Mike’s Cereal Shack uses Vault to encrypt customer data to ensure it is always stored securely. They are developing a new application integration to…

Comprehensive and Detailed in Depth

The data.json file in this API request contains the data to be encrypted by the Transit secrets engine.

The HashiCorp Vault documentation states: "When executing any call to the Vault API, data can be

sent using an external file as shown above. In this case, the contents of the file would be cleartext

customer data that needs to be encrypted by the transit secrets engine." Specifically, for the

/transit/encrypt/ endpoint, it explains: "The API expects a JSON payload with a plaintext field

containing the base64-encoded data to encrypt."

The documentation elaborates under "Encrypt Data": "The request body must include the plaintext

parameter, which is the base64-encoded version of the data you want to encrypt. For example:

{"plaintext": "base64-encoded-data"}." Here, D (Cleartext customer data to be encrypted) fits this

requirement—customer data in cleartext, base64-encoded, sent for encryption. A (Transit config) is

managed in Vault, not sent. B (Ciphertext) is the output, not input. C (Encryption key) is stored in

Vault, not provided by the client. Thus, D is correct.

Reference:

HashiCorp Vault Documentation - Transit API: Encrypt Data