vhsm unwrap
Learn to unwarp a wrapped secret from vHSM using a wrapping token.
The unwrap command is used to unwrap a wrapped secret from vHSM using a wrapping token. This operation is functionally equivalent to a vhsm read on the original secret. It is commonly used for secure transmission of sensitive information, such as credentials or temporary tokens.
If no token is provided, the unwrap operation will attempt to unwrap the secret associated with the currently authenticated token.
Usage
TOKEN: (Optional) The wrapping token to unwrap. If omitted, the current authentication token is used.
Examples
Unwrap a wrapped secret using a specific token:
Unwrap the secret associated with the currently authenticated token:
HTTP Options
-address=<string>
Address of the vHSM server. Default: https://127.0.0.1:8200. Can also be set via VAULT_ADDR.
-agent-address=<string>
Address of the Agent. Also configurable via VAULT_AGENT_ADDR.
-ca-cert=<string>
Path to a PEM-encoded CA certificate file to verify the vHSM server's certificate. Overrides -ca-path. Also configurable via VAULT_CACERT.
-ca-path=<string>
Path to a directory of PEM-encoded CA certificates. Also configurable via VAULT_CAPATH.
-client-cert=<string>
Path to a client certificate for TLS authentication. Requires -client-key. Also settable via VAULT_CLIENT_CERT.
-client-key=<string>
Path to the private key matching the -client-cert. Also settable via VAULT_CLIENT_KEY.
-disable-redirects
Prevents following HTTP redirects. Default is false. Also configurable via VAULT_DISABLE_REDIRECTS.
-header=<key=value>
Additional HTTP headers (cannot start with X-Vault-). Can be specified multiple times.
-mfa=<string>
Multi-Factor Authentication credentials. Also settable via VAULT_MFA.
-namespace=<string>
Namespace to use. Shortcut: -ns. Also settable via VAULT_NAMESPACE.
-non-interactive
Disables interactive prompts. Useful for automation. Default is false.
-output-curl-string
Prints an equivalent curl command instead of executing.
-output-policy
Prints an example HCL policy required for this command.
-policy-override
Overrides soft-mandatory Sentinel policies.
-tls-server-name=<string>
Sets the SNI host for TLS. Also settable via VAULT_TLS_SERVER_NAME.
-tls-skip-verify
Skips TLS certificate verification. Not recommended. Also settable via VAULT_SKIP_VERIFY.
-unlock-key=<string>
Key used to unlock a namespace API lock.
-wrap-ttl=<duration>
Wraps the response in a cubbyhole token with a TTL (e.g., 30s, 5m). Also settable via VAULT_WRAP_TTL.
Output Options
-field=<string>
Output only a specific field. No trailing newline. Useful for piping output.
-format=<string>
Output format: table, json, yaml, pretty. Default is table. Settable via VAULT_FORMAT. raw is allowed only for vhsm read.
Last updated
Was this helpful?