from wirebox import Wirebox
wb = Wirebox()
result = wb.vault.initialize()
# result.vault_key is generated client-side and shown once — store it securely.
import { Wirebox } from "@wirebox-sh/sdk";
const wb = new Wirebox();
const { vaultKey, warning } = await wb.vault.initialize();
// vaultKey is generated client-side and shown once — store it securely.
wirebox vault init
# The body is client-generated key material (see the SDK/CLI).
curl -X POST https://api.wirebox.sh/api/v1/vault/initialize \
-H "Authorization: Bearer $WIREBOX_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"kdf_salt": "<base64 salt>",
"wrapped_org_key": "<base64 blob>",
"auth_hash": "<sha256 hex>"
}'
{
"initialized": true,
"id": "vlt_01J8ABC123XYZ",
"kdf_salt": "bBvH9uSqCs66wy8PO8HMIQ==",
"kdf_params": { "algorithm": "argon2id", "m": 65536, "t": 3, "p": 1 },
"created_at": "2026-10-10T10:00:00Z"
}
Vault
Initialize Vault
Create the organization’s zero-knowledge vault from client-generated key material.
POST
/
api
/
v1
/
vault
/
initialize
from wirebox import Wirebox
wb = Wirebox()
result = wb.vault.initialize()
# result.vault_key is generated client-side and shown once — store it securely.
import { Wirebox } from "@wirebox-sh/sdk";
const wb = new Wirebox();
const { vaultKey, warning } = await wb.vault.initialize();
// vaultKey is generated client-side and shown once — store it securely.
wirebox vault init
# The body is client-generated key material (see the SDK/CLI).
curl -X POST https://api.wirebox.sh/api/v1/vault/initialize \
-H "Authorization: Bearer $WIREBOX_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"kdf_salt": "<base64 salt>",
"wrapped_org_key": "<base64 blob>",
"auth_hash": "<sha256 hex>"
}'
{
"initialized": true,
"id": "vlt_01J8ABC123XYZ",
"kdf_salt": "bBvH9uSqCs66wy8PO8HMIQ==",
"kdf_params": { "algorithm": "argon2id", "m": 65536, "t": 3, "p": 1 },
"created_at": "2026-10-10T10:00:00Z"
}
Creates the vault for the caller’s organization. All cryptographic material is
generated on the client; the server stores only what it is given. Admin only.
Returns
409 if a vault already exists.
The request body is produced by the client: generate a random salt and
Organization Encryption Key (OEK), derive the master key from your vault key
with Argon2id, wrap the OEK, and compute the auth hash. The
SDK/CLI do this for you.
Body Parameters
string
required
Base64-encoded random salt (≥16 bytes) used for Argon2id key derivation.
object
Argon2id parameters:
algorithm (argon2id), m (memory KiB), t
(iterations), p (parallelism). Defaults to { "algorithm": "argon2id", "m": 65536, "t": 3, "p": 1 }.string
required
Base64 AES-256-GCM blob: the OEK wrapped under the master key derived from the vault key.
string
required
SHA-256(master key) as a 64-character hex digest. Used to verify the vault key on unlock; never reveals the key.Response
boolean
true once the vault exists.string
Vault identifier (
vlt_ prefix).string
The stored salt, echoed back.
object
The stored Argon2id parameters.
string
ISO 8601 creation timestamp.
Vault metadata
GET /api/v1/vault returns the vault’s public metadata — initialized,
kdf_salt, and kdf_params — which a client needs to derive the master key
before unlocking. It never returns the auth hash or any ciphertext. If no vault
exists it returns { "initialized": false }.
from wirebox import Wirebox
wb = Wirebox()
result = wb.vault.initialize()
# result.vault_key is generated client-side and shown once — store it securely.
import { Wirebox } from "@wirebox-sh/sdk";
const wb = new Wirebox();
const { vaultKey, warning } = await wb.vault.initialize();
// vaultKey is generated client-side and shown once — store it securely.
wirebox vault init
# The body is client-generated key material (see the SDK/CLI).
curl -X POST https://api.wirebox.sh/api/v1/vault/initialize \
-H "Authorization: Bearer $WIREBOX_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"kdf_salt": "<base64 salt>",
"wrapped_org_key": "<base64 blob>",
"auth_hash": "<sha256 hex>"
}'
{
"initialized": true,
"id": "vlt_01J8ABC123XYZ",
"kdf_salt": "bBvH9uSqCs66wy8PO8HMIQ==",
"kdf_params": { "algorithm": "argon2id", "m": 65536, "t": 3, "p": 1 },
"created_at": "2026-10-10T10:00:00Z"
}