layout | page_title | description |
---|---|---|
api |
/sys/raw - HTTP API |
The `/sys/raw` endpoint is used to access the raw underlying store in Vault. |
@include 'alerts/restricted-root.mdx'
The /sys/raw
endpoint is used to access the raw underlying store in Vault.
This endpoint is off by default. See the Vault configuration documentation to enable.
This endpoint reads the value of the key at the given path. This is the raw path in the storage backend and not the logical path that is exposed via the mount system.
Method | Path |
---|---|
GET |
/sys/raw/:path |
-
path
(string: <required>)
– Specifies the raw path in the storage backend. This is specified as part of the URL. -
compressed
(bool: true)
- Attempt to decompress the value. -
encoding
(string: "")
- Specifies the encoding of the returned data. Defaults to no encoding. "base64" returns the value encoded in base64.
$ curl \
--header "X-Vault-Token: ..." \
http://127.0.0.1:8200/v1/sys/raw/secret/foo
{
"value": "{'foo':'bar'}"
}
This endpoint updates the value of the key at the given path. This is the raw path in the storage backend and not the logical path that is exposed via the mount system.
Method | Path |
---|---|
POST |
/sys/raw/:path |
-
path
(string: <required>)
– Specifies the raw path in the storage backend. This is specified as part of the URL. -
value
(string: <required>)
– Specifies the value of the key. -
compression_type
(string: "")
- Create/update using the compressed form ofvalue
. Supportedcompression_type
values aregzip
,lzw
,lz4
,snappy
, or""
.""
means no compression is used. If omitted and key already exists, update uses the same compression (or no compression) as the existing value. -
encoding
(string: "")
- Specifies the encoding ofvalue
. Defaults to no encoding. Use "base64" ifvalue
is encoded in base64.
{
"value": "{\"foo\": \"bar\"}"
}
$ curl \
--header "X-Vault-Token: ..." \
--request POST \
--data @payload.json \
http://127.0.0.1:8200/v1/sys/raw/secret/foo
This endpoint returns a list keys for a given path prefix.
This endpoint requires 'sudo' capability.
Method | Path |
---|---|
LIST |
/sys/raw/:prefix |
GET |
/sys/raw/:prefix?list=true |
$ curl \
--header "X-Vault-Token: ..." \
--request LIST \
http://127.0.0.1:8200/v1/sys/raw/logical
{
"data": {
"keys": ["abcd-1234...", "efgh-1234...", "ijkl-1234..."]
}
}
This endpoint deletes the key with given path. This is the raw path in the storage backend and not the logical path that is exposed via the mount system.
Method | Path |
---|---|
DELETE |
/sys/raw/:path |
path
(string: <required>)
– Specifies the raw path in the storage backend. This is specified as part of the URL.
$ curl \
--header "X-Vault-Token: ..." \
--request DELETE \
http://127.0.0.1:8200/v1/sys/raw/secret/foo