Data tokenization with transform secrets engine

1. Enable the transform secrets engine at transform/.

   $ vault secrets enable transformSuccess! Enabled the transform secrets engine at: transform/

2. Create a role named mobile-pay with a transformation named credit-card.

   $ vault write transform/role/mobile-pay transformations=credit-cardSuccess! Data written to: transform/role/mobile-pay

3. Create a transformation named credit-card which sets the generated token's time-to-live (TTL) to 24 hours.

   $ vault write transform/transformations/tokenization/credit-card \  allowed_roles=mobile-pay \  max_ttl=24h

   Example output:

   Success! Data written to: transform/transformations/tokenization/credit-card

   The max_ttl is an optional parameter which allows you to control how long the token should stay valid.

   You can set the allowed_roles parameter to a wildcard (*) to allow all roles or with globs at the end for pattern matching (e.g. mobile-*).

4. Display details about the credit-card transformation.

   $ vault read transform/transformations/tokenization/credit-card Key                 Value---                 -----allowed_roles       [mobile-pay]deletion_allowed    falsemapping_mode        defaultmax_ttl             24hstores              [builtin/internal]templates           <nil>type                tokenization

   The type is set to tokenization.

1. Enable transform secrets engine using /sys/mounts endpoint.

   $ curl --header "X-Vault-Token: $VAULT_TOKEN" \     --request POST \     --data '{"type":"transform"}' \     $VAULT_ADDR/v1/sys/mounts/transform

2. Create a role named mobile-pay with a transformation named credit-card.

   $ curl --header "X-Vault-Token: $VAULT_TOKEN" \     --request POST \     --data '{"transformations": ["credit-card"]}' \     $VAULT_ADDR/v1/transform/role/mobile-pay

3. Create a API request payload for the credit-card tokenization transformation.

   $ tee payload.json <<EOF{  "max_ttl": "24h",  "allowed_roles": [ "mobile-pay" ]}EOF

   The max_ttl is an optional parameter which allows you to control how long the token should stay valid.

   You can set the allowed_roles parameter to a wildcard (*) to allow all roles or with globs at the end for pattern matching (e.g. mobile-*).

4. Create a transformation named credit-card.

   $ curl --header "X-Vault-Token: $VAULT_TOKEN" \     --request POST \     --data @payload.json \     $VAULT_ADDR/v1/transform/transformations/tokenization/credit-card

5. List existing tokenization transformations to verify that credit-card was created successfully.

   $ curl --header "X-Vault-Token: $VAULT_TOKEN" \     --request LIST \    $VAULT_ADDR/v1/transform/transformations/tokenization \    | jq ".data"

   Example output:

   {  "keys": [    "credit-card",  ]}

6. Read the credit-card transformation configuration.

   $ curl --header "X-Vault-Token: $VAULT_TOKEN" \     $VAULT_ADDR/v1/transform/transformations/tokenization/credit-card \     | jq ".data"

   Example output:

   {  "allowed_roles": [    "mobile-pay"  ],  "deletion_allowed": false,  "mapping_mode": "default",  "max_ttl": 86400,  "stores": [    "builtin/internal"  ],  "templates": null,  "type": "tokenization"}

   The type is set to tokenization.

1. Encode data using the mobile-pay role and store it in a variable.

   $ TOKEN_VALUE=$(vault write transform/encode/mobile-pay value=1111-2222-3333-4444 \    transformation=credit-card \    ttl=8h \    metadata="Organization=HashiCorp" \    metadata="Purpose=Travel" \    metadata="Type=AMEX" -format=json | jq -r '.data | .encoded_value') \    && echo encoded_value: $TOKEN_VALUE

   The ttl value is an optional parameter. Remember that the max_ttl was set to 24 hours when you created the credit-card transformation. You can overwrite that value to make the token's TTL to be shorter.

   In addition, you can set optional metadata about the data.

   Example output:

   encoded_value: Q4tYgFXHxUbU5XZoQsxusAzxhNyVWmCFWxAT8SGkHoYB3VkrmQGXVR

2. Retrieve the metadata of the token.

   $ vault write transform/metadata/mobile-pay value=$TOKEN_VALUE transformation=credit-card Key                Value---                -----expiration_time    2021-03-13 06:49:58.041608 +0000 UTCmetadata           map[Organization:HashiCorp Purpose:Travel Type:AMEX]

   Notice the expiration_time value. Since you have overwritten the max_ttl, the ttl is set to 8 hours.

3. Validate the token value.

   $ vault write transform/validate/mobile-pay value=$TOKEN_VALUE transformation=credit-card Key      Value---      -----valid    true

4. Validate that the credit card number has been tokenized already.

   $ vault write transform/tokenized/mobile-pay value=1111-2222-3333-4444 transformation=credit-card Key          Value---          -----tokenized    true

5. Retrieve the original plaintext credit card value.

   $ vault write transform/decode/mobile-pay transformation=credit-card value=$TOKEN_VALUE Key              Value---              -----decoded_value    1111-2222-3333-4444

1. Create an HTTP request payload with a value and metadata.

   $ tee payload.json <<EOF{  "value": "1111-2222-3333-4444",  "transformation": "credit-card",  "ttl": "8h",  "metadata": {       "Organization": "HashiCorp",        "Purpose": "Travel",        "Type": "AMEX"  }}EOF

   The ttl value is an optional parameter. Remember that the max_ttl was set to 24 hours when you created the credit-card transformation. You can overwrite that value to make the token's TTL to be shorter.

   In addition, you can set optional metadata about the data.

2. Encode a value with the mobile-pay role and store it in a variable.

   $ TOKEN_VALUE=$(curl --header "X-Vault-Token: $VAULT_TOKEN" \    --request POST \    --data @payload.json \    $VAULT_ADDR/v1/transform/encode/mobile-pay | jq -r '.data | .encoded_value') \    && echo encoded_value: $TOKEN_VALUE

   Example output:

   encoded_value: 9UrVvkyFti3hHaT1cWqs5Hch14hKL2B8bMtgRbqYjyepgCgK6Hy5zXtrHLzqJs93C41DRGnf

3. Retrieve the metadata of the token.

   $ curl --header "X-Vault-Token: $VAULT_TOKEN" \    --request POST \    --data '{"value": "'"$TOKEN_VALUE"'", "transformation": "credit-card"}' \    $VAULT_ADDR/v1/transform/metadata/mobile-pay | jq ".data"

   Example output:

   {  "expiration_time": "2021-03-13 06:49:58.041608 +0000 UTC",  "metadata": {    "Organization": "HashiCorp",    "Purpose": "Travel",    "Type": "AMEX"  }}

   Since you have overwritten the max_ttl, the ttl is set to 8 hours.

4. Validate the token value.

   $ curl --header "X-Vault-Token: $VAULT_TOKEN" \    --request POST \    --data '{"value": "'"$TOKEN_VALUE"'", "transformation": "credit-card"}' \    $VAULT_ADDR/v1/transform/validate/mobile-pay | jq ".data"

   Example output:

   {  "valid": true}

5. Validate that the credit card number has been tokenized already.

   $ curl --header "X-Vault-Token: $VAULT_TOKEN" \    --request POST \    --data '{"value": "1111-2222-3333-4444", "transformation": "credit-card"}' \    $VAULT_ADDR/v1/transform/tokenized/mobile-pay | jq ".data"

   Example output:

   {  "tokenized": true}

6. Retrieve the original plaintext credit card value.

   $ curl --header "X-Vault-Token: $VAULT_TOKEN" \    --request POST \    --data '{"value": "'"$TOKEN_VALUE"'", "transformation": "credit-card"}' \    $VAULT_ADDR/v1/transform/decode/mobile-pay | jq ".data"

   Example output:

   {  "decoded_value": "1111-2222-3333-4444"}

1. Update the mobile-pay role with a convergent transformation named credit-card-convergent.

   $ vault write transform/role/mobile-pay transformations="credit-card, credit-card-convergent"Success! Data written to: transform/role/mobile-pay

2. Create a transformation named credit-card-convergent which sets the enables the convergent encryption. When you define a transformation, set convergent=true.

   $ vault write transform/transformations/tokenization/credit-card-convergent \     allowed_roles="*" \     convergent=true

   Example output:

   Success! Data written to: transform/transformations/tokenization/credit-card-convergent

3. Encode a value using the credit-card-convergent transformation.

   $ vault write transform/encode/mobile-pay value=5555-6666-7777-8888 \     transformation=credit-card-convergent

   Example output:

   Key              Value---              -----encoded_value    DaCJhefr1oRUoY1vCtgJ8HixeazFhWHzFsNoNGeDWnyGGe76Xp8Er4UyW76xiPyQ2Eh2jGztnb3x

4. Run the command again.

   $ vault write transform/encode/mobile-pay value=5555-6666-7777-8888 \     transformation=credit-card-convergent

   Example output:

   It returns the same encrypted value.

   Key              Value---              -----encoded_value    DaCJhefr1oRUoY1vCtgJ8HixeazFhWHzFsNoNGeDWnyGGe76Xp8Er4UyW76xiPyQ2Eh2jGztnb3x

1. Create an API request payload.

   $ tee payload-convergent.json <<EOF{   "convergent": true,   "allowed_roles": [ "*" ]}EOF

   NOTE: Set the convergent parameter to "true" to enable convergent encryption.

2. Create a transformation named credit-card-convergent.

   $ curl --header "X-Vault-Token: $VAULT_TOKEN" \     --request POST \     --data @payload-convergent.json \     $VAULT_ADDR/v1/transform/transformations/tokenization/credit-card-convergent

3. Add the credit-card-convergent transformation to the mobile-pay role.

   $ curl --header "X-Vault-Token: $VAULT_TOKEN" \     --request POST \     --data '{"transformations": ["credit-card","credit-card-convergent"]}' \     $VAULT_ADDR/v1/transform/role/mobile-pay

4. Create an API request payload to encode a value using the credit-card-convergent transformation.

   $ tee payload.json <<EOF{  "value": "5555-6666-7777-8888",  "transformation": "credit-card-convergent"}EOF

5. Encode the value in the payload.json file using the mobile-pay role.

   $ curl --header "X-Vault-Token: $VAULT_TOKEN" \    --request POST \    --data @payload.json \    $VAULT_ADDR/v1/transform/encode/mobile-pay | jq ".data"

   Example output:

   {  "encoded_value": "DaCJhefr1oRUoY1vCtgJ8HixeazFhWHzFsNoNGeDWnyGGe76Xp8Er4UyW76xiPyQ2Eh2jGztnb3x"}

6. Run the command again.

   $ curl --header "X-Vault-Token: $VAULT_TOKEN" \    --request POST \    --data @payload.json \    $VAULT_ADDR/v1/transform/encode/mobile-pay | jq ".data"

   Example output:

   It returns the same encrypted value.

   {  "encoded_value": "DaCJhefr1oRUoY1vCtgJ8HixeazFhWHzFsNoNGeDWnyGGe76Xp8Er4UyW76xiPyQ2Eh2jGztnb3x"}

1. Encode the value using the credit-card-convergent transformation with time-to-live (TTL) of 8 hours.

   $ vault write transform/encode/mobile-pay value=5555-6666-7777-8888 \     transformation=credit-card-convergent ttl=8h

   Example output:

   Key              Value---              -----encoded_value    MQEgMY8jwXYJNb9p177dYCttwRUcctAeo89yVmMPiLotzfe3sx2btpBGNLijo2KA9cy4hAnTfeV78D5rJwyBdC5j6tMEZgH

   The encoded value (token) is longer than the one without a TTL.

2. Look up the token for card number "5555-6666-7777-8888".

   $ vault write transform/tokens/mobile-pay value=5555-6666-7777-8888 \    transformation=credit-card-convergent

   Example output:

   Key       Value---       -----tokens    [DaCJhefr1oRUoY1vCtgJ8HixeazFhWHzFsNoNGeDWnyGGe76Xp8Er4UyW76xiPyQ2Eh2jGztnb3x]

3. Look up with expiration of "any".

   $ vault write transform/tokens/mobile-pay value=5555-6666-7777-8888 \    transformation=credit-card-convergent expiration="any"

   Example output:

   Key       Value---       -----tokens    [DaCJhefr1oRUoY1vCtgJ8HixeazFhWHzFsNoNGeDWnyGGe76Xp8Er4UyW76xiPyQ2Eh2jGztnb3x MQEgMY8jwXYJNb9p177dYCttwRUcctAeo89yVmMPiLotzfe3sx2btpBGNLijo2KA9cy4hAnTfeV78D5rJwyBdC5j6tMEZgH]

   This returns two space-separated tokens. In absence of the expiration parameter, the command returns token with no expiration. When the expiration is set to "any", it returns tokens with any expiration.

4. Look up tokens that have an expiration between a given range using min_expiration and min_expiration which are RFC3339 formatted time and date.

   $ vault write transform/tokens/mobile-pay value=5555-6666-7777-8888 \    transformation=credit-card-convergent \    min_expiration=$(echo $(date -v-60M "+%Y-%m-%dT%H:%M:%S+00:00")) \    max_expiration=$(echo $(date -v+10d "+%Y-%m-%dT%H:%M:%S+00:00"))

   Example output:

   Key       Value---       -----tokens    [MQEgMY8jwXYJNb9p177dYCttwRUcctAeo89yVmMPiLotzfe3sx2btpBGNLijo2KA9cy4hAnTfeV78D5rJwyBdC5j6tMEZgH]

   Any token that expires within the provided date range is displayed.

1. Create an HTTP request payload.

   $ tee payload-input-3.json <<EOF{  "value": "5555-6666-7777-8888",  "transformation": "credit-card-convergent",  "ttl": "8h"}EOF

2. Encode the value using the credit-card-convergent transformation with time-to-live (TTL) of 8 hours using the mobile-pay role.

   $ curl --header "X-Vault-Token: $VAULT_TOKEN" \    --request POST \    --data @payload-input-3.json \    $VAULT_ADDR/v1/transform/encode/mobile-pay | jq ".data"

   Example output:

   {  "encoded_value": "MQEgMY8jwXMzbK94WCG1SsWvrAP6JBUNBLyLM45Kb4h42La4zHj15N6ZG3Q3aaQqPvDhf6wXCm6B3L4L4zx19yaPiskLbNm"}

   Notice that the encoded value (token) is longer than the one without TTL.

3. Look up the token for a card number, "5555-6666-7777-8888".

   $ curl --header "X-Vault-Token: $VAULT_TOKEN" \    --request POST \    --data '{"value": "5555-6666-7777-8888", "transformation": "credit-card-convergent"}' \    $VAULT_ADDR/v1/transform/tokens/mobile-pay | jq ".data"

   Example output:

   {  "tokens": [    "DaCJhefr1oRUoY1vCtgJ8HixeazFhWHzFsNoNGeDWnyGGe76Xp8Er4UyW76xiPyQ2Eh2jGztnb3x"  ]}

4. Look up with expiration of "any".

   $ curl --header "X-Vault-Token: $VAULT_TOKEN" \    --request POST \    --data '{"expiration": "any", "value": "5555-6666-7777-8888", "transformation": "credit-card-convergent"}' \    $VAULT_ADDR/v1/transform/tokens/mobile-pay | jq ".data"

   Example output:

   {  "tokens": [    "DaCJhefr1oRUoY1vCtgJ8HixeazFhWHzFsNoNGeDWnyGGe76Xp8Er4UyW76xiPyQ2Eh2jGztnb3x",    "MQEgMY8jwXMzbK94WCG1SsWvrAP6JBUNBLyLM45Kb4h42La4zHj15N6ZG3Q3aaQqPvDhf6wXCm6B3L4L4zx19yaPiskLbNm"  ]}

5. Create an API request payload to look up tokens that are expire between a given range using min_expiration and min_expiration which are RFC3339 formatted time and date.

   $ tee payload-range.json <<EOF{  "value": "5555-6666-7777-8888",  "transformation": "credit-card-convergent",  "min_expiration": "$(echo $(date -v-60M "+%Y-%m-%dT%H:%M:%S+00:00"))",  "max_expiration": "$(echo $(date -v+10d "+%Y-%m-%dT%H:%M:%S+00:00"))"}EOF

6. Look up the tokens that expire within the given range.

   $ curl -s --header "X-Vault-Token: $VAULT_TOKEN" \    --request POST \    --data @payload-range.json \    $VAULT_ADDR/v1/transform/tokens/mobile-pay | jq ".data"

   Example output:

   The request returns tokens that expire within the given expiration range.

   {  "tokens": [    "MQEgMY8jwXJKzBtYixUTKERLehxpHX8YohswL8RYgiHozcJxfvhSd38BjHikRh4hFNHPs1aq3DxJGSGa7MKmcwhRvY8z6fK"  ]}

1. Read the key information for credit-card transformation.

   $ vault read transform/tokenization/keys/credit-card Key                       Value---                       -----auto_rotate_period        0slatest_version            1min_available_version     0min_decryption_version    1name                      credit-cardtype                      aes256-gcm96

   Notice that the latest_version is 1.

2. Rotate the key for credit-card transformation.

   $ vault write -force transform/tokenization/keys/credit-card/rotateSuccess! Data written to: transform/tokenization/keys/credit-card/rotate

3. Read the key information again.

   $ vault read transform/tokenization/keys/credit-card Key                       Value---                       -----auto_rotate_period        0slatest_version            2min_available_version     0min_decryption_version    1name                      credit-cardtype                      aes256-gcm96

   The latest_version is now 2.

4. Configure the key to be automatically rotated every 90 days to reduce operational overhead.

   Note

   The minimum permitted value for the auto_rotate_period is 1 hour.

   $ vault write transform/tokenization/keys/credit-card/config \   auto_rotate_period=90d

   Example output:

   Success! Data written to: transform/tokenization/keys/credit-card/config

5. Verify the configuration.

   $ vault read transform/tokenization/keys/credit-card

   Example output:

   Key                       Value---                       -----auto_rotate_period        2160hlatest_version            1min_available_version     0min_decryption_version    1name                      credit-cardtype                      aes256-gcm96

   If the key becomes compromised, you can rotate the key using the transform/tokenization/keys/<transformation_name>/rotate, and then set the min_decryption_version to the latest key version so that the older (possibly compromised) key will not be able to decrypt the data.

1. Read the key information for the credit-card transformation.

   $ curl --header "X-Vault-Token: $VAULT_TOKEN" \     $VAULT_ADDR/v1/transform/tokenization/keys/credit-card | jq ".data"

   Example output:

   {   "auto_rotate_period": 0,   "latest_version": 1,   "min_available_version": 0,   "min_decryption_version": 1,   "name": "credit-card",   "type": "aes256-gcm96"}

   The latest_version is 1.

2. Rotate the key for the credit-card transformation.

   $ curl --header "X-Vault-Token: $VAULT_TOKEN" \     --request POST \     $VAULT_ADDR/v1/transform/tokenization/keys/credit-card/rotate

3. Read the key information again.

   $ curl --header "X-Vault-Token: $VAULT_TOKEN" \     $VAULT_ADDR/v1/transform/tokenization/keys/credit-card | jq ".data"

   Example output:

   {   "auto_rotate_period": 0,   "latest_version": 2,   "min_available_version": 0,   "min_decryption_version": 1,   "name": "credit-card",   "type": "aes256-gcm96"}

   The latest_version is now 2.

4. Configure the key to be automatically rotated every 90 days to reduce operational overhead.

   $ curl --header "X-Vault-Token: $VAULT_TOKEN" \     --request POST \     --data '{ "auto_rotate_period": "90d" }' \     $VAULT_ADDR/v1/transform/tokenization/keys/credit-card/config

   Note

   The minimum permitted value for the auto_rotate_period is 1 hour.

5. Verify the configuration.

   $ curl --header "X-Vault-Token: $VAULT_TOKEN" \    $VAULT_ADDR/v1/transform/tokenization/keys/credit-card | jq ".data"

   Example output:

   {   "auto_rotate_period": 7776000,   "latest_version": 2,   "min_available_version": 0,   "min_decryption_version": 1,   "name": "credit-card",   "type": "aes256-gcm96"}

   The auto_rotate_period shows the time in seconds before the key is auto rotated.

   If the key gets compromised, you can rotate the key using the transform/tokenization/keys/<transformation_name>/rotate, and then set the min_decryption_version to the latest key version so that the older (possibly compromised) key will not be able to decrypt the data.

1. Create a new role, global-id.

   $ vault write transform/role/global-id transformations=passportSuccess! Data written to: transform/role/global-id

2. Create a store which points to the postgres.

   $ vault write transform/stores/postgres \     type=sql \     driver=postgres \     supported_transformations=tokenization \     connection_string="postgresql://{{username}}:{{password}}@$(docker inspect -f '{{range.NetworkSettings.Networks}}{{.IPAddress}}{{end}}' postgres):5432/root?sslmode=disable" \     username=root \     password=rootpassword

   Example output:

   Success! Data written to: transform/stores/postgres

3. Create a schema in postgres to store tokenization artifacts.

   $ vault write transform/stores/postgres/schema transformation_type=tokenization \    username=root password=rootpassword

   Example output:

   Success! Data written to: transform/stores/postgres/schema

4. Create a new transformation named, "passport" which points to the postgres store.

   $ vault write transform/transformations/tokenization/passport \    allowed_roles=global-id stores=postgres

   Example output:

   Success! Data written to: transform/transformations/tokenization/passport

5. Open another terminal and connect to the postgres container.

   $ docker exec -it postgres bash

6. Start psql.

   $ psql -U root

7. Verify that there is no entry.

   $ select * from tokens; storage_token | key_version | ciphertext | encrypted_metadata | fingerprint | expiration_time---------------+-------------+------------+--------------------+-------------+-----------------(0 rows)

8. Return to the terminal you were running Vault CLI, and encode some test data.

   $ vault write transform/encode/global-id \    transformation=passport \    value="123456789"

   Example output:

   Key              Value---              -----encoded_value    Q4tYgFXHxUS3PnQLiUnyH2JfGeEZQDFXMMaFXLU6MZfiix1tjqwgNX

9. Return to the postgres container, and check the data entry.

   $ select * from tokens;   storage_token        | key_version |       ciphertext          | encrypted_metadata | ...--------------------------+-------------+---------------------------+--------------------+-...\x128aa3c24699...snip... |           1 | \x1ee7cc3505e31...snip... |                    | ...(1 row)

   As you encode more data, the table entry grows.

10. Enter \q to quit the psql session.

11. Enter exit to exit out of the Docker container.

1. Create a new role named global-id.

   $ curl --header "X-Vault-Token: $VAULT_TOKEN" \    --request POST \    --data '{"transformations": ["passport"]}' \    $VAULT_ADDR/v1/transform/role/global-id

2. Create a API request payload which connects to the PostgreSQL database.

   $ tee payload-store.json <<EOF{   "type": "sql",   "supported_transformations": "tokenization",   "connection_string": "postgresql://{{username}}:{{password}}@$(docker inspect -f '{{range.NetworkSettings.Networks}}{{.IPAddress}}{{end}}' postgres):5432/root?sslmode=disable",   "driver": "postgres",   "username": "root",   "password": "rootpassword"}EOF

3. Create the store using the transform/stores/postgres endpoint.

   $ curl --header "X-Vault-Token: $VAULT_TOKEN" \    --request POST \    --data @payload-store.json \    $VAULT_ADDR/v1/transform/stores/postgres

4. Create a API request payload that creates a schema in the PostgreSQL database to store tokenization artifacts.

   $ tee payload-scm.json <<EOF{   "transformation_type": "tokenization",   "username": "root",   "password": "rootpassword"}EOF

5. Create the schema using the transform/stores/postgres/schema endpoint.

   $ curl --header "X-Vault-Token: $VAULT_TOKEN" \    --request POST \    --data @payload-scm.json \    $VAULT_ADDR/v1/transform/stores/postgres/schema

6. Create a new transformation named passport which points to the postgres store.

   $ curl --header "X-Vault-Token: $VAULT_TOKEN" \     --request POST \     --data '{ "allowed_roles": [ "global-id" ], "stores": "postgres" }' \     $VAULT_ADDR/v1/transform/transformations/tokenization/passport

7. Open another terminal and connect to the postgres container.

   $ docker exec -it postgres bash

8. Start psql.

   $ psql -U root

9. Verify that there is no entry in the table.

   $ select * from tokens; storage_token | key_version | ciphertext | encrypted_metadata | fingerprint | expiration_time---------------+-------------+------------+--------------------+-------------+-----------------(0 rows)

10. Return to the terminal you were executing the Vault API using cURL, and encode some test data.

    $ curl --header "X-Vault-Token: $VAULT_TOKEN" \     --request POST \     --data '{ "value": "123456789", "transformation": "passport"}' \     $VAULT_ADDR/v1/transform/encode/global-id | jq ".data"

    Example output:

    {  "encoded_value": "Q4tYgFXHxUTaU7ekcJhzZ9CUtzWmgMh4MmAXLiaSsVe4Y9TAsB3iAs"}

11. Return to the postgres container, and check the data entry.

    $ select * from tokens; storage_token        | key_version |       ciphertext          | encrypted_metadata | ...-------------------------+-------------+---------------------------+--------------------+-...\x128aa3c24699...snip... |           1 | \x1ee7cc3505e31...snip... |                    | ...(1 row)

    The table contains a row of data associated with the encode request. As you encode more data, the table entry grows.

12. Enter \q to quit the psql session.

13. Enter exit to exit out of the Docker container.

$ vault read -field=public_key transform/wrapping_key-----BEGIN PUBLIC KEY-----MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAttRvwFiW9kPtTutUeC3sQ3PXXrCOuHrUlAqJxH/nNj7HpuERSJg+HW70b16YCU7mo+lVhpD+bMW3WVzov3v3jXu6LSZYPZjlO8cEUtQQfydpWVC98cxjn8WCKrIeI+J211/xQQIsOT8sF9MYe11GPz/VGdEj+BKel7HWWD1nJ4i0Uo10iN76r0E5GioN8E5wK8L/11k/puEB3EcWhyPp6aQ8PUbFqU8cmChd2Jg+Cj0k81sp72vOPkDJ7oAekYeR/iIYUjUINlz2Yob/qt25AuF1t+TSLcI+RHzTetpL6/oHnbKdyM95MNq4XlELun4x2xOa4Q2EVkczwnb+X1kO0d3FL2dAmMVxCXQnMdd/e2rJx8HxQZX02R4IfojmvfD5x/yICYrqm6bmv9RzTCxEmyQMVUYZsEfXgCKffW0vmEZOFIKvLkI5iaaHqMPk3SCGpMnniybEFt7dmXAnswpEmtxf+5/gm+aTBOUmEWy0WYb+hHK0RXnUC9ScRWBd+eOMONEm+N7nUUS4e57+EnjHOrjshTEU/B2BO8DvfYyuYyFzBiWzCJywj2eOaQxYdg8Y05YgDrE1GVEOceErDxT8eoP/MQgUvVOAsD1KIAT5WmmNOCZ0HHAHjOKDdZ1FWtasNBjGJI7g5a1oCHuwl1p/CZ2i8Rd7XOEnWZ+ld7l+qS0CAwEAAQ==-----END PUBLIC KEY-----

The output is the (4096-bit RSA) wrapping key.

$ curl --header "X-Vault-Token: $VAULT_TOKEN" --request GET --silent \    $VAULT_ADDR/v1/transform/wrapping_key | jq

Example output:

{  "request_id": "aa998396-098f-391b-213e-572fd0882608",  "lease_id": "",  "renewable": false,  "lease_duration": 0,  "data": {    "public_key": "-----BEGIN PUBLIC KEY-----\nMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAttRvwFiW9kPtTutUeC3s\nQ3PXXrCOuHrUlAqJxH/nNj7HpuERSJg+HW70b16YCU7mo+lVhpD+bMW3WVzov3v3\njXu6LSZYPZjlO8cEUtQQfydpWVC98cxjn8WCKrIeI+J211/xQQIsOT8sF9MYe11G\nPz/VGdEj+BKel7HWWD1nJ4i0Uo10iN76r0E5GioN8E5wK8L/11k/puEB3EcWhyPp\n6aQ8PUbFqU8cmChd2Jg+Cj0k81sp72vOPkDJ7oAekYeR/iIYUjUINlz2Yob/qt25\nAuF1t+TSLcI+RHzTetpL6/oHnbKdyM95MNq4XlELun4x2xOa4Q2EVkczwnb+X1kO\n0d3FL2dAmMVxCXQnMdd/e2rJx8HxQZX02R4IfojmvfD5x/yICYrqm6bmv9RzTCxE\nmyQMVUYZsEfXgCKffW0vmEZOFIKvLkI5iaaHqMPk3SCGpMnniybEFt7dmXAnswpE\nmtxf+5/gm+aTBOUmEWy0WYb+hHK0RXnUC9ScRWBd+eOMONEm+N7nUUS4e57+EnjH\nOrjshTEU/B2BO8DvfYyuYyFzBiWzCJywj2eOaQxYdg8Y05YgDrE1GVEOceErDxT8\neoP/MQgUvVOAsD1KIAT5WmmNOCZ0HHAHjOKDdZ1FWtasNBjGJI7g5a1oCHuwl1p/\nCZ2i8Rd7XOEnWZ+ld7l+qS0CAwEAAQ==\n-----END PUBLIC KEY-----\n"  },  "wrap_info": null,  "warnings": null,  "auth": null}

The output is a JSON object with a data.public_key field containing the (4096-bit RSA) wrapping key.

Create a JSON payload containing ciphertext value and any additional parameters.

$ cat > payload.json << EOF{  "ciphertext": "ceXhQrVMuf70i2qL3DvQu/0AFhkPXAV6JyzbPdTs9A/Twjd8PGs/2XV3VhBgvhb4Fr1xWnVmIUKwxgP+emBlIqwpmoJsnkVNJSMpXP0YG+MkvheB9ATlfGXTlf6RLt7OaOtSSBxeVZQBtuWuVnbatTQiXhhC91J49V4+n1JiDjs0tRpz8hUxuzyedkjXWv8Mn0gD4nHV1GgrxLvNGPrrk2Y3xcZO4MoO3Lp447BjPTXwSwmR2rSOeW9+MsuYPfjx2dKC/uJRr6GM2wyyzaRu+5N+goNDaPzTAcNhutb/isf9wAOC3v8SGYXkF9919/ioxZKejWDscFLKBU/6O3+n7Zgf+NLJP/5qyjFOR6F/OnyXpEaOcD+5zpW0yppo/SqThS14E3jDIDmvwxiDBY0SHMBebLYx/t6Y29P+kAP3dPBXeHejHTZ0kJlQuKNcu2Ge1EkTFvR4vScvFlG4OcZIDzxwVxbS6IR83m/xeFyQhuMc/PntDvIJBnUb+AREtZCtNOcwh2Qei8iHfSttCNzROLRZ4ETaBUEKBBWKJztscDfKFOAGKiJIZeze+nVYK7sf94PMJF1r3ET75IyvwCXUEQoPtacg8nyUx6UVpp4BP6xzeOcEPKr1GPEj1kjcj43+rhozzzrs5AgTknQAcorpUwHFUezQtKWyEh/wastp6elX7V0IBL8YmKmWmbIz2hS+uH9TspQM9BnJL/ex18qgmpwIhfR40hzo", "allowed_roles": "legacy-system", "allow_rotation": true}EOF

Import the key.

$ curl \    --header "X-Vault-Token: $VAULT_TOKEN" \    --request POST \    --data @payload.json \    $VAULT_ADDR/v1/transform/transformations/tokenization/application-form/import

Create a JSON payload.

$ cat > payload.json << EOF{   "value": "887345",   "metadata": "organization=ColoTown,purpose=Server-Cage,type=PIN",   "transformation": "application-form"}EOF

Encode the values.

$ curl \    --silent \    --header "X-Vault-Token: $VAULT_TOKEN" \    --request POST \    --data @payload.json \    $VAULT_ADDR/v1/transform/encode/legacy-system | jq

Example output:

{  "request_id": "08754cc7-90a3-e68a-2824-0a35db768ccd",  "lease_id": "",  "renewable": false,  "lease_duration": 0,  "data": {    "encoded_value": "Q4tYgFXHxUXeL61wuEeFMMAeho1gXj8yw5VtNKNUY4NRdBCkvY9FRB"  },  "wrap_info": null,  "warnings": null,  "auth": null}

$ curl \    --silent \    --header "X-Vault-Token: $VAULT_TOKEN" \    --request GET \    $VAULT_ADDR/v1/transform/tokenization/keys/application-form | jq

Example output:

{  "request_id": "93d63de8-c83d-3190-3e6a-ec33ecdf8478",  "lease_id": "",  "renewable": false,  "lease_duration": 0,  "data": {    "auto_rotate_period": 0,    "latest_version": 1,    "min_available_version": 0,    "min_decryption_version": 1,    "name": "application-form",    "type": "aes256-gcm96"  },  "wrap_info": null,  "warnings": null,  "auth": null}

$ curl \    --silent \    --header "X-Vault-Token: $VAULT_TOKEN" \    --request GET \    $VAULT_ADDR/v1/transform/tokenization/keys/application-form | jq

Example output:

{  "request_id": "a01d18ea-8219-0187-12ce-d0012dfbeb18",  "lease_id": "",  "renewable": false,  "lease_duration": 0,  "data": {    "auto_rotate_period": 0,    "latest_version": 2,    "min_available_version": 0,    "min_decryption_version": 1,    "name": "application-form",    "type": "aes256-gcm96"  },  "wrap_info": null,  "warnings": null,  "auth": null}