Navigation
Vault access. Public access is not open. This product is separate from initial Identity and Apparatus access.
Screenshots use fictional demonstration accounts. Your data and available actions may differ. Reviewed October 16, 2026.
Reference
TypeScript client method reference
The current package is @ghoststack/vault-client, distributed through the private Rosecraft GitLab registry. Create it with createVaultClient({ baseUrl, token }) or { baseUrl, tokenSource }; provide exactly one token mechanism. The optional fetch override supports host integration.
| Area | Methods |
|---|---|
| Metadata | listCredentials, getCredential, searchCredentials |
| Storage | storeCredential, archiveCredential, restoreCredential, rotateCredential |
| Reads | leaseCredential, readCredential, revealCredential, revokeLease |
| Grants | listGrants, createGrant, revokeGrant |
| Roles | listRoleAssignments, upsertRoleAssignment, revokeRoleAssignment |
| Inspection | whoami, listAudit, pollRotations |
Important contracts
listCredentials({ keyPrefix?, includeArchived? }) and getCredential(key) return metadata, not decrypted values. storeCredential({ key, plaintext, metadata? }) accepts the intended raw or typed serialized value and allowed public metadata.
leaseCredential({ key, agentRunId, justification, ttlSeconds? }) returns leaseId, leaseHandle, credentialId, issuedAt and expiresAt. readCredential({ leaseHandle }) returns plaintext and consumedAt. revealCredential(key) is a convenience read returning raw, a parsed envelope when applicable, the lease ID and expiry.
The published client’s rotateCredential accepts key, newPlaintext, justification and optional dualWindowSeconds. It does not currently expose the console’s new typed metadata option. Do not assume SDK rotation updates public typed connection metadata; use the console for that complete workflow or coordinate against the deployed API contract.
VaultClientError carries status, code and optional details for non-success HTTP responses. The client does not automatically perform browser OAuth, invite workspace members or renew consumed leases. Consult the installed package’s TypeScript signatures for exact optional fields.
See the working example and structured-record guide. Historical Vault.connect() and vault.credentials.* snippets describe a different, unsupported interface.
Screen reference
