Which Vault API Path Should You Use to Encrypt Data with the Transit Engine?
A DevOps team needs to encrypt sensitive configuration data before storing it in a version control system. They want to use Vault's encryption as a service to encrypt the data using a named encryption key. Which Vault path should they use to perform the encryption?
Quick Answer
The answer is POST /v1/transit/encrypt/my-key. This is the correct path because the Transit secrets engine functions as Vault’s encryption-as-a-service, and the /encrypt endpoint is specifically designed to accept plaintext data and apply encryption using a named key, such as ‘my-key’, which must already exist in the engine. On the HashiCorp Vault Associate VA-003 exam, this question tests your understanding of the Transit engine’s core API structure and its role in securing data at rest or in transit without exposing the key material. A common trap is confusing the /encrypt path with /encrypt/data or the /transit/keys endpoint, which is used for key management, not data encryption. To remember, think of the pattern: transit/encrypt/{key-name} — the verb is always the action (encrypt) and the key name is the last segment, just like a file path.
⚠ Common exam trap
HashiCorp often tests the distinction between encryption (/encrypt), signing (/sign), and HMAC (/hmac) endpoints, and candidates frequently confuse the purpose of /encrypt with /sign or /hmac because all three involve cryptographic operations on data.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
POST /v1/transit/encrypt/my-key
The correct path for encrypting data using Vault's encryption-as-a-service is POST /v1/transit/encrypt/my-key. The Transit secrets engine provides encryption as a service, and the /encrypt endpoint is specifically designed to encrypt plaintext data using a named encryption key. The key name 'my-key' in the path identifies which key in the Transit engine should be used for the encryption operation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
POST /v1/transit/encrypt/my-key
Why this is correct
The encryption endpoint is /encrypt under the transit engine path, providing encryption as a service.
- ✗
POST /v1/transit/sign/my-key
Why it's wrong here
This path is used for signing data, not encryption.
- ✗
POST /v1/transit/hmac/my-key
Why it's wrong here
This path computes an HMAC, not encryption.
- ✗
POST /v1/transit/random
Why it's wrong here
This endpoint generates random bytes, not encrypts data.
- ✗
POST /v1/transit/decrypt/my-key
Why it's wrong here
This path is used for decryption, not encryption.
Go deeper
Related to this question
About these practice questions
Courseiva writes every VA-003 question from scratch — 498 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on VA-003
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A developer wants to encrypt data using Vault's transit engine with a key named 'payment-key'. The key already exists and is set to allow encryption. Which API path should the developer use to encrypt the data?
easy- A.POST /v1/transit/decrypt/payment-key
- B.POST /v1/transit/rewrap/payment-key
- C.POST /v1/transit/keys/payment-key
- ✓ D.POST /v1/transit/encrypt/payment-key
Why D: The Vault transit engine exposes the `/v1/transit/encrypt/<key_name>` endpoint for encrypting plaintext data using a named encryption key. Since the key 'payment-key' already exists and is allowed to encrypt, a POST request to this path will perform the encryption operation and return the ciphertext.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.