---
title: "Store encrypted blob"
method: PUT
path: "/v1/vault/{key}"
tags: ["vault"]
---

# Store encrypted blob

`PUT /v1/vault/{key}`

## Request

- Base URL: `https://agentlair.dev`
- URL: `https://agentlair.dev/v1/vault/{key}`
- Auth: HTTP bearer

Store an encrypted blob under a named key (versioned, append-only).
AgentLair stores the opaque ciphertext — never sees plaintext.
Version history is maintained up to tier limits (free: 3 versions, paid: 100).

## Path parameters

- `key` string, required

## Request body

- object
  - `ciphertext` string, required: Base64url or hex encoded ciphertext (max 16KB free / 64KB paid)
  - `metadata` object: Optional unencrypted metadata (max 4KB)

## Response `200`

Existing key updated (new version)

## Other responses

- `201`: New key created
- `400`: Invalid ciphertext or metadata
- `403`: Vault key limit reached

---

[API](https://skmtc.dev/agentlair/apis/agentlair-api.md) · [All operations](https://skmtc.dev/agentlair/apis/agentlair-api/llms.txt) · [OpenAPI document](https://skmtc.dev/agentlair/apis/agentlair-api/revisions/fac95ff4995d?raw)