---
title: "migrate secrets from HashiCorp Vault to database"
method: POST
path: "/settings/migrate_secrets_to_database"
tags: ["setting"]
---

# migrate secrets from HashiCorp Vault to database

`POST /settings/migrate_secrets_to_database`

## Request body

- VaultSettings
  - `address` string, required — HashiCorp Vault server address (e.g., https://vault.company.com:8200)
  - `mount_path` string, required — KV v2 secrets engine mount path (e.g., windmill)
  - `kv_secret_path_prefix` string — Optional path prefix inserted between the KV data/metadata segment and the workspace id (e.g., "apps/windmill"). When set, secrets are stored at `<mount>/data/<prefix>/<workspace>/<secret>`, allowing a Vault policy scoped to exactly `<mount>/data/<prefix>/*`.
  - `jwt_role` string — Vault JWT auth role name for Windmill (optional, if not provided token auth is used)
  - `jwt_mount_path` string — Mount path for the JWT auth method in Vault (optional, defaults to "jwt"). Set this when the JWT auth method is mounted at a non-default path, e.g. via `vault auth enable -path=<mount> jwt`.
  - `namespace` string — Vault Enterprise namespace (optional)
  - `token` string — Static Vault token for testing/development (optional, if provided this is used instead of JWT authentication)
  - `skip_ssl_verify` boolean — Skip TLS certificate verification when connecting to Vault. Only use for self-signed certificates in development environments.

## Response `200`

migration report

- SecretMigrationReport
  - `total_secrets` integer, required — Total number of secrets found
  - `migrated_count` integer, required — Number of secrets successfully migrated
  - `failed_count` integer, required — Number of secrets that failed to migrate
  - `failures` SecretMigrationFailure[], required — Details of any failures encountered during migration
    - `workspace_id` string, required — Workspace ID where the secret is located
    - `path` string, required — Path of the secret that failed to migrate
    - `error` string, required — Error message

---

[API](https://skmtc.net/windmill/apis/windmill-api.md) · [All operations](https://skmtc.net/windmill/apis/windmill-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/windmill/windmill-api/revisions/8a5fd82f8851/schema)