What each integration returns

GET /api/actionsets lists what is installed. Parameters are strict objects: an unknown key fails validation instead of changing what the integration will do.

raw: one stored value

{ "actionset": "raw", "action": "serve", "params": { "value": "sk_live_…" } }

generator: a new value on every read

Nothing is stored, so two reads give two values. Nothing to revoke, nothing to rotate. nonce and token come from the operating system's cryptographic random source. faker does not: it produces realistic fake data for demos and tests, and must never stand in for a real credential.

{ "actionset": "generator", "action": "nonce",
  "params": { "bytes": 32, "encoding": "base64url" } }

{ "actionset": "generator", "action": "token",
  "params": { "length": 40, "encoding": "alphanumeric", "prefix": "sk_live_" } }

{ "actionset": "generator", "action": "faker",
  "params": { "module": "internet", "method": "email", "locale": "en" } }

nonce encodings: hex, base64, base64url, decimal. token adds alphanumeric, letters, and digits, with lengths from 4 to 512. faker accepts a fixed list of module and method pairs, plus an optional seed when you want the same output twice.

pgsql: short-lived Postgres logins

{ "actionset": "pgsql", "action": "create-role", "params": {
  "connectionString": "postgresql://aker_root:…@db:5432/app",
  "rolePrefix": "aker",
  "attributes": ["LOGIN"],
  "ttlMinutes": 60,
  "tables": [ { "schema": "public", "table": "orders", "permissions": ["SELECT"] } ],
  "allowRequest": { "ttlMinutes": true }
} }

The stored connection string needs permission to create roles. Every read creates a new login named <prefix>_<actor>_<random>, sets it to expire with VALID UNTIL, and returns a full connection string. table: "*" covers every table in the schema. Set database to use a different database on the same server. Revoking drops the login after removing what it was granted.

mysql and mssql: a login per requester

{ "actionset": "mysql", "action": "create-user", "params": {
  "connectionString": "mysql://root:…@db:3306/app",
  "userPrefix": "aker",
  "ttlMinutes": 60,
  "tables": [ { "table": "orders", "permissions": ["SELECT"] } ]
} }

{ "actionset": "mssql", "action": "create-login", "params": {
  "connectionString": "mssql://sa:…@db:1433/app",
  "userPrefix": "aker",
  "tables": [ { "schema": "dbo", "table": "orders", "permissions": ["SELECT"] } ]
} }

MySQL user names stop at 32 characters, and ttlMinutes also sets a password expiry as a backstop. SQL Server has no server-side expiry, so a login stays until it is revoked. Keep a TTL on those secrets so the record can be cleaned up.

redis: keys, lists, and caching

{ "actionset": "redis", "action": "get", "params": {
  "connectionString": "redis://:…@cache:6379",
  "keyTemplate": "session:{user.id}"
} }

{ "actionset": "redis", "action": "list-append", "params": {
  "connectionString": "redis://:…@cache:6379",
  "keyTemplate": "audit:{orgId}",
  "valueTemplate": "{user.email} {request.action}",
  "maxLength": 1000,
  "ttlSeconds": 86400
} }

{ "actionset": "redis", "action": "cache", "params": {
  "connectionString": "redis://:…@cache:6379",
  "keyTemplate": "secret:{secretId}:{user.id}",
  "ttlSeconds": 300,
  "inner": { "actionset": "pgsql", "action": "create-role", "params": { … } }
} }

Templates accept {user.id}, {user.email}, {user.name}, {secretId}, {orgId}, {request.<key>}, and {context.<key>}. A missing variable refuses the read, so a mistyped placeholder cannot return a value. Keys must match ^[A-Za-z0-9:_.@-]{1,256}$. cache serves from the key, and on a miss runs the integration inside it, storing the result for ttlSeconds (up to 30 days). Revoking a cached value deletes the key and passes the revoke on to the inner value.