Read versioned key/value data

Read versioned data from an existing data path in the kv v2 plugin.

Assumptions

You have set up a kv v2 plugin.
Your authentication token has read permissions for the kv v2 plugin.

Use vault kv get to read all the current key/value pairs on the given path:

$ vault kv get             \
   -cas <target_version>   \
   -mount <mount_path>     \
   <secret_path>

For example:

$ vault kv get -mount shared dev/square-api

======= Secret Path =======
shared/data/dev/square-api

======= Metadata =======
Key                Value
---                -----
created_time       2024-11-13T21:58:32.128442898Z
custom_metadata    <nil>
deletion_time      n/a
destroyed          false
version            3

===== Data =====
Key        Value
---        -----
prod       5678
sandbox    1234

Use the -field flag to target specific key value pairs on the given path:

$ vault kv get          \
   -mount <mount_path>  \
   -field <field_name>  \
   <secret_path>

For example:

$ vault kv get -mount shared -field prod dev/square-api

5678

Open the data page for your kv plugin:
1. Open the GUI for your Vault instance.
2. Login under the namespace for the plugin or select the namespace from the selector at the bottom of the left-hand menu and re-authenticate.
3. Select Secrets Engines from the left-hand menu.
4. Select the mount path for your kv plugin.

Click through the path segments to select the relevant secret path.
Click the eye icon to view the desired key value.

Partial screenshot of the Vault GUI showing two key/value pairs at the path dev/square-api. The "prod" key is visible

Call the /{plugin_mount_path}/data/{secret_path} endpoint to read all the key/value pairs at the secret path:

$ curl                                       \
   --request GET                             \
   --header "X-Vault-Token: ${VAULT_TOKEN}"  \
   ${VAULT_ADDR}/v1/<plugin_mount_path>/data/<secret_path>

For example:

$ curl                                       \
   --request GET                             \
   --header "X-Vault-Token: ${VAULT_TOKEN}"  \
   ${VAULT_ADDR}/v1/shared/data/dev/square-api | jq

{
  "request_id": "992da4a2-f2d1-5786-ea53-1e8ea6440a7c",
  "lease_id": "",
  "renewable": false,
  "lease_duration": 0,
  "data": {
    "data": {
      "prod": "5679",
      "sandbox": "1234",
      "smoke": "abcd"
    },
    "metadata": {
      "created_time": "2024-11-15T02:41:02.556301319Z",
      "custom_metadata": null,
      "deletion_time": "",
      "destroyed": false,
      "version": 7
    }
  },
  "wrap_info": null,
  "warnings": null,
  "auth": null,
  "mount_type": "kv"
}