From 5a5bd8ff75856dce8ed5e1f0782bc8935ce928cd Mon Sep 17 00:00:00 2001 From: Dave Kempe Date: Wed, 11 Mar 2026 20:05:35 +1100 Subject: [PATCH] Document Vault KV v2 metadata policy requirement for deletes (#54) Co-Authored-By: Claude Opus 4.6 --- docs/integrations.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/docs/integrations.md b/docs/integrations.md index 4e2f2df..b1b65a9 100644 --- a/docs/integrations.md +++ b/docs/integrations.md @@ -128,15 +128,23 @@ vault secrets enable -path=secret kv-v2 ```bash vault policy write rustguac - <<'EOF' +# Address book entries: create, read, update, soft-delete path "secret/data/rustguac/*" { capabilities = ["create", "read", "update", "delete"] } + +# Folder/entry listing and permanent deletion +# - "list" + "read": browse the address book +# - "delete": permanently remove entries and folders +# (KV v2 permanent deletes go through the metadata/ path, not data/) path "secret/metadata/rustguac/*" { capabilities = ["list", "read", "delete"] } EOF ``` +> **Note:** Both policy paths are required. A common mistake is omitting `delete` from the metadata path — this causes "vault access denied" errors when deleting entries or folders. See the [Vault KV v2 API docs](https://developer.hashicorp.com/vault/api-docs/secret/kv/kv-v2) for details on the `data/` vs `metadata/` path split. + **3. Enable AppRole auth** and create a role: ```bash