Troubleshoot vault secrets

An empty vault secret is a vault secret that doesn't have a value and is referenced in a request. An unresolved vault secret is a vault secret that exists in your Postman Vault but can't be referenced in a request. For example, a vault secret might be unresolved because you're sending a request to a domain not in the secret's allowed domains list.

Vault secrets linked with an external vault integration can be unresolved if the secret isn't defined or Postman can't reference the secret stored in your Postman Vault.

Learn about Postman Vault features that require the Postman desktop app.

Reasons why a vault secret can be empty or unresolved

A vault secret and vault secret added using Guided Auth can be empty or unresolved for the following reasons:

• Empty vault secrets

  • The vault secret isn't present in your Postman Vault, and the vault secret doesn't have a value.
  • The vault secret's key name (in the key-value pair) was updated in your Postman Vault, but references to the vault secret use the previous key name.
  • (Vault secrets added using Guided Auth only) The suffix associated with the vault secret's key name was edited or removed. The suffix must be present in your Postman Vault and in references to the vault secret. If you edit or remove the suffix, it's recommended that you recreate the vault secret using Guided Auth.

• Unresolved vault secrets

  • The vault secret is turned off in your Postman Vault.
  • The vault secret isn't allowed to be in requests to the domain.
  • You haven't entered your vault key since signing in to Postman.
  • You aren't using the Postman Desktop Agent or the Postman Browser Agent to send requests from the Postman web app.

If you linked sensitive data from an external vault integration, a vault secret can be unresolved for the following reasons:

• The vault secret isn't present in your Postman Vault.
• The vault secret is turned off in your Postman Vault.
• The vault secret's key name (in the key-value pair) was updated in your Postman Vault, but references to the vault secret use the previous key name.
• The vault secret isn't allowed to be in requests to the domain.
• The integration isn't configured with correct details.
• Your computer isn't able to access your external vault provider.
• The integration was disconnected.
• You aren't sending requests from the Postman desktop app.
• You aren't assigned the required roles for retrieving secrets from your external vault provider.
• You haven't reauthenticated with your external vault since you last opened Postman, or since your authentication credentials expired. Learn more about reauthenticating with an external vault.

Fix vault secrets

When you're working on an API request, Postman highlights empty and unresolved vault secrets in the URL builder, the Params tab, the Authorization tab, and the Headers tab. Postman highlights empty and unresolved vault secret text in red. If your request has an empty or unresolved vault secret, an exclamation point displays on the Variables icon in the upper-right of the workbench.

To view empty and unresolved vault secrets used in a request, do the following:

1. Open a request with empty or unresolved vault secrets, then select Variables to open the variables pane.

2. Under Variables used, review your vault secrets with missing or unresolved values:

   • If the vault secret is empty, you can enter a value. Then you can add the vault secret to your Postman Vault if you'd like.
   • If the vault secret is unresolved, hover over Error to learn how to fix it.

You can also open your Postman Vault to check if the vault secret exists and should be accessible from the request. For example, a vault secret might be turned off in your Postman Vault.

To fix an empty vault secret that doesn't have a value, you can enter a value. If the vault secret doesn't exist in your Postman Vault, you can enter a value for the vault secret without adding it your Postman Vault. When you're ready, you can add the vault secret to your Postman Vault.

To fix an unresolved vault secret that Postman can't access, you can take the following actions from the request builder:

• Turn on a vault secret - If the vault secret exists in your Postman Vault and it's turned off, hover over the reference to the secret or Error in the variables pane, then select Enable Secret.
• Update allowed domains - If the vault secret exists in your Postman Vault and you're sending a request to a domain not in the allowed domains list, hover over the reference to the secret or Error in the variables pane, then select Update Domains. Your Postman Vault will open in a new tab, and you can update the allowed domains for the vault secret.
• Enter your vault key - If a vault secret is referenced in your request and you haven't entered your vault key, hover over the reference to the secret or Error in the variables pane, enter your vault key, then select Access Vault.
• Select the Postman Agent - If you're using an unsupported Postman Agent to send requests from the Postman web app, select the Desktop or Browser Agent, depending on which is best suited for your request.

Learn about editing vault secrets and editing vault secrets added using Guided Auth.