For stores, the secrets are encrypted in json form.

When creating stores in an automated fashion, secrets have to be first converted into the proper representation. To obtain the representation of a secret of an existing store, use the /secret/decrypt endpoint.

The secret encryption method depends on your vault setup. Without any vault user and passphrase, the secret will be encrypted with a generic vault key. If you have a vault user with custom passphrase or a team set up, the secret can be encrypted with that key.

You can also control the access scope of a secret by passing a custom principal. A principal is a vault user or role that has access to the secret. You can pass this principal to this endpoint to control who has access to this secret.