Read subkeys for a key/value data path

Read the available subkeys on an existing data path in the kv v2 plugin.

Assumptions

You have set up a kv v2 plugin.
Your authentication token has read permissions for subkeys on the target secret path.

Use vault read with the /subkeys path to retrieve a list of secret data subkeys at the given path.

$ vault read <mount_path>/subkeys/<secret_path>

Vault retrieves secrets at the given path but replaces the underlying values of non-map keys and map keys with no underlying subkeys (leaf keys) with nil.

For example:

$ vault read shared/subkeys/dev/square-apiKey         Value---         -----metadata    map[created_time:2024-11-20T20:00:13.385182722Z custom_metadata:<nil> deletion_time: destroyed:false version:1]subkeys     map[prod:<nil> sandbox:<nil> smoke:<nil>]

Appropriate Vault Enterprise license required

Open the Overview screen for your secret path:
1. Open the GUI for your Vault instance.
2. Login under the namespace for the plugin or select the namespace from the selector at the bottom of the left-hand menu and re-authenticate.
3. Select Secrets Engines from the left-hand menu.
4. Select the mount path for your kv plugin.
5. Click through the path segments to select the relevant secret path.

You can read a list of available subkeys for the target path in the Subkeys card.

Partial screenshot of the Vault GUI showing subkeys "prod" and "sandbox" for secret data at path dev/square-api.

Call the /{plugin_mount_path}/subkeys/{secret_path} endpoint to fetch a list of available subkeys on the given path:

$ curl                                       \   --request GET                             \   --header "X-Vault-Token: ${VAULT_TOKEN}"  \   ${VAULT_ADDR}/v1/<plugin_mount_path>/subkeys/<secret_path>

Vault retrieves secrets at the given path but replaces the underlying values of non-map keys and map keys with no underlying subkeys (leaf keys) with null.

For example:

$ curl                                       \   --request GET                             \   --header "X-Vault-Token: ${VAULT_TOKEN}"  \   ${VAULT_ADDR}/v1/shared/subkeys/dev/square-api | jq{  "request_id": "bfeac3c5-f4dc-37b2-8909-3b15121cfd20",  "lease_id": "",  "renewable": false,  "lease_duration": 0,  "data": {    "metadata": {      "created_time": "2024-11-20T20:00:13.385182722Z",      "custom_metadata": null,      "deletion_time": "",      "destroyed": false,      "version": 11    },    "subkeys": {      "prod": null,      "sandbox": null,      "smoke": null    }  },  "wrap_info": null,  "warnings": null,  "auth": null,  "mount_type": "kv"}