Vault-compatible API

Tools written for HashiCorp Vault can read Monopam secrets without changes: the vault CLI, External Secrets Operator's vault provider, ArgoCD Vault Plugin, Terraform's vault provider and the Jenkins Vault plugin.

Applies to	Who can do this
Monopam v2026.10	Administrators turn it on. Pipelines and clusters use it with a machine identity.

Turn it on

Open System → Secrets API and turn on the Vault-compatible API. It is off by default; while it is off, every /v1 path answers 404.

How paths map

Vault	Monopam
Mount	Project
First path segment	Environment
Rest of the path	Folder
Fields of a secret	Keys of the folder

Example: vault kv get -mount=payments prod/db returns the keys of folder db in environment prod of project payments.

Logins

Vault login	Monopam identity
`auth/approle/login`	Universal Auth: `role_id` is the client ID, `secret_id` the client secret.
`auth/kubernetes/login`	Kubernetes identity: `role` is the identity name.
`auth/jwt/login`	OIDC identity: `role` is the identity name.

Set VAULT_ADDR to the Monopam address. Grants, allowed IP ranges and audit apply exactly as for the machine API.

This is a read-only KV v2 subset. Writes, version selection, policies, PKI and database engines are not available, and PAM vault items are not reachable through it.

Identities and the CLI
Projects and environments