---
title: "test secret backend connection (HashiCorp Vault)"
method: POST
path: "/settings/test_secret_backend"
tags: ["setting"]
---

# test secret backend connection (HashiCorp Vault)

`POST /settings/test_secret_backend`

## Request body

- VaultSettings
  - `address` string, required — HashiCorp Vault server address (e.g., https://vault.company.com:8200)
  - `mount_path` string, required — KV v2 secrets engine mount path (e.g., windmill)
  - `kv_secret_path_prefix` string — Optional path prefix inserted between the KV data/metadata segment and the workspace id (e.g., "apps/windmill"). When set, secrets are stored at `<mount>/data/<prefix>/<workspace>/<secret>`, allowing a Vault policy scoped to exactly `<mount>/data/<prefix>/*`.
  - `jwt_role` string — Vault JWT auth role name for Windmill (optional, if not provided token auth is used)
  - `jwt_mount_path` string — Mount path for the JWT auth method in Vault (optional, defaults to "jwt"). Set this when the JWT auth method is mounted at a non-default path, e.g. via `vault auth enable -path=<mount> jwt`.
  - `namespace` string — Vault Enterprise namespace (optional)
  - `token` string — Static Vault token for testing/development (optional, if provided this is used instead of JWT authentication)
  - `skip_ssl_verify` boolean — Skip TLS certificate verification when connecting to Vault. Only use for self-signed certificates in development environments.

## Response `200`

connection successful

---

[API](https://skmtc.net/windmill/apis/windmill-api.md) · [All operations](https://skmtc.net/windmill/apis/windmill-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/windmill/windmill-api/revisions/964225251155/schema)