Vaults

The Vault endpoint returns secrets by default and can optionally return keys, certificates, or a single resource. Vault access requires a Vault Access Key provided as a Bearer token.

Endpoint

GET /api/v1/vaults/{vault_id}

Authentication

All requests must include:

Authorization: Bearer VAULT_ACCESS_KEY
Accept: application/json

If the token is missing or invalid, the API returns:

401 Unauthorized

Default Response (Secrets)

If no query parameters are provided, the response includes:

• Vault id and name
• All active secrets
• Secret values are included

Example

curl --request GET \
  --url "https://secryn.example.com/api/v1/vaults/{vault_id}" \
  --header "Accept: application/json" \
  --header "Authorization: Bearer VAULT_ACCESS_KEY"

Response includes

secrets[] with: id, name, value, content_type, tags

Secrets Mode

Use the secrets query parameter to control secret output.

Secrets: Names only

GET /api/v1/vaults/{vault_id}?secrets=names

Returns only:

• id
• name

Example

curl --request GET \
  --url "https://secryn.example.com/api/v1/vaults/{vault_id}?secrets=names" \
  --header "Accept: application/json" \
  --header "Authorization: Bearer VAULT_ACCESS_KEY"

Include Keys and Certificates

Use the include query parameter to fetch keys and/or certificates.

Supported values:

• keys
• certificates

Multiple values can be comma-separated.

Example - Include both

curl --request GET \
  --url "https://secryn.example.com/api/v1/vaults/{vault_id}?include=keys,certificates" \
  --header "Accept: application/json" \
  --header "Authorization: Bearer VAULT_ACCESS_KEY"

Key Behavior

Returned key fields:

id, name, type, key_type, key_size, activation_date, expiration_date, tags

Keys are only included if:

• activation_date is null or
• activation_date <= now()

If a key is expired, it is returned as:

{ "id": "<key-id>", "message": "Resource expired" }

Certificate Behavior

Returned certificate fields:

id, name, type, expires_at, tags

If a certificate is expired, it is returned as:

{ "id": "<certificate-id>", "message": "Resource expired" }

Note: Expired certificates and keys may be included in the list, but will be represented as an object with an id and an expiration message.

Fetch a Single Resource from a Vault

Use the resource query parameter to fetch a specific secret, key, or certificate by ID.

GET /api/v1/vaults/{vault_id}?resource={resource_id}

Secryn checks the resource in this order:

• Secret (active only)
• Certificate
• Key

If not found, returns:

404 Not Found

Fetch a Secret by Resource ID

If the resource ID matches an active secret, Secryn returns JSON.

Fields returned:

id, name, value, content_type, tags

Example:

curl --request GET \
  --url "https://secryn.example.com/api/v1/vaults/{vault_id}?resource={secret_id}" \
  --header "Accept: application/json" \
  --header "Authorization: Bearer VAULT_ACCESS_KEY"

Fetch a Certificate by Resource ID

If the resource ID matches a certificate, Secryn returns the certificate file contents (PEM) with:

• Content-Type: application/x-pem-file
• No-cache headers

Example:

curl --request GET \
  --url "https://secryn.example.com/api/v1/vaults/{vault_id}?resource={certificate_id}" \
  --header "Authorization: Bearer VAULT_ACCESS_KEY"

If expired, returns:

410 Gone with { "message": "Resource expired" }

Fetch a Key by Resource ID

If the resource ID matches a key, Secryn returns the key file contents (PEM) with:

• Content-Type: application/x-pem-file
• No-cache headers

Example:

curl --request GET \
  --url "https://secryn.example.com/api/v1/vaults/{vault_id}?resource={key_id}" \
  --header "Authorization: Bearer VAULT_ACCESS_KEY"

If the key is not active yet (activation_date is in the future), returns:

403 Forbidden with { "message": "Resource not active" }

If expired, returns:

410 Gone with { "message": "Resource expired" }

Response Fields

All successful vault responses include:

• id
• name

Depending on query parameters, responses may include:

• secrets (array)
• keys (array)
• certificates (array)

Logging

Every vault request is recorded in Request Logs with:

• success or failure
• resource type vault
• IP address, route, method, status

Common Status Codes