Read versioned key/value data

[!IMPORTANT]
Documentation Update: Product documentation, which were located in this repository under /website, are now located in hashicorp/web-unified-docs, colocated with all other product documentation. Contributions to this content should be done in the web-unified-docs repo, and not this one. Changes made to /website content in this repo will not be reflected on the developer.hashicorp.com website.

Read versioned data from an existing data path in the kv v2 plugin.

Assumptions

You have set up a kv v2 plugin.
Your authentication token has read permissions for the kv v2 plugin.

Use vault kv get to read all the current key/value pairs on the given path:

$ vault kv get             \
   -mount <mount_path>     \
   <secret_path>

For example:

$ vault kv get -mount shared dev/square-api

======= Secret Path =======
shared/data/dev/square-api

======= Metadata =======
Key                Value
---                -----
created_time       2024-11-13T21:58:32.128442898Z
custom_metadata    <nil>
deletion_time      n/a
destroyed          false
version            3

===== Data =====
Key        Value
---        -----
prod       5678
sandbox    1234

Use the -field flag to target specific key value pairs on the given path:

$ vault kv get          \
   -mount <mount_path>  \
   -field <field_name>  \
   <secret_path>

For example:

$ vault kv get -mount shared -field prod dev/square-api

5678

Open the Overview screen for your secret path:
1. Open the GUI for your Vault instance.
2. Login under the namespace for the plugin or select the namespace from the selector at the bottom of the left-hand menu and re-authenticate.
3. Select Secrets Engines from the left-hand menu.
4. Select the mount path for your kv plugin.
5. Click through the path segments to select the relevant secret path.

Select the Secret tab.
Click the eye icon to view the desired key value.

Partial screenshot of the Vault GUI showing two key/value pairs at the path dev/square-api. The "prod" key is visible

Call the /{plugin_mount_path}/data/{secret_path} endpoint to read all the key/value pairs at the secret path:

$ curl                                       \
   --request GET                             \
   --header "X-Vault-Token: ${VAULT_TOKEN}"  \
   ${VAULT_ADDR}/v1/<plugin_mount_path>/data/<secret_path>

For example:

$ curl                                       \
   --request GET                             \
   --header "X-Vault-Token: ${VAULT_TOKEN}"  \
   ${VAULT_ADDR}/v1/shared/data/dev/square-api | jq

{
  "request_id": "992da4a2-f2d1-5786-ea53-1e8ea6440a7c",
  "lease_id": "",
  "renewable": false,
  "lease_duration": 0,
  "data": {
    "data": {
      "prod": "5679",
      "sandbox": "1234",
      "smoke": "abcd"
    },
    "metadata": {
      "created_time": "2024-11-15T02:41:02.556301319Z",
      "custom_metadata": null,
      "deletion_time": "",
      "destroyed": false,
      "version": 7
    }
  },
  "wrap_info": null,
  "warnings": null,
  "auth": null,
  "mount_type": "kv"
}