---
title: "List the fingerprints currently covered by this vault's key envelopes, plus the org's desired-recipient state for this vault"
method: GET
path: "/vaults/v1/{vault_id}/envelope-recipients"
tags: ["vault"]
---

# List the fingerprints currently covered by this vault's key envelopes, plus the org's desired-recipient state for this vault

`GET /vaults/v1/{vault_id}/envelope-recipients`

## Request

- Base URL: `https://api.run402.com`
- URL: `https://api.run402.com/vaults/v1/{vault_id}/envelope-recipients`
- Auth: one of:
  - API key in header `SIGN-IN-WITH-X`
  - HTTP bearer
  - HTTP bearer

FINGERPRINTS ONLY, never envelope bytes — the `ek_` fingerprints of the principals with a working `key_envelope` on this vault, in `recipient_fingerprints`. Distinct from `POST .../object-reads`, whose recipient-only rule on envelope BYTES is unchanged. Additively also carries `desired[]` (repo-surface-consolidation task 2.3) — the org's desired-recipient state (design D5: membership-driven, versioned, audited; the server owns this state but never wraps a key) with each principal's `public_key`/`ek_fingerprint`/`suite` inline plus whether this vault already `covered` them, so a key-holding client can fulfill in ONE read rather than a second directory call — and `desired_state_version`, the substrate's watermark for cheap diffing. This is what a client-side reconcile diffs against, and what the owner overview's coverage advisory computes from. Never lifecycle-gated.

## Path parameters

- `vault_id` string, required

## Headers

- `SIGN-IN-WITH-X` string, required

## Response `200`

Recipient fingerprints, sorted

- object
  - `vault_id` string
  - `recipient_fingerprints` string[]
  - `desired` object[]: The org's desired-recipient state for this vault (repo-surface-consolidation task 2.1/2.3).
    - `principal_id` string
    - `display_name` string, nullable
    - `status` 'active' | 'pending_removal': `pending_removal` means membership was revoked but today's protocol has no epoch rotation yet — stated distinctly from active, not fabricated as convergence.
    - `ek_fingerprint` string, nullable: Null when the principal hasn't enrolled an encryption key yet.
    - `public_key` string, nullable
    - `suite` string, nullable
    - `covered` boolean: Whether this vault's `recipient_fingerprints` already includes this principal's `ek_fingerprint`.
  - `desired_state_version` integer: The desired-recipient substrate's watermark for this org — 0 if no row has ever been written.
  - `recipient_state_version` string: The org's D194 recipient-state counter (decimal string), read alongside desired[] so a writer can fence a reason:"member_removed" rotation from this same read — the removal itself advanced it; no declaration route exists for that reason.
  - `recipient_revocation_version` string: The org's D194 recipient-revocation counter (decimal string); paired with recipient_state_version, see that field.

## Other responses

- `403`: Not authorized (VAULT_ACCESS_DENIED)

---

[API](https://skmtc.dev/run402/apis/run402-api.md) · [All operations](https://skmtc.dev/run402/apis/run402-api/llms.txt) · [OpenAPI document](https://skmtc.dev/run402/apis/run402-api/revisions/893607557f50?raw)