---
title: "Declare this vault's epoch secret exposed (owner + step-up)"
method: POST
path: "/vaults/v1/{vault_id}/epoch-secret-exposure"
tags: ["vault"]
---

# Declare this vault's epoch secret exposed (owner + step-up)

`POST /vaults/v1/{vault_id}/epoch-secret-exposure`

## Request

- Base URL: `https://api.run402.com`
- URL: `https://api.run402.com/vaults/v1/{vault_id}/epoch-secret-exposure`
- Auth: one of:
  - API key in header `SIGN-IN-WITH-X`
  - HTTP bearer

Owner + step-up (`gitvault.rotate`, protocol rev 42 D199). Declares `reason:"epoch_secret_exposed"` admissible — deliberately VAULT-scoped, not org-wide: one vault's leaked secret is not evidence any sibling vault is compromised. Advances the vault's own `epoch_secret_exposure_version` counter, cleared only by a COMMITTED rotation bound to it.

## Path parameters

- `vault_id` string, required

## Headers

- `SIGN-IN-WITH-X` string, required

## Response `200`

The vault's exposure counter after the declaration

- object
  - `epoch_secret_exposure_version` string

## Other responses

- `403`: VAULT_ACCESS_DENIED

---

[API](https://skmtc.dev/run402/apis/run402-api.md) · [All operations](https://skmtc.dev/run402/apis/run402-api/llms.txt) · [OpenAPI document](https://skmtc.dev/run402/apis/run402-api/revisions/893607557f50?raw)