Soft delete key/value data

Use soft deletes to flag data at a secret path as unavailable while leaving the data recoverable. You can revert soft deletes as long as the destroyed field is false in the metadata.

Assumptions

You have set up a kv v2 plugin.
Your authentication token has delete permissions for the kv v2 plugin.

Use vault kv delete with the -versions flag to soft delete one or more version of key/value data and set deletion_time in the metadata:

$ vault kv delete               \
   -mount <mount_path>          \
   -versions <target_versions>  \
   <secret_path>

For example:

$ vault kv delete -mount shared -versions 1,4 dev/square-api

Success! Data deleted (if it existed) at: shared/data/dev/square-api

The deletion_time metadata field for versions 1 and 4 now has the timestamp of when Vault marked the versions as deleted:

$ vault kv metadata get -mount shared dev/square-api

======== Metadata Path ========
shared/metadata/dev/square-api

========== Metadata ==========
Key                     Value
---                     -----
cas_required            false
created_time            2024-11-13T21:51:50.898782695Z
current_version         4
custom_metadata         <nil>
delete_version_after    0s
max_versions            5
oldest_version          0
updated_time            2024-11-14T22:32:42.29534643Z

====== Version 1 ======
Key              Value
---              -----
created_time     2024-11-13T21:51:50.898782695Z
deletion_time    2024-11-15T00:45:04.057772212Z
destroyed        false

...

====== Version 4 ======
Key              Value
---              -----
created_time     2024-11-14T22:32:42.29534643Z
deletion_time    2024-11-15T00:45:04.057772712Z
destroyed        false

Open the data page for your kv plugin:
1. Open the GUI for your Vault instance.
2. Login under the namespace for the plugin or select the namespace from the selector at the bottom of the left-hand menu and re-authenticate.
3. Select Secrets Engines from the left-hand menu.
4. Select the mount path for your kv plugin.

Click through the path segments to select the relevant secret path.
Select the appropriate data version from the Version dropdown.
Click Delete.
Select Delete this version to delete the selected version or Delete latest version to delete the most recent data.
Click Confirm.

Partial screenshot of the Vault GUI showing the "Delete version?" confirmation modal for data at the path dev/square-api

Make a POST call to /{plugin_mount_path}/delete/{secret_path} with the data versions you want to soft delete:

$ curl                                       \
   --request POST                            \
   --header "X-Vault-Token: ${VAULT_TOKEN}"  \
   --data '{"versions":[<target_versions>]}  \
   ${VAULT_ADDR}/v1/<plugin_mount_path>/delete/<secret_path>

For example:

$ curl                                       \
    --request POST                           \
    --header "X-Vault-Token: ${VAULT_TOKEN}" \
    --data '{"versions":[5,8]}'              \
    ${VAULT_ADDR}/v1/shared/delete/dev/square-api | jq