HashiCorp Vault

HashiCorp Vault is an open source tool for securely storing and accessing secrets. A secret is anything you want to tightly control access to, such as API keys, passwords, certificates, and more. Vault provides a unified interface to any secret while providing tight access control via policies and recording a detailed audit log. It supports dynamic secrets, data encryption, PKI, SSH certificate issuance, and identity-based access through a comprehensive REST HTTP API.

HashiCorp Vault publishes 8 APIs on the APIs.io network, including Auth Methods API, Health API, Leases API, and 5 more. Tagged areas include DevOps, Encryption, Open Source, PKI, and Secrets Management.

The HashiCorp Vault catalog on APIs.io includes 2 JSON-LD contexts and 2 Spectral governance rulesets.

HashiCorp Vault’s developer surface includes authentication, developer portal, engineering blog, Stack Overflow tag, training material, and 11 more developer resources.

🌐 Visit website 📡 Source on GitHub

54.5/100 developing ▼ -7.7 Agent 44/100 agent ready Full breakdown ↓
scored 2026-07-28 · rubric v0.6

AccessFreemiumSelf serve⚡ Free to try

9 APIs 10 Features 7 Use Cases

DevOpsEncryptionOpen SourcePKISecrets ManagementSecurity

Kin Score

Kin Score How this is scored →
scored 2026-07-28 · rubric v0.6

Composite quality — 54.5/100 · developing

Contract Quality 16.0 / 25

Developer Ergonomics 5.2 / 20

Commercial Clarity 12.1 / 20

Operational Transparency 6.8 / 13

Governance 7.0 / 12

Discoverability 7.4 / 10

Agent readiness — 44/100 · agent ready

Machine-Readable Contract 18 / 18

Agentic Access Contract 10 / 10

MCP Server 0 / 12

Machine-Readable Auth 10 / 10

Idempotency 0 / 9

Stable Error Semantics 8 / 8

Request/Response Examples 7 / 7

Rate-Limit Signaling 7 / 7

Typed Event Surface 0 / 6

Agent Skills 0 / 5

Well-Known Catalog 0 / 4

Consent & Bot Identity 0 / 3

A2A Agent Card 0 / 8

Dry-Run / Simulate Mode 0 / 4

Improve this rating by publishing the missing artifacts — every area above can be raised, and the full rubric is at apis.io/rating/. This rating is computed from github.com/api-evangelist/vault: open an issue to ask a question, or submit a pull request to add artifacts. Want it done for you? Prioritized profiling — $2,500 →

APIs 9

Individual APIs this provider publishes, each with its own machine-readable definition.

Rate Limits 1

Documented rate limits and quota policies.

Vault Rate Limits

5 limits

RATE LIMITS

FinOps 1

Cost, billing, and metering signals for API financial operations.

Vault Finops

FINOPS

Features 10

Notable capabilities this provider offers.

KV Secrets Engine

Versioned key-value secret storage with soft delete, undelete, and permanent destruction.

Dynamic Secrets

On-demand, time-limited credentials for databases, AWS, Azure, GCP, and other backends.

Data Encryption (Transit)

Encryption-as-a-Service for application data without storing plaintext in Vault.

PKI Certificate Authority

Built-in PKI secrets engine for issuing X.509 certificates with configurable TTLs.

SSH Certificate Issuance

Dynamic SSH certificates and OTPs for secure machine access management.

ACL Policies

Fine-grained HCL-based policies controlling access to any secret path with capabilities.

Auth Methods

Pluggable authentication supporting AppRole, LDAP, JWT/OIDC, Kubernetes, AWS, and more.

Lease Management

All dynamic secrets have TTL-bound leases that can be renewed or revoked on demand.

Audit Logging

Comprehensive audit trail of all API requests and responses for compliance.

MCP Server

Official HashiCorp Vault MCP server enabling AI-assisted secrets management workflows.

Scroll for all 10

JSON Schema 23

Standalone JSON Schema definitions for this provider's data models.

Scroll for all 23

JSON Structure 23

JSON Structure definitions describing this provider's data shapes.

Scroll for all 23

Examples 23

Example request and response payloads for these APIs.

Scroll for all 23

AGENTIC

Use Cases 7

What developers build with this provider.

Application Secret Injection

Inject database credentials, API keys, and config into applications at runtime via Vault Agent.

Kubernetes Secrets Management

Replace Kubernetes secrets with Vault-managed secrets using the Vault Secrets Operator.

Database Credential Rotation

Automatically rotate database credentials with dynamic secrets engine for zero-knowledge security.

PKI Automation

Automate certificate lifecycle management for internal services and mutual TLS.

CI/CD Secret Injection

Provide short-lived credentials to CI/CD pipelines via AppRole or GitHub Actions OIDC.

Secrets as Code

Manage Vault configuration as code using the Terraform Vault provider.

Compliance and Audit

Meet SOC 2, PCI-DSS, HIPAA, and FedRAMP requirements with immutable audit logs.

Scroll for all 7

Integrations 8

Pre-built integrations with other platforms and tools.

Terraform

Terraform Vault provider for managing Vault configuration and policies as code.

Kubernetes

Vault Secrets Operator and Vault Agent Injector for native Kubernetes integration.

GitHub Actions

OIDC-based authentication from GitHub Actions workflows without static credentials.

AWS

Dynamic AWS IAM credentials and EC2/IAM-based authentication methods.

Consul

Native HashiCorp Consul integration for service mesh secrets and ACL tokens.

PostgreSQL

Dynamic database credentials for PostgreSQL with configurable role TTLs.

Nomad

Native HashiCorp Nomad integration for workload identity and secrets.

Ansible

HashiCorp Vault lookup plugin for Ansible playbook secret retrieval.

Scroll for all 8

Resources

Get Started 1

Portal, sign-up, and the first successful call

Portal

Portal

Agent Surfaces 1

MCP servers, agent skills, and machine-readable catalogs

AgenticAccess

AgenticAccess

Design & Contract 1

Pagination, idempotency, versioning, errors, and events

SpectralRules

SpectralRules

Build 3

SDKs, sample code, and the tooling you integrate with

PostmanWorkspace

PostmanWorkspace

GitHubOrganization

GitHubOrganization

GitHubRepository

GitHubRepository

Access & Security 2

Authentication, authorization, and security posture

DomainSecurity

DomainSecurity

Authentication

Authentication

Learn 1

Tutorials, courses, talks, and written guidance

Training

Training

Operate 3

Status, limits, changes, and where to get help

StatusPage

StatusPage

Forums

Forums

StackOverflow

StackOverflow

Commercial 2

Pricing, plans, and the legal terms of use

TermsOfService

TermsOfService

PrivacyPolicy

PrivacyPolicy

Company 2

The organization behind the API

Website

Website

Blog

Blog

Source (apis.yml)

aid: vault
name: HashiCorp Vault
description: HashiCorp Vault is an open source tool for securely storing and accessing secrets. A secret is anything you want
  to tightly control access to, such as API keys, passwords, certificates, and more. Vault provides a unified interface to
  any secret while providing tight access control via policies and recording a detailed audit log. It supports dynamic secrets,
  data encryption, PKI, SSH certificate issuance, and identity-based access through a comprehensive REST HTTP API.
type: Index
accessModel:
  pricing: freemium
  onboarding: self-serve
  trial: false
  try_now: true
  public: false
  label: Freemium · Self-serve signup
  confidence: high
  source:
  - plans
  - authentication
  generated: '2026-07-22'
  method: derived
position: Consumer
access: 3rd-Party
image: https://kinlane-images.s3.amazonaws.com/shared/apis-json/icons/vault.png
tags:
- DevOps
- Encryption
- Open Source
- PKI
- Secrets Management
- Security
url: https://raw.githubusercontent.com/api-evangelist/vault/refs/heads/main/apis.yml
created: '2024-01-01'
modified: '2026-05-19'
specificationVersion: '0.19'
apis:
- aid: vault:vault-api
  name: Vault HTTP API
  description: The complete Vault HTTP API gives full access to all Vault operations via REST. Includes authentication method
    APIs (AppRole, LDAP, JWT, Kubernetes, AWS, Azure), secrets engine APIs (Database, AWS, PKI, SSH, Transit), and the system
    backend. The OpenAPI spec is dynamically generated from a running Vault instance at /v1/sys/internal/specs/openapi.
  humanURL: https://developer.hashicorp.com/vault/api-docs
  baseURL: https://vault.example.com/v1
  tags:
  - Auth Methods
  - Dynamic Secrets
  - Secrets Management
  properties:
  - type: Documentation
    url: https://developer.hashicorp.com/vault/api-docs
  - type: Authentication
    url: https://developer.hashicorp.com/vault/docs/auth
  - type: GettingStarted
    url: https://developer.hashicorp.com/vault/tutorials/get-started
  - type: ChangeLog
    url: https://github.com/hashicorp/vault/blob/main/CHANGELOG.md
- aid: vault:vault-auth-methods-api
  name: HashiCorp Vault Auth Methods API
  description: Enable, disable, list, and configure authentication methods.
  humanURL: https://developer.hashicorp.com/vault/api-docs/secret/kv/kv-v2
  baseURL: https://vault.example.com/v1
  tags:
  - Auth Methods
  properties:
  - type: OpenAPI
    url: openapi/vault-auth-methods-api-openapi.yml
  - type: Documentation
    url: https://developer.hashicorp.com/vault/api-docs/secret/kv/kv-v2
  - type: JSONSchema
    url: json-schema/vault-kv-secret-data-request-schema.json
  - type: JSONSchema
    url: json-schema/vault-kv-secret-data-response-schema.json
  - type: JSONStructure
    url: json-structure/vault-kv-secret-data-request-structure.json
  - type: Examples
    url: examples/vault-kv-secret-data-response-example.json
  - type: JSONLD
    url: json-ld/vault-kv-context.jsonld
  - type: Documentation
    url: https://developer.hashicorp.com/vault/api-docs
  - type: JSONSchema
    url: json-schema/vault-sys-health-response-schema.json
  - type: JSONStructure
    url: json-structure/vault-sys-health-response-structure.json
  - type: Examples
    url: examples/vault-sys-health-response-example.json
  - type: JSONLD
    url: json-ld/vault-sys-context.jsonld
- aid: vault:vault-health-api
  name: HashiCorp Vault Health API
  description: Check Vault health and initialization status.
  humanURL: https://developer.hashicorp.com/vault/api-docs/secret/kv/kv-v2
  baseURL: https://vault.example.com/v1
  tags:
  - Health
  properties:
  - type: OpenAPI
    url: openapi/vault-health-api-openapi.yml
  - type: Documentation
    url: https://developer.hashicorp.com/vault/api-docs/secret/kv/kv-v2
  - type: JSONSchema
    url: json-schema/vault-kv-secret-data-request-schema.json
  - type: JSONSchema
    url: json-schema/vault-kv-secret-data-response-schema.json
  - type: JSONStructure
    url: json-structure/vault-kv-secret-data-request-structure.json
  - type: Examples
    url: examples/vault-kv-secret-data-response-example.json
  - type: JSONLD
    url: json-ld/vault-kv-context.jsonld
  - type: Documentation
    url: https://developer.hashicorp.com/vault/api-docs
  - type: JSONSchema
    url: json-schema/vault-sys-health-response-schema.json
  - type: JSONStructure
    url: json-structure/vault-sys-health-response-structure.json
  - type: Examples
    url: examples/vault-sys-health-response-example.json
  - type: JSONLD
    url: json-ld/vault-sys-context.jsonld
- aid: vault:vault-leases-api
  name: HashiCorp Vault Leases API
  description: Look up, renew, and revoke leases for secrets and tokens.
  humanURL: https://developer.hashicorp.com/vault/api-docs/secret/kv/kv-v2
  baseURL: https://vault.example.com/v1
  tags:
  - Leases
  properties:
  - type: OpenAPI
    url: openapi/vault-leases-api-openapi.yml
  - type: Documentation
    url: https://developer.hashicorp.com/vault/api-docs/secret/kv/kv-v2
  - type: JSONSchema
    url: json-schema/vault-kv-secret-data-request-schema.json
  - type: JSONSchema
    url: json-schema/vault-kv-secret-data-response-schema.json
  - type: JSONStructure
    url: json-structure/vault-kv-secret-data-request-structure.json
  - type: Examples
    url: examples/vault-kv-secret-data-response-example.json
  - type: JSONLD
    url: json-ld/vault-kv-context.jsonld
  - type: Documentation
    url: https://developer.hashicorp.com/vault/api-docs
  - type: JSONSchema
    url: json-schema/vault-sys-health-response-schema.json
  - type: JSONStructure
    url: json-structure/vault-sys-health-response-structure.json
  - type: Examples
    url: examples/vault-sys-health-response-example.json
  - type: JSONLD
    url: json-ld/vault-sys-context.jsonld
- aid: vault:vault-policies-api
  name: HashiCorp Vault Policies API
  description: Create, read, update, delete, and list ACL policies.
  humanURL: https://developer.hashicorp.com/vault/api-docs/secret/kv/kv-v2
  baseURL: https://vault.example.com/v1
  tags:
  - Policies
  properties:
  - type: OpenAPI
    url: openapi/vault-policies-api-openapi.yml
  - type: Documentation
    url: https://developer.hashicorp.com/vault/api-docs/secret/kv/kv-v2
  - type: JSONSchema
    url: json-schema/vault-kv-secret-data-request-schema.json
  - type: JSONSchema
    url: json-schema/vault-kv-secret-data-response-schema.json
  - type: JSONStructure
    url: json-structure/vault-kv-secret-data-request-structure.json
  - type: Examples
    url: examples/vault-kv-secret-data-response-example.json
  - type: JSONLD
    url: json-ld/vault-kv-context.jsonld
  - type: Documentation
    url: https://developer.hashicorp.com/vault/api-docs
  - type: JSONSchema
    url: json-schema/vault-sys-health-response-schema.json
  - type: JSONStructure
    url: json-structure/vault-sys-health-response-structure.json
  - type: Examples
    url: examples/vault-sys-health-response-example.json
  - type: JSONLD
    url: json-ld/vault-sys-context.jsonld
- aid: vault:vault-secrets-config-api
  name: HashiCorp Vault Secrets Config API
  description: Configure KV v2 engine settings such as max versions and CAS required.
  humanURL: https://developer.hashicorp.com/vault/api-docs/secret/kv/kv-v2
  baseURL: https://vault.example.com/v1
  tags:
  - Secrets Config
  properties:
  - type: OpenAPI
    url: openapi/vault-secrets-config-api-openapi.yml
  - type: Documentation
    url: https://developer.hashicorp.com/vault/api-docs/secret/kv/kv-v2
  - type: JSONSchema
    url: json-schema/vault-kv-secret-data-request-schema.json
  - type: JSONSchema
    url: json-schema/vault-kv-secret-data-response-schema.json
  - type: JSONStructure
    url: json-structure/vault-kv-secret-data-request-structure.json
  - type: Examples
    url: examples/vault-kv-secret-data-response-example.json
  - type: JSONLD
    url: json-ld/vault-kv-context.jsonld
  - type: Documentation
    url: https://developer.hashicorp.com/vault/api-docs
  - type: JSONSchema
    url: json-schema/vault-sys-health-response-schema.json
  - type: JSONStructure
    url: json-structure/vault-sys-health-response-structure.json
  - type: Examples
    url: examples/vault-sys-health-response-example.json
  - type: JSONLD
    url: json-ld/vault-sys-context.jsonld
- aid: vault:vault-secrets-data-api
  name: HashiCorp Vault Secrets Data API
  description: Read, write, patch, and delete secret data versions in the KV v2 engine.
  humanURL: https://developer.hashicorp.com/vault/api-docs/secret/kv/kv-v2
  baseURL: https://vault.example.com/v1
  tags:
  - Secrets Data
  properties:
  - type: OpenAPI
    url: openapi/vault-secrets-data-api-openapi.yml
  - type: Documentation
    url: https://developer.hashicorp.com/vault/api-docs/secret/kv/kv-v2
  - type: JSONSchema
    url: json-schema/vault-kv-secret-data-request-schema.json
  - type: JSONSchema
    url: json-schema/vault-kv-secret-data-response-schema.json
  - type: JSONStructure
    url: json-structure/vault-kv-secret-data-request-structure.json
  - type: Examples
    url: examples/vault-kv-secret-data-response-example.json
  - type: JSONLD
    url: json-ld/vault-kv-context.jsonld
  - type: Documentation
    url: https://developer.hashicorp.com/vault/api-docs
  - type: JSONSchema
    url: json-schema/vault-sys-health-response-schema.json
  - type: JSONStructure
    url: json-structure/vault-sys-health-response-structure.json
  - type: Examples
    url: examples/vault-sys-health-response-example.json
  - type: JSONLD
    url: json-ld/vault-sys-context.jsonld
- aid: vault:vault-secrets-engines-api
  name: HashiCorp Vault Secrets Engines API
  description: Mount, unmount, list, and configure secrets engines.
  humanURL: https://developer.hashicorp.com/vault/api-docs/secret/kv/kv-v2
  baseURL: https://vault.example.com/v1
  tags:
  - Secrets Engines
  properties:
  - type: OpenAPI
    url: openapi/vault-secrets-engines-api-openapi.yml
  - type: Documentation
    url: https://developer.hashicorp.com/vault/api-docs/secret/kv/kv-v2
  - type: JSONSchema
    url: json-schema/vault-kv-secret-data-request-schema.json
  - type: JSONSchema
    url: json-schema/vault-kv-secret-data-response-schema.json
  - type: JSONStructure
    url: json-structure/vault-kv-secret-data-request-structure.json
  - type: Examples
    url: examples/vault-kv-secret-data-response-example.json
  - type: JSONLD
    url: json-ld/vault-kv-context.jsonld
  - type: Documentation
    url: https://developer.hashicorp.com/vault/api-docs
  - type: JSONSchema
    url: json-schema/vault-sys-health-response-schema.json
  - type: JSONStructure
    url: json-structure/vault-sys-health-response-structure.json
  - type: Examples
    url: examples/vault-sys-health-response-example.json
  - type: JSONLD
    url: json-ld/vault-sys-context.jsonld
- aid: vault:vault-secrets-metadata-api
  name: HashiCorp Vault Secrets Metadata API
  description: Manage metadata and version history for KV v2 secrets.
  humanURL: https://developer.hashicorp.com/vault/api-docs/secret/kv/kv-v2
  baseURL: https://vault.example.com/v1
  tags:
  - Secrets Metadata
  properties:
  - type: OpenAPI
    url: openapi/vault-secrets-metadata-api-openapi.yml
  - type: Documentation
    url: https://developer.hashicorp.com/vault/api-docs/secret/kv/kv-v2
  - type: JSONSchema
    url: json-schema/vault-kv-secret-data-request-schema.json
  - type: JSONSchema
    url: json-schema/vault-kv-secret-data-response-schema.json
  - type: JSONStructure
    url: json-structure/vault-kv-secret-data-request-structure.json
  - type: Examples
    url: examples/vault-kv-secret-data-response-example.json
  - type: JSONLD
    url: json-ld/vault-kv-context.jsonld
  - type: Documentation
    url: https://developer.hashicorp.com/vault/api-docs
  - type: JSONSchema
    url: json-schema/vault-sys-health-response-schema.json
  - type: JSONStructure
    url: json-structure/vault-sys-health-response-structure.json
  - type: Examples
    url: examples/vault-sys-health-response-example.json
  - type: JSONLD
    url: json-ld/vault-sys-context.jsonld
common:
- type: PostmanWorkspace
  url: https://www.postman.com/kinlaneapi/hashicorp-vault/overview
- type: AgenticAccess
  url: agentic-access/vault-agentic-access.yml
- type: DomainSecurity
  url: security/vault-domain-security.yml
- type: Authentication
  url: authentication/vault-authentication.yml
- type: Portal
  url: https://developer.hashicorp.com/vault
- type: Website
  url: https://www.vaultproject.io
- type: Blog
  url: https://www.hashicorp.com/blog/products/vault
- type: StatusPage
  url: https://status.hashicorp.com
- type: TermsOfService
  url: https://www.hashicorp.com/terms-of-service
- type: PrivacyPolicy
  url: https://www.hashicorp.com/privacy
- type: GitHubOrganization
  url: https://github.com/hashicorp
- type: GitHubRepository
  url: https://github.com/hashicorp/vault
- type: Forums
  url: https://discuss.hashicorp.com/c/vault
- type: StackOverflow
  url: https://stackoverflow.com/questions/tagged/vault
- type: Training
  url: https://developer.hashicorp.com/vault/tutorials
- type: SpectralRules
  url: rules/vault-spectral-rules.yml
- type: Features
  data:
  - name: KV Secrets Engine
    description: Versioned key-value secret storage with soft delete, undelete, and permanent destruction.
  - name: Dynamic Secrets
    description: On-demand, time-limited credentials for databases, AWS, Azure, GCP, and other backends.
  - name: Data Encryption (Transit)
    description: Encryption-as-a-Service for application data without storing plaintext in Vault.
  - name: PKI Certificate Authority
    description: Built-in PKI secrets engine for issuing X.509 certificates with configurable TTLs.
  - name: SSH Certificate Issuance
    description: Dynamic SSH certificates and OTPs for secure machine access management.
  - name: ACL Policies
    description: Fine-grained HCL-based policies controlling access to any secret path with capabilities.
  - name: Auth Methods
    description: Pluggable authentication supporting AppRole, LDAP, JWT/OIDC, Kubernetes, AWS, and more.
  - name: Lease Management
    description: All dynamic secrets have TTL-bound leases that can be renewed or revoked on demand.
  - name: Audit Logging
    description: Comprehensive audit trail of all API requests and responses for compliance.
  - name: MCP Server
    description: Official HashiCorp Vault MCP server enabling AI-assisted secrets management workflows.
- type: UseCases
  data:
  - name: Application Secret Injection
    description: Inject database credentials, API keys, and config into applications at runtime via Vault Agent.
  - name: Kubernetes Secrets Management
    description: Replace Kubernetes secrets with Vault-managed secrets using the Vault Secrets Operator.
  - name: Database Credential Rotation
    description: Automatically rotate database credentials with dynamic secrets engine for zero-knowledge security.
  - name: PKI Automation
    description: Automate certificate lifecycle management for internal services and mutual TLS.
  - name: CI/CD Secret Injection
    description: Provide short-lived credentials to CI/CD pipelines via AppRole or GitHub Actions OIDC.
  - name: Secrets as Code
    description: Manage Vault configuration as code using the Terraform Vault provider.
  - name: Compliance and Audit
    description: Meet SOC 2, PCI-DSS, HIPAA, and FedRAMP requirements with immutable audit logs.
- type: Integrations
  data:
  - name: Terraform
    description: Terraform Vault provider for managing Vault configuration and policies as code.
  - name: Kubernetes
    description: Vault Secrets Operator and Vault Agent Injector for native Kubernetes integration.
  - name: GitHub Actions
    description: OIDC-based authentication from GitHub Actions workflows without static credentials.
  - name: AWS
    description: Dynamic AWS IAM credentials and EC2/IAM-based authentication methods.
  - name: Consul
    description: Native HashiCorp Consul integration for service mesh secrets and ACL tokens.
  - name: PostgreSQL
    description: Dynamic database credentials for PostgreSQL with configurable role TTLs.
  - name: Nomad
    description: Native HashiCorp Nomad integration for workload identity and secrets.
  - name: Ansible
    description: HashiCorp Vault lookup plugin for Ansible playbook secret retrieval.
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com

HashiCorp Vault

APIs 9

Postman Collections 8

Open Collections 2

Pricing Plans 1

Rate Limits 1

FinOps 1

Features 10

KV Secrets Engine

Dynamic Secrets

Data Encryption (Transit)

PKI Certificate Authority

SSH Certificate Issuance

ACL Policies

Auth Methods

Lease Management

Audit Logging

MCP Server

Semantic Vocabularies 2

Spectral Rules 2

JSON Schema 23

JSON Structure 23

Examples 23

Security Posture 2

Agentic Access 1

Use Cases 7

Application Secret Injection

Kubernetes Secrets Management

Database Credential Rotation

PKI Automation

CI/CD Secret Injection

Secrets as Code

Compliance and Audit

Integrations 8

Terraform

Kubernetes

GitHub Actions

AWS

Consul

PostgreSQL

Nomad

Ansible