vault

List the fingerprints currently covered by this vault's key envelopes, plus the org's desired-recipient state for this vault

FINGERPRINTS ONLY, never envelope bytes — the ek_ fingerprints of the principals with a working key_envelope on this vault, in recipient_fingerprints. Distinct from POST .../object-reads, whose recipient-only rule on envelope BYTES is unchanged. Additively also carries desired[] (repo-surface-consolidation task 2.3) — the org's desired-recipient state (design D5: membership-driven, versioned, audited; the server owns this state but never wraps a key) with each principal's public_key/ek_fingerprint/suite inline plus whether this vault already covered them, so a key-holding client can fulfill in ONE read rather than a second directory call — and desired_state_version, the substrate's watermark for cheap diffing. This is what a client-side reconcile diffs against, and what the owner overview's coverage advisory computes from. Never lifecycle-gated.

get/vaults/v1/{vault_id}/envelope-recipients

Request

  • Base URL: https://api.run402.com
  • URL: https://api.run402.com/vaults/v1/{vault_id}/envelope-recipients
  • Auth: one of:
    • API key in header SIGN-IN-WITH-X
    • HTTP bearer
    • HTTP bearer

Path parameters

vault_idstring required

The vault id (src_<32 hex>); the wire field is repo_id (protocol D185).

Headers

SIGN-IN-WITH-Xstring required

SIWX auth header — base64-encoded JSON payload containing a signed CAIP-122 (EIP-4361) message. See https://docs.x402.org/extensions/sign-in-with-x.

Response

Recipient fingerprints, sorted

vault_idstring
recipient_fingerprintsstring[]
desired_state_versioninteger

The desired-recipient substrate's watermark for this org — 0 if no row has ever been written.

recipient_state_versionstring

The org's D194 recipient-state counter (decimal string), read alongside desired[] so a writer can fence a reason:"member_removed" rotation from this same read — the removal itself advanced it; no declaration route exists for that reason.

recipient_revocation_versionstring

The org's D194 recipient-revocation counter (decimal string); paired with recipient_state_version, see that field.

Changes

No recorded changes to this operation across all 1 revision of this API.