Read a KV secret
vault_kv_readRetrieve secrets from HashiCorp Vault KV engines by specifying the mount and secret path. Supports reading specific versions for KV v2 engines.
Instructions
Read the key/value data stored at a secret path in a Vault KV engine. For KV v2 you may request a specific historical version; omit it to get the latest.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| mount | Yes | Mount point of the KV secrets engine, without leading/trailing slashes (e.g. 'secret', 'kv', 'apps/prod'). | |
| path | Yes | Path of the secret within the mount (e.g. 'db/creds', 'services/api'). Do NOT include the mount, or the KV v2 'data/'/'metadata/' prefix — those are added automatically. | |
| kv_version | No | KV engine version: 1 or 2. If omitted, the server auto-detects it from the mount (falling back to 2). Set explicitly to avoid an extra detection call. | |
| version | No | KV v2 only: specific secret version number to read. Omit for the latest version. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| data | Yes | The secret's key/value pairs. | |
| metadata | No | KV v2 version metadata (version, created_time, etc.). | |
| kv_version | Yes |