# HashiCorp Vault

Baton HashiCorp Vault Connector - Sync users and roles (core identity) and secrets / auth methods (NHI secrets) from HashiCorp Vault

## Prerequisites

- A Mesh administrator account with permission to manage connectors.
- `vault_host` — HashiCorp Vault address or host (for example http://<internal-host>:8200)
- Credentials for authentication: vault_token (stored write-only).

## Authentication

**Method:** Bearer token

Mesh authenticates with a token (personal access token, API token, or bot token).

| Field | Required | Secret | Description |
| --- | --- | --- | --- |
| `vault_token` | Yes | Yes (write-only) | HashiCorp Vault token (stored as secret) |

## Capabilities

<CapabilityMatrix
  capabilities={[
    { name: "Identity & entitlement sync", supported: true },
    { name: "Writeback / remediation", supported: false, notes: "Read-only" },
  ]}
/>

## Data model

_This information is not yet available from the connector schema._

## Setup

1. Gather the required value: `vault_host`.
2. Create the required credentials in the source system: vault_token.
3. In Admin → Connectors, add the connector and enter its configuration.
4. Save and run an initial collection.

## Troubleshooting

_This information is not yet available from the connector schema._