---
title: "Create an external vault variable"
method: POST
path: "/vault-variables/external"
tags: ["VaultVariables"]
---

# Create an external vault variable

`POST /vault-variables/external`

## Request

- Base URL: `https://public.escape.tech/v3`
- URL: `https://public.escape.tech/v3/vault-variables/external`
- Auth: API key in header `X-ESCAPE-API-KEY`

Create a variable that points at an entry in a provider vault. Escape looks up the vault and the entry first and rejects the request when either is missing, then links the vault and stores the variable.

## Request body

- object
  - `type` 'EXTERNAL', required
  - `name` string, required: The name of the variable, referenced from scan configs as ${NAME}
  - `externalId` string, required: The vault's own coordinate at the provider
  - `externalEntry` string, required: The name of the entry inside the provider vault. Write-only.

## Response `200`

OK

- object
  - `id` string, uuid, required: The id of the vault variable
  - `type` 'EXTERNAL' | 'PLAINTEXT' | 'SECRET', required: The type of the vault variable
  - `name` string, required: The name of the vault variable, referenced from scan configs as ${NAME}

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `404`: Not found
- `409`: A variable with this name already exists
- `502`: The vault provider refused or could not answer

---

[API](https://skmtc.dev/escape/apis/escape-public-api.md) - [All operations](https://skmtc.dev/escape/apis/escape-public-api/llms.txt) - [OpenAPI document](https://skmtc.dev/escape/apis/escape-public-api/revisions/2eab35df40c7?raw)