---
schema_version: 1
route: /t/vault.md
tool: "vault"
---

# sincecutoff.com /t/vault — HashiCorp Vault

- name: HashiCorp Vault
- kind: service
- children: none
- homepage: <https://github.com/hashicorp/vault>

Changes to the tools coding agents drive, since a model's training cutoff, each linked to its first-party source. Check installed versions and limitations before acting; a cutoff date does not establish what a model knows.
Original editorial content: [Apache 2.0](https://sincecutoff.com/v1/data-license.txt), by [0xPatrick](https://0xpatrick.dev). Preserve applicable license and [NOTICE](https://sincecutoff.com/notice.txt) attribution when redistributing. Third-party source text and examples retain their own rights. [License scope and attribution](https://sincecutoff.com/v1/license.json).
To stay current, read the changes feed: [`/v1/changes.md?tool=vault`](https://sincecutoff.com/v1/changes.md?tool=vault) (or `.json`), adding `since=YYYY-MM-DD` for your training cutoff. Entries for registered children are included; the registry itself is `/v1/tools.json`. How to page and save your place: [llms.txt](https://sincecutoff.com/llms.txt).

### SCIM Group PATCH supports member value filter paths (2026-10-15)
- slug: scim-group-patch-supports-member-value-filter-paths-5a1fbc9067ac
- score: 0.92

How to use it:

When removing a member from an existing SCIM Group, set the PATCH operation’s `path` to `members[value eq "<user-id>"]`.

- why_it_matters: Remove a SCIM Group member using a value-filter path.
- sources: <https://github.com/hashicorp/vault/releases/tag/v2.2.0>, <https://developer.hashicorp.com/vault/docs/enterprise/scim-overview>
- gotchas: "Version: v2.2.0"; "Operations[].path: On a remove operation, use `members[value eq \"<user-id>\"]` to target the member. The Vault API docs do not specify this path form; it is stated in the v2.2.0 release note."; "Prerequisite: SCIM requires Vault Enterprise and activation of the SCIM feature flag. Authenticate with a Vault token whose entity matches the SCIM client’s `access_grant_principal`; the client also needs ACL permission for the SCIM Groups endpoint."; "The path form is supported on remove operations."

### Vault token auth adds OAuth JWT revocation routes and a global denylist (2026-10-15)
- slug: vault-token-auth-adds-oauth-jwt-revocation-routes-and-a-global-denylist-49bfd93550b3
- score: 0.91

How to use it:

When revoking an OAuth JWT, POST its issuer, configured unique ID claim, and denylist duration to `/auth/token/revoke-oauth`. For a Vault token, POST its accessor to `/auth/token/revoke-accessor`.

Examples:

```
curl --header "X-Vault-Token: <vault-token>" --request POST --data '{"issuer":"<jwt-iss>","unique_id":"<configured-unique-id>","exp":3600}' http://127.0.0.1:8200/v1/auth/token/revoke-oauth
```

```
curl --header "X-Vault-Token: <vault-token>" --request POST --data '{"accessor":"<token-accessor>"}' http://127.0.0.1:8200/v1/auth/token/revoke-accessor
```

- why_it_matters: Revoke an OAuth JWT so it cannot be authorized across Vault namespaces.
- sources: <https://github.com/hashicorp/vault/releases/tag/v2.2.0>, <https://developer.hashicorp.com/vault/api-docs/auth/token>, <https://developer.hashicorp.com/vault/docs/auth/token>
- gotchas: "Version: v2.2.0"; "revoke-oauth.issuer (required): JWT `iss` claim identifying the OAuth issuer."; "revoke-oauth.unique_id (required): JWT claim value configured as `unique_id_claim` on the OAuth resource server profile."; "revoke-oauth.exp (required): Seconds to keep the JWT on Vault's denylist when the full JWT is not stored; actual JWT `exp` overrides this after the token is discovered."; "revoke-accessor.accessor (required): Accessor of the token to revoke."; "Prerequisite: The `revoke-oauth` endpoint is Enterprise."; "Prerequisite: Requests use a Vault token in the `X-Vault-Token` header or `Authorization: Bearer <token>` header."; "The global denylist applies across all namespaces."; "The `revoke-oauth` endpoint identifies an external token by issuer and unique ID."

### Vault billing overview API accepts start_month and end_month (2026-05-19)
- slug: vault-billing-overview-api-accepts-start-month-and-end-month-e99b21ef1ece
- score: 0.93

How to use it:

To query billing data for a specific time range, send a GET request to `/sys/billing/overview` with `start_month` and `end_month` in `YYYY-MM` format.

Examples:

```
curl --header "X-Vault-Token: <VAULT_TOKEN>" "<VAULT_ADDR>/v1/sys/billing/overview?start_month=<YYYY-MM>&end_month=<YYYY-MM>"
```

- why_it_matters: Query Vault billing data for a specific time range.
- sources: <https://github.com/hashicorp/vault/releases/tag/v2.0.1>, <https://developer.hashicorp.com/vault/api-docs/system/billing/overview>
- gotchas: "Version: v2.0.1"; "start_month: Optional query parameter in `YYYY-MM` format; includes months starting from this month. If unset, uses the start of the retention period."; "end_month: Optional query parameter in `YYYY-MM` format; includes months up to this month. If unset, uses the current month."; "Prerequisite: Call the restricted API path from the root or administrative namespace."; "Prerequisite: Provide a Vault token using the `X-Vault-Token` header."

### Vault API exposes consumption billing overview (2026-04-14)
- slug: vault-api-exposes-consumption-billing-overview-27cdb4781ff9
- score: 0.98

How to use it:

When integrating consumption billing metrics, call `BillingOverview` on the Vault API client’s `Sys()` handle to retrieve current and previous month metrics.

Examples:

```
overview, err := client.Sys().BillingOverview(false)
```

- why_it_matters: When integrating Vault consumption billing metrics into code, call the billing overview API client method.
- sources: <https://github.com/hashicorp/vault/releases/tag/v2.0.0>, <https://github.com/hashicorp/vault/blob/v2.0.0/api/sys_billing.go>, <https://developer.hashicorp.com/vault/api-docs/system/billing/overview>
- gotchas: "Version: v2.0.0"; "updateCounts (required): When true, updates current-month counts before returning; this is an expensive operation that holds locks and should be used sparingly. False reads the existing counts."; "Prerequisite: Call the restricted endpoint from the root or administrative namespace."; "Prerequisite: The API request requires a Vault token; the endpoint documentation’s sample sends `X-Vault-Token`."; "Docs conflict: The current HTTP API documentation describes optional `start_month` and `end_month` parameters, but the `v2.0.0` Go client method takes only `updateCounts` and does not expose those parameters."