Overview
Vault manages secrets, private PKI, crypto keys, and one-time delivery through a single, workspace-scoped API. Every request selects a vault engine, while the control plane keeps the resource metadata and the engine keeps sensitive material.
An engine is part of every Vault resource’s identity. Read and list requests can select one engine
or the federation selector (-); mutations always select one concrete engine. Responses include
the engine that owns each returned resource. See engine selection
for the request rules.
Core resources
Section titled “Core resources”Vault’s capabilities do not all sit at the same maturity, and the address says which is which: a
stable capability is served under /vault/v1/, one whose shape may still change under
/vault/alpha/. Pin to the address you are willing to live with.
Stable, at /vault/v1/
Section titled “Stable, at /vault/v1/”- Secrets: named, versioned containers of opaque secret bytes. Each version is immutable, so you can keep history and roll back to an earlier value.
- Private PKI: a certificate authority you run yourself. Define the certificate templates you allow, then issue and revoke certificates against them and publish a revocation list.
- Operations and audit: Vault records completed operations for audit and never records a secret payload in the clear.
Alpha, at /vault/alpha/
Section titled “Alpha, at /vault/alpha/”These work, and their shape is not yet settled. An alpha capability can change without a deprecation window, which is exactly what its address is telling you.
- Crypto keys: named, versioned cryptographic keys you use without ever handling the key material. The service encrypts, decrypts, re-encrypts, signs, verifies, computes MAC tags, and generates data-encryption keys and random bytes on your behalf, with the key staying inside the engine.
- Capsules: a persisted, single-use delivery. Create a capsule from a payload and it can be collected exactly once, against a redemption secret, after which the delivery has ended.