eva = wb.get_identity("eva")
wb.vault.grant_access("vsec_01J8ABC123XYZ", eva.id)
wb.vault.list_access("vsec_01J8ABC123XYZ")
wb.vault.revoke_access("vsec_01J8ABC123XYZ", eva.id)
const eva = await wb.getIdentity("eva");
await wb.vault.grantAccess("vsec_01J8ABC123XYZ", eva.id);
await wb.vault.listAccess("vsec_01J8ABC123XYZ");
await wb.vault.revokeAccess("vsec_01J8ABC123XYZ", eva.id);
# Accepts an agent handle (@eva) or id, and a secret name or id.
wirebox vault access grant GitHub -i @eva
wirebox vault access list GitHub
wirebox vault access revoke GitHub -i @eva
curl -X POST https://api.wirebox.sh/api/v1/vault/secrets/vsec_01J8ABC123XYZ/access \
-H "Authorization: Bearer $WIREBOX_API_KEY" \
-H "Content-Type: application/json" \
-d '{ "identity_id": "agt_01J8ABC123XYZ" }'
{
"id": "vacc_01J8ABC123XYZ",
"secret_id": "vsec_01J8ABC123XYZ",
"identity_id": "agt_01J8ABC123XYZ",
"created_at": "2026-10-10T10:00:00Z"
}
Vault
Vault Access
Grant, list, and revoke an agent identity’s access to a vault secret.
GET
/
api
/
v1
/
vault
/
secrets
/
{secret_id}
/
access
eva = wb.get_identity("eva")
wb.vault.grant_access("vsec_01J8ABC123XYZ", eva.id)
wb.vault.list_access("vsec_01J8ABC123XYZ")
wb.vault.revoke_access("vsec_01J8ABC123XYZ", eva.id)
const eva = await wb.getIdentity("eva");
await wb.vault.grantAccess("vsec_01J8ABC123XYZ", eva.id);
await wb.vault.listAccess("vsec_01J8ABC123XYZ");
await wb.vault.revokeAccess("vsec_01J8ABC123XYZ", eva.id);
# Accepts an agent handle (@eva) or id, and a secret name or id.
wirebox vault access grant GitHub -i @eva
wirebox vault access list GitHub
wirebox vault access revoke GitHub -i @eva
curl -X POST https://api.wirebox.sh/api/v1/vault/secrets/vsec_01J8ABC123XYZ/access \
-H "Authorization: Bearer $WIREBOX_API_KEY" \
-H "Content-Type: application/json" \
-d '{ "identity_id": "agt_01J8ABC123XYZ" }'
{
"id": "vacc_01J8ABC123XYZ",
"secret_id": "vsec_01J8ABC123XYZ",
"identity_id": "agt_01J8ABC123XYZ",
"created_at": "2026-10-10T10:00:00Z"
}
Access grants link a secret to an agent identity. An identity-scoped key with
the
vault:read scope can read a secret only if it has a grant. The server
enforces this by filtering ciphertext per identity on unlock, so revocation
takes effect on the next unlock. All access operations are admin-only.
Path Parameters
string
required
The secret’s id (
vsec_ prefix).Operations
| Method & Path | Description |
|---|---|
GET /api/v1/vault/secrets/{secret_id}/access | List identities granted access. |
POST /api/v1/vault/secrets/{secret_id}/access | Grant access. Body: identity_id. |
DELETE /api/v1/vault/secrets/{secret_id}/access/{identity_id} | Revoke access. |
Access Grant Object
string
Grant identifier (
vacc_ prefix).string
The secret the grant applies to.
string
The agent identity (
agt_ prefix) that was granted access.string
ISO 8601 creation timestamp.
eva = wb.get_identity("eva")
wb.vault.grant_access("vsec_01J8ABC123XYZ", eva.id)
wb.vault.list_access("vsec_01J8ABC123XYZ")
wb.vault.revoke_access("vsec_01J8ABC123XYZ", eva.id)
const eva = await wb.getIdentity("eva");
await wb.vault.grantAccess("vsec_01J8ABC123XYZ", eva.id);
await wb.vault.listAccess("vsec_01J8ABC123XYZ");
await wb.vault.revokeAccess("vsec_01J8ABC123XYZ", eva.id);
# Accepts an agent handle (@eva) or id, and a secret name or id.
wirebox vault access grant GitHub -i @eva
wirebox vault access list GitHub
wirebox vault access revoke GitHub -i @eva
curl -X POST https://api.wirebox.sh/api/v1/vault/secrets/vsec_01J8ABC123XYZ/access \
-H "Authorization: Bearer $WIREBOX_API_KEY" \
-H "Content-Type: application/json" \
-d '{ "identity_id": "agt_01J8ABC123XYZ" }'
{
"id": "vacc_01J8ABC123XYZ",
"secret_id": "vsec_01J8ABC123XYZ",
"identity_id": "agt_01J8ABC123XYZ",
"created_at": "2026-10-10T10:00:00Z"
}