Vault by Empyre

Vault API documentation

The Vault API lets an authenticated agent list permitted metadata, read an allowed secret, issue a bounded temporary credential, or ask a signing key to sign a payload. Private signing material is never returned by any endpoint.

Integrations should treat denials as final, rotate agent credentials when exposure is suspected, request the narrowest action and scope, and retain request identifiers for audit work. The documentation covers authentication, policy evaluation, signing algorithms, quotas, revocation and error handling.

How Vault works

Vault stores the credentials AI agents need and signs with private keys that must never leave controlled storage. Policies are deny by default: an operation needs a matching allow and no matching deny, and every access decision is written to an audit trail.

Agents can receive short-lived temporary credentials with expiration and read limits, while signing keys have no read path at all. The agent sends a payload and receives a signature, never the private key. Organizations can rotate secrets, revoke credentials, monitor usage and investigate security alerts from one account.

Public pages

• Vault home
• Pricing for agent secrets and signing
• Talk to the Vault team
• Vault terms of service
• Vault privacy policy
• Vault API documentation

JavaScript is required to sign in and use the Vault dashboard. The product information above and the linked public pages remain readable without it.