> For the complete documentation index, see [llms.txt](https://docs.aohwv.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.aohwv.dev/administration/vault.md).

# Vault

Vault is AOH Sync's centralized store for the credentials and secrets that your Connectors use to communicate with connected systems.

The Vault screen shows the store's seal state and a searchable, filterable inventory of secrets grouped by category, each with per-secret and bulk rotation actions.

## What you can do here

| Action                           | What it does                                                                             |
| -------------------------------- | ---------------------------------------------------------------------------------------- |
| View seal state                  | Confirm whether the Vault is **UNSEALED** (accessible) or sealed                         |
| Search secrets                   | Use the search bar to find secrets by name, owner, or domain                             |
| **Domain filter**                | Narrow the list to secrets belonging to a specific connected system                      |
| **Owner filter**                 | Filter secrets by the component or Connector that registered them                        |
| **Rotate** (per secret)          | Trigger an immediate rotation for an individual secret                                   |
| **Rotate all infra credentials** | Trigger a bulk rotation of all externally-coordinated infrastructure credentials at once |
| View rotation schedule           | See which secrets have upcoming rotation jobs queued and how many are pending            |
| **Refresh**                      | Reload the Vault inventory to reflect recent changes                                     |

## Seal state

The Vault displays a status badge at the top of the screen:

* **UNSEALED** — the store is open and credentials are accessible to your Connectors
* A sealed state would prevent Connectors from retrieving credentials

The badge also shows a partial identifier of the master key and the time the Vault was last unsealed.

## Secrets inventory

Secrets are grouped into categories based on how they are managed:

* **EXTERNAL-COORDINATED** — credentials that are coordinated with external systems (for example, infrastructure passwords and session keys). 4 secrets are shown in this category.
* **INTERNAL-ROTATABLE** — internally managed credentials that can be rotated on demand (for example, application service passwords). 11 secrets are shown in this category.

Each secret row displays: **Name**, **Type**, **Cadence**, **Next Due**, **Last Rotated**, **Owner**, **Active** version, **Job** status, and a **Rotate** button in the Actions column.

You can search and filter the full inventory to locate a specific credential, check its owner, or review its rotation status.

## Rotation Schedule

The **Rotation Schedule** section at the bottom of the screen shows any rotation jobs that are queued. When no rotations are pending, it displays "No rotation jobs queued." AOH Sync tracks upcoming rotations so credentials are kept current without manual intervention.

{% hint style="info" %}
Vault access is controlled by the **Vault Admin**, **Vault Operator**, and **Vault Reader** roles in your permission groups. Only users with the appropriate role can view or manage secrets. See [Access Management](/administration/access-management.md) to review role assignments.
{% endhint %}

## Related

* [Access Management](/administration/access-management.md) — control who can view and manage Vault secrets
* [Connectors](/feature-reference/connectors.md) — Connectors register and use credentials stored in the Vault
* [System Settings](/administration/system-settings.md) — view overall system health alongside Vault status


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.aohwv.dev/administration/vault.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.