Read subkeys for a key/value data path

Read the available subkeys on an existing data path in the kv v2 plugin.

Assumptions

You have set up a kv v2 plugin.
Your authentication token has read permissions for subkeys on the target secret path.

Use vault read with the /subkeys metadata path retrieve a list of available subkeys on the given path.

$ vault read <mount_path>/subkeys/<secret_path>

Vault retrieves secrets at the given path but replaces the underlying values of non-map keys and map keys with no underlying subkeys (leaf keys) with nil.

For example:

$ vault read shared/subkeys/dev/square-api

Key         Value
---         -----
metadata    map[created_time:2024-11-20T20:00:13.385182722Z custom_metadata:<nil> deletion_time: destroyed:false version:1]
subkeys     map[prod:<nil> sandbox:<nil> smoke:<nil>]

Open the data page for your kv plugin:
1. Open the GUI for your Vault instance.
2. Login under the namespace for the plugin or select the namespace from the selector at the bottom of the left-hand menu and re-authenticate.
3. Select Secrets Engines from the left-hand menu.
4. Select the mount path for your kv plugin.

Click through the path segments to select the relevant secret path.
Note the subkeys listed on the data page.

Partial screenshot of the Vault GUI showing two key/value pairs at the path dev/square-api. The "prod" key is visible

Call the /{plugin_mount_path}/subkeys/{secret_path} endpoint to fetch a list of available subkeys on the given path:

$ curl                                       \
   --request GET                             \
   --header "X-Vault-Token: ${VAULT_TOKEN}"  \
   ${VAULT_ADDR}/v1/<plugin_mount_path>/subkeys/<secret_path>

Vault retrieves secrets at the given path but replaces the underlying values of non-map keys and map keys with no underlying subkeys (leaf keys) with null.

For example:

$ curl                                       \
   --request GET                             \
   --header "X-Vault-Token: ${VAULT_TOKEN}"  \
   ${VAULT_ADDR}/v1/shared/subkeys/dev/square-api | jq

{
  "request_id": "bfeac3c5-f4dc-37b2-8909-3b15121cfd20",
  "lease_id": "",
  "renewable": false,
  "lease_duration": 0,
  "data": {
    "metadata": {
      "created_time": "2024-11-20T20:00:13.385182722Z",
      "custom_metadata": null,
      "deletion_time": "",
      "destroyed": false,
      "version": 11
    },
    "subkeys": {
      "prod": null,
      "sandbox": null,
      "smoke": null
    }
  },
  "wrap_info": null,
  "warnings": null,
  "auth": null,
  "mount_type": "kv"
}