MaksIT.Vault.Client 1.3.0

MaksIT.Vault.Client

HTTP client for the MAKS-IT Vault API.

• Vault routes (api/vault/*): API key via X-API-KEY header.
• Identity, API key admin, key migration (api/identity/*, api/apikey/*, api/admin/key-migration/*): JWT Bearer via AccessToken (set manually or after LoginAsync / RefreshTokenAsync).
• Secret generation (api/secret/generatesecret): no auth required.

Shared wire types (MaksIT.Vault.Contracts) are bundled in this NuGet package.

Features

• IVaultClient / VaultClient for vault CRUD, identity, API keys, key migration, and secret generation.
• DI registration via AddVaultClient (Microsoft.Extensions.Http).
• VaultApiException when the API returns a non-success status code.

Installation

dotnet add package MaksIT.Vault.Client

Target Framework

• .NET 10 (net10.0)

Quick Start

Dependency injection (API key)

using MaksIT.Vault.Client;
using MaksIT.Vault.Contracts.Vault.Organization.Search;

builder.Services.AddVaultClient(opts => {
  opts.BaseAddress = "https://vault.example.com";
  opts.ApiKey = "<api-key>";
});

public sealed class MyService(IVaultClient vault) {
  public Task DoWorkAsync(CancellationToken ct) =>
    vault.SearchOrganizationsAsync(new SearchOrganizationRequest { PageNumber = 1, PageSize = 20 }, ct);
}

JWT (identity / admin)

var login = await client.LoginAsync(new LoginRequest { Username = "admin", Password = "..." });
// client.AccessToken is set automatically

var users = await client.SearchUsersAsync(new SearchUserRequest { PageNumber = 1, PageSize = 20 });

Or pass AccessToken in VaultClientOptions / Connect-Vault -AccessToken.

Use the reverse-proxy origin when Vault is deployed behind YARP or ingress (e.g. http://localhost:8080), not the internal server port.

Manual construction

var httpClient = new HttpClient();
var client = new VaultClient(httpClient, "https://vault.example.com", "<api-key>", accessToken: null);

Contract namespaces

Types moved from flat MaksIT.Vault.Contracts / MaksIT.Vault.Client.Models to nested folders:

Patch DTOs use PatchRequestModelBase with Operations: Dictionary<string, PatchOperation> from MaksIT.Core.Webapi.Models.

API surface

Secret version label current (case-insensitive) resolves to the lowest vN version that is not expired.

PowerShell

See MaksIT.Vault.Client.PowerShell (Connect-Vault, 38 cmdlets for vault, identity, API keys, and key migration).

Contributing

See CONTRIBUTING.md.

License

See LICENSE.md.