git:20260713.1fbd3f3 to git:20260728.b7e78fc

---

name: "Hudu Passwords"

description: >

when_to_use: >-

---

# Hudu Passwords Management

## Overview

Passwords in Hudu (called "asset passwords" in the API) provide secure credential storage scoped to companies. They allow MSP technicians to store, organize, and retrieve credentials for client infrastructure, applications, and services. Password access can be restricted at the API key level, and all access is logged in Hudu's activity logs.

**Critical API naming note:** The Hudu UI calls these "Passwords," but the API endpoint is `/api/v1/asset_passwords`. Always use `asset_passwords` in API calls.

## Key Concepts

### Password Organization

Passwords are organized by:

- **Company** - Each password belongs to a specific company

- **Password Folders** - Hierarchical folder structure within a company

- **Name** - Descriptive name identifying the credential

```

Company: Acme Corporation

+-- Passwords

+-- Infrastructure

| +-- Domain Admin - ACME

| +-- Local Admin - Servers

| +-- vCenter Admin

+-- Network

| +-- Firewall Admin

| +-- Switch Admin

| +-- WiFi Controller

+-- Applications

| +-- ERP Admin

| +-- CRM Admin

+-- Cloud Services

+-- Microsoft 365 Global Admin

+-- AWS Root Account

```

### API Key Password Permission

API keys in Hudu can be configured to allow or deny password access:

| Permission | Effect |

|------------|--------|

| Enabled | API key can read/write password values |

| Disabled | API key cannot access password values (403 Forbidden) |

This is configured per API key in Admin > API Keys.

### Security Audit Trail

```http

```

```

```

## Common Workflows

### Secure Password Creation

```javascript

async function createSecurePassword(companyId, data) {

const password = await createAssetPassword({

company_id: companyId,

name: data.name,

username: data.username,

password: data.password,

url: data.url,

description: `Created: ${new Date().toLocaleDateString()}\nPurpose: ${data.purpose}`,

password_type: data.type,

password_folder_id: data.folderId

});

return password;

}

```

### Password Rotation Workflow

```javascript

async function rotatePassword(passwordId, newPassword, reason) {

// Get current password info (for logging, not the value)

const current = await getAssetPassword(passwordId);

// Update with new password

const updated = await updateAssetPassword(passwordId, {

password: newPassword,

description: `${current.description || ''}\nRotated: ${new Date().toLocaleDateString()} - ${reason}`

});

return updated;

}

```

### Password Search by Context

```javascript

async function findPasswordsForServer(companyId, serverName) {

const passwords = await fetchAssetPasswords({ company_id: companyId });

return passwords.filter(p =>

p.name.toLowerCase().includes(serverName.toLowerCase()) ||

p.description?.toLowerCase().includes(serverName.toLowerCase()) ||

p.url?.toLowerCase().includes(serverName.toLowerCase())

);

}

```

### Find Stale Passwords

```javascript

async function findStalePasswords(companyId, daysOld = 90) {

const cutoffDate = new Date();

cutoffDate.setDate(cutoffDate.getDate() - daysOld);

const passwords = await fetchAssetPasswords({ company_id: companyId });

return passwords

.filter(p => new Date(p.updated_at) < cutoffDate)

.map(p => ({

id: p.id,

name: p.name,

username: p.username,

lastUpdated: p.updated_at,

daysSinceUpdate: Math.floor(

(new Date() - new Date(p.updated_at)) / (1000 * 60 * 60 * 24)

)

}));

}

```

### Password Inventory Report

```javascript

async function generatePasswordReport(companyId) {

const passwords = await fetchAssetPasswords({ company_id: companyId });

const byType = {};

passwords.forEach(p => {

const type = p.password_type || 'Uncategorized';

if (!byType[type]) byType[type] = [];

byType[type].push({

name: p.name,

username: p.username,

url: p.url,

lastUpdated: p.updated_at

// NEVER include actual password values in reports

});

});

return byType;

}

```

## Security Best Practices

### Access Control

1. **Restrict API key permissions** - Only enable password access on keys that need it

2. **Use company-scoped keys** - Limit API keys to specific companies when possible

3. **IP whitelist** - Restrict API key usage to known IPs

4. **Regular access reviews** - Audit who has API keys with password access

### Password Hygiene

1. **Regular rotation** - Rotate passwords on schedule (90 days recommended)

1. **Use descriptive names** - Include system name and account type (e.g., "Domain Admin - ACME")

2. **Set password type** - Classify passwords (Administrative, Network, Application, etc.)

3. **Organize with folders** - Create a logical folder hierarchy per company

4. **Document purpose** - Use the description field to explain what the password is for

5. **Track URLs** - Always include the login URL when applicable

## Related Skills

- [Hudu Companies](../companies/SKILL.md) - Password company scope

- [Hudu Assets](../assets/SKILL.md) - Device-related credentials

- [Hudu Articles](../articles/SKILL.md) - Embedding passwords in articles

- [Hudu Websites](../websites/SKILL.md) - Website credentials

- [Hudu API Patterns](../api-patterns/SKILL.md) - API reference