Payload Schemas

The encrypted_payload field in a vault secret contains a client-side encrypted JSON object. The plaintext structure depends on the secret_type. This page documents the schema for each type. All encryption and decryption happens client-side using your vault key — the server only ever sees ciphertext.

API key

Stores API keys and tokens.

Field	Type	Required	Description
`api_key`	string	Yes	API key or token
`endpoint`	string	No	API endpoint URL
`notes`	string	No	Freeform notes

JSON

{
  "api_key": "example-api-key",
  "endpoint": "https://api.example.com/v1",
  "notes": "Production key, 10k RPM limit"
}

Key pair

Stores access key and secret key pairs.

Field	Type	Required	Description
`access_key`	string	Yes	Access key ID
`secret_key`	string	Yes	Secret access key
`endpoint`	string	No	Service endpoint URL
`notes`	string	No	Freeform notes

JSON

{
  "access_key": "example-access-key",
  "secret_key": "example-secret-key",
  "endpoint": "https://api.example.com",
  "notes": "Service credentials"
}

Stores website or service credentials with optional two-factor authentication.

Field	Type	Required	Description
`password`	string	Yes	Password
`username`	string	No	Username
`email`	string	No	Email address
`url`	string	No	Login URL
`notes`	string	No	Freeform notes
`totp`	object	No	TOTP configuration for two-factor authentication (see below)

JSON

{
  "password": "s3cret!",
  "username": "alice",
  "email": "alice@example.com",
  "url": "https://example.com/login",
  "notes": "Primary account",
  "totp": {
      "secret": "JBSWY3DPEHPK3PXP",
      "algorithm": "sha1",
      "digits": 6,
      "period": 30,
      "issuer": "Example",
      "account_name": "alice@example.com"
  }
}

TOTP configuration

When a login secret includes a totp field, the SDK can generate time-based one-time passwords (RFC 6238) client-side. The TOTP secret is encrypted alongside the rest of the login payload — the server never sees it.

Field	Type	Required	Default	Description
`secret`	string	Yes	—	Base32-encoded shared secret
`algorithm`	string	No	`sha1`	Hash algorithm: `sha1`, `sha256`, or `sha512`
`digits`	number	No	`6`	Code length: `6` or `8`
`period`	number	No	`30`	Time step in seconds: `30` or `60`
`issuer`	string	No	—	Issuer name (e.g. `"Example"`)
`account_name`	string	No	—	Account identifier (e.g. `"user@example.com"`)

You can parse an otpauth://totp/... URI directly using the SDK’s parse_totp_uri / parseTotpUri helper.

SSH key

Stores SSH key pairs and metadata.

Field	Type	Required	Description
`private_key`	string	Yes	Private key (PEM format)
`public_key`	string	No	Public key
`fingerprint`	string	No	Key fingerprint
`passphrase`	string	No	Private key passphrase
`notes`	string	No	Freeform notes

JSON

{
  "private_key": "-----BEGIN OPENSSH PRIVATE KEY-----\nb3BlbnNzaC1rZXktdjEAAAAA...\n-----END OPENSSH PRIVATE KEY-----",
  "public_key": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAI...",
  "fingerprint": "SHA256:abc123...",
  "passphrase": "optional-passphrase",
  "notes": "Deploy key for production server"
}

Other

Freeform data for secrets that don’t fit other types.

Field	Type	Required	Description
`data`	string	Yes	Freeform data
`notes`	string	No	Freeform notes

JSON

{
  "data": "any arbitrary string data here",
  "notes": "Custom secret format"
}

Agent signup API

Agent identity API

Agent2Agent API

Message retries

Mail API

Phone API

iMessage API

Slack API

Webhooks API

Tunnels API

Contacts API

Notes API

Vault API

Billing API

Payload Schemas

API key

Key pair

TOTP configuration

SSH key

Other

​API key

​Key pair

​Login

​TOTP configuration

​SSH key

​Other

API key

Key pair

Login

TOTP configuration

SSH key

Other