> ## Documentation Index
> Fetch the complete documentation index at: https://syteca.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Bulk Add Secrets and Folders

> Syteca ACB REST API endpoint for bulk-creating multiple folders and secrets in a single call — the canonical migration and onboarding endpoint. Returns per-record success/error summary.

Creates multiple folders and secrets in a single API call. The canonical endpoint for **migration from another PAM product**, **bulk onboarding from a CSV/spreadsheet**, or **populating a freshly-installed Syteca with the organization's existing secrets**. Returns a summary identifying which records were created and which failed (with reasons).

<Note>
  For ACB deployments updated from a version prior to 1.2, switch to the `https://{hostname}/EkranACB` server in the Playground.
</Note>

### Permissions required

The user owning the Access Token must have **Editor** or **Owner** role on the target parent folders (and **Owner** on the root if creating root-level folders).

### Folders processed before secrets

Folders are processed **before** secrets within a single call — so you can reference newly-created folders by `parent_folder_name` in the `secrets` array. Each `secrets[]` entry has the same shape as the [Add secret](/docs/api/acb/endpoints/add-secret) request body; each `folders[]` entry has the same shape as [Add folder](/docs/api/acb/endpoints/add-folder).

### Not atomic — partial success is normal

The response's `Errors` array reports per-record failures. **Some records may succeed while others fail with reasons in `Errors`.** The Playground will show this structure on a successful (200) response.

<Tip>
  **For very large migrations** (10,000+ secrets), batch the request into chunks of \~500 secrets per call to avoid timeouts and rate-limit issues. The endpoint's rate limit is **5 requests per minute per Access Token** — so 500-secret batches × 5/min = 2,500 secrets/minute throughput.
</Tip>

### Rate limit

**5 requests per minute per Access Token.** Lower than other write endpoints because each call typically creates many records.

### Errors

See [Status codes](/docs/api/acb/api-reference#status-codes). Common errors:

* **400 Bad Request** — top-level request body malformed (per-record errors return inside the `Errors` array of a 200 response instead).
* **403 Forbidden** — user lacks Editor/Owner role on the target folders.
* **429 Too Many Requests** — rate limit exceeded.

## Related

<CardGroup cols={2}>
  <Card title="Add folder" icon="folder-plus" href="/docs/api/acb/endpoints/add-folder">Per-folder schema.</Card>
  <Card title="Add secret" icon="plus" href="/docs/api/acb/endpoints/add-secret">Per-secret schema, including type-specific fields.</Card>
  <Card title="CLI reference" icon="terminal" href="/docs/api/acb/cli">SytecaACBConsole.exe BulkAdd command for scripted migrations.</Card>
  <Card title="Data models" icon="braces" href="/docs/api/acb/data-models">Shared schemas for permissions, rotation, etc.</Card>
</CardGroup>


## OpenAPI

````yaml POST /api/bulk/add-secrets-and-folders
openapi: 3.0.3
info:
  title: Application Credentials Broker API
  description: >-
    API for managing secrets and folders in the Application Credentials Broker
    system
  version: 1.4.0
  contact:
    name: API Support
    email: support@example.com
servers:
  - url: https://your-syteca-host/SytecaACB
    description: On-premises Syteca ACB service (v1.2 or later)
    variables:
      hostname:
        default: your-syteca-host.example.com
        description: Your Syteca Application Server hostname
  - url: https://your-syteca-host/EkranACB
    description: Legacy URL prefix for ACB deployments updated from pre-v1.2
    variables:
      hostname:
        default: your-syteca-host.example.com
        description: Your Syteca Application Server hostname
security:
  - AccessTokenAuth: []
paths:
  /api/bulk/add-secrets-and-folders:
    post:
      tags:
        - Bulk Operations
      summary: Bulk add secrets and folders
      description: Creates multiple secrets and folders in a single operation
      operationId: bulkAdd
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SecretsAndFoldersRequestDto'
      responses:
        '201':
          description: Bulk operation completed successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecretsAndFoldersSummaryResponseDto'
        '400':
          description: Invalid request data
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '403':
          description: Access denied
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
components:
  schemas:
    SecretsAndFoldersRequestDto:
      type: object
      properties:
        secrets:
          type: array
          items:
            $ref: '#/components/schemas/SecretRequestDto'
          description: List of secrets to create
        folders:
          type: array
          items:
            $ref: '#/components/schemas/FolderRequestDto'
          description: List of folders to create
    SecretsAndFoldersSummaryResponseDto:
      type: object
      properties:
        folders:
          type: array
          items:
            $ref: '#/components/schemas/FolderResponseDto'
          description: Created folders
        secrets:
          type: array
          items:
            $ref: '#/components/schemas/SecretPasswordlessResponseDto'
          description: Created secrets
        errors:
          type: array
          items:
            type: string
          description: List of errors that occurred during bulk operation
    ErrorResponse:
      type: object
      properties:
        status:
          type: integer
          description: HTTP status code
        message:
          type: string
          description: Error message
      required:
        - status
        - message
    SecretRequestDto:
      type: object
      properties:
        name:
          type: string
          maxLength: 512
          description: Name of the secret
        type:
          $ref: '#/components/schemas/SecretType'
        description:
          type: string
          maxLength: 2000
          description: Description of the secret
        password:
          type: string
          description: The password value
        ssh_key:
          $ref: '#/components/schemas/SshKey'
        parent_folder_id:
          type: integer
          format: int32
          minimum: 0
          description: ID of the parent folder
        parent_folder_name:
          type: string
          maxLength: 512
          description: Name of the parent folder
        domain:
          type: string
          maxLength: 512
          description: Domain for AD accounts
        computer_name:
          type: string
          maxLength: 512
          description: Computer name for Windows/Unix accounts
        url:
          type: string
          maxLength: 2000
          format: uri
          description: URL for web accounts
        server:
          type: string
          maxLength: 512
          description: Server for database accounts
        login:
          type: string
          maxLength: 512
          description: Login username
        computers:
          type: array
          items:
            type: string
          description: List of computers
        file_transfer:
          $ref: '#/components/schemas/FileTransfer'
        rotation:
          $ref: '#/components/schemas/Rotation'
        record_activities:
          type: boolean
          description: Whether to record activities for this secret
        check_out:
          $ref: '#/components/schemas/CheckOut'
        require_approval:
          $ref: '#/components/schemas/RequireApproval'
        permissions:
          $ref: '#/components/schemas/Permissions'
        check_password:
          $ref: '#/components/schemas/CheckPassword'
      required:
        - name
        - type
        - login
    FolderRequestDto:
      type: object
      properties:
        name:
          type: string
          maxLength: 512
          description: Name of the folder
        description:
          type: string
          maxLength: 2000
          description: Description of the folder
        parent_folder_id:
          type: integer
          format: int32
          minimum: 0
          description: ID of the parent folder
        parent_folder_name:
          type: string
          maxLength: 512
          description: Name of the parent folder
        permissions:
          $ref: '#/components/schemas/Permissions'
      required:
        - name
    FolderResponseDto:
      type: object
      properties:
        id:
          type: integer
          format: int32
          description: Unique identifier of the folder
        name:
          type: string
          description: Name of the folder
        description:
          type: string
          description: Description of the folder
        parent_folder_id:
          type: integer
          format: int32
          description: ID of the parent folder
        permissions:
          $ref: '#/components/schemas/Permissions'
      required:
        - id
        - name
    SecretPasswordlessResponseDto:
      type: object
      properties:
        id:
          type: integer
          format: int32
          description: Unique identifier of the secret
        name:
          type: string
          description: Name of the secret
        type:
          $ref: '#/components/schemas/SecretType'
        description:
          type: string
          description: Description of the secret
        parent_folder_id:
          type: integer
          format: int32
          description: ID of the parent folder
        domain:
          type: string
          description: Domain for AD accounts
        computer_name:
          type: string
          description: Computer name for Windows/Unix accounts
        url:
          type: string
          description: URL for web accounts
        server:
          type: string
          description: Server for database accounts
        login:
          type: string
          description: Login username
        computers:
          type: array
          items:
            type: string
          description: List of computers
        file_transfer:
          $ref: '#/components/schemas/FileTransfer'
        rotation:
          $ref: '#/components/schemas/Rotation'
        record_activities:
          type: boolean
          description: Whether to record activities for this secret
        check_out:
          $ref: '#/components/schemas/CheckOut'
        require_approval:
          $ref: '#/components/schemas/RequireApproval'
        permissions:
          $ref: '#/components/schemas/Permissions'
        check_password:
          $ref: '#/components/schemas/CheckPassword'
        check_password_status:
          $ref: '#/components/schemas/PasswordCheckStatus'
        last_password_check_utc:
          type: string
          format: date-time
          nullable: true
          description: UTC timestamp of the last password check
        password_rotation_status:
          $ref: '#/components/schemas/PasswordRotationStatus'
        last_password_rotation_utc:
          type: string
          format: date-time
          nullable: true
          description: UTC timestamp of the last password rotation
      required:
        - id
        - name
        - type
        - login
    SecretType:
      type: string
      enum:
        - None
        - UnixAccountSSH
        - UnixAccountTelnet
        - WindowsAccount
        - ADAccount
        - WebAccount
        - MSSQLAccount
      description: Type of secret
    SshKey:
      type: object
      properties:
        private_key:
          type: string
          description: SSH private key
        pass_phrase:
          type: string
          description: Passphrase for the private key
      required:
        - private_key
    FileTransfer:
      type: object
      properties:
        protocol:
          $ref: '#/components/schemas/FileTransferProtocol'
        port:
          type: integer
          format: int32
          minimum: 0
          maximum: 65535
          default: 22
          description: Port number for file transfer
      required:
        - protocol
        - port
    Rotation:
      type: object
      properties:
        enabled:
          type: boolean
          description: Whether rotation is enabled
        rotate_every_min:
          type: integer
          format: int32
          minimum: 1
          description: Rotation interval in minutes
      required:
        - enabled
        - rotate_every_min
    CheckOut:
      type: object
      properties:
        enabled:
          type: boolean
          description: Whether check-out is enabled
        rotate_on_checkin:
          type: boolean
          description: Whether to rotate password on check-in
        auto_checkin_after_min:
          type: integer
          format: int32
          default: 60
          description: Auto check-in timeout in minutes
      required:
        - enabled
        - rotate_on_checkin
        - auto_checkin_after_min
    RequireApproval:
      type: object
      properties:
        require_approval_type:
          $ref: '#/components/schemas/SecretUsagePermissionType'
        approver_users:
          type: array
          items:
            type: string
          description: List of approver users
        approver_user_groups:
          type: array
          items:
            type: string
          description: List of approver user groups
        require_owners_and_approvers:
          type: boolean
          default: false
          description: Whether to require both owners and approvers
        working_dates:
          $ref: '#/components/schemas/WorkingDatePeriod'
        working_hours:
          $ref: '#/components/schemas/WorkingTimePeriod'
        working_days:
          type: array
          items:
            $ref: '#/components/schemas/DayOfWeek'
          description: Working days of the week
      required:
        - require_approval_type
    Permissions:
      type: object
      properties:
        inherit_users_and_roles:
          type: boolean
          default: false
          description: Whether to inherit users and roles from parent
        inherit_features:
          type: boolean
          default: false
          description: Whether to inherit features from parent
        users:
          type: array
          items:
            $ref: '#/components/schemas/Permission'
          description: User permissions
        user_groups:
          type: array
          items:
            $ref: '#/components/schemas/Permission'
          description: User group permissions
    CheckPassword:
      type: object
      properties:
        enabled:
          type: boolean
          default: false
          description: Whether heartbeat password checking is enabled
        check_every:
          type: integer
          format: int32
          default: 30
          description: Interval for password check.
        check_period_type:
          $ref: '#/components/schemas/PasswordCheckPeriodType'
      required:
        - enabled
        - check_every
        - check_period_type
    PasswordCheckStatus:
      type: string
      enum:
        - None
        - Valid
        - Invalid
        - Failed
      description: Status of the last password check (heartbeat)
    PasswordRotationStatus:
      type: string
      enum:
        - Disabled
        - Enabled
        - Failed
      description: Status of password rotation
    FileTransferProtocol:
      type: string
      enum:
        - Sftp
        - Scp
        - Ftp
      description: File transfer protocol
    SecretUsagePermissionType:
      type: string
      enum:
        - None
        - RequiredForAll
        - RequiredForOwners
        - RequiredForNonOwners
      description: Secret usage permission type
    WorkingDatePeriod:
      type: object
      properties:
        from:
          type: string
          format: date-time
          description: Start date
        to:
          type: string
          format: date-time
          description: End date
      required:
        - from
        - to
    WorkingTimePeriod:
      type: object
      properties:
        from:
          type: string
          format: time
          description: Start time
        to:
          type: string
          format: time
          description: End time
      required:
        - from
        - to
    DayOfWeek:
      type: string
      enum:
        - Sunday
        - Monday
        - Tuesday
        - Wednesday
        - Thursday
        - Friday
        - Saturday
      description: Day of the week
    Permission:
      type: object
      properties:
        name:
          type: string
          description: User or group name
        access_type:
          $ref: '#/components/schemas/SecretPermissionType'
        features:
          type: array
          items:
            $ref: '#/components/schemas/AdditionalFeature'
          description: Additional features granted
      required:
        - name
        - access_type
    PasswordCheckPeriodType:
      type: string
      enum:
        - Minute
        - Hour
        - Day
      description: Period type for the password check interval
    SecretPermissionType:
      type: string
      enum:
        - None
        - PAMUser
        - Owner
        - Viewer
      description: Secret permission type
    AdditionalFeature:
      type: string
      enum:
        - CopyPassword
        - ViewPassword
        - FileTransfer
      description: Additional features for permissions
  securitySchemes:
    AccessTokenAuth:
      type: apiKey
      in: header
      name: Authorization
      description: Access token for authentication

````