Secrets infrastructureProgrammatic surfaces
Local HTTP API
Call the loopback service from desktop or local clients through the intentionally reduced API contract.
Local HTTP API — contract and behavior
- The serve command binds a configurable loopback port; it is not a public network service.
- The API exposes programmatic-safe item, grant, and metadata operations rather than every operator command.
- Client products own their UX, login, and directory integration; the vault API owns encrypted storage and authorization.
- Remote access requires a separate authenticated transport and must not be achieved by binding the vault directly to all interfaces.