@startuml
hide unlinked
title Save secret in the Vault
participant "SODALITE Endpoint\nClient" as client
participant "Secrets\nVault" as secretstore
participant "IAM" as IAM


activate client
client->secretstore: Obtain Vault token (JWT token + role)
activate secretstore
secretstore->IAM: Check JWT access token
activate IAM
IAM-->secretstore: Access token is valid
deactivate IAM
secretstore->secretstore: Check JWT\nroles mapping\nto Vault roles
secretstore->client: Vault token
deactivate secretstore
client->secretstore: Save secret key-value (Vault token)
activate secretstore
secretstore->secretstore: Check role\nwrite privilege\nto secret storage
secretstore-->client: Return saving response (JSON)
deactivate secretstore


@enduml
