vault

Read the vault record

Policy, allocation generation + the signed allocation receipt copy, the chain tip, admitted counts, storage + maintenance state, warnings[] (e.g. the persistent grandfathered-policy warning), and (vault-multi-writer rev 47) the vault's chain-admitted writer set (writer_set), members who could become writers but aren't yet (pending_writers, with pending_writers_skipped naming why that list is empty on a vault that cannot admit one), members who can't right now and why (ineligible_members), and whether the vault has lost its last writer (read_only_terminal). Ledger figures exactly — never estimates. Never lifecycle-gated.

get/vaults/v1/{vault_id}

Request

  • Base URL: https://api.run402.com
  • URL: https://api.run402.com/vaults/v1/{vault_id}
  • Auth: one of:
    • API key in header SIGN-IN-WITH-X
    • HTTP bearer
    • HTTP bearer

Path parameters

vault_idstring required

The vault id (src_<32 hex>); the wire field is repo_id (protocol D185).

Headers

SIGN-IN-WITH-Xstring required

SIWX auth header — base64-encoded JSON payload containing a signed CAIP-122 (EIP-4361) message. See https://docs.x402.org/extensions/sign-in-with-x.

Response

Vault record

repo_idstring
project_idstring
org_idstring uuid
vault_policy'required' | 'grandfathered' nullable
vault_policy_versionstring
vault_policy_changed_atstring date-time nullable
allocation_generationstring
allocationobject nullable
allocation_sha256string nullable
storage_profile'managed' | 'byo'

vault-byo-primary-bucket (D220). Absent or managed is byte-identical to every vault allocated before this field existed. Chosen ONLY at allocation in v1 — no route flips it on an existing vault.

byo_destinationstring nullable

Present iff storage_profile is byo; the destination address only (bucket/prefix/endpoint-shaped), never credential material of any kind.

newest_generationstring nullable
genesis_admitted_atstring date-time nullable
latest_effective_admitted_atstring date-time nullable
admitted_generationsstring
authorization_epoch_installed_atstring date-time nullable
gc_epochstring
repair_versionstring
repair_fence_statestring
project_deleted_atstring date-time nullable

When the vault's project has been deleted, the instant it was; null while the project is live. A vault OUTLIVES its project: deleting a project does not delete, expire, or unbill its vault, so this field plus the vault_project_deleted warning are the only signals distinguishing a retained vault from a live one. Null is also returned when the project row is gone entirely — the instant is unknown, never invented — in which case the warning still fires.

storageobject
maintenanceobject
created_atstring date-time nullable
pending_writers_skipped'byo_single_writer' | 'null' nullable

vault-byo-primary-bucket D11. Why pending_writers is EMPTY on a vault whose org has writer-eligible members waiting. "byo_single_writer" on a bring-your-own-bucket vault — it admits exactly one writer in v1, because its key envelopes live only in the customer's bucket, so a reconcile skips it rather than driving an add_writer_key the admission door refuses with 409 VAULT_BYO_SINGLE_WRITER. null whenever pending_writers means what it says.

read_only_terminalboolean

vault-multi-writer rev 47. True only once a rotate_epoch{writer_set_update, reason:"writer_key_revoked"} explicitly forced the vault's last writer out (the only path to zero writers). The vault still SERVES reads; nothing can push until a new writer is admitted through a recovery path. Driven entirely by the writer chain, never by billing/lifecycle state.

writer_revocation_versionstring

vault-multi-writer rev 47 (D6/D227). Decimal-string uint64 counter, bumped by the gateway every time a membership/role/key change gateway-blocks one or more writer keys. A client builds a rotate_epoch{writer_set_update} by freezing this value into rotation_attempt_descriptor.writer_revocation_version at its own admission fence — there is no separate "declare" round-trip for the writer dimension, unlike the encryption side's declareRecipientKeyRevoked.

Changes

No recorded changes to this operation across all 1 revision of this API.