Reports

When you're using HashiCorp Vault's KV Version 2 secrets engine, fetching a specific key from within a path like /mysecrets is not done by appending the key name to the path.The entire secret (ie, all key-value pairs under that path) is fetched at one using the API:

GET /v1/kv/data/mysecrets

This returns a structure like:

{
 "data":{
     "data":{
       "key1":"value1",
       "key1":"value1"
        }
        ,
       "metadate"{
         ...
       }
   }
}

So if you want just key1, you need to fetch the whole secret and extract the key1 from data.data.object programatically

why the below does not work?

GET /v1/kv/data/mysecrets/key1

That path would be valid only if you stored the secret directly at /mysecrets/key1 as below:

vault kv put kv/mysecrets/key1
value=somevalue

Then you could do

GET /v1/kv/data/mysecrets/key1

and receive

{
 "data":{
     "data":{
       "value":"somevalue",
        }
        ,
       "metadate"{
         ...
       }
   }
}

79563798