REST API Reference

Sovereign Vault exposes a minimal, high-throughput REST API. All endpoints return and consume JSON.

GET /v1/sys/health

Query real-time vault initialization and unseal status.

{
  "status": "sealed" | "active",
  "initialized": true | false,
  "sealed": true | false,
  "version": "0.1.0"
}

POST /v1/sys/init

Initialize a cold vault. Requires the ephemeral bootstrap nonce emitted to stdout.

Header: X-Vault-Bootstrap-Nonce: init_...

POST /v1/sys/unseal

Supply the 256-bit unseal key to unlock the memory-locked buffer.

// Request
{ "unseal_key": "37051358e370eab65b24360a1ef28c531a1cb06ad241ae503a54a412b610613c" }

// Response
{ "status": "unsealed", "sealed": false }

POST /v1/sys/enroll

Enroll a scoped machine identity token.

// Request
{
  "project": "production",
  "name": "jellyfin-transcoder",
  "allowed_paths": ["apps/jellyfin/*"],
  "capabilities": ["read"]
}

GET /v1/secret/*path

Retrieve a decrypted secret if token scope permits.

Optional Header: X-Vault-Token: sv_live_...