2f6a...", "leaseDuration": 1800, "renewable": true }revoke
Immediately invalidates a lease — e.g. after a workflow finishes using a dynamic database credential, to make sure it stops working right away rather than waiting out its TTL.
| Field | Type | Required | Description |
|---|---|---|---|
leaseID | text | ✓ Yes | The lease ID to revoke. |
Example response:
{ "leaseID": "database/creds/readonly/2f6a..." }lookup
Checks a lease's remaining TTL and renewability before deciding whether to renew it.
| Field | Type | Required | Description |
|---|---|---|---|
leaseID | text | ✓ Yes | The lease ID to inspect. |
Example response:
{ "leaseID": "database/creds/readonly/2f6a...", "ttl": 900, "renewable": true }
Typical pattern:
lookup before a long-running step to confirm the
remaining TTL comfortably covers it, renew if it doesn't, and revoke once
the workflow is done with the dynamic secret so it can't be reused after the fact.
renew error mapping: a 400/404 from Vault on
renew maps to
HASHICORP_LEASE_NOT_RENEWABLE if Vault's error text says the lease isn't renewable, and
to HASHICORP_LEASE_NOT_FOUND otherwise — see Error
Codes.