/sys/unseal
The /sys/unseal
endpoint is used to unseal the Vault.
Submit unseal key
This endpoint is used to enter a single root key share to progress the unsealing of the Vault. If the threshold number of root key shares is reached, Vault will attempt to unseal the Vault. Otherwise, this API must be called multiple times until that threshold is met.
Either the key
or reset
parameter must be provided; if both are provided, reset
takes precedence.
Method | Path |
---|---|
|
|
Parameters
key
(string: "")
– Specifies a single root key share. This is required unlessreset
is true.reset
(bool: false)
– Specifies if previously-provided unseal keys are discarded and the unseal process is reset.migrate
(bool: false)
- Available in 1.0 - Used to migrate the seal from shamir to autoseal or autoseal to shamir. Must be provided on all unseal key calls.
Sample payload
Sample request
Sample response
The "t" parameter is the threshold, and "n" is the number of shares.
Sample response when Vault is unsealed.
Last updated