EnvVault API Reference

health.get - Health check.

Auth: none
Query: none

Body: none

variables.list - List variable metadata. Values are not returned.

Auth: read
Query: application, environment, type

Body: none

variables.get - Retrieve one decrypted variable value.

Auth: read
Query: application, environment

Body: none

variables.create - Create or upsert a variable.

Auth: write
Query: none

Required: name, value
Optional: application, environment, description, type, expires_at, metadata

variables.update - Update value, description, type, expiry, metadata, name, application, or environment. Returns 409 if a rename/move targets an existing variable.

Auth: write
Query: application, environment

Required: none
Optional: value, description, type, expires_at, metadata, new_name, new_application, environment

variables.bulk - Retrieve multiple decrypted variable values by name.

Auth: read
Query: none

Required: names
Optional: application, environment

variables.delete - Delete one variable.

Auth: write
Query: application, environment

Body: none

applications.list - List applications plus APP_DESCRIPTION and GITHUB_URL metadata when present.

Auth: read
Query: none

Body: none

env.export - Export decrypted secrets as shell `export NAME='value'` lines (text/plain). Scoped session tokens only receive their scoped applications (403 on out-of-scope names; X-EnvVault-Scope: enforced header on all scoped-token responses). Variable names that are not strict shell identifiers are skipped. Pipe via capture-then-eval: `envvault_env=$(curl -sf ...) && eval "$envvault_env"` — never eval curl output directly.

Auth: read
Query: applications, type

Body: none

cookies.sync - Bulk upsert browser cookies as session_token variables for an application.

Auth: write
Query: none

Required: application, cookies
Optional: none

cookies.get - Get decrypted session_token cookies for an application.

Auth: read
Query: none

Body: none

cookies.delete - Delete all session_token cookies for an application.

Auth: write
Query: none

Body: none

actions.create - Create an action for the browser extension to execute.

Auth: write
Query: none

Required: application, action_type, payload
Optional: expires_at

actions.pending - List pending extension actions.

Auth: read
Query: application

Body: none

actions.get - Get one extension action.

Auth: read
Query: none

Body: none

actions.complete - Mark an action completed or failed.

Auth: write
Query: none

Required: none
Optional: success, result

actions.list - List actions with optional filters.

Auth: read
Query: application, status, limit

Body: none

api_keys.list - List account API keys. Session tokens are blocked.

Auth: admin
Query: none

Body: none

api_keys.create - Create a new API key. Raw key is shown once. Session tokens are blocked.

Auth: admin
Query: none

Required: name
Optional: role

api_keys.revoke - Revoke an API key. Session tokens are blocked.

Auth: admin
Query: none

Body: none

sessions.create - Create or initiate creation of a short-lived session token. Child sessions created by a session-token parent are capped to the parent's expiry.

Auth: admin
Query: none

Required: none
Optional: ttl_seconds, role, applications, description, skip_2fa

sessions.verify - Verify an emailed code and return the raw session token.

Auth: none
Query: none

Required: verification_id, code
Optional: none

sessions.list - List current user's session tokens.

Auth: read
Query: include_expired

Body: none

sessions.revoke - Revoke one session token.

Auth: read
Query: none

Body: none

sessions.revoke_all - Revoke all active session tokens for the current user.

Auth: read
Query: none

Body: none

auth.login - Password login. Returns a web session token.

Auth: none
Query: none

Required: username, password
Optional: none

auth.logout - Revoke current web session or session token.

Auth: read
Query: none

Body: none

auth.change_password - Change current user's password. Session tokens are blocked; on success ALL web sessions and session tokens are revoked.

Auth: read
Query: none

Required: new_password
Optional: current_password

auth.forgot_password - Request a password reset code by email.

Auth: none
Query: none

Required: email
Optional: none

auth.reset_password - Reset password with email verification code. On success ALL web sessions and session tokens are revoked.

Auth: none
Query: none

Required: email, code, new_password
Optional: none

users.create - Register a user or admin-create one. Session tokens are blocked from the admin-create path.

Auth: none or site_admin
Query: none

Required: username
Optional: email, password, default_role, is_admin

users.me - Get current user and current token metadata.

Auth: read
Query: none

Body: none

users.list - List all users. Session tokens are blocked.

Auth: site_admin
Query: none

Body: none

users.pending - List pending user registrations. Session tokens are blocked.

Auth: site_admin
Query: none

Body: none

users.approve - Approve a pending user and create their first API key. Session tokens are blocked.

Auth: site_admin
Query: none

Required: none
Optional: role

users.reject - Reject a pending user. Session tokens are blocked.

Auth: site_admin
Query: none

Body: none

users.delete - Delete a user and owned data. Session tokens are blocked.

Auth: site_admin
Query: none

Body: none

users.reset_password - Send or create a password reset for a user. Session tokens are blocked; the email path returns no secret in the response.

Auth: site_admin
Query: none

Body: none

users.api_keys.list - List current user's API keys.

Auth: api_key or web_session
Query: none

Body: none

users.api_keys.create - Create a personal API key. Raw key is shown once.

Auth: api_key or web_session
Query: none

Required: none
Optional: name, role

users.api_keys.revoke - Revoke one personal API key.

Auth: api_key or web_session
Query: none

Body: none

users.api_keys.rotate - Revoke current API keys and create a replacement.

Auth: api_key or web_session
Query: none

Body: none

ai_setup.create - Create a one-time 10-minute AI setup link with an embedded session token.

Auth: admin
Query: none

Body: none

ai_setup.get - Consume a one-time AI setup link and return Markdown setup instructions.

Auth: none
Query: none

Body: none

sso.login - Start Authentik OAuth login when SSO is configured.

Auth: none
Query: none

Body: none

sso.callback - OAuth callback for Authentik.

Auth: none
Query: code, state

Body: none

sso.logout - Clear local session and redirect through Authentik logout when configured.

Auth: none
Query: none

Body: none

All errors return JSON: {"error": "human-readable message"}