---
title: "Upsert a Vault"
method: PUT
path: "/v2/control-planes/{controlPlaneId}/core-entities/vaults/{VaultId}"
tags: ["Vaults"]
---

# Upsert a Vault

`PUT /v2/control-planes/{controlPlaneId}/core-entities/vaults/{VaultId}`

## Request

- Base URL: `https://global.api.konghq.com`
- URL: `https://global.api.konghq.com/v2/control-planes/{controlPlaneId}/core-entities/vaults/{VaultId}`
- Auth: one of:
  - HTTP bearer
  - HTTP bearer
  - HTTP bearer
  - HTTP bearer

Create or Update Vault using ID or prefix.

## Request body

- Vault: Vault entities are used to configure different Vault connectors. Examples of Vaults are Environment Variables, Hashicorp Vault and AWS Secrets Manager. Configuring a Vault allows referencing the secrets with other entities. For example a certificate entity can store a reference to a certificate and key, stored in a vault, instead of storing the certificate and key within the entity. This allows a proper separation of secrets and configuration and prevents secret sprawl.
  - `config` object, nullable: The configuration properties for the Vault which can be found on the vaults' documentation page.
  - `created_at` integer, nullable: Unix epoch when the resource was created.
  - `description` string, nullable: The description of the Vault entity.
  - `id` string, nullable: A string representing a UUID (universally unique identifier).
  - `name` string, required: The name of the Vault that's going to be added. Currently, the Vault implementation must be installed in every Kong instance.
  - `prefix` string, required: The unique prefix (or identifier) for this Vault configuration. The prefix is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
  - `tags` string[], nullable: An optional set of strings associated with the Vault for grouping and filtering.
  - `updated_at` integer, nullable: Unix epoch when the resource was last updated.

## Response `200`

Successfully upserted Vault

- Vault: Vault entities are used to configure different Vault connectors. Examples of Vaults are Environment Variables, Hashicorp Vault and AWS Secrets Manager. Configuring a Vault allows referencing the secrets with other entities. For example a certificate entity can store a reference to a certificate and key, stored in a vault, instead of storing the certificate and key within the entity. This allows a proper separation of secrets and configuration and prevents secret sprawl.
  - `config` object, nullable: The configuration properties for the Vault which can be found on the vaults' documentation page.
  - `created_at` integer, nullable: Unix epoch when the resource was created.
  - `description` string, nullable: The description of the Vault entity.
  - `id` string, nullable: A string representing a UUID (universally unique identifier).
  - `name` string, required: The name of the Vault that's going to be added. Currently, the Vault implementation must be installed in every Kong instance.
  - `prefix` string, required: The unique prefix (or identifier) for this Vault configuration. The prefix is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
  - `tags` string[], nullable: An optional set of strings associated with the Vault for grouping and filtering.
  - `updated_at` integer, nullable: Unix epoch when the resource was last updated.

## Other responses

- `401`: Unauthorized

## Changes

- **2025-07-22** `76b0fefddb0d`: 1 breaking, 1 info
  - the response property `tags` became nullable for the status `200`
  - the request property `tags` became nullable
- **2025-06-27** `0aead68de7b0`: 2 breaking, 2 info
  - the response property `config` became nullable for the status `200`
  - the response property `config` became optional for the status `200`
  - the request property `config` became nullable
  - the request property `config` became optional

[Operation history](https://skmtc.dev/kong/apis/konnect-api-go-sdk/changes/v2/control-planes/:controlPlaneId/core-entities/vaults/:VaultId/put.md)

---

[API](https://skmtc.dev/kong/apis/konnect-api-go-sdk.md) · [All operations](https://skmtc.dev/kong/apis/konnect-api-go-sdk/llms.txt) · [OpenAPI document](https://skmtc.dev/kong/apis/konnect-api-go-sdk/revisions/7aab863a6daa?raw)