CLI and API Operations¶

# Required: Vault server address
export VAULT_ADDR="https://vault.example.com:8200"

# Authentication token
export VAULT_TOKEN="hvs.xxxxxxxxxxxxx"

# Namespace (Enterprise only)
export VAULT_NAMESPACE="admin"

# Skip TLS verification (development only)
export VAULT_SKIP_VERIFY="true"

# Output format
export VAULT_FORMAT="json"   # json, table, yaml

# CA certificate for TLS
export VAULT_CACERT="/path/to/ca.pem"

# Client certificate (for TLS auth)
export VAULT_CLIENT_CERT="/path/to/client.pem"
export VAULT_CLIENT_KEY="/path/to/client-key.pem"

# Check Vault status (sealed/unsealed, HA mode)
vault status

# Output includes:
# Seal Type: shamir
# Initialized: true
# Sealed: false
# Total Shares: 5
# Threshold: 3
# HA Enabled: true
# HA Mode: active

# Initialize Vault
vault operator init
vault operator init -key-shares=5 -key-threshold=3

# Unseal (provide one key at a time)
vault operator unseal <unseal_key>

# Seal Vault
vault operator seal

# Step down as leader (HA)
vault operator step-down

# Generate root token
vault operator generate-root -init
vault operator generate-root -nonce=<nonce> <unseal_key>

# Login with token (default method)
vault login <token>
vault login  # Prompts for token

# Login with userpass
vault login -method=userpass username=alice

# Login with LDAP
vault login -method=ldap username=alice

# Login with AppRole
vault write auth/approle/login role_id="xxx" secret_id="yyy"

# Login with AWS
vault login -method=aws role=my-app

# Login with Kubernetes
vault login -method=kubernetes role=my-app \
  jwt="$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)"

# Check current token
vault token lookup

# KV v2 operations
vault kv put secret/app key1=value1 key2=value2
vault kv get secret/app
vault kv get -field=key1 secret/app
vault kv get -version=2 secret/app
vault kv get -format=json secret/app
vault kv list secret/
vault kv delete secret/app
vault kv undelete -versions=1 secret/app
vault kv destroy -versions=1 secret/app
vault kv metadata get secret/app
vault kv metadata delete secret/app

# Read from file
vault kv put secret/app @data.json

# Pipe input
echo '{"key":"value"}' | vault kv put secret/app -

# Auth methods
vault auth enable approle
vault auth enable -path=corp-ldap ldap
vault auth list
vault auth list -detailed
vault auth tune -default-lease-ttl=2h auth/approle/
vault auth disable userpass
vault auth move auth/old-path/ auth/new-path/

# Secrets engines
vault secrets enable -path=kv kv-v2
vault secrets enable database
vault secrets enable transit
vault secrets list
vault secrets list -detailed
vault secrets tune -max-lease-ttl=24h database/
vault secrets disable kv/
vault secrets move secret/ kv/

# Create/update policy
vault policy write my-policy policy.hcl
vault policy write my-policy - <<EOF
path "secret/data/my-app/*" {
  capabilities = ["read", "list"]
}
EOF

# Read policy
vault policy read my-policy

# List policies
vault policy list

# Delete policy
vault policy delete my-policy

# Format policy file
vault policy fmt policy.hcl

# Create tokens
vault token create
vault token create -policy="my-policy" -ttl=1h
vault token create -policy="my-policy" -ttl=1h -max-ttl=24h
vault token create -orphan
vault token create -period=24h
vault token create -num-uses=5
vault token create -type=batch

# Token management
vault token lookup
vault token lookup <token>
vault token lookup -accessor <accessor>
vault token renew
vault token renew <token>
vault token renew -increment=2h
vault token revoke <token>
vault token revoke -accessor <accessor>
vault token revoke -self

# List leases
vault list sys/leases/lookup/database/creds/my-role

# Lookup lease
vault lease lookup <lease_id>

# Renew lease
vault lease renew <lease_id>
vault lease renew -increment=2h <lease_id>

# Revoke lease
vault lease revoke <lease_id>

# Revoke all leases under prefix
vault lease revoke -prefix database/creds/my-role

# Health check (no auth required)
curl $VAULT_ADDR/v1/sys/health

# Check seal status
curl $VAULT_ADDR/v1/sys/seal-status

# Read KV v2 secret (note /data/ in path)
curl -H "X-Vault-Token: $VAULT_TOKEN" \
  $VAULT_ADDR/v1/secret/data/my-app

# Write KV v2 secret
curl -H "X-Vault-Token: $VAULT_TOKEN" \
  -X POST \
  -d '{"data":{"key":"value"}}' \
  $VAULT_ADDR/v1/secret/data/my-app

# List secrets
curl -H "X-Vault-Token: $VAULT_TOKEN" \
  -X LIST \
  $VAULT_ADDR/v1/secret/metadata/

# Delete secret (soft delete KV v2)
curl -H "X-Vault-Token: $VAULT_TOKEN" \
  -X DELETE \
  $VAULT_ADDR/v1/secret/data/my-app

# Generate dynamic credentials
curl -H "X-Vault-Token: $VAULT_TOKEN" \
  $VAULT_ADDR/v1/database/creds/my-role

# Encrypt with Transit
curl -H "X-Vault-Token: $VAULT_TOKEN" \
  -X POST \
  -d '{"plaintext":"dGVzdA=="}' \
  $VAULT_ADDR/v1/transit/encrypt/my-key

# Decrypt with Transit
curl -H "X-Vault-Token: $VAULT_TOKEN" \
  -X POST \
  -d '{"ciphertext":"vault:v1:xxx"}' \
  $VAULT_ADDR/v1/transit/decrypt/my-key

# List auth methods
curl -H "X-Vault-Token: $VAULT_TOKEN" \
  $VAULT_ADDR/v1/sys/auth

# List secrets engines
curl -H "X-Vault-Token: $VAULT_TOKEN" \
  $VAULT_ADDR/v1/sys/mounts

# Read policy
curl -H "X-Vault-Token: $VAULT_TOKEN" \
  $VAULT_ADDR/v1/sys/policies/acl/my-policy

# Output formatting
vault kv get -format=json secret/app          # JSON output
vault kv get -format=yaml secret/app          # YAML output
vault kv get -format=table secret/app         # Table output (default)

# Field extraction
vault kv get -field=password secret/app       # Single field

# Force (no confirmation)
vault write -f transit/keys/my-key            # Force write with no data

# Output only (useful in scripts)
vault kv get -field=password secret/app 2>/dev/null