Navigation
Vault access. Public access is not open. This product is separate from initial Identity and Apparatus access.
Screenshots use fictional demonstration accounts. Your data and available actions may differ. Reviewed October 16, 2026.
Concepts
Understand leases and expiry
A lease is a short-lived, single-use permission to retrieve a credential value. It is not the underlying provider credential itself.
Request and redeem
Supply the exact key, a run identifier and a justification. The server chooses an expiry within its configured limits; the usual range is 600 to 3600 seconds. Inspect the returned expiry instead of assuming the requested duration was accepted unchanged.
Redeem the handle once. A consumed handle cannot be read again. Expired or revoked handles cannot be redeemed. Request another lease only when the work is still approved and requires another read.
Read the states
- Active: available for a read before expiry.
- Consumed: its single read already occurred.
- Expired: the time window ended.
- Revoked: access through that handle was explicitly ended.
The credential’s Activity tab shows lease status and permits authorized revocation. Revocation and expiry prevent future redemption. They cannot erase plaintext already returned, remove it from a log or revoke an API key at its issuer. Use provider-side rotation when the underlying value must stop working.
Screen reference
