Vault

Your vault: your own entries and the shared ones.

Says whether each has a secret, never what it is. 423 until the PIN has been entered.

curl "$MORSE/vault" \
  -H "Authorization: Bearer $MORSE_TOKEN"

[
  {
    "can_manage": true,
    "has_secret": true,
    "id": "3f9c1a24-5e6f-4b31-9a77-1b2c3d4e5f60",
    "label": "…",
    "notes": "…",
    "shared": true,
    "updated_at": "2026-10-02T10:30:00+05:30",
    "url": "https://onmorse.com/priya",
    "username": "…"
  }
]

Add a vault entry, such as a login, link or password, private or shared.

curl -X POST "$MORSE/vault" \
  -H "Authorization: Bearer $MORSE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "label": "…" }'

{
  "can_manage": true,
  "has_secret": true,
  "id": "3f9c1a24-5e6f-4b31-9a77-1b2c3d4e5f60",
  "label": "…",
  "notes": "…",
  "shared": true,
  "updated_at": "2026-10-02T10:30:00+05:30",
  "url": "https://onmorse.com/priya",
  "username": "…"
}

Give this session's five minutes back, before they run out.

Another session keeps its own.

curl -X POST "$MORSE/vault/lock" \
  -H "Authorization: Bearer $MORSE_TOKEN"

Whether this member has a vault PIN and whether it is currently open.

What the page asks before it draws anything.

curl "$MORSE/vault/pin" \
  -H "Authorization: Bearer $MORSE_TOKEN"

{
  "factor": "app",
  "has_pin": true,
  "locked_out_until": "…",
  "seconds_left": 1,
  "unlocked": true
}

Set or change the vault PIN.

Changing one needs the current one, so a session left open cannot replace the second factor with one its finder knows.

curl -X PUT "$MORSE/vault/pin" \
  -H "Authorization: Bearer $MORSE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "pin": "…" }'

Forget the vault PIN, so the vault answers again and the page offers to set a new one. The way back from a forgotten PIN.

Needs a token from /api/auth/reauth/* minted for this same user in the last five minutes, sent as X-Morse-Recent-Auth — the same proof a hard voice-note delete takes. Behind a fresh sign-in rather than behind the PIN, because the PIN is the thing that has been forgotten. Unlike that delete, an API token is **not** proof here: a token is a standing credential, and one that could drop the vault's second factor would be a way round it rather than a way back.

curl -X DELETE "$MORSE/vault/pin" \
  -H "Authorization: Bearer $MORSE_TOKEN" \
  -H "x-morse-recent-auth: …"

Whether this member has an authenticator app set up, and how many recovery codes they have left.

curl "$MORSE/vault/totp" \
  -H "Authorization: Bearer $MORSE_TOKEN"

{
  "enrolled": true,
  "pending": true,
  "recovery_codes_left": 1
}

Make a secret for an app to scan. Nothing is gated by it until a code from the app comes back to /totp/confirm — beginning must not be able to lock someone out of their own vault.

Behind the gate that is already there. Without that, the laptop left open in a meeting room — the case the PIN exists for — could enrol its own app over the owner's PIN, which both opens the vault for the intruder and stops the owner's PIN working, since the app replaces it. Replacing a factor must be at least as hard as using one. With no factor set up yet require_open returns straight away, so a first enrolment is unchanged.

curl -X POST "$MORSE/vault/totp" \
  -H "Authorization: Bearer $MORSE_TOKEN"

{
  "secret": "…",
  "uri": "…"
}

Turn the authenticator app off.

Behind the same fresh sign-in as forgetting a PIN: turning the second factor off must take more than an open session, or it is not a second factor.

curl -X DELETE "$MORSE/vault/totp" \
  -H "Authorization: Bearer $MORSE_TOKEN" \
  -H "x-morse-recent-auth: …"

Finish setting up the app, and hand back the recovery codes. This is the only time they can be read.

Behind the existing gate as well as /totp: confirming is the half that actually changes which factor the vault asks for.

curl -X POST "$MORSE/vault/totp/confirm" \
  -H "Authorization: Bearer $MORSE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "code": "4KJ9P2" }'

{
  "recovery_codes": [
    "…"
  ]
}

Open the vault for five minutes.

Wrong PINs are counted and then held off.

curl -X POST "$MORSE/vault/unlock" \
  -H "Authorization: Bearer $MORSE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "pin": "…" }'

{
  "seconds": 1
}

Change a vault entry.

Anyone may edit a shared one; only its creator may make it private.

curl -X PUT "$MORSE/vault/3f9c1a24-5e6f-4b31-9a77-1b2c3d4e5f60" \
  -H "Authorization: Bearer $MORSE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "label": "…" }'

{
  "can_manage": true,
  "has_secret": true,
  "id": "3f9c1a24-5e6f-4b31-9a77-1b2c3d4e5f60",
  "label": "…",
  "notes": "…",
  "shared": true,
  "updated_at": "2026-10-02T10:30:00+05:30",
  "url": "https://onmorse.com/priya",
  "username": "…"
}

Delete a vault entry: your own, or a shared one you created.

curl -X DELETE "$MORSE/vault/3f9c1a24-5e6f-4b31-9a77-1b2c3d4e5f60" \
  -H "Authorization: Bearer $MORSE_TOKEN"

Decrypt one entry's secret and return it.

Logged, and never cached.

curl -X POST "$MORSE/vault/3f9c1a24-5e6f-4b31-9a77-1b2c3d4e5f60/reveal" \
  -H "Authorization: Bearer $MORSE_TOKEN"

{
  "secret": "…"
}