Browse docs+

Move Vault Item

Moves a vault item into a different vault.

PATCH /api/v1/machine/vault-item/:id/move

Important

This write path no longer requires item detail or vault summary checkpoints.
The target vault is provided as vaultId.
When the source and target vaults use different DEKs, send reEncryptedFieldValues so stored field values can be rewritten under the target vault's encryption context.
The moved item's name, field labels, and websites remain metadata, so they are not end-to-end encrypted.

Headers

Header	Type	Required	Description
`X-API-Key`	string	Yes	Your machine API key
`Content-Type`	string	Yes	Must be `application/json`

Path Parameters

Parameter	Type	Required	Description
`id`	string	Yes	The unique identifier of the vault item to move

Request Body

Field	Type	Required	Description
`vaultId`	string	Yes	Target vault ID
`reEncryptedFieldValues`	array	No	Field values re-encrypted for the target vault DEK

Re-Encrypted Field Value Object

Field	Type	Required	Description
`fieldInstanceId`	string	Yes	Field-instance ID being rewritten for the move
`value`	string	Yes	Client-encrypted value for the target vault DEK

Response

Success (200 OK)

No response body is returned on success.

Notes

This endpoint requires machine.vault.write plus ADMIN access to the target vault item.
Use this route when you need to change the parent vault. Use PATCH /api/v1/machine/vault-item/:id/update for field edits that keep the item in the same vault.

Example Request

curl -X PATCH "https://r4.dev/api/v1/machine/vault-item/507f1f77bcf86cd799439021/move" \
  -H "X-API-Key: rk_abc123def456.ghijklmnopqrstuvwxyz" \
  -H "Content-Type: application/json" \
  -d '{
    "vaultId": "507f1f77bcf86cd799439012",
    "reEncryptedFieldValues": [
      {
        "fieldInstanceId": "507f1f77bcf86cd799439061",
        "value": "{\"v\":3,\"iv\":\"...\",\"t\":\"...\",\"d\":\"...\"}"
      }
    ]
  }'