Vault API

• router → prefix /api/resource/Secret (tags: Secret)
• method_router → prefix /api/method (tags: Vault Methods)

Hand-maintained notes against modules/vault/router.go. Route inventory (generated): routes.md. Response models (generated): response-models/vault.md.

Method	Path	Permission
GET	/api/resource/Secret	—
POST	/api/resource/Secret	—
DELETE	/api/resource/Secret/{key:path}	—
GET	/api/resource/Secret/{key:path}	—
PUT	/api/resource/Secret/{key:path}	—

• source: modules/vault/router.go

• source: modules/vault/router.go

• source: modules/vault/router.go

• source: modules/vault/router.go

• source: modules/vault/router.go

Method	Path	Permission
GET	/api/method/shc.vault.exists	—
GET	/api/method/shc.vault.status	—
POST	/api/method/shc.vault.unlock	—
POST	/api/method/shc.vault.rotate	—
POST	/api/method/shc.vault.migrate	—
POST	/api/method/shc.vault.export	—
POST	/api/method/shc.vault.import	—

• source: modules/vault/router.go

• source: modules/vault/router.go

• source: modules/vault/router.go

• summary: rotate the vault key-encryption key (KEK) and re-wrap stored secrets.
• source: modules/vault/router.go

• summary: migrate secrets to a different vault provider backend.
• source: modules/vault/router.go

• summary: export secrets (scoped) for backup / transfer.
• source: modules/vault/router.go

• summary: import a previously exported secret bundle.
• source: modules/vault/router.go

Peer / bootstrap routes on the internal listener (not the public API):

Method	Path
POST	/internal/vault/unlock
POST	/internal/vault/rekey