---
title: "Get a vault"
method: GET
path: "/vaults/{id}"
tags: ["Contract Intelligence"]
---

# Get a vault

`GET /vaults/{id}`

## Request

- Base URL: `https://app.gc.ai/api/external/v1`
- URL: `https://app.gc.ai/api/external/v1/vaults/{id}`
- Auth: API key in header `Authorization`
- TypeScript: <https://skmtc.dev/gc-ai/apis/gc-ai-external-api/docs/vaults/:id/get.ts> (a function with typed inputs; its response is checked against the schema)

Retrieve a single Contract Intelligence vault by ID, with the caller's role and its scanned-document count.

Requires a user-scoped API key (`u:gcai_...`). A vault is shared with named people, so an organization-scoped key has no identity to resolve vault access with.

## Path parameters

- `id` string, uuid, required: The vault ID

## Response `200`

Vault details

- VaultResponse
  - `id` string, uuid, required: Unique vault identifier
  - `name` string, required: Vault name
  - `description` string, nullable, required: Vault description, or null if unset
  - `my_role` 'owner' | 'editor' | 'viewer', required: Caller's role in this vault: `owner` (manage members and settings), `editor` (add documents and edit extracted data), or `viewer` (read and annotate). A vault the caller reaches only through organization-wide visibility reports `viewer`. The role is not the whole story for writes: adding documents also needs the organization-level permission to manage vaults, so a caller can hold `editor` here and still receive `403` from `POST /vaults/{id}/documents`.
  - `is_access_controlled` boolean, required: When true, only vault members can see the vault. When false, any member of the organization with organization-wide vault read can see it.
  - `document_count` number, required: Documents that have finished scanning in this vault. Documents still being read are not counted yet.
  - `setup_completed_at` string, nullable, required: ISO 8601 timestamp when guided setup finished, or null while the vault is still in setup. Documents added to a vault in setup are stored but not scanned until setup finishes. Vaults created through `POST /vaults` finish setup immediately, so this is always set for them.
  - `archived_at` string, nullable, required: ISO 8601 timestamp when the vault was archived, or null while it is live. Archived vaults are hidden from the default list and reject changes until `POST /vaults/{id}/restore` runs.
  - `created_at` string, required: ISO 8601 creation timestamp
  - `updated_at` string, required: ISO 8601 last-update timestamp

## Other responses

- `401`: Missing or malformed API key
- `403`: Contract Intelligence is not enabled for this account. Contact support to request access.
- `404`: Vault not found, archived, or access denied
- `422`: Vault access is per-user and requires a user-scoped API key (u:gcai_...).
- `429`: Rate limit exceeded. See [Rate Limits](https://docs.gc.ai/api-reference/concepts/rate-limits) for the tiers, limits, and how to back off.
- `500`: Internal server error
- `503`: Service temporarily unavailable

---

[API](https://skmtc.dev/gc-ai/apis/gc-ai-external-api.md) - [All operations](https://skmtc.dev/gc-ai/apis/gc-ai-external-api/llms.txt) - [OpenAPI document](https://skmtc.dev/gc-ai/apis/gc-ai-external-api/revisions/2bbdfddf7107?raw)