Vaults

Vaults are how secrets are organized. Every account has a personal vault; team vaults are shared with the members of an org.

Your personal vault

Created for you automatically — no setup, no password to remember. Anything you save without picking a team vault lands there, private to you.

Team vaults

A team vault belongs to an org. Members see it according to their role, and the vault carries the caller's permission and an owner flag — the API enforces both. Create, rename, and delete vaults from the Secrets panel (Connections → Secrets).

What a vault holds

Two record types:

• Items — the typed, current system of record: AI provider keys, API keys, database credentials, environment variables, certificates, SSH keys, webhooks, and more. Each item has a name, a value, and a category.
• Notes — freeform reference material kept alongside the items.

The API

The vault REST surface sits behind authentication — the same endpoints Poly's own clients call:

Action	Request
List vaults	GET /api/vaults
Create a vault	POST /api/vaults
Delete a vault	DELETE /api/vaults/{id}
List a vault's notes	GET /api/vaults/{vault_id}/notes
Read one note	GET /api/vaults/{vault_id}/notes/{note_id}

Vault limits by plan are not published yet — this page carries the table when they are.