Vault API Overview

​

Cryptography

vault key ──Argon2id(kdf_salt)──► master key
master key ──AES-256-GCM──► wraps the Organization Encryption Key (OEK)
OEK ──AES-256-GCM──► encrypts each secret's JSON payload

• KDF: Argon2id. Parameters (m, t, p) are stored per-vault and returned by the API, so clients always derive with the right settings.
• Encryption: AES-256-GCM. Each ciphertext blob is a versioned, self-describing structure ([version][algorithm][iv][ciphertext+tag]), base64-encoded.
• Salt: a random value generated at initialization and stored server-side.

​

The Two Keys

• API key — authenticates requests, sent as Authorization: Bearer ....
• Vault key — never sent. It is used locally to derive the master key. To prove possession on unlock, the client sends only auth_hash, the SHA-256 of the derived master key.

​

Access Model

• Admin credentials (a Console JWT or an admin API key) may initialize the vault, create/update/delete secrets, and manage access grants.
• Identity-scoped API keys with the vault:read scope may read only the secrets granted to that identity. The server filters ciphertext by grant before it leaves the edge, so a scoped key can never retrieve a secret it was not granted.

​

Endpoints