HashiCorp Vault — Vault UI & CLI

4 minute read

Vault provides three interfaces: the CLI, the HTTP API, and the Web UI. This page helps you master the CLI and navigate the UI effectively.

The Vault CLI

The CLI is the primary tool for interacting with Vault. Every CLI command maps to an API call.

CLI Structure

vault <command> <subcommand> [options] [args]

# Examples
vault status                           # Server status
vault secrets list                     # List secrets engines
vault kv put secret/app key=value      # Write a secret
vault kv get secret/app                # Read a secret
vault auth enable userpass             # Enable auth method
vault policy write mypol policy.hcl    # Create a policy

Environment Variables

Variable Description Example
VAULT_ADDR Vault server address http://127.0.0.1:8200
VAULT_TOKEN Authentication token hvs.abc123
VAULT_SKIP_VERIFY Skip TLS verification true (lab only)
VAULT_NAMESPACE Vault namespace (Enterprise) admin/team-a
VAULT_FORMAT Output format json, table, yaml 
# Set up your environment
export VAULT_ADDR='http://127.0.0.1:8200'
export VAULT_TOKEN='my-root-token'

Output Formats

# Default table format
vault kv get secret/myapp

# JSON format (great for scripting)
vault kv get -format=json secret/myapp

# Get a single field
vault kv get -field=password secret/myapp

# Set default format
export VAULT_FORMAT=json

JSON output example:

{
  "request_id": "abc123",
  "data": {
    "data": {
      "password": "s3cur3!",
      "username": "admin"
    },
    "metadata": {
      "created_time": "2024-01-15T10:30:00.000000Z",
      "custom_metadata": null,
      "deletion_time": "",
      "destroyed": false,
      "version": 1
    }
  }
}

Parsing JSON Output with jq

# Get all data
vault kv get -format=json secret/myapp | jq '.data.data'

# Get a specific field
vault kv get -format=json secret/myapp | jq -r '.data.data.password'

# Get metadata
vault kv get -format=json secret/myapp | jq '.data.metadata'

# List secrets and format as array
vault kv list -format=json secret/ | jq '.[]'

Essential CLI Commands

Server Operations

# Check server status
vault status

# View server configuration (requires sudo/root policy)
vault read sys/config/state/sanitized

Secrets Operations

# Write a secret
vault kv put secret/myapp username="admin" password="s3cur3!"

# Read a secret
vault kv get secret/myapp

# List secrets at a path
vault kv list secret/

# Delete a secret (soft delete in KV v2)
vault kv delete secret/myapp

# Permanently destroy a version
vault kv destroy -versions=1 secret/myapp

# Undelete (restore soft-deleted version)
vault kv undelete -versions=1 secret/myapp

Auth Operations

# List auth methods
vault auth list

# Enable an auth method
vault auth enable userpass

# Login with different methods
vault login                            # Token (interactive)
vault login -method=userpass username=admin
vault login -method=oidc

Policy Operations

# List policies
vault policy list

# Read a policy
vault policy read default

# Write a policy from file
vault policy write my-policy policy.hcl

# Write a policy inline
vault policy write my-policy - <<EOF
path "secret/data/myapp/*" {
  capabilities = ["read", "list"]
}
EOF

# Delete a policy
vault policy delete my-policy

Token Operations

# View current token info
vault token lookup

# Create a new token
vault token create -policy=my-policy -ttl=1h

# Renew a token
vault token renew <token>

# Revoke a token
vault token revoke <token>

The Web UI

Enable the UI in your Vault configuration:

ui = true

Accessing the UI

Navigate to http://127.0.0.1:8200/ui (or your Vault address).

UI Login Methods

The UI supports multiple auth methods:

  • Token — Enter a Vault token directly
  • Username & Password — For userpass auth
  • OIDC — Browser-based SSO login
  • Other — LDAP, GitHub, etc.

What You Can Do in the UI

Feature Location
Browse secrets Secrets tab → click engine → navigate paths
Create/edit secrets Secrets → Create secret
Manage auth methods Access → Auth Methods
View/edit policies Policies tab
Manage tokens Access → Auth Methods → Token
View audit logs Not in UI — use CLI or log files
Wrap/unwrap secrets Tools → Wrap / Unwrap
Generate random data Tools → Random
Hash data Tools → Hash

UI vs CLI

Aspect CLI UI
Automation ✅ Scriptable ❌ Manual only
Speed Fast for experienced users Easier for beginners
Full API access ✅ All operations Most common operations
Audit visibility Via log files ❌ Not available
Batch operations ✅ Loops and scripts ❌ One at a time

The HTTP API

Every Vault operation is ultimately an API call:

# Read a secret via API
curl -s \
    --header "X-Vault-Token: $VAULT_TOKEN" \
    "$VAULT_ADDR/v1/secret/data/myapp" | jq

# Write a secret via API
curl -s \
    --header "X-Vault-Token: $VAULT_TOKEN" \
    --request POST \
    --data '{"data": {"username": "admin", "password": "s3cur3!"}}' \
    "$VAULT_ADDR/v1/secret/data/myapp" | jq

# List secrets via API
curl -s \
    --header "X-Vault-Token: $VAULT_TOKEN" \
    --request LIST \
    "$VAULT_ADDR/v1/secret/metadata/" | jq

# Check health (no auth needed)
curl -s "$VAULT_ADDR/v1/sys/health" | jq

Health check response:

{
  "initialized": true,
  "sealed": false,
  "standby": false,
  "performance_standby": false,
  "replication_performance_mode": "disabled",
  "replication_dr_mode": "disabled",
  "server_time_utc": 1706198400,
  "version": "1.15.4",
  "cluster_name": "vault-cluster-abc123",
  "cluster_id": "12345678-abcd-efgh-ijkl-123456789012"
}

Quick Reference

Command Description
vault status Server status
vault secrets list List secrets engines
vault auth list List auth methods
vault policy list List policies
vault kv put secret/path k=v Write secret
vault kv get secret/path Read secret
vault kv get -format=json secret/path Read as JSON
vault kv get -field=key secret/path Read single field
vault kv list secret/ List secrets at path
vault kv delete secret/path Soft-delete secret
vault login Authenticate
vault token lookup Current token info
curl $VAULT_ADDR/v1/sys/health API health check

Next: Practice Exercises

You may also enjoy