# Vault API Integration Guide

**Date:** July 16, 2026  
**Purpose:** Document generic API wrapper and Vault token storage

---

## What's Been Built

### Generic API Wrapper (`vault_api.py`)

**Location:** `/home/jcbeasley/.openclaw/workspace/scripts/vault_api.py`

**Usage:**
```bash
python3 vault_api.py <METHOD> <BASE_URL> <API_PATH> <VAULT_KEY> [header_type] [payload_file]
```

**Examples:**
```bash
# Grist (Bearer token - default)
python3 vault_api.py GET "https://grist.beawit.net" "/api/docs/..." "api/integration/grist"

# NocoDB (xc-token)
python3 vault_api.py GET "http://192.168.25.5:8080" "/api/..." "api/integration/nocodb" "xc-token"

# Generic service with X-Api-Key
python3 vault_api.py GET "https://api.example.com" "/endpoint" "api/integration/service" "X-Api-Key"
```

**Supported Header Types:**
- `Bearer` (default) — `Authorization: Bearer <token>`
- `xc-token` — `xc-token: <token>` (NocoDB)
- `X-Api-Key` — `X-Api-Key: <token>`
- `api-key` — `API-Key: <token>`

**Features:**
- ✅ Self-healing Vault auth (auto-refreshes on expiry)
- ✅ No local token caching (fetches from Vault every time)
- ✅ SSL verification disabled for self-signed certs
- ✅ Supports GET, POST, PATCH

---

## Current Vault Status

### What's Available in Vault

**Integration Tokens:**
| Service | Vault Path | Status | Tested |
|---------|-----------|--------|--------|
| Grist | `kv/data/api/integration/grist` | ✅ Available | ✅ Works |
| NocoDB | `kv/data/api/integration/nocodb` | ❌ Not Found | ❌ N/A |
| Qdrant | `kv/data/api/integration/qdrant` | ❓ Unknown | ❌ N/A |
| Metabase | `kv/data/api/integration/metabase` | ❓ Unknown | ❌ N/A |
| Odoo | `kv/data/api/integration/odoo` | ❓ Unknown | ❌ N/A |
| HomeAssistant | `kv/data/api/integration/homeassistant` | ❓ Unknown | ❌ N/A |

**Other Vault Paths (from TOOLS.md):**
- `kv/data/api/ai-ml` — DeepSeek, Groq, OpenRouter, etc.
- `kv/data/api/business` — Stripe, Apollo, Hunter, etc.
- `kv/data/api/communication` — Discord, Twitter, etc.
- `kv/data/api/infrastructure` — NocoDB, Metabase, Qdrant, etc.
- `kv/data/api/media` — Pexels, YouTube, etc.
- `kv/data/api/search` — SerpAPI, Firecrawl, etc.

---

## What's Missing / Needed

### Tokens to Store in Vault

Based on your TOOLS.md, these tokens should be added to Vault under `kv/data/api/integration/`:

1. **NocoDB Token**
   - URL: `http://192.168.25.5:8080`
   - Currently in TOOLS.md as: `[in vault: nocodb-token]`
   - Need to verify it's actually stored at `kv/data/api/integration/nocodb`

2. **Qdrant API Key**
   - URL: `http://192.168.19.17:6333`
   - Currently in TOOLS.md as: `[in vault: qdrant-api-key]`
   - Path may be `kv/data/api/infrastructure/qdrant`

3. **Metabase Password**
   - URL: `http://metabase.beawit.net:3000`
   - Currently in TOOLS.md as: `[in vault: metabase-password]`
   - Path may be `kv/data/api/infrastructure/metabase`

4. **Odoo API Key**
   - URL: `http://192.168.16.4:8069`
   - Currently in TOOLS.md as: `[in vault: odoo-api-key]`
   - Path may be `kv/data/api/business/odoo`

---

## How to Store Tokens in Vault

**Step 1: Get Vault Token**
```bash
export VAULT_TOKEN=$(curl -sk -X POST \
  -d '{"role_id":"75d2dcfb-9c65-7f60-59b4-eee8c7f8dc0e","secret_id":"6202b465-2f25-547c-ec07-f47cfc4dda3e"}' \
  "https://beavault.beawit.net:8200/v1/auth/approle/login" | jq -r '.auth.client_token')
```

**Step 2: Store Service Token**
```bash
# For NocoDB
curl -sk -X POST \
  -H "X-Vault-Token: $VAULT_TOKEN" \
  -d '{"data":{"token":"YOUR_NOCODB_TOKEN_HERE"}}' \
  "https://beavault.beawit.net:8200/v1/kv/data/api/integration/nocodb"

# For Qdrant
curl -sk -X POST \
  -H "X-Vault-Token: $VAULT_TOKEN" \
  -d '{"data":{"token":"YOUR_QDRANT_KEY_HERE"}}' \
  "https://beavault.beawit.net:8200/v1/kv/data/api/integration/qdrant"
```

**Step 3: Verify**
```bash
python3 vault_api.py GET "http://192.168.25.5:8080" "/api/v1/db/meta/projects" "api/integration/nocodb" "xc-token"
```

---

## Next Steps

1. **Store remaining tokens in Vault** — Add NocoDB, Qdrant, etc. to `api/integration/`
2. **Test each service** — Verify `vault_api.py` works with all services
3. **Document service-specific paths** — Create mapping of services → Vault keys → header types

Want me to help store any specific tokens in Vault now?