Skip to content

Vault API

A zero-knowledge encrypted credential store for your organization. Store API keys, login credentials, SSH keys, and other secrets — Inkbox never sees the plaintext. All encryption and decryption happens client-side using your vault key.

API base URL:

https://inkbox.ai/api/v1/vault

Quick start

Create an account and get your API key from the Inkbox console:

Get API key

Most vault API requests support api-key authentication. Vault deletion is handled separately in the Inkbox Console. See individual endpoint docs for details.

X-API-Key: YOUR_API_KEY

Vault

Only one active vault can exist per organization. After deleting a vault, you can initialize a new one.

Initialize vault

POST

Create a new vault with a primary key and four recovery keys

/api/v1/vault/initialize

Get vault info

GET

Get vault metadata including secret and key counts

/api/v1/vault/info

Unlock vault

GET

Fetch encrypted secrets and wrapped keys for client-side decryption

/api/v1/vault/unlock

Delete vault

DELETE

Delete the vault and all its keys and secrets

/api/v1/vault

Secrets

Create secret

POST

Store a new encrypted secret

/api/v1/vault/secrets

List secrets

GET

List all secrets (metadata only, no payloads)

/api/v1/vault/secrets

Get secret

GET

Get a single secret with its encrypted payload

/api/v1/vault/secrets/{secret_id}

Update secret

PATCH

Update a secret's name, description, or encrypted payload

/api/v1/vault/secrets/{secret_id}

Delete secret

DELETE

Delete a secret

/api/v1/vault/secrets/{secret_id}

Keys

List vault keys

GET

List all vault keys (primary and recovery)

/api/v1/vault/keys

Replace primary key

PUT

Replace the primary vault key using current key or recovery code

/api/v1/vault/keys/primary

Revoke vault key

DELETE

Revoke a vault key by its auth hash

/api/v1/vault/keys/{auth_hash}

Access control

Grant identity access

POST

Grant an agent identity access to a specific secret

/api/v1/vault/secrets/{secret_id}/access

List access rules

GET

List all identity access rules for a secret

/api/v1/vault/secrets/{secret_id}/access

Revoke identity access

DELETE

Revoke an identity's access to a secret

/api/v1/vault/secrets/{secret_id}/access/{identity_id}

Initialize vault POST

POST /vault/initialize

Create a new vault for your organization. The request body contains client-generated cryptographic material, so use the SDK or CLI rather than calling this directly — see capabilities/vault.

Returns 201 with the new vault_id and related identifiers.

Get vault info GET

GET /vault/info

Retrieve metadata about the organization's active vault.

Response (200)

FieldTypeDescription
idUUIDVault identifier
organization_idstringOrganization that owns this vault
created_atstringCreation timestamp (ISO 8601)
updated_atstringLast update timestamp (ISO 8601)
key_countintegerActive primary vault keys
secret_countintegerActive vault secrets
recovery_key_countintegerActive recovery keys

Unlock vault GET

GET /vault/unlock

Fetch the encrypted vault bundle so the client can decrypt it locally. The response contains the wrapped key material needed to derive the org encryption key, plus encrypted_secrets (same shape as GET /vault/secrets/{secret_id}). Use the SDK or CLI to handle the decryption flow.

Delete vault DELETE

DELETE /vault

Delete the vault and all associated keys and secrets. This is a destructive operation — all vault keys and secrets are permanently inaccessible after deletion. This action is performed in the Inkbox Console.

After deletion, the organization can initialize a new vault. The deleted vault does not block creating a new one.

Response

Returns 204 No Content on success.

Where to delete a vault

Delete the vault from the Inkbox Console:

Open Inkbox Console

Additional resources