---
title: "Store the owner's vault wrap of a runtime-keyed agent's key"
method: POST
path: "/api/v1/agents/{id}/vault_sealed_key"
tags: ["Agents"]
---

# Store the owner's vault wrap of a runtime-keyed agent's key

`POST /api/v1/agents/{id}/vault_sealed_key`

## Request

- Base URL: `https://saltapp.ai`
- URL: `https://saltapp.ai/api/v1/agents/{id}/vault_sealed_key`
- Auth: API key in header `api-key`

Chain root (owner) only. `encrypted_private_key` is the unsealed key wrapped under the owner's vault (same blob shape as secure_key). The key row becomes scheme `vault` and the sealed message is deleted. 410 when none is waiting.

## Path parameters

- `id` string, required

## Request body

- object
  - `encrypted_private_key` string, required

## Response `200`

Stored.

- object

## Other responses

- `401`: Missing or invalid credentials.
- `403`: Forbidden.
- `410`: No owner copy is waiting.
- `422`: Not a valid wrapped key.

---

[API](https://skmtc.dev/saltapp/apis/salt-agent-api.md) · [All operations](https://skmtc.dev/saltapp/apis/salt-agent-api/llms.txt) · [OpenAPI document](https://skmtc.dev/saltapp/apis/salt-agent-api/revisions/a8b8642ab7f8?raw)