---
title: "Lock the vault"
method: POST
path: "/v1/vault/lock"
tags: ["Vault"]
---

# Lock the vault

`POST /v1/vault/lock`

## Request

- Base URL: `http://localhost:9998`
- URL: `http://localhost:9998/v1/vault/lock`
- Auth: HTTP bearer

Drops the in-memory VMK reference and the decrypted index; content
routes answer 423 afterwards. Needs no secret, so it is web-reachable
(unlike unlock, which is native-only). Idempotent: locking a locked
vault re-answers the locked status, 200.

## Response `200`

The post-lock vault status

- WireVaultLockResponse: The post-lock vault status.
  - `status` WireVaultStatus, required: Vault presence and lock state, also carried by the `vault.changed` SSE event's consumers via re-fetch.
    - `hasVault` boolean, required: True once a vault exists on disk (`vault-keys.json` present).
    - `locked` boolean, required: True while no VMK is loaded; content routes then answer 423 vault_locked.
    - `unlockedSince` integer, nullable: Epoch milliseconds when the vault was last unlocked, or null while locked. Advisory only.

## Other responses

- `503`: Vault service unavailable

---

[API](https://skmtc.dev/modelpiper/apis/toolpiper-api.md) · [All operations](https://skmtc.dev/modelpiper/apis/toolpiper-api/llms.txt) · [OpenAPI document](https://skmtc.dev/modelpiper/apis/toolpiper-api/revisions/6722bf56385c?raw)