> ## Documentation Index > Fetch the complete documentation index at: https://hyperbrowser.ai/docs/llms.txt > Use this file to discover all available pages before exploring further. # Create a vault > Create a vault of stored secrets or a linked 1Password vault. See the [vaults guide](/docs/sandboxes/vaults) for SDK and CLI examples. ## OpenAPI ````yaml openapi.json POST /api/vaults openapi: 3.0.1 info: title: Hyperbrowser API version: 1.0.0 servers: - url: https://api.hyperbrowser.ai description: Production server security: [] paths: /api/vaults: post: summary: Create a vault description: >- Creates a vault: a set of environment variables that point at your secrets, or at fields of a linked 1Password vault. Pass the vault by name as `vault` to POST /api/sandbox and POST /api/sandbox/{id}/processes, or as `{"vault": name}` in a browser session's `credentials`. A team can have at most 100 vaults. Secrets are enabled for teams on request; please contact support to enable them (otherwise 403 SECRETS_FEATURE_DISABLED). Restricted API keys need the secrets.manage scope. When you're signed in rather than using an API key, you must be a team owner or admin (otherwise 403 SECRETS_ADMIN_REQUIRED). operationId: createVault requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/CreateVaultParams' responses: '200': description: Success content: application/json: schema: $ref: '#/components/schemas/Vault' '400': description: >- Invalid request body, or VAULT_ENTRY_INVALID (the message starts with the variable name). content: application/json: schema: $ref: '#/components/schemas/SecretErrorResponse' '401': description: Authentication required. content: application/json: schema: $ref: '#/components/schemas/SecretErrorResponse' '403': description: >- API_KEY_SCOPE_DENIED (the API key lacks a required scope), SECRETS_FEATURE_DISABLED, or SECRETS_ADMIN_REQUIRED. content: application/json: schema: $ref: '#/components/schemas/SecretErrorResponse' '404': description: >- SECRET_NOT_FOUND or SECRET_VERSION_NOT_FOUND: an entry or the token names a missing secret or version. content: application/json: schema: $ref: '#/components/schemas/SecretErrorResponse' '409': description: >- VAULT_NAME_TAKEN, VAULT_LIMIT_REACHED, VAULT_ENTRY_LIMIT_REACHED, or SECRET_TYPE_MISMATCH (an `op_token` secret as an entry, or a `tokenSecret` that isn't an `op_token`). content: application/json: schema: $ref: '#/components/schemas/SecretErrorResponse' '500': description: Internal server error. content: application/json: schema: $ref: '#/components/schemas/SecretErrorResponse' security: - ApiKeyAuth: [] components: schemas: CreateVaultParams: type: object properties: name: type: string pattern: ^[a-zA-Z0-9][a-zA-Z0-9_-]{0,127}$ description: >- 1-128 letters, digits, `_` or `-`, starting with a letter or digit. Unique within your team. description: type: string maxLength: 1024 default: '' description: Trimmed before it's stored. source: oneOf: - type: object title: Stored properties: type: type: string enum: - stored required: - type additionalProperties: false - type: object title: 1Password properties: type: type: string enum: - 1password tokenSecret: type: string pattern: ^[a-zA-Z0-9][a-zA-Z0-9_-]{0,127}$ description: >- Name of the `op_token` secret holding a 1Password service account token. vault: type: string minLength: 1 maxLength: 256 description: >- The 1Password vault's name or ID. 1-256 characters; a 1Password name or ID without `/` or `?`, and not `.` or `..`. required: - type - tokenSecret - vault additionalProperties: false description: >- Where values come from. Defaults to `{"type": "stored"}`. The type can't change later. entries: type: object additionalProperties: oneOf: - $ref: '#/components/schemas/VaultStoredEntry' - $ref: '#/components/schemas/VaultOnePasswordEntry' description: >- Environment variable name to entry: secrets for a stored vault, item fields for a 1Password vault (otherwise 400 VAULT_ENTRY_INVALID). Keys are environment variable names: letters, digits and `_`, not starting with a digit, at most 256 characters. A vault holds at most 32 entries (otherwise 409 VAULT_ENTRY_LIMIT_REACHED). example: USERNAME: name: github-username PASSWORD: name: github-password required: - name additionalProperties: false Vault: type: object description: A named set of environment variables. Holds no values. properties: id: type: string format: uuid name: type: string pattern: ^[a-zA-Z0-9][a-zA-Z0-9_-]{0,127}$ description: >- 1-128 letters, digits, `_` or `-`, starting with a letter or digit. Unique within your team. description: type: string maxLength: 1024 source: $ref: '#/components/schemas/VaultSource' entries: type: object additionalProperties: $ref: '#/components/schemas/VaultEntry' description: Environment variable name to entry. createdAt: type: string format: date-time updatedAt: type: string format: date-time required: - id - name - description - entries - createdAt - updatedAt SecretErrorResponse: type: object properties: code: type: string description: Machine-readable error code, such as SECRET_NOT_FOUND. message: type: string error: type: string description: >- Set instead of `code` by authentication and API key scope errors (API_KEY_SCOPE_DENIED). requiredScopes: type: array items: type: string description: The scope the API key is missing, with API_KEY_SCOPE_DENIED. retryable: type: boolean description: >- Whether repeating the same request can succeed. Set on delivery errors. details: type: object additionalProperties: true description: >- Extra information for some codes, such as `origin` for CREDENTIAL_ORIGIN_NOT_ALLOWED or `pages` for CREDENTIAL_PAGE_AMBIGUOUS. description: >- HTTP failure. Secret errors include `code` and `message`; request validation errors include only `message`; API key scope errors include `error`, `message` and `requiredScopes`. VaultStoredEntry: type: object description: 'An entry of a stored vault: a secret, by name.' properties: name: type: string pattern: ^[a-zA-Z0-9][a-zA-Z0-9_-]{0,127}$ description: Name of a `secret` or `totp` secret. version: oneOf: - type: string enum: - latest - type: integer minimum: 1 maximum: 2147483647 description: A version to pin, or `latest`. Omit to follow the latest version. required: - name additionalProperties: false VaultOnePasswordEntry: type: object description: >- An entry of a 1Password vault: a field of an item in the linked 1Password vault, read as `op:////[
/]`. The reference can be at most 512 bytes. properties: item: type: string minLength: 1 maxLength: 256 description: >- The item. 1-256 characters; a 1Password name or ID without `/` or `?`, and not `.` or `..`. section: type: string minLength: 1 maxLength: 256 description: >- The section, if any. 1-256 characters; a 1Password name or ID without `/` or `?`, and not `.` or `..`. field: type: string minLength: 1 maxLength: 256 description: >- The field. 1-256 characters; a 1Password name or ID without `/` or `?`, and not `.` or `..`. It may end with a query such as `?attribute=otp`, which reads a TOTP field's current code. required: - item - field additionalProperties: false VaultSource: type: object description: >- Where the vault's values come from. `stored`: your secrets. `1password`: a linked 1Password vault, read with the service account token in `tokenSecret`. Treat a missing `source` as `stored`. properties: type: type: string enum: - stored - 1password tokenSecret: type: object description: The `op_token` secret, for 1Password vaults. properties: name: type: string secretId: type: string format: uuid required: - name - secretId vault: type: string description: The 1Password vault's name or ID, for 1Password vaults. required: - type VaultEntry: description: >- An entry as returned. A stored vault's entry has the secret's `name`, `secretId` and pinned `version` (`null` follows the latest). A 1Password vault's entry has `item`, `section`, `field` and the `reference` built from them. type: object properties: name: type: string secretId: type: string format: uuid version: type: integer nullable: true item: type: string section: type: string field: type: string reference: type: string description: The `op://` reference read from 1Password. securitySchemes: ApiKeyAuth: type: apiKey in: header name: x-api-key ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.