> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pinkfish.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# vault

> Encrypted secrets storage and management

**Server path:** `/vault` | **Type:** Embedded | **PCID required:** No

## Tools

| Tool                                                  | Description                                                                                                                                                                                                                                                                                                                                     |
| ----------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| [`vault_list_collections`](#vault_list_collections)   | List all available vault collections                                                                                                                                                                                                                                                                                                            |
| [`vault_create_collection`](#vault_create_collection) | Create a new vault collection for storing encrypted secrets. Returns \{ id, name, type } - use the "id" field as collectionId for subsequent operations like creating secrets.                                                                                                                                                                  |
| [`vault_list_items`](#vault_list_items)               | List secrets from a vault collection with optional filtering and decryption. Returns array of secrets with secretId, key, content (encrypted unless decryptSecrets=true), metadata, secretType, and timestamps. Use secretId from response for vault\_get\_item/vault\_update\_item/vault\_delete\_item.                                        |
| [`vault_get_item`](#vault_get_item)                   | Retrieve a specific secret from a vault collection by its ID. IMPORTANT: Use the secretId from vault\_create\_item response (field name is "docId" in create response, but use that value as "secretId" parameter here). Response includes secretId, key, content (encrypted unless decryptSecrets=true), metadata, secretType, and timestamps. |
| [`vault_create_item`](#vault_create_item)             | Create a new secret in a vault collection with optional metadata and type. Response includes "docId" (use this as "secretId" for vault\_get\_item/vault\_update\_item/vault\_delete\_item), "key", "message", and collection info. IMPORTANT: Save the "docId" from response to use in subsequent operations.                                   |
| [`vault_update_item`](#vault_update_item)             | Update an existing secret in a vault collection with new content and metadata. Use secretId from vault\_create\_item response ("docId" field) or vault\_list\_items. Only provided fields are updated; others remain unchanged.                                                                                                                 |
| [`vault_delete_item`](#vault_delete_item)             | Delete a secret from a vault collection by ID or key. Dependency: datacollection\_list\_collections                                                                                                                                                                                                                                             |

***

## vault\_list\_collections

List all available vault collections

**Parameters:** None

<Expandable title="inputSchema">
  ```json theme={null}
  {
    "type": "object",
    "properties": {}
  }
  ```
</Expandable>

***

## vault\_create\_collection

Create a new vault collection for storing encrypted secrets. Returns \{ id, name, type } - use the "id" field as collectionId for subsequent operations like creating secrets.

**Parameters:**

| Parameter       | Type   | Required | Default | Description                                                                       |
| --------------- | ------ | -------- | ------- | --------------------------------------------------------------------------------- |
| `name`          | string | Yes      | —       | Display name for the vault collection                                             |
| `description`   | string | No       | —       | Optional description of the collection purpose                                    |
| `createdBy`     | string | Yes      | —       | User ID creating the collection - use the current user ID or a service identifier |
| `createdByName` | string | Yes      | —       | Display name shown as creator - use the current user name or service name         |

<Expandable title="inputSchema">
  ```json theme={null}
  {
    "type": "object",
    "properties": {
      "name": {
        "type": "string",
        "description": "Display name for the vault collection"
      },
      "description": {
        "type": "string",
        "description": "Optional description of the collection purpose"
      },
      "createdBy": {
        "type": "string",
        "description": "User ID creating the collection - use the current user ID or a service identifier"
      },
      "createdByName": {
        "type": "string",
        "description": "Display name shown as creator - use the current user name or service name"
      }
    },
    "required": [
      "name",
      "createdBy",
      "createdByName"
    ]
  }
  ```
</Expandable>

***

## vault\_list\_items

List secrets from a vault collection with optional filtering and decryption. Returns array of secrets with secretId, key, content (encrypted unless decryptSecrets=true), metadata, secretType, and timestamps. Use secretId from response for vault\_get\_item/vault\_update\_item/vault\_delete\_item.

**Parameters:**

| Parameter        | Type    | Required | Default            | Description                                                                                                                                                      |
| ---------------- | ------- | -------- | ------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `collectionId`   | string  | Yes      | —                  | Collection ID (not name) to list secrets from - e.g. "KCny7nGXpBzWNYpJzC0b". Get from vault\_list\_collections.                                                  |
| `limit`          | number  | No       | `50`               | Maximum number of secrets to return (default: 50, max: 1000)                                                                                                     |
| `orderedBy`      | string  | No       | `"createdAt:desc"` | Field and direction to order by. Format: "field:direction". Options: "createdAt:desc", "createdAt:asc", "updatedAt:desc", "updatedAt:asc", "key:asc", "key:desc" |
| `decryptSecrets` | boolean | No       | `false`            | Whether to decrypt secret content. Set to true to get readable content. Response includes decrypted "content" field when true.                                   |

<Expandable title="inputSchema">
  ```json theme={null}
  {
    "type": "object",
    "properties": {
      "collectionId": {
        "type": "string",
        "description": "Collection ID (not name) to list secrets from - e.g. \"KCny7nGXpBzWNYpJzC0b\". Get from vault_list_collections."
      },
      "limit": {
        "type": "number",
        "default": 50,
        "description": "Maximum number of secrets to return (default: 50, max: 1000)"
      },
      "orderedBy": {
        "type": "string",
        "default": "createdAt:desc",
        "description": "Field and direction to order by. Format: \"field:direction\". Options: \"createdAt:desc\", \"createdAt:asc\", \"updatedAt:desc\", \"updatedAt:asc\", \"key:asc\", \"key:desc\""
      },
      "decryptSecrets": {
        "type": "boolean",
        "default": false,
        "description": "Whether to decrypt secret content. Set to true to get readable content. Response includes decrypted \"content\" field when true."
      }
    },
    "required": [
      "collectionId"
    ]
  }
  ```
</Expandable>

***

## vault\_get\_item

Retrieve a specific secret from a vault collection by its ID. IMPORTANT: Use the secretId from vault\_create\_item response (field name is "docId" in create response, but use that value as "secretId" parameter here). Response includes secretId, key, content (encrypted unless decryptSecrets=true), metadata, secretType, and timestamps.

**Parameters:**

| Parameter        | Type    | Required | Default | Description                                                                                                                                                           |
| ---------------- | ------- | -------- | ------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `collectionId`   | string  | Yes      | —       | Collection ID (not name) the secret belongs to - e.g. "KCny7nGXpBzWNYpJzC0b". Get from vault\_list\_collections.                                                      |
| `secretId`       | string  | Yes      | —       | Secret ID to retrieve. When creating a secret, the response contains "docId" - use that value here as "secretId". Also available from vault\_list\_items.             |
| `decryptSecrets` | boolean | No       | `false` | Whether to decrypt the secret content. Set to true to get readable content. Response structure: \{"secretId": "...", "key": "...", "content": "decrypted-value", ...} |

<Expandable title="inputSchema">
  ```json theme={null}
  {
    "type": "object",
    "properties": {
      "collectionId": {
        "type": "string",
        "description": "Collection ID (not name) the secret belongs to - e.g. \"KCny7nGXpBzWNYpJzC0b\". Get from vault_list_collections."
      },
      "secretId": {
        "type": "string",
        "description": "Secret ID to retrieve. When creating a secret, the response contains \"docId\" - use that value here as \"secretId\". Also available from vault_list_items."
      },
      "decryptSecrets": {
        "type": "boolean",
        "default": false,
        "description": "Whether to decrypt the secret content. Set to true to get readable content. Response structure: {\"secretId\": \"...\", \"key\": \"...\", \"content\": \"decrypted-value\", ...}"
      }
    },
    "required": [
      "collectionId",
      "secretId"
    ]
  }
  ```
</Expandable>

***

## vault\_create\_item

Create a new secret in a vault collection with optional metadata and type. Response includes "docId" (use this as "secretId" for vault\_get\_item/vault\_update\_item/vault\_delete\_item), "key", "message", and collection info. IMPORTANT: Save the "docId" from response to use in subsequent operations.

**Parameters:**

| Parameter        | Type    | Required | Default   | Description                                                                                                     |
| ---------------- | ------- | -------- | --------- | --------------------------------------------------------------------------------------------------------------- |
| `collectionId`   | string  | Yes      | —         | Collection ID (not name) to add the secret to - e.g. "KCny7nGXpBzWNYpJzC0b". Get from vault\_list\_collections. |
| `key`            | string  | Yes      | —         | Unique key identifier for the secret within the collection (required)                                           |
| `content`        | string  | Yes      | —         | Content of the secret to store (string or object). Will be encrypted automatically.                             |
| `metadata`       | object  | No       | —         | Optional metadata object for categorization (e.g. \{"category": "api-keys", "environment": "production"})       |
| `secretType`     | string  | No       | `"login"` | Type of secret: "login" (default), "api-key", "password", "token", etc.                                         |
| `sortField`      | string  | No       | —         | Optional sort field for organizing secrets                                                                      |
| `triggerChanges` | boolean | No       | `true`    | Whether to trigger webhooks on change                                                                           |

<Expandable title="inputSchema">
  ```json theme={null}
  {
    "type": "object",
    "properties": {
      "collectionId": {
        "type": "string",
        "description": "Collection ID (not name) to add the secret to - e.g. \"KCny7nGXpBzWNYpJzC0b\". Get from vault_list_collections."
      },
      "key": {
        "type": "string",
        "description": "Unique key identifier for the secret within the collection (required)"
      },
      "content": {
        "oneOf": [
          {
            "type": "string"
          },
          {
            "type": "object",
            "properties": {}
          }
        ],
        "description": "Content of the secret to store (string or object). Will be encrypted automatically."
      },
      "metadata": {
        "type": "object",
        "properties": {},
        "description": "Optional metadata object for categorization (e.g. {\"category\": \"api-keys\", \"environment\": \"production\"})"
      },
      "secretType": {
        "type": "string",
        "default": "login",
        "description": "Type of secret: \"login\" (default), \"api-key\", \"password\", \"token\", etc."
      },
      "sortField": {
        "type": "string",
        "description": "Optional sort field for organizing secrets"
      },
      "triggerChanges": {
        "type": "boolean",
        "default": true,
        "description": "Whether to trigger webhooks on change"
      }
    },
    "required": [
      "collectionId",
      "key",
      "content"
    ]
  }
  ```
</Expandable>

***

## vault\_update\_item

Update an existing secret in a vault collection with new content and metadata. Use secretId from vault\_create\_item response ("docId" field) or vault\_list\_items. Only provided fields are updated; others remain unchanged.

**Parameters:**

| Parameter        | Type    | Required | Default | Description                                                                                                                          |
| ---------------- | ------- | -------- | ------- | ------------------------------------------------------------------------------------------------------------------------------------ |
| `collectionId`   | string  | Yes      | —       | Collection ID (not name) the secret belongs to - e.g. "KCny7nGXpBzWNYpJzC0b"                                                         |
| `secretId`       | string  | Yes      | —       | Secret ID to update. From vault\_create\_item response, use the "docId" value. Also available from vault\_list\_items as "secretId". |
| `content`        | string  | Yes      | —       | Updated content of the secret (string or object). Will be re-encrypted automatically.                                                |
| `metadata`       | object  | No       | —       | Optional updated metadata object. Only provided fields are updated; existing metadata is preserved unless explicitly changed.        |
| `triggerChanges` | boolean | No       | `true`  | Whether to trigger webhooks on change                                                                                                |

<Expandable title="inputSchema">
  ```json theme={null}
  {
    "type": "object",
    "properties": {
      "collectionId": {
        "type": "string",
        "description": "Collection ID (not name) the secret belongs to - e.g. \"KCny7nGXpBzWNYpJzC0b\""
      },
      "secretId": {
        "type": "string",
        "description": "Secret ID to update. From vault_create_item response, use the \"docId\" value. Also available from vault_list_items as \"secretId\"."
      },
      "content": {
        "oneOf": [
          {
            "type": "string"
          },
          {
            "type": "object",
            "properties": {}
          }
        ],
        "description": "Updated content of the secret (string or object). Will be re-encrypted automatically."
      },
      "metadata": {
        "type": "object",
        "properties": {},
        "description": "Optional updated metadata object. Only provided fields are updated; existing metadata is preserved unless explicitly changed."
      },
      "triggerChanges": {
        "type": "boolean",
        "default": true,
        "description": "Whether to trigger webhooks on change"
      }
    },
    "required": [
      "collectionId",
      "secretId",
      "content"
    ]
  }
  ```
</Expandable>

***

## vault\_delete\_item

Delete a secret from a vault collection by ID or key. Dependency: datacollection\_list\_collections

**Parameters:**

| Parameter      | Type   | Required | Default | Description                         |
| -------------- | ------ | -------- | ------- | ----------------------------------- |
| `collectionId` | string | Yes      | —       | Collection ID the secret belongs to |
| `secretId`     | string | No       | —       | Secret ID to delete                 |
| `key`          | string | No       | —       | Secret key to delete                |
| `sortField`    | string | No       | —       | Sort field of the secret to delete  |

<Expandable title="inputSchema">
  ```json theme={null}
  {
    "type": "object",
    "properties": {
      "collectionId": {
        "type": "string",
        "description": "Collection ID the secret belongs to"
      },
      "secretId": {
        "type": "string",
        "description": "Secret ID to delete"
      },
      "key": {
        "type": "string",
        "description": "Secret key to delete"
      },
      "sortField": {
        "type": "string",
        "description": "Sort field of the secret to delete"
      }
    },
    "required": [
      "collectionId"
    ]
  }
  ```
</Expandable>