Documentation
HashiCorp Vault
Connecting REAP to HashiCorp Vault (opens in a new tab): prerequisites, permissions, setup, what is read and written, troubleshooting.
Overview
Planned, not available today: connectors would obtain device credentials from Vault (opens in a new tab) paths with short TTLs. CyberArk (opens in a new tab) brokering is available today.
Status Planned Not available today and without a date. The sections below describe the design, so a reviewer can see what the integration would read and write; tell us if you need it.
Prerequisites
- Vault (opens in a new tab) reachable from the connector cluster
- A KV path or dynamic-secrets engine with the read-only device account
- An auth method for the connector (AppRole recommended) supported methods
Permissions requested
| Scope | Permission | Why |
|---|---|---|
| Read | Policy granting read on the REAP path(s) | Credential brokering |
| Runbooks (optional) | Separate path and policy for the scoped write account | Approved runbooks only |
Setup
- Create the path and policy; issue the AppRole (role ID / secret ID) for the connector.
- Configure Vault (opens in a new tab) address, path and auth in the connector; test read.
- Set TTLs; connectors renew within lease.
What REAP reads
- Credentials at time of use
What REAP writes
- Nothing
Troubleshooting
| Symptom | Likely cause | Check |
|---|---|---|
| permission denied | Policy does not cover the path | vault policy read |
| Lease expired | Renewal blocked | Check token TTL and renewal permissions |
Changelog
- September 2026 · page created (draft).
Engineering to confirm
- Supported auth methods and secrets engines
Last reviewed: October 7, 2026 (draft) · Owner: solutions engineering · Corrections: security@reapnet.ai