A Quick Overview of VaultApi

The path lookup process is as follows:

VaultApi FindPaths Vehicle

This command returns a list of paths matching the specified value of Vehicle.

VaultApi FindPaths Vehicle
kv1/Vehicle/1995-Mustang-GT500                           
kv1/Vehicle/2003-DodgeViper
kv1/Vehicle/2012-Nissan
kv1/Vehicle/2016-Telsa

To lookup all the keys associated to a given path:

VaultApi kv1Read kv1/Vehicle/2012-Nissan -kvkey _ReturnKeys
plate                           
VIN

To return a value associated with a key of a given path to the clipboard:

VaultApi kv1Read kv1/Vehicle/2012-Nissan -kvkey plate

If the -raw options is included the value will be returned to the console.

To add a new key/value pair to an existing path:

VaultApi kv1Update kv1/Vehicle/2012-Nissan 21000000 -kvkey mileage

To add a new path and key/value pair:

VaultApi kv1Create kv1/Vehicle/2025-Lambo Bitcoin -kvkey plate

To list the 2nd level path names:

Default level 1 path name is "kv1"
    
VaultApi kv1list

To list 3rd level path names:

VaultApi kv1list kv1/Vehicle

To Delete a path and it's associated key/value pairs:

VaultApi kv1Delete kv1/Vehicle/2012-Nissan

To just delete a single key/value pair for a given path
use the HashiCorp Vault Web interface.

To launch the HashiCorp Vault web interface:

VaultApi WebUI

To return status information about the Vault:

VaultApi status
sealed initialized version n t
----- ----------- ------- - -
False        True  1.15.6  5 3

To return process information about the Vault:

VaultApi Check
Hashicorp Vault (v1.15.6) is running...116147

To show the hash value of the VaultApi script:

VaultApi ShowHash
3D47628ECB3FA0E7DBD28BA7606CE5BF

To return a 20 character randomized value to the clipboard:

VaultApi SetValue

To create a backup of the HashiCorp Vault :

Must be logged in with the root token.
VaultApi Backup
A snapshot file will be created in the $HOME/Downloads directory by default.

To stop the HashiCorp Vault server:

VaultApi seal
The vault is sealed.
    
VaultApi stop
The server is stopped.

Here are some past articles I wrote about setting up HashiCorp Vault and VeraCrypt.

Bitcoin and key/value using Hashicorp Vault

Bitcoin and Cold Storage using VeraCrypt

More information on VaultApi.

VaultApi Documentation

Download VaultApi script here

Nostr Article

VaultApi.ps1 is a PowerShell script that helps users interact with HashiCorp Vault, which is a tool for securely storing and managing sensitive information like passwords and API keys.

This script makes it easier to use Vault by providing simple commands to start the Vault server, unlock it (unseal), log in, store secrets, retrieve secrets, and shut down the server. Think of it as a friendly interface that simplifies all the complex operations you would otherwise need to do manually with Vault.

The script takes several inputs:

• An action parameter that tells the script what operation to perform (like Start, Stop, Kv1Create, Kv1Read)

• A kvpath parameter that specifies where in Vault to store or retrieve information

• A kvalue parameter for the actual secret value you want to store

• A kvkey parameter that lets you specify a custom name for your secret

• Optional switches like -Info to show more detailed information and -Raw to display output directly instead of copying to clipboard

Depending on the action performed, the script produces different outputs:

• Text messages in the console showing the status of operations

• Secret values retrieved from Vault (either displayed or copied to clipboard)

• Lists of available secret paths

• Status information about the Vault server

• Backup files of your Vault data

The script works by:

1. First checking if Vault is installed and running

2. Setting up communication with the Vault server using its API address

3. Performing the requested action by sending the appropriate commands to Vault

4. Processing any responses and displaying results to the user

For example, when you use the Kv1Create action, the script:

• Checks if you're logged in

• Verifies the path doesn't already exist

• Formats your data correctly

• Sends a request to Vault to create the new secret

• Shows you the result

Some key processes in the script include:

1. Authentication flow: The script helps you log in using either a token or username/password, then stores your authentication token for future commands.

2. Unsealing process: Vault requires multiple keys to unlock (unseal) it after starting. The script can retrieve these keys from a secure file or prompt you to enter them.

3. Secret management: The script handles creating, reading, updating, and deleting secrets, supporting both single values and multiple key-value pairs at a path.

4. Path management: The script can list all available paths and help you search for specific ones, making it easier to organize and find your secrets.

5. Value generation: When creating or updating secrets, you can use the keyword setvalue to automatically generate a random 20-character value, which is then copied to your clipboard.

The script uses a configuration file in your home directory to know how to connect to Vault, and it can optionally use encrypted files to store sensitive information like unlock keys. It communicates with Vault using REST API calls, which are like special messages that tell Vault what to do.

In summary, VaultApi.ps1 is a helper tool that makes it much easier to use HashiCorp Vault for securely storing and managing your sensitive information, without needing to remember all the complex commands and procedures.