Bitwarden REST API for automated secrets management on self-hosted server

kgoetz · February 1, 2019, 3:48am

Another vote from me!
I was hoping to do some reporting using the new history data (since its not included in the built in reports) but will be deferring the project until I have more time given the lack of documentation

Consumers/implementations of the API I’ve found so far:

Real bit warden, linked in 3rd post
Python CLI tool mentioned ~6th post
RS bitwarden GitHub - dani-garcia/vaultwarden: Unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs
Rubywarden GitHub - jcs/rubywarden: An unofficial, mostly Bitwarden-compatible API server written in Ruby (Sinatra and ActiveRecord)

Rubywarden has an API overview included in API.md. I was going to do some experiments with curl but going by that description I’ll need something a little more advanced to experiment with.

github.com/jcs/rubywarden

API.md

master

## Bitwarden API Overview

Despite being open source, the
[.NET Bitwarden API code](https://github.com/bitwarden/core)
is somewhat difficult to navigate and comprehend from a high level,
and there is no formal documentation on API endpoints or how the
encryption and decryption is implemented.

The following notes were made by analyzing traffic between the Firefox
extension and the Bitwarden servers by running
[tools/mitm.rb](mitm.rb)
and having the Firefox extension use `http://127.0.0.1:4567/` as its
base URL.

The details for key derivation and encryption/decryption were done by
reading the
[web extension](https://github.com/bitwarden/browser)
code.

### Password hashing and encryption key derivation

This file has been truncated. show original

I have only skimmed the API code but it seems manageable as a research source.