RAR type specification

Vault supports the vault:path_access RAR type for fine-grained authorization. Each authorization detail object in the authorization_details claim must conform to the following structure:

Field	Type	Required	Description
`type`	string	Yes	Must be `vault:path_access` to indicate a Vault path access constraint.
`path`	string	Yes	The Vault path the constraint applies to. Supports exact path matching.
`capabilities`	array of strings	Yes	List of capabilities permitted for the path. Valid values: `read`, `create`, `update`, `delete`, `list`, `sudo`, `patch`, `subscribe`, `recover`, `deny`.
`allowed_parameters`	object	No	Map of parameter names to arrays of values that restricts which request parameters and values Vault permits. An empty array `[]` allows any value for that parameter.
`denied_parameters`	object	No	Map of parameter names to arrays of denied values. Blocks specific parameter values. Takes precedence over `allowed_parameters`.
`required_parameters`	array of strings	No	List of parameter names that must be present in the request. Vault rejects requests missing any required parameter.

The parameter control fields work similarly to the parameter controls available in Vault ACL policies. RAR parameter controls provide an additional layer of restriction on top of policy-level controls, enabling fine-grained authorization directly within OAuth tokens.

Basic RAR definition

The following constraint:

Applies to the path database/creds/my-role.
Permits only read operations.
Works with ACL policies to determine final access for the entity.

{
  "type": "vault:path_access",
  "path": "database/creds/my-role",
  "capabilities": ["read"]
}

Example RAR request with multiple constraints

A JWT can include multiple authorization detail objects in the authorization_details array. Vault evaluates each constraint independently. The JWT request succeeds if the authorization detail object matches at least one constraint that permits the operation and no matching constraint denies it.

{
  "authorization_details": [
    {
      "type": "vault:path_access",
      "path": "database/creds/readonly-role",
      "capabilities": ["read"]
    },
    {
      "type": "vault:path_access",
      "path": "pki/issue/my-role",
      "capabilities": ["create", "update"]
    }
  ]
}