---
title: "List every stored object in the vault"
method: GET
path: "/vaults/v1/{vault_id}/objects"
tags: ["vault"]
---

# List every stored object in the vault

`GET /vaults/v1/{vault_id}/objects`

## Request

- Base URL: `https://api.run402.com`
- URL: `https://api.run402.com/vaults/v1/{vault_id}/objects`
- Auth: one of:
  - API key in header `SIGN-IN-WITH-X`
  - HTTP bearer
  - HTTP bearer

Keyset-paginated enumeration of every stored artifact under the vault's prefix — the client-uploaded kinds, the server-authored kinds (retention_cutoff tickets, prune intents/completions, maintenance issuances/cuts/terminals), AND the vault's head chain (every COMMITTED generation's head/vault_genesis object plus its admission_record, incl. genesis at generation 0000000000000000 — fetch head bytes via GET .../heads/{generation} and admission-record bytes via GET .../admissions/{generation}, not via object-reads) — each entry naming its storage key, kind, stored-bytes hash, and size: exactly what a client-side mirror reconcile needs to diff against a mirror. `sha256`/`size_bytes` on head-chain entries are always the ledger's exact stored-bytes hash/length (never estimated, never null). NOT an r402s/v0 protocol object (no `format`, no wire revision) — a platform-only read surface. Excludes the same tombstoned lifecycle states presigned reads exclude (DELETING / DELETED / PRUNE_AUTHORIZED_PRESENT), so every listed key is fetchable. `cursor` is opaque and bound to this vault; a malformed, tampered, or cross-vault cursor is a typed `INVALID_CURSOR`, never a silent restart. Never lifecycle-gated.

## Path parameters

- `vault_id` string, required

## Query parameters

- `limit` string
- `cursor` string

## Headers

- `SIGN-IN-WITH-X` string, required

## Response `200`

One page of the vault's stored objects

- object
  - `repo_id` string
  - `objects` object[]
    - `key` string: The exact storage key under source/<repo_id>/.
    - `object_kind` string
    - `sha256` string: The object's stored-bytes (or ciphertext) SHA-256, matching what a presigned read returns as stored_bytes_sha256.
    - `size_bytes` string: Decimal byte count as a string (values exceed 2^53).
  - `has_more` boolean
  - `next_cursor` string, nullable
  - `total` string: The exact total count of stored artifacts across the whole vault (not just this page), as a decimal string (values may exceed 2^53). Always present and exact — every page materializes the full set before slicing, so it is never an estimate and never null.

## Other responses

- `400`: INVALID_CURSOR / VALIDATION_FAILED
- `403`: Not authorized (VAULT_ACCESS_DENIED)

---

[API](https://skmtc.dev/run402/apis/run402-api.md) · [All operations](https://skmtc.dev/run402/apis/run402-api/llms.txt) · [OpenAPI document](https://skmtc.dev/run402/apis/run402-api/revisions/893607557f50?raw)