nv nanvc v2.1.0

Documentation

API v2

The v2 API introduces a more typed model built on a lower-level raw transport client.

Here, API v2 means the newer nanvc client surface, not a Vault API version label.

import { RawVaultClient, VaultClientV2 } from 'nanvc';

Result Model

V2 methods return a promise-like Result<T> object. The model is intentionally inspired by Rust’s Result, adapted for TypeScript and promise-based APIs.

You can use it in two ways:

  • destructure it as a tuple
  • use helper methods like .unwrap() to convert it into the style you want

The underlying tuple shape is:

type ResultTuple<T, E = VaultClientError> = [T, null] | [null, E];

interface Result<T, E = VaultClientError> extends Promise<ResultTuple<T, E>> {
  unwrap(): Promise<T>;
  unwrapOr(defaultValue: T): Promise<T>;
  unwrapOrElse(fn: (error: E) => T): Promise<T>;
  unwrapErr(): Promise<E>;
  intoErr(): Promise<E | null>;
}

Tuple style:

const [secret, error] = await vault.read<{ foo: string }>('secret/my-app/my-secret');
if (error) {
  throw error;
}

console.log(secret.foo);

Unwrap style:

const secret = await vault.read<{ foo: string }>('secret/my-app/my-secret').unwrap();

console.log(secret.foo);

Other helpers:

const secret = await vault.secret.kv.v1.read<{ foo: string }>('secret', 'my-app/my-secret').unwrapOr({
  foo: 'fallback',
});

const secret2 = await vault.secret.kv.v1.read<{ foo: string }>('secret', 'my-app/my-secret').unwrapOrElse((error) => {
  console.warn(error.message);
  return { foo: 'fallback' };
});

const error = await vault.secret.kv.v1.read('secret', 'my-app/my-secret').intoErr();

unwrapErr() is available for tests or flows where failure is the expected outcome:

const error = await vault.secret.kv.v1.read('secret', 'missing').unwrapErr();

console.log(error.code);
console.log(error.message);

VaultClientV2

VaultClientV2 is a higher-level wrapper for common operations.

Constructor

const vault = new VaultClientV2({
  clusterAddress: 'http://vault.local:8200',
  apiVersion: 'v1',
  authToken: process.env.NANVC_VAULT_AUTH_TOKEN ?? null,
});

KV shortcuts

VaultClientV2 exposes Vault CLI-style KV shortcuts for common secret operations:

  • read
  • write
  • delete
  • list

Shortcuts default to KV v1:

await vault.write('secret/apps/demo', {
  foo: 'bar',
}).unwrap();

const secret = await vault.read<{ foo: string }>('secret/apps/demo').unwrap();
const keys = await vault.list('secret/apps').unwrap();
await vault.delete('secret/apps/demo').unwrap();

Use { engineVersion: 2 } for KV v2 mounts:

await vault.write('secret-v2', 'apps/demo', { foo: 'bar' }, { engineVersion: 2, cas: 1 }).unwrap();
const secret = await vault.read<{ foo: string }>('secret-v2', 'apps/demo', { engineVersion: 2, version: 3 }).unwrap();
const keys = await vault.list('secret-v2', 'apps', { engineVersion: 2 }).unwrap();
await vault.delete('secret-v2', 'apps/demo', { engineVersion: 2 }).unwrap();

Client Structure

Generated Shorthand Reference

This section is generated from @nanvc-doc blocks in src/v2/client/**/*.ts.

Auth / AppRole
auth.generateAppRoleSecretId

Generate a SecretID for an AppRole role.

Signatures:

  • auth.generateAppRoleSecretId(roleName, payload?)
  • auth.generateAppRoleSecretId(mount, roleName, payload?)

Example:

const { secret_id } = await vault.auth.generateAppRoleSecretId('jenkins').unwrap();
auth.getAppRoleRoleId

Read the RoleID assigned to an AppRole role.

Signatures:

  • auth.getAppRoleRoleId(roleName)
  • auth.getAppRoleRoleId(mount, roleName)

Example:

const { role_id } = await vault.auth.getAppRoleRoleId('jenkins').unwrap();
auth.loginWithAppRole

Authenticate with AppRole credentials and set the returned client token on the client.

Signatures:

  • auth.loginWithAppRole(payload)
  • auth.loginWithAppRole(mount, payload)

Example:

const login = await vault.auth.loginWithAppRole({
    role_id: roleId,
    secret_id: secretId,
}).unwrap();
auth.registerAppRole

Register or update an AppRole role on an AppRole auth backend.

Signatures:

  • auth.registerAppRole(roleName, payload)
  • auth.registerAppRole(mount, roleName, payload)

Example:

await vault.auth.registerAppRole('jenkins', {
    token_policies: ['jenkins'],
    token_ttl: '20m',
    token_max_ttl: '30m',
}).unwrap();
auth.registerAppRoleRoleId

Register a custom RoleID for an AppRole role.

Signatures:

  • auth.registerAppRoleRoleId(roleName, payload)
  • auth.registerAppRoleRoleId(mount, roleName, payload)

Example:

await vault.auth.registerAppRoleRoleId('jenkins', {
    role_id: 'jenkins-role-id',
}).unwrap();
Auth
auth.disableAuthMethod

Disable an auth method mounted at the given path.

Signatures:

  • auth.disableAuthMethod(path)

Example:

await vault.auth.disableAuthMethod('approle').unwrap();
auth.enableAuthMethod

Enable an auth method if it is not already enabled.

Signatures:

  • auth.enableAuthMethod(path, payload)

Example:

await vault.auth.enableAuthMethod('approle', {
    type: 'approle',
}).unwrap();
auth.getAuthMethodConfig

Read configuration for an enabled auth method.

Signatures:

  • auth.getAuthMethodConfig(path)

Example:

const config = await vault.auth.getAuthMethodConfig('approle').unwrap();
auth.isAuthMethodEnabled

Check whether an auth method exists at the given path.

Signatures:

  • auth.isAuthMethodEnabled(path)

Example:

const enabled = await vault.auth.isAuthMethodEnabled('approle').unwrap();
Secrets / Cubbyhole
secret.cubbyhole.delete

Delete a secret from the caller token’s cubbyhole.

Signatures:

  • secret.cubbyhole.delete(path)

Example:

await vault.secret.cubbyhole.delete('my/secret').unwrap();
secret.cubbyhole.list

List secret keys stored in the caller token’s cubbyhole at the given path prefix.

Signatures:

  • secret.cubbyhole.list(path?)

Example:

const keys = await vault.secret.cubbyhole.list('my').unwrap();
secret.cubbyhole.read

Read a secret from the caller token’s cubbyhole.

Signatures:

  • secret.cubbyhole.read<T>(path)

Example:

const secret = await vault.secret.cubbyhole.read<{ token: string }>('my/secret').unwrap();
secret.cubbyhole.write

Write a secret into the caller token’s cubbyhole.

Signatures:

  • secret.cubbyhole.write(path, payload)

Example:

await vault.secret.cubbyhole.write('my/secret', { token: 'abc123' }).unwrap();
Secrets / Database
secret.db.configureConnection

Configure a database connection under the given mount.

Signatures:

  • secret.db.configureConnection(mount, name, options)

Example:

await vault.secret.db.configureConnection('database', 'my-db', {
    plugin_name: 'postgresql-database-plugin',
    connection_url: 'postgresql://:@localhost/postgres',
    allowed_roles: ['*'],
}).unwrap();
secret.db.deleteConnection

Delete a named database connection configuration.

Signatures:

  • secret.db.deleteConnection(mount, name)

Example:

await vault.secret.db.deleteConnection('database', 'my-db').unwrap();
secret.db.deleteRole

Delete a dynamic database role.

Signatures:

  • secret.db.deleteRole(mount, name)

Example:

await vault.secret.db.deleteRole('database', 'my-role').unwrap();
secret.db.deleteStaticRole

Delete a static database role.

Signatures:

  • secret.db.deleteStaticRole(mount, name)

Example:

await vault.secret.db.deleteStaticRole('database', 'my-static-role').unwrap();
secret.db.generateCredentials

Generate dynamic database credentials for a role.

Signatures:

  • secret.db.generateCredentials(mount, role)

Example:

const creds = await vault.secret.db.generateCredentials('database', 'my-role').unwrap();
secret.db.listConnections

List configured database connection names under the given mount.

Signatures:

  • secret.db.listConnections(mount)

Example:

const names = await vault.secret.db.listConnections('database').unwrap();
secret.db.listRoles

List dynamic database role names under the given mount.

Signatures:

  • secret.db.listRoles(mount)

Example:

const roles = await vault.secret.db.listRoles('database').unwrap();
secret.db.listStaticRoles

List static database role names under the given mount.

Signatures:

  • secret.db.listStaticRoles(mount)

Example:

const roles = await vault.secret.db.listStaticRoles('database').unwrap();
secret.db.readConnection

Read the configuration for a named database connection.

Signatures:

  • secret.db.readConnection(mount, name)

Example:

const conn = await vault.secret.db.readConnection('database', 'my-db').unwrap();
secret.db.readRole

Read the configuration of a dynamic database role.

Signatures:

  • secret.db.readRole(mount, name)

Example:

const role = await vault.secret.db.readRole('database', 'my-role').unwrap();
secret.db.readStaticCredentials

Read the current credentials for a static database role.

Signatures:

  • secret.db.readStaticCredentials(mount, role)

Example:

const creds = await vault.secret.db.readStaticCredentials('database', 'my-static-role').unwrap();
secret.db.readStaticRole

Read the configuration of a static database role.

Signatures:

  • secret.db.readStaticRole(mount, name)

Example:

const role = await vault.secret.db.readStaticRole('database', 'my-static-role').unwrap();
secret.db.resetConnection

Close and re-open a database connection, discarding existing connections.

Signatures:

  • secret.db.resetConnection(mount, name)

Example:

await vault.secret.db.resetConnection('database', 'my-db').unwrap();
secret.db.rotateRootCredentials

Rotate the root credentials for a named database connection.

Signatures:

  • secret.db.rotateRootCredentials(mount, name)

Example:

await vault.secret.db.rotateRootCredentials('database', 'my-db').unwrap();
secret.db.rotateStaticCredentials

Trigger an immediate rotation of the credentials for a static database role.

Signatures:

  • secret.db.rotateStaticCredentials(mount, role)

Example:

await vault.secret.db.rotateStaticCredentials('database', 'my-static-role').unwrap();
secret.db.writeRole

Create or update a dynamic database role.

Signatures:

  • secret.db.writeRole(mount, name, options)

Example:

await vault.secret.db.writeRole('database', 'my-role', {
    db_name: 'my-db',
    creation_statements: ['CREATE ROLE "" WITH LOGIN PASSWORD \'\' VALID UNTIL \'\''],
    default_ttl: 3600,
    max_ttl: 86400,
}).unwrap();
secret.db.writeStaticRole

Create or update a static database role.

Signatures:

  • secret.db.writeStaticRole(mount, name, options)

Example:

await vault.secret.db.writeStaticRole('database', 'my-static-role', {
    db_name: 'my-db',
    username: 'existing_db_user',
    rotation_period: 86400,
}).unwrap();
Secrets / KV v1
secret.kv.v1.delete

Delete a KV v1 secret.

Signatures:

  • secret.kv.v1.delete(path)
  • secret.kv.v1.delete(mount, path)

Example:

await vault.secret.kv.v1.delete('secret', 'apps/demo').unwrap();
secret.kv.v1.list

List keys at a KV v1 path.

Signatures:

  • secret.kv.v1.list(path)
  • secret.kv.v1.list(mount, path?)

Example:

const keys = await vault.secret.kv.v1.list('secret', 'apps').unwrap();
secret.kv.v1.read

Read a KV v1 secret and return its nested data object.

Signatures:

  • secret.kv.v1.read<T>(path)
  • secret.kv.v1.read<T>(mount, path)

Example:

const secret = await vault.secret.kv.v1.read<{ foo: string }>('secret', 'apps/demo').unwrap();
secret.kv.v1.write

Write a KV v1 secret.

Signatures:

  • secret.kv.v1.write(path, payload)
  • secret.kv.v1.write(mount, path, payload)

Example:

await vault.secret.kv.v1.write('secret', 'apps/demo', {
    foo: 'bar',
}).unwrap();
Secrets / KV v2
secret.kv.v2.delete

Soft-delete the latest version of a KV v2 secret.

Signatures:

  • secret.kv.v2.delete(mount, path)

Example:

await vault.secret.kv.v2.delete('secret-v2', 'apps/demo').unwrap();
secret.kv.v2.deleteMetadata

Permanently delete all versions and metadata for a KV v2 secret path.

Signatures:

  • secret.kv.v2.deleteMetadata(mount, path)

Example:

await vault.secret.kv.v2.deleteMetadata('secret-v2', 'apps/demo').unwrap();
secret.kv.v2.deleteVersions

Soft-delete specific versions of a KV v2 secret.

Signatures:

  • secret.kv.v2.deleteVersions(mount, path, versions)

Example:

await vault.secret.kv.v2.deleteVersions('secret-v2', 'apps/demo', [1, 2]).unwrap();
secret.kv.v2.destroyVersions

Permanently destroy specific versions of a KV v2 secret.

Signatures:

  • secret.kv.v2.destroyVersions(mount, path, versions)

Example:

await vault.secret.kv.v2.destroyVersions('secret-v2', 'apps/demo', [1]).unwrap();
secret.kv.v2.list

List keys from KV v2 metadata.

Signatures:

  • secret.kv.v2.list(mount, path?)

Example:

const keys = await vault.secret.kv.v2.list('secret-v2', 'apps').unwrap();
secret.kv.v2.patch

Patch (partially update) a KV v2 secret using JSON Merge Patch semantics.

Signatures:

  • secret.kv.v2.patch(mount, path, payload, options?)

Example:

await vault.secret.kv.v2.patch('secret-v2', 'apps/demo', { foo: 'updated' }).unwrap();
secret.kv.v2.patchMetadata

Partially update metadata for a KV v2 secret path.

Signatures:

  • secret.kv.v2.patchMetadata(mount, path, options)

Example:

await vault.secret.kv.v2.patchMetadata('secret-v2', 'apps/demo', { max_versions: 10 }).unwrap();
secret.kv.v2.read

Read a KV v2 secret with data and version metadata.

Signatures:

  • secret.kv.v2.read<T>(mount, path, options?)

Example:

const secret = await vault.secret.kv.v2.read<{ foo: string }>('secret-v2', 'apps/demo').unwrap();
secret.kv.v2.readConfig

Read the backend-level configuration for a KV v2 mount.

Signatures:

  • secret.kv.v2.readConfig(mount)

Example:

const config = await vault.secret.kv.v2.readConfig('secret-v2').unwrap();
secret.kv.v2.readMetadata

Read all metadata and versions for a KV v2 secret.

Signatures:

  • secret.kv.v2.readMetadata(mount, path)

Example:

const meta = await vault.secret.kv.v2.readMetadata('secret-v2', 'apps/demo').unwrap();
secret.kv.v2.readSubkeys

Read the key structure of a KV v2 secret without returning values.

Signatures:

  • secret.kv.v2.readSubkeys(mount, path, options?)

Example:

const subkeys = await vault.secret.kv.v2.readSubkeys('secret-v2', 'apps/demo').unwrap();
secret.kv.v2.undeleteVersions

Restore (undelete) previously soft-deleted versions of a KV v2 secret.

Signatures:

  • secret.kv.v2.undeleteVersions(mount, path, versions)

Example:

await vault.secret.kv.v2.undeleteVersions('secret-v2', 'apps/demo', [1]).unwrap();
secret.kv.v2.write

Write a KV v2 secret, optionally using check-and-set.

Signatures:

  • secret.kv.v2.write(mount, path, payload, options?)

Example:

await vault.secret.kv.v2.write('secret-v2', 'apps/demo', {
    foo: 'bar',
}, {
    cas: 1,
}).unwrap();
secret.kv.v2.writeConfig

Update the backend-level configuration for a KV v2 mount.

Signatures:

  • secret.kv.v2.writeConfig(mount, options)

Example:

await vault.secret.kv.v2.writeConfig('secret-v2', { max_versions: 10 }).unwrap();
secret.kv.v2.writeMetadata

Create or update metadata for a KV v2 secret path.

Signatures:

  • secret.kv.v2.writeMetadata(mount, path, options)

Example:

await vault.secret.kv.v2.writeMetadata('secret-v2', 'apps/demo', { max_versions: 5 }).unwrap();
System / Mounts
sys.mount.disable

Disable the secrets engine mounted at the given path.

Signatures:

  • sys.mount.disable(path)

Example:

await vault.sys.mount.disable('secret').unwrap();
sys.mount.enable

Enable a secrets engine at the given mount path.

Signatures:

  • sys.mount.enable(path, payload)

Example:

await vault.sys.mount.enable('secret', {
    type: 'kv',
}).unwrap();
System / Operator
sys.init

Initialize Vault and set the returned root token on the client.

Signatures:

  • sys.init(payload)
sys.unseal

Submit an unseal key to unseal Vault.

Signatures:

  • sys.unseal(payload)
System / Policies / ACL
sys.policies.acl.delete

Delete an ACL policy.

Signatures:

  • sys.policies.acl.delete(name)

Example:

await vault.sys.policies.acl.delete('deploy').unwrap();
sys.policies.acl.list

List configured ACL policies.

Signatures:

  • sys.policies.acl.list()

Example:

const policies = await vault.sys.policies.acl.list().unwrap();
sys.policies.acl.read

Read an ACL policy by name.

Signatures:

  • sys.policies.acl.read(name)

Example:

const policy = await vault.sys.policies.acl.read('deploy').unwrap();
sys.policies.acl.write

Create or update an ACL policy.

Signatures:

  • sys.policies.acl.write(name, payload)

Example:

await vault.sys.policies.acl.write('deploy', {
    policy: 'path "secret/*" { capabilities = ["read"] }',
}).unwrap();
System / Policies / EGP
sys.policies.egp.delete

Delete an endpoint governing policy.

Signatures:

  • sys.policies.egp.delete(name)

Example:

await vault.sys.policies.egp.delete('breakglass').unwrap();
sys.policies.egp.list

List configured endpoint governing policies.

Signatures:

  • sys.policies.egp.list()

Example:

const policies = await vault.sys.policies.egp.list().unwrap();
sys.policies.egp.read

Read an endpoint governing policy by name.

Signatures:

  • sys.policies.egp.read(name)

Example:

const policy = await vault.sys.policies.egp.read('breakglass').unwrap();
sys.policies.egp.write

Create or update an endpoint governing policy.

Signatures:

  • sys.policies.egp.write(name, payload)

Example:

await vault.sys.policies.egp.write('breakglass', {
    enforcement_level: 'soft-mandatory',
    paths: ['*'],
    policy: 'rule main = { true }',
}).unwrap();
System / Policies / Password
sys.policies.password.delete

Delete a password policy.

Signatures:

  • sys.policies.password.delete(name)

Example:

await vault.sys.policies.password.delete('app').unwrap();
sys.policies.password.generate

Generate a password from an existing password policy.

Signatures:

  • sys.policies.password.generate(name)

Example:

const { password } = await vault.sys.policies.password.generate('app').unwrap();
sys.policies.password.list

List configured password policies.

Signatures:

  • sys.policies.password.list()

Example:

const policies = await vault.sys.policies.password.list().unwrap();
sys.policies.password.read

Read a password policy by name.

Signatures:

  • sys.policies.password.read(name)

Example:

const policy = await vault.sys.policies.password.read('app').unwrap();
sys.policies.password.write

Create or update a password policy.

Signatures:

  • sys.policies.password.write(name, payload)

Example:

await vault.sys.policies.password.write('app', {
    policy: 'length = 20',
}).unwrap();
System / Policies / RGP
sys.policies.rgp.delete

Delete a response governing policy.

Signatures:

  • sys.policies.rgp.delete(name)

Example:

await vault.sys.policies.rgp.delete('webapp').unwrap();
sys.policies.rgp.list

List configured response governing policies.

Signatures:

  • sys.policies.rgp.list()

Example:

const policies = await vault.sys.policies.rgp.list().unwrap();
sys.policies.rgp.read

Read a response governing policy by name.

Signatures:

  • sys.policies.rgp.read(name)

Example:

const policy = await vault.sys.policies.rgp.read('webapp').unwrap();
sys.policies.rgp.write

Create or update a response governing policy.

Signatures:

  • sys.policies.rgp.write(name, payload)

Example:

await vault.sys.policies.rgp.write('webapp', {
    enforcement_level: 'soft-mandatory',
    policy: 'rule main = { true }',
}).unwrap();
System / Policies / Rotation
sys.policies.rotation.delete

Delete a rotation retry policy.

Signatures:

  • sys.policies.rotation.delete(name)

Example:

await vault.sys.policies.rotation.delete('retry').unwrap();
sys.policies.rotation.read

Read a rotation retry policy by name.

Signatures:

  • sys.policies.rotation.read(name)

Example:

const policy = await vault.sys.policies.rotation.read('retry').unwrap();
sys.policies.rotation.write

Create or update a rotation retry policy.

Signatures:

  • sys.policies.rotation.write(name, payload)

Example:

await vault.sys.policies.rotation.write('retry', {
    policy: '{"max_retries":3}',
}).unwrap();
System / Wrapping
sys.wrapping.lookup

Look up wrapping properties for a given response-wrapped token.

Signatures:

  • sys.wrapping.lookup(token)

Example:

const info = await vault.sys.wrapping.lookup(wrappingToken).unwrap();
sys.wrapping.rewrap

Rotate a response-wrapped token, returning a new wrapping token for the same data.

Signatures:

  • sys.wrapping.rewrap(token)

Example:

const result = await vault.sys.wrapping.rewrap(oldWrappingToken).unwrap();
const newToken = result.wrap_info?.token;
sys.wrapping.unwrap

Unwrap a response-wrapped token and return the original data.

Signatures:

  • sys.wrapping.unwrap(token)

Example:

const result = await vault.sys.wrapping.unwrap(wrappingToken).unwrap();
const roleId = result.data?.role_id;
sys.wrapping.wrap

Response-wrap an arbitrary JSON object with the given TTL.

Signatures:

  • sys.wrapping.wrap(data, ttl)

Example:

const result = await vault.sys.wrapping.wrap({ role_id: '...', secret_id: '...' }, '300s').unwrap();
const token = result.wrap_info?.token;
System
sys.isInitialized

Check whether the Vault server has been initialized.

Signatures:

  • sys.isInitialized()

Example:

const initialized = await vault.sys.isInitialized().unwrap();
sys.isReady

Check whether Vault is reachable and ready.

Signatures:

  • sys.isReady()

Example:

const ready = await vault.sys.isReady().unwrap();
sys.sealStatus

Read Vault seal status.

Signatures:

  • sys.sealStatus()

Example:

const status = await vault.sys.sealStatus().unwrap();
sys.status

Read Vault health status.

Signatures:

  • sys.status()

Example:

const status = await vault.sys.status().unwrap();

Behavior Notes

  • secret.kv.v1.read() currently returns the nested data object from Vault’s secret read response.
  • sys.mount.enable() normalizes leading slashes in mount paths.
  • secret.kv.v1.list() supports both full paths and split mount / path arguments.
  • secret.kv.v2 is the dedicated helper for KV secrets engine version 2 route and payload semantics.

KV v1 Example

await vault.secret.kv.v1.write('secret', 'apps/demo', {
  foo: 'bar',
}).unwrap();

const secret = await vault.secret.kv.v1.read<{ foo: string }>('secret', 'apps/demo').unwrap();
const keys = await vault.secret.kv.v1.list('secret', 'apps').unwrap();

console.log(secret.foo);
console.log(keys);

KV v2 Example

await vault.sys.mount.enable('secret-v2', {
  type: 'kv',
  options: {
    version: '2',
  },
}).unwrap();

await vault.secret.kv.v2.write('secret-v2', 'apps/demo', {foo: 'bar'}, {cas: 1}).unwrap();
const secret = await vault.secret.kv.v2.read<{ foo: string }>('secret-v2', 'apps/demo').unwrap();
const keys = await vault.secret.kv.v2.list('secret-v2', 'apps').unwrap();

console.log(secret.data.foo);
console.log(secret.metadata.version);
console.log(keys);

RawVaultClient

Use RawVaultClient when you want lower-level control over HTTP method, path templating, headers, query parameters, and request bodies.

Methods

  • request(method, path, config)
  • get(path, config)
  • list(path, config)
  • post(path, config)
  • put(path, config)
  • delete(path, config)

Typed overloads

For supported generated OpenAPI paths, methods have typed overloads that infer:

  • the allowed path
  • request body shape
  • query/path params
  • success response type

For unknown or custom paths, the raw client falls back to a generic overload that accepts any string path.

Example

const raw = new RawVaultClient({
  clusterAddress: 'http://vault.local:8200',
  authToken: process.env.NANVC_VAULT_AUTH_TOKEN ?? null,
});

const data = await raw.get('/sys/seal-status').unwrap();

console.log(data.sealed);

Path templating

RawVaultClient resolves template placeholders using params.path.

Example:

await raw.post('/sys/mounts/{path}', {
  body: { type: 'kv' },
  params: {
    path: {
      path: 'secret',
    },
  },
});

If a required path parameter is missing, the client throws a VaultClientError with code VALIDATION_ERROR.

Error Type

V2 uses a structured VaultClientError with fields such as:

  • code
  • message
  • status
  • responseBody
  • details
  • cause

See Error Handling for more detail.