Read versioned key/value data
Read versioned data from an existing data path in the kv
v2 plugin.
Assumptions
- You have set up a
kv
v2 plugin. - Your authentication token has
read
permissions for thekv
v2 plugin.
Use vault kv get
to read all the current
key/value pairs on the given path:
$ vault kv get \ -mount <mount_path> \ <secret_path>
$ vault kv get \
-mount <mount_path> \
<secret_path>
For example:
$ vault kv get -mount shared dev/square-api ======= Secret Path ======= shared/data/dev/square-api ======= Metadata ======= Key Value --- ----- created_time 2024-11-13T21:58:32.128442898Z custom_metadata <nil> deletion_time n/a destroyed false version 3 ===== Data ===== Key Value --- ----- prod 5678 sandbox 1234
$ vault kv get -mount shared dev/square-api
======= Secret Path =======
shared/data/dev/square-api
======= Metadata =======
Key Value
--- -----
created_time 2024-11-13T21:58:32.128442898Z
custom_metadata <nil>
deletion_time n/a
destroyed false
version 3
===== Data =====
Key Value
--- -----
prod 5678
sandbox 1234
Use the -field
flag to target specific key value pairs on the given path:
$ vault kv get \ -mount <mount_path> \ -field <field_name> \ <secret_path>
$ vault kv get \
-mount <mount_path> \
-field <field_name> \
<secret_path>
For example:
$ vault kv get -mount shared -field prod dev/square-api 5678
$ vault kv get -mount shared -field prod dev/square-api
5678
Open the Overview screen for your secret path:
Open the GUI for your Vault instance.
Login under the namespace for the plugin or select the namespace from the selector at the bottom of the left-hand menu and re-authenticate.
Select Secrets Engines from the left-hand menu.
Select the mount path for your
kv
plugin.Click through the path segments to select the relevant secret path.
- Select the Secret tab.
- Click the eye icon to view the desired key value.
Call the /{plugin_mount_path}/data/{secret_path}
endpoint to read all the key/value pairs at the secret path:
$ curl \ --request GET \ --header "X-Vault-Token: ${VAULT_TOKEN}" \ ${VAULT_ADDR}/v1/<plugin_mount_path>/data/<secret_path>
$ curl \
--request GET \
--header "X-Vault-Token: ${VAULT_TOKEN}" \
${VAULT_ADDR}/v1/<plugin_mount_path>/data/<secret_path>
For example:
$ curl \ --request GET \ --header "X-Vault-Token: ${VAULT_TOKEN}" \ ${VAULT_ADDR}/v1/shared/data/dev/square-api | jq { "request_id": "992da4a2-f2d1-5786-ea53-1e8ea6440a7c", "lease_id": "", "renewable": false, "lease_duration": 0, "data": { "data": { "prod": "5679", "sandbox": "1234", "smoke": "abcd" }, "metadata": { "created_time": "2024-11-15T02:41:02.556301319Z", "custom_metadata": null, "deletion_time": "", "destroyed": false, "version": 7 } }, "wrap_info": null, "warnings": null, "auth": null, "mount_type": "kv" }
$ curl \
--request GET \
--header "X-Vault-Token: ${VAULT_TOKEN}" \
${VAULT_ADDR}/v1/shared/data/dev/square-api | jq
{
"request_id": "992da4a2-f2d1-5786-ea53-1e8ea6440a7c",
"lease_id": "",
"renewable": false,
"lease_duration": 0,
"data": {
"data": {
"prod": "5679",
"sandbox": "1234",
"smoke": "abcd"
},
"metadata": {
"created_time": "2024-11-15T02:41:02.556301319Z",
"custom_metadata": null,
"deletion_time": "",
"destroyed": false,
"version": 7
}
},
"wrap_info": null,
"warnings": null,
"auth": null,
"mount_type": "kv"
}