Browse docs+

Update Vault

Updates vault metadata such as the vault name, discoverability, or data classification.

PATCH /api/v1/machine/vault/:id/update

Important

This write path uses the platform vault update contract and no longer accepts directoryCheckpoint or summaryCheckpoint fields.
The vault name, discoverable, and dataClassification fields are metadata. They are not end-to-end encrypted.
Field edits happen through PATCH /api/v1/machine/vault-item/:id/update.

Headers

Header	Type	Required	Description
`X-API-Key`	string	Yes	Your machine API key
`Content-Type`	string	Yes	Must be `application/json`

Path Parameters

Parameter	Type	Required	Description
`id`	string	Yes	The unique identifier of the vault to update

Request Body

Field	Type	Required	Description
`name`	string	No	Optional new vault name, max 255 characters
`discoverable`	boolean	No	Whether the vault can appear in discovery/request-access flows
`dataClassification`	string \| null	No	Optional classification: `PUBLIC`, `INTERNAL`, `CONFIDENTIAL`, or `CUI`

Response

Success (200 OK)

No response body is returned on success.

Notes

This endpoint requires machine.vault.write plus ADMIN access to the target vault.
The backend updates vault timestamps so sync clients can observe metadata changes.

Example Request

curl -X PATCH "https://r4.dev/api/v1/machine/vault/507f1f77bcf86cd799439011/update" \
  -H "X-API-Key: rk_abc123def456.ghijklmnopqrstuvwxyz" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Production Secrets",
    "discoverable": true,
    "dataClassification": "CONFIDENTIAL"
  }'