HashiCorp Vault Secrets - Transit API
Transit secrets engine (encryption as a service)
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/hashicorp-vault:hashicorp-vault-secrets-transit-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
title: HashiCorp Vault HTTP Secrets - Transit API
description: The Vault HTTP API provides full access to Vault functionality via HTTP. Every aspect of Vault can be controlled via this API including secrets management, authentication, system configuration, identity, and policy management.
version: 1.15.0
contact:
name: HashiCorp
url: https://www.vaultproject.io/
license:
name: Business Source License 1.1
url: https://github.com/hashicorp/vault/blob/main/LICENSE
servers:
- url: https://127.0.0.1:8200/v1
description: Local Vault server
- url: https://{vault_host}:{port}/v1
description: Custom Vault server
variables:
vault_host:
default: 127.0.0.1
port:
default: '8200'
security:
- VaultToken: []
tags:
- name: Secrets - Transit
description: Transit secrets engine (encryption as a service)
paths:
/transit/encrypt/{name}:
post:
operationId: transitEncrypt
summary: Encrypt data
description: Encrypts the provided plaintext using the named key.
tags:
- Secrets - Transit
parameters:
- name: name
in: path
required: true
schema:
type: string
description: Name of the encryption key
requestBody:
required: true
content:
application/json:
schema:
type: object
required:
- plaintext
properties:
plaintext:
type: string
description: Base64-encoded plaintext
context:
type: string
description: Base64-encoded context for key derivation
key_version:
type: integer
nonce:
type: string
type:
type: string
enum:
- aes128-gcm96
- aes256-gcm96
- chacha20-poly1305
- rsa-2048
- rsa-3072
- rsa-4096
responses:
'200':
description: Encrypted data
content:
application/json:
schema:
type: object
properties:
data:
type: object
properties:
ciphertext:
type: string
key_version:
type: integer
/transit/decrypt/{name}:
post:
operationId: transitDecrypt
summary: Decrypt data
description: Decrypts the provided ciphertext using the named key.
tags:
- Secrets - Transit
parameters:
- name: name
in: path
required: true
schema:
type: string
requestBody:
required: true
content:
application/json:
schema:
type: object
required:
- ciphertext
properties:
ciphertext:
type: string
context:
type: string
nonce:
type: string
responses:
'200':
description: Decrypted data
content:
application/json:
schema:
type: object
properties:
data:
type: object
properties:
plaintext:
type: string
description: Base64-encoded plaintext
/transit/keys/{name}:
post:
operationId: createTransitKey
summary: Create an encryption key
tags:
- Secrets - Transit
parameters:
- name: name
in: path
required: true
schema:
type: string
requestBody:
content:
application/json:
schema:
type: object
properties:
type:
type: string
enum:
- aes128-gcm96
- aes256-gcm96
- chacha20-poly1305
- ed25519
- ecdsa-p256
- ecdsa-p384
- ecdsa-p521
- rsa-2048
- rsa-3072
- rsa-4096
derived:
type: boolean
exportable:
type: boolean
allow_plaintext_backup:
type: boolean
convergent_encryption:
type: boolean
responses:
'204':
description: Key created
get:
operationId: getTransitKey
summary: Read an encryption key
tags:
- Secrets - Transit
parameters:
- name: name
in: path
required: true
schema:
type: string
responses:
'200':
description: Key information
content:
application/json:
schema:
type: object
properties:
data:
type: object
properties:
name:
type: string
type:
type: string
deletion_allowed:
type: boolean
derived:
type: boolean
exportable:
type: boolean
latest_version:
type: integer
min_available_version:
type: integer
min_decryption_version:
type: integer
min_encryption_version:
type: integer
supports_encryption:
type: boolean
supports_decryption:
type: boolean
supports_signing:
type: boolean
supports_derivation:
type: boolean
delete:
operationId: deleteTransitKey
summary: Delete an encryption key
tags:
- Secrets - Transit
parameters:
- name: name
in: path
required: true
schema:
type: string
responses:
'204':
description: Key deleted
components:
securitySchemes:
VaultToken:
type: apiKey
name: X-Vault-Token
in: header
description: Vault client token