Passbolt Api

Passbolt is an open-source, self-hosted password manager designed for teams. It provides a centralized, encrypted vault where organizations can store, share, and manage credentials securely. The server exposes a JSON REST API that authenticates requests using either GPGAuth or JWT tokens, and all secrets are protected with OpenPGP end-to-end encryption, ensuring the server never has access to plaintext passwords.

The platform distinguishes itself through a comprehensive role-based access control system that governs resource sharing and administrative actions. Teams can organize users into groups, share passwords and folders with granular permissions, and audit credential access. Administrators have dedicated tools to configure security policies, manage user accounts, and oversee the workspace. The server also supports multi-factor authentication and metadata version migration for evolving data structures.

Beyond core password management, the API enables programmatic vault management through high-level and low-level endpoints. Users can tag resources, manage favorites, and organize passwords into folders. The system tracks credential access for accountability and provides health check diagnostics for monitoring.

The server can be deployed on private infrastructure using Docker Compose, Kubernetes via Helm charts, or directly on various Linux distributions including Ubuntu, Debian, CentOS, AlmaLinux, Red Hat, and openSUSE. An interactive command-line configuration wizard guides administrators through initial setup, database configuration, and creation of the first admin user.

Features

Password Vaults - Stores all team passwords in a single, encrypted vault accessible from a central server.
OpenPGP Encryptions - Encrypts all secrets client-side using OpenPGP keys so the server never sees plaintext passwords.
Team Credential Vaults - Provides a shared, encrypted vault for teams to store and manage credentials with user permissions.
Team Password Manager APIs - A platform that enables teams to securely share passwords and secrets with controlled user and group permissions.
Permissioned Resource Sharings - Shares resources and folders with users using an exhaustive permission system.
User Group Management - Organizes users into logical groups to simplify sharing resources.
Workspace Administration - Provides administrators with tools to manage users, groups, and permissions across the organization.
REST API Integrations - Provides a full REST API for authenticating, managing resources, and sharing vault items.
Docker Compose Deployments - Packages the entire server stack as a Docker Compose file for reproducible multi-service deployment.
Self-Hosted Infrastructure Management - Provides installation and update procedures for running the password manager on private infrastructure.
Self-Hosted Deployments - Installs the password manager on private servers using Docker, Kubernetes, or Linux distributions for full data control.
Docker Deployments - Runs the password manager backend in a Docker container for quick and consistent server setup.
Self-Hosted Server Platforms - Installs and updates the backend server on your own infrastructure to keep full control of password data.
High-Level API Interfaces - Exposes both high-level and low-level REST endpoints for programmatic vault management.
Controlled Password Sharing - Enables team members to share passwords with controlled access and permissions.
Encrypted Storage Vaults - Centralizes credentials in a shared vault with end-to-end encryption for secure team management.
End-to-End Encryption - Distributes passwords and secrets using end-to-end encryption so only intended recipients can read them.
GPG Authentication Protocols - Authenticates API requests using a GPG challenge-response protocol.
Access Control Policies - Sets role-based permissions and workspace-level controls to restrict user actions within the vault.
API Request Authentication - Authenticates all API requests using GPGAuth or JWT tokens for secure programmatic vault access.
Credential Sharing - Shares passwords and secrets with specific users or groups, controlling who can view or modify them.
Self-Hosted Password Managers - Provides a self-hosted backend server for encrypted storage and synchronization of team credentials.
User Management - Creates and manages user entities that interact with the application.
User Account Management - Configures user accounts, roles, and permissions within the admin workspace to control access.
Encrypted Credential Storage - Stores passwords and secrets in an encrypted vault so only authorized users can access them.
Organizational Vault Administration - Ships administrative tools for enforcing policies and controlling shared items within the organizational vault.
Password Management - Stores and shares passwords securely within an organization for collaborative credential management.
Permission-Based Access Control - Assigns roles and workspace access to define who can view, edit, or share each password entry.
Role-Based Access Control - Restricts resource access and administrative actions based on assigned user roles and permissions.
Secure Secret Sharing - Stores and organizes passwords in a secure vault accessible only by authorized team members.
JWT Authentications - Authenticates API requests using signed JSON Web Tokens as a modern alternative to GPG-based auth.
GPG Authentications - Authenticates API requests using the GPGAuth protocol for secure programmatic access.
User Access Controls - Manages user invitations, roles, and permissions to control access to the password vault.
User Access Management - Administrators invite users, assign roles, and configure security settings to enforce organizational policies.
User Account Administration - Manages user roles, permissions, and workspace settings through a dedicated administrative interface.
JSON APIs - Exposes all vault operations as stateless HTTP endpoints returning JSON responses.
Metadata Migrations - Migrates resource metadata between schema versions to support evolving data structures.
Debian Packages - Ships a Debian package repository and command-line installation guide for the server.
AWS EC2 Deployments - Provides a deployment guide for installing the password manager on AWS EC2 instances.
Cloud Deployment - Provides deployment instructions for major cloud platforms using pre-configured images or marketplace offerings.
CentOS Distributions - Ships a native installation guide for CentOS using package manager and command-line steps.
Manual Server Installations - Provides a step-by-step manual installation guide for setting up the server from scratch.
Helm Chart Deployment - Installs the application on a Kubernetes cluster using a Helm chart from the official repository.
Administration Interfaces - Provides an administrative interface to configure security settings, user access, and organizational policies.
GPGAuth Protocols - Authenticates API requests using the legacy GPGAuth protocol for backward compatibility.
Multi-Factor Authentication - Validates authentication for users who have multi-factor authentication enabled.
Public Key Retrieval - Retrieves stored public OpenPGP keys needed for encryption between server and clients.
User Password Administration - Centralizes and organizes passwords for individual users within a team environment.
Security Configurations - Adjusts security policies and interface preferences to align with organizational requirements.
Security Policy Management - Adjusts security settings and user interface options to enforce organizational policies on the instance.
Credential Access Monitoring - Tracks and logs user interactions with stored credentials to enforce accountability and compliance.
Health Checks - Provides a diagnostic endpoint for collecting health check data about the server instance.
Password Folder Organizers - Groups passwords into folders for bulk sharing and organization.

TheHive-Project/TheHive

3,891View on GitHub

TheHive is a security incident response platform and multi-tenant case management system. It functions as a Security Orchestration, Automation, and Response (SOAR) tool and a threat intelligence platform designed to coordinate security investigations by managing alerts, cases, and observables. The platform is distinguished by its multi-tenant architecture, which isolates data across different organizations while supporting selective cross-tenant sharing. It features a SOAR automation engine capable of executing sandboxed JavaScript logic to automate workflows and trigger response actions thro

kimai/kimai

4,757View on GitHub

Kimai is an open-source time tracking system that records employee working hours, manages absences, and generates professional invoices from recorded timesheets and expenses. It organizes all time records through a mandatory three-level hierarchy of customer, project, and activity, and supports project budget monitoring with configurable time and money limits. The application is extensible through a plugin system that allows adding custom features, invoice templates, reporting views, and dashboard widgets without modifying core files. It provides a RESTful JSON API for programmatic read and w

bitwarden/android

8,457View on GitHub

This project is an Android password manager application that provides an end-to-end encrypted vault for storing and synchronizing login credentials, secure notes, and identities. It functions as a secure storage system using zero-knowledge encryption to ensure that only the user can decrypt their stored data. The application integrates directly with the Android system to provide an autofill service that populates usernames and passwords into mobile apps and browser login fields. It also serves as a passkey management wallet for FIDO2 cryptographic passkeys and a time-based one-time password a

Velocidex/velociraptor

3,769View on GitHub

Velociraptor is a digital forensics and incident response platform, endpoint detection and response system, and visibility tool. It provides a query engine and remote forensic collector used to hunt for indicators of compromise and perform triage across a fleet of hosts. The system is distinguished by its specialized query language for interrogating host state and parsing binary files. It features a notebook environment that combines markdown documentation with executable query cells to standardize investigative workflows and enable collaborative reporting. The platform covers a wide range o

passboltpassbolt_api

Features