EnvVault API Reference

EnvVault manages encrypted variables, passwords, API keys, browser session tokens, short-lived AI session tokens, users, and browser-extension actions.

Machine-readable spec: /api/v1/spec. Markdown spec: /docs/api.md.

System

GET /api/v1/health

health.get - Health check.

Auth: none
Query: none

Body: none

Variables

GET /api/v1/variables/

variables.list - List variable metadata. Values are not returned.

Auth: read
Query: application, environment, type

Body: none

GET /api/v1/variables/{name}

variables.get - Retrieve one decrypted variable value.

Auth: read
Query: application, environment

Body: none

POST /api/v1/variables/

variables.create - Create or upsert a variable.

Auth: write
Query: none

Required: name, value
Optional: application, environment, description, type, expires_at, metadata

PATCH /api/v1/variables/{name}

variables.update - Update value, description, type, expiry, metadata, name, application, or environment.

Auth: write
Query: application, environment

Required: none
Optional: value, description, type, expires_at, metadata, new_name, new_application, environment

POST /api/v1/variables/bulk

variables.bulk - Retrieve multiple decrypted variable values by name.

Auth: read
Query: none

Required: names
Optional: application, environment

DELETE /api/v1/variables/{name}

variables.delete - Delete one variable.

Auth: write
Query: application, environment

Body: none

Applications

GET /api/v1/applications/

applications.list - List applications plus APP_DESCRIPTION and GITHUB_URL metadata when present.

Auth: read
Query: none

Body: none

Cookies

POST /api/v1/cookies/sync

cookies.sync - Bulk upsert browser cookies as session_token variables for an application.

Auth: write
Query: none

Required: application, cookies
Optional: none

GET /api/v1/cookies/{application}

cookies.get - Get decrypted session_token cookies for an application.

Auth: read
Query: none

Body: none

DELETE /api/v1/cookies/{application}

cookies.delete - Delete all session_token cookies for an application.

Auth: write
Query: none

Body: none

Actions

POST /api/v1/actions/

actions.create - Create an action for the browser extension to execute.

Auth: write
Query: none

Required: application, action_type, payload
Optional: expires_at

GET /api/v1/actions/pending

actions.pending - List pending extension actions.

Auth: read
Query: application

Body: none

GET /api/v1/actions/{id}

actions.get - Get one extension action.

Auth: read
Query: none

Body: none

POST /api/v1/actions/{id}/complete

actions.complete - Mark an action completed or failed.

Auth: write
Query: none

Required: none
Optional: success, result

GET /api/v1/actions/

actions.list - List actions with optional filters.

Auth: read
Query: application, status, limit

Body: none

API Keys

GET /api/v1/api-keys/

api_keys.list - List account API keys. Application-scoped session tokens are blocked.

Auth: admin
Query: none

Body: none

POST /api/v1/api-keys/

api_keys.create - Create a new API key. Raw key is shown once. Application-scoped session tokens are blocked.

Auth: admin
Query: none

Required: name
Optional: role

DELETE /api/v1/api-keys/{id}

api_keys.revoke - Revoke an API key. Application-scoped session tokens are blocked.

Auth: admin
Query: none

Body: none

Sessions

POST /api/v1/sessions/

sessions.create - Create or initiate creation of a short-lived session token.

Auth: admin
Query: none

Required: none
Optional: ttl_seconds, role, applications, description, skip_2fa

POST /api/v1/sessions/verify

sessions.verify - Verify an emailed code and return the raw session token.

Auth: none
Query: none

Required: verification_id, code
Optional: none

GET /api/v1/sessions/

sessions.list - List current user's session tokens.

Auth: read
Query: include_expired

Body: none

DELETE /api/v1/sessions/{id}

sessions.revoke - Revoke one session token.

Auth: read
Query: none

Body: none

DELETE /api/v1/sessions/all

sessions.revoke_all - Revoke all active session tokens for the current user.

Auth: read
Query: none

Body: none

Authentication

POST /api/v1/auth/login

auth.login - Password login. Returns a web session token.

Auth: none
Query: none

Required: username, password
Optional: none

POST /api/v1/auth/logout

auth.logout - Revoke current web session or session token.

Auth: read
Query: none

Body: none

POST /api/v1/auth/change-password

auth.change_password - Change current user's password.

Auth: read
Query: none

Required: new_password
Optional: current_password

POST /api/v1/auth/forgot-password

auth.forgot_password - Request a password reset code by email.

Auth: none
Query: none

Required: email
Optional: none

POST /api/v1/auth/reset-password

auth.reset_password - Reset password with email verification code.

Auth: none
Query: none

Required: email, code, new_password
Optional: none

Users

POST /api/v1/users/

users.create - Register a user or admin-create one.

Auth: none or site_admin
Query: none

Required: username
Optional: email, password, default_role, is_admin

GET /api/v1/users/me

users.me - Get current user and current token metadata.

Auth: read
Query: none

Body: none

GET /api/v1/users/

users.list - List all users.

Auth: site_admin
Query: none

Body: none

GET /api/v1/users/pending

users.pending - List pending user registrations.

Auth: site_admin
Query: none

Body: none

POST /api/v1/users/{id}/approve

users.approve - Approve a pending user and create their first API key.

Auth: site_admin
Query: none

Required: none
Optional: role

POST /api/v1/users/{id}/reject

users.reject - Reject a pending user.

Auth: site_admin
Query: none

Body: none

DELETE /api/v1/users/{id}

users.delete - Delete a user and owned data.

Auth: site_admin
Query: none

Body: none

POST /api/v1/users/{id}/reset-password

users.reset_password - Send or create a password reset for a user.

Auth: site_admin
Query: none

Body: none

Personal API Keys

GET /api/v1/users/me/api-keys

users.api_keys.list - List current user's API keys.

Auth: api_key or web_session
Query: none

Body: none

POST /api/v1/users/me/api-keys

users.api_keys.create - Create a personal API key. Raw key is shown once.

Auth: api_key or web_session
Query: none

Required: none
Optional: name, role

DELETE /api/v1/users/me/api-keys/{id}

users.api_keys.revoke - Revoke one personal API key.

Auth: api_key or web_session
Query: none

Body: none

POST /api/v1/users/me/api-keys/rotate

users.api_keys.rotate - Revoke current API keys and create a replacement.

Auth: api_key or web_session
Query: none

Body: none

AI Setup

POST /api/v1/ai-setup

ai_setup.create - Create a one-time 10-minute AI setup link with an embedded session token.

Auth: admin
Query: none

Body: none

GET /ai-setup/{id}

ai_setup.get - Consume a one-time AI setup link and return Markdown setup instructions.

Auth: none
Query: none

Body: none

SSO

GET /auth/login

sso.login - Start Authentik OAuth login when SSO is configured.

Auth: none
Query: none

Body: none

GET /auth/callback

sso.callback - OAuth callback for Authentik.

Auth: none
Query: code, state

Body: none

GET /auth/logout

sso.logout - Clear local session and redirect through Authentik logout when configured.

Auth: none
Query: none

Body: none