python-barbicanclient — Interactions

Interactions — python-barbicanclient — branch stable/2026.2

Branch stable/2026.2 @ 8162006e8677 — repository https://opendev.org/openstack/python-barbicanclient — analysed on 2026-11-01

All observed frames come from the local stub. They show what the client sends. Responses shown are what the stub was told to answer, not what a real Barbican answers. The barbican: references say what the service source does; no service was run.

No database, message bus, cache, RPC, subprocess or socket other than HTTP. The inventory found 25 keystoneauth occurrences in 5 files, 0 RPC and 0 triggers.

1. Keystone

Handled entirely by keystoneauth. Under OSC the session comes from osc-lib:osc_lib/clientmanager.py:195. Under barbican it is built by barbicanclient/barbican.py:132.

2. Barbican: endpoint and microversion

Selection of the endpoint:

With endpoint=, requests go to <endpoint>/<version>/ (barbicanclient/client.py:39). version defaults to v1 (barbicanclient/client.py:30).

**osc_plugin.make_client reads instance._region_name**, a private attribute of the OSC client manager (openstackclient:openstackclient/common/clientmanager.py:80). It passes no version and no microversion, so --os-key-manager-api-version only selects the command group: another value gives a warning, then 'secret list' is not an openstack command, exit 2 (openstackclient:openstackclient/shell.py:135) [observed].

Negotiation, in order, in one process [observed]:

With endpoint=, step 1 does not happen and step 2 targets the endpoint as given, without /v1 [observed in legacy-no-auth].

Reading the answer (barbicanclient/v1/client.py:135):

• The first entry of the version list is used. A status equal to STABLE, ignoring case, means 1.0 only.
• Any other status needs min_version and max_version.
• The client takes the highest of 1.2, 1.1, 1.0 inside the range (barbicanclient/v1/client.py:30, barbicanclient/v1/client.py:97).
• The result becomes default_microversion of the adapter (barbicanclient/v1/client.py:62), and every later request carries OpenStack-API-Version: key-manager <version> (keystoneauth1:keystoneauth1/adapter.py:284, keystoneauth1:keystoneauth1/session.py:683).

The service gives stable without min and max when the requested version is 1.0 or absent, and CURRENT with both otherwise (barbican:barbican/api/controllers/versions.py:94, barbican:barbican/api/controllers/versions.py:156, barbican:barbican/api/controllers/versions.py:182). The list of versions at the root is answered with 300 (barbican:barbican/api/controllers/versions.py:206). The maximum is 1.2 (barbican:barbican/api/controllers/versions.py:30).

What each microversion changes in the client:

3. Barbican: operations

The full table with headers, service handler and unit test counts is api-surface. The specifics that a re-implementation can miss:

Sample frames [observed]

GET /key-manager/v1 HTTP/1.1
Accept: application/json
OpenStack-API-Version: key-manager 1.1
X-Auth-Token: <token>

POST /key-manager/v1/secrets/ HTTP/1.1
Accept: */*
Content-Type: application/json
OpenStack-API-Version: key-manager 1.2
X-Auth-Token: <token>

{"name": "n", "algorithm": "aes", "mode": "cbc", "bit_length": 256, "secret_type": "opaque", "payload": "cA==", "payload_content_type": "application/octet-stream", "payload_content_encoding": "base64"}

GET /key-manager/v1/secrets/11111111-2222-4333-8444-555555555555/payload HTTP/1.1
Accept: text/plain
OpenStack-API-Version: key-manager 1.2
X-Auth-Token: <token>

PUT /key-manager/v1/secrets/11111111-2222-4333-8444-555555555555/acl HTTP/1.1
Accept: */*
Content-Type: application/json
OpenStack-API-Version: key-manager 1.2
X-Auth-Token: <token>

{"read": {"project-access": true, "users": ["u1", "u2"]}}

POST /key-manager/v1/orders/ HTTP/1.1
Accept: */*
Content-Type: application/json
OpenStack-API-Version: key-manager 1.2
X-Auth-Token: <token>

{"type": "key", "meta": {"name": "n", "algorithm": "aes", "bit_length": 256, "expiration": "2030-01-01T00:00:00+00:00", "payload_content_type": "application/octet-stream", "mode": "cbc"}}

DELETE /key-manager/v1/secrets/11111111-2222-4333-8444-555555555555/consumers HTTP/1.1
Accept: */*
Content-Type: application/json
OpenStack-API-Version: key-manager 1.2
X-Auth-Token: <token>

{"service": "x", "resource_type": "x", "resource_id": "x"}

More are in wire-probe-shape.

4. Other

etc/barbicanclient.conf:1 is a sample file that no code reads [inferred: oslo_config is imported only by functionaltests/common/config.py:18].

Source: reverse-spec-python-barbicanclient/03-interactions_stable-2026.2.md. The _rewrite/ and _inventory/ files are not published on the site.