Data Vault API

Query and manage customer data collections via the Control Plane Dataplane proxy.

Base path: /v1/workspaces/{workspace_id}/vault

All customer data access flows Control Plane → Dataplane — never call Dataplane directly from integrator code. Control Plane loads the workspace DATAPLANE_SERVICE_API_KEY from secrets and proxies with audit.

See also: Customer Portal — Data Vault

Permissions

Action	Endpoints
`read`	list collections, schema, query, count
`write`	create / update / delete records
`ddl`	create / update / drop collections

List collections

GET /v1/workspaces/{workspace_id}/vault/collections

curl -s -H "Authorization: Bearer $TOKEN" \
  "$CP_URL/v1/workspaces/$WORKSPACE_ID/vault/collections" | jq .

Get collection schema

GET /v1/workspaces/{workspace_id}/vault/collections/{name}/schema

Query records

POST /v1/workspaces/{workspace_id}/vault/collections/{name}/query

curl -s -X POST -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"filter":{},"limit":25,"offset":0}' \
  "$CP_URL/v1/workspaces/$WORKSPACE_ID/vault/collections/tenants/query" | jq .

Request body (query)

Field	Type	Description
`filter`	object	Dataplane filter expression or substring
`sort`	array	`[{ "field": "name", "dir": "asc" }]`
`limit`	integer	Page size
`offset`	integer	Pagination offset

Count records

GET /v1/workspaces/{workspace_id}/vault/collections/{name}/count

Create record

POST /v1/workspaces/{workspace_id}/vault/collections/{name}

Permission: write

Update record

PUT /v1/workspaces/{workspace_id}/vault/collections/{name}/{document_id}

Permission: write

Delete record

DELETE /v1/workspaces/{workspace_id}/vault/collections/{name}/{document_id}

Permission: delete

DDL — create collection

POST /v1/workspaces/{workspace_id}/vault/collections

Permission: ddl

DDL — drop collection

DELETE /v1/workspaces/{workspace_id}/vault/collections/{name}

Permission: ddl — irreversible.

Dataplane provisioning

Before vault queries work, the workspace needs a Dataplane service key. Provision via the Customer Portal setup card or:

POST /v1/workspaces/{workspace_id}/dataplane/provision

Errors

Status	Meaning
403	Missing ReBAC action
404	Collection or document not found
502	Dataplane error (check `detail` message)