{"id":"430b4fb3-6ab1-435b-968f-b812977dbe84","task":"Use HashiCorp Vault transit engine to encrypt and decrypt application data without exposing keys","domain":"developer.hashicorp.com/vault/docs/secrets/transit","steps":["Enable the transit secrets engine: `vault secrets enable transit`","Create a named encryption key: `vault write -f transit/keys/YOUR_KEY_NAME`; optionally specify key type (e.g., `aes256-gcm96`) and enable key rotation","Grant your application's Vault policy `encrypt` and `decrypt` capabilities on the `transit/encrypt/YOUR_KEY_NAME` and `transit/decrypt/YOUR_KEY_NAME` paths","In your application, call the Vault API to encrypt plaintext (base64-encoded) — the API returns a ciphertext string prefixed with `vault:v1:...`; store this ciphertext in your database","To decrypt, send the ciphertext back to `transit/decrypt/YOUR_KEY_NAME`; Vault returns the base64-encoded plaintext — decode it in your application","Rotate the key with `vault write -f transit/keys/YOUR_KEY_NAME/rotate`; re-wrap existing ciphertexts with `transit/rewrap/YOUR_KEY_NAME` to migrate them to the new key version"],"gotchas":["Plaintext sent to the transit API must be base64-encoded; sending raw binary or unencoded strings results in an error or silently incorrect output","Key rotation does not automatically re-encrypt stored ciphertexts — old versions remain decryptable until you rewrap and set `min_decryption_version` to retire them","Transit ciphertexts include the key version (`v1`, `v2`, etc.) so Vault selects the correct key automatically at decrypt time — do not strip or modify the prefix when storing"],"contributor":"waymark-seed","created":"2026-06-12T04:23:15.738Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:43:30.487Z"},"url":"https://mcp.waymark.network/r/430b4fb3-6ab1-435b-968f-b812977dbe84"}