Restore soft deleted key/value data

You can restore data from soft deletes in the kv v2 plugin as long as the destroyed metadata field for the targeted version is false.

Assumptions

You have set up a kv v2 plugin.
Your authentication token has create and update permissions for the kv v2 plugin.

Use vault kv undelete with the -versions flag to restore soft deleted version of key/value data:

$ vault kv undelete             \   -mount <mount_path>          \   -versions <target_versions>  \   <secret_path>

For example:

$ vault kv undelete -mount shared -versions 1,4 dev/square-apiSuccess! Data deleted (if it existed) at: shared/data/dev/square-api

The deletion_time metadata field for versions 1 and 4 is now n/a:

$ vault kv metadata get -mount shared dev/square-api======== Metadata Path ========shared/metadata/dev/square-api========== Metadata ==========Key                     Value---                     -----cas_required            falsecreated_time            2024-11-13T21:51:50.898782695Zcurrent_version         4custom_metadata         <nil>delete_version_after    0smax_versions            5oldest_version          0updated_time            2024-11-14T22:32:42.29534643Z====== Version 1 ======Key              Value---              -----created_time     2024-11-13T21:51:50.898782695Zdeletion_time    n/adestroyed        false...====== Version 4 ======Key              Value---              -----created_time     2024-11-14T22:32:42.29534643Zdeletion_time    n/adestroyed        false

Open the data page for your kv plugin:
1. Open the GUI for your Vault instance.
2. Login under the namespace for the plugin or select the namespace from the selector at the bottom of the left-hand menu and re-authenticate.
3. Select Secrets Engines from the left-hand menu.
4. Select the mount path for your kv plugin.

Click through the path segments to select the relevant secret path.
Select the appropriate data version from the Version dropdown.
Click Undelete.

Partial screenshot of the Vault GUI showing the deleted version message

Make a POST call to /{plugin_mount_path}/undelete/{secret_path} with the data versions you want to restore:

$ curl                                       \   --request POST                            \   --header "X-Vault-Token: ${VAULT_TOKEN}"  \   --data '{"versions":[<target_versions>]}  \   ${VAULT_ADDR}/v1/<plugin_mount_path>/undelete/<secret_path>

For example:

$ curl                                       \    --request POST                           \    --header "X-Vault-Token: ${VAULT_TOKEN}" \    --data '{"versions":[5,8]}'              \    ${VAULT_ADDR}/v1/shared/undelete/dev/square-api | jq