---
title: "Initialize Vault"
method: POST
path: "/api/v1/vault/initialize"
tags: ["Vault"]
---

# Initialize Vault

`POST /api/v1/vault/initialize`

## Request body

- VaultInitializeRequest
  - `vault_key` VaultKeyCreate, required
    - `id` string, uuid, required
    - `wrapped_org_encryption_key` string, required — AES-256-GCM ciphertext wrapping the org encryption key (base64)
    - `auth_hash` string, required — SHA-256(masterKey) hex digest, required for server-side row lookup
    - `key_type` 'primary' | 'recovery'
  - `recovery_keys` VaultKeyCreate[], required — Exactly four recovery keys, each wrapping the same org encryption key with a different recovery-code-derived master key.
    - `id` string, uuid, required
    - `wrapped_org_encryption_key` string, required — AES-256-GCM ciphertext wrapping the org encryption key (base64)
    - `auth_hash` string, required — SHA-256(masterKey) hex digest, required for server-side row lookup
    - `key_type` 'primary' | 'recovery'

## Response `201`

Successful Response

- VaultInitializeResponse
  - `vault_id` string, uuid, required
  - `vault_key_id` string, uuid, required
  - `recovery_key_count` integer, required

## Other responses

- `422` — Validation Error
- `4XX` — Client error with Support Agent information.
- `5XX` — Server error with Support Agent information.

---

[API](https://skmtc.dev/inkbox/apis/inkbox-api.md) · [All operations](https://skmtc.dev/inkbox/apis/inkbox-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/inkbox/inkbox-api/revisions/31f357e7e6f8/schema)