> For the complete documentation index, see [llms.txt](https://wiki.datadike.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://wiki.datadike.com/pam/administration/accounts/vault-entries.md).

# Vault entries and folders

Storing credentials that no automation manages, organising them in folders, sharing them with named permissions, and revealing a secret behind MFA.

## What this is and when to use it

Not every credential belongs to a managed asset. A certificate authority login, a supplier portal, a registrar, a licence account: things a team needs, that no rotation job can reach, and that otherwise end up in a spreadsheet.

**Vault** holds those. Each credential is an **entry**; entries live in **folders**; and both can be shared with named users and groups under explicit permissions. Revealing a secret requires a second factor, and every entry keeps the history of its previous values.

{% hint style="info" %}
This is a different store from the secrets of managed accounts. A managed account's credential is held against an asset and is rotated, pushed and used to open sessions; see [The credential vault](/pam/administration/accounts/vault.md). A Vault entry is held by a person, shared by hand, and never pushed anywhere. Use managed accounts for what the solution connects to, and Vault for everything else the team has to keep.
{% endhint %}

## Folders

![The Vault screen, with folders, credentials and the detail pane](https://1085357737-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7xzJyi9JVzRwnV6JzUho%2Fuploads%2Fgit-blob-391988f3befec66e5058a5012381646722037ed7%2Fvault-entries.png?alt=media)

**1** How many folders and credentials the vault holds. **2** A folder, with its own count and its private state. **3** A credential shared with someone else. **4** New Credential, which opens the entry form.

Every user gets a **Default** folder, created automatically. It cannot be renamed, changed or deleted, and it is where anything without an explicit folder lands.

Beyond that, you create folders freely. Two behaviours are worth knowing before you organise anything:

* An entry saved without a folder goes to **your** Default folder.
* **Deleting a folder does not delete its entries.** They are moved to Default. That is deliberate, and it means a folder deletion is never a credential loss.

## Entries

| Field               | Required | What it holds                   |
| ------------------- | -------- | ------------------------------- |
| Site or application | Yes      | The name of the service         |
| Username            | Yes      | The login or e-mail             |
| Password            | Yes      | The secret. Stored encrypted    |
| URL                 | No       | Address of the service          |
| Folder              | No       | Defaults to your Default folder |
| Comment             | No       | Free note                       |

## Sharing

An entry or a folder is shared with users, with groups, or with both. Each share carries up to four permissions, and they are **cumulative**:

| Permission   | What it allows                                                     |
| ------------ | ------------------------------------------------------------------ |
| `can_view`   | See the folder or entry. **The default when nothing is specified** |
| `can_create` | Create entries inside the folder. Only meaningful on a folder      |
| `can_update` | Edit the entry                                                     |
| `can_delete` | Delete the entry                                                   |

Three rules decide what someone can actually do:

1. **`can_update` and `can_delete` imply `can_view`.** You do not have to grant view separately.
2. **Only the owner manages sharing.** Nobody who received a share can re-share it, rename the folder, or change who else has it.
3. **Folder and entry permissions combine, and the more permissive wins.** `can_view` on the folder plus `can_update` on one entry means the person edits that entry and only reads the rest.

{% hint style="warning" %}
**`can_update` on a folder applies to every entry in it**, including entries added later. Grant it when you mean "this person maintains this folder", not when you mean "this person may fix one password".

Note also that changing shares is a **total replacement**: the list you submit becomes the whole set. Sending an empty list removes every share.
{% endhint %}

### Who can do what

| Action                          | Owner | `can_view` | `can_create` | `can_update` | `can_delete` |
| ------------------------------- | ----- | ---------- | ------------ | ------------ | ------------ |
| See the entry in the list       | Yes   | Yes        | Yes          | Yes          | Yes          |
| See the entry detail            | Yes   | Yes        | Yes          | Yes          | Yes          |
| Reveal the secret, with MFA     | Yes   | Yes        | Yes          | Yes          | Yes          |
| Create an entry in the folder   | Yes   | No         | Yes          | No           | No           |
| Edit the entry                  | Yes   | No         | No           | Yes          | No           |
| Delete the entry                | Yes   | No         | No           | No           | Yes          |
| See the folder                  | Yes   | Yes        | Yes          | Yes          | Yes          |
| Create, rename, delete a folder | Yes   | No         | No           | No           | No           |
| Change the folder's sharing     | Yes   | No         | No           | No           | No           |

{% hint style="danger" %}
**Any level of share can reveal the secret.** `can_view` is enough. There is no permission that grants "see that this entry exists" without also granting the password behind a second factor. Share an entry only with people who may hold the credential itself.
{% endhint %}

## Revealing a secret

Reading a password in clear is a separate, read-only operation and **requires MFA confirmation**, regardless of the permission that granted access to the entry. Passing the normal login is not enough.

## Password history

Every entry keeps its previous values. The history records, for each change:

| Field  | What it holds        |
| ------ | -------------------- |
| Secret | The previous value   |
| Date   | When it was replaced |
| User   | Who replaced it      |

This is what answers "what was this password in March", and it is also how a change made by the wrong person is undone.

## Importing from a spreadsheet

Credentials already living in a spreadsheet can be loaded in one pass.

1. Download the import template, as **XLSX** or **CSV**. In the XLSX, the required columns are marked in red and the optional ones in blue.
2. Fill it in. The columns are the entry fields above.
3. Upload the filled file.

A folder named in the file that does not exist yet **is created automatically**. A row with no folder goes to Default.

Only `.xlsx` and `.csv` are accepted.

## How to verify it worked

1. **Create an entry, share it with one colleague as `can_view`, and ask them to open it.** Confirm they see it, and confirm the reveal asks them for a second factor.
2. **Ask the same colleague to try to edit it.** They should not be able to. This is the check that catches a share granted wider than intended.
3. **Change a password and open the history.** The previous value, the date and your username should be there.
4. **After an import, count the entries** and open one from a folder the file created. A row whose folder name had a typo creates a folder, it does not fail, so a miscount is how you find those.

## Common errors

| Symptom                                                  | Cause                                                                                     | Fix                                                                      |
| -------------------------------------------------------- | ----------------------------------------------------------------------------------------- | ------------------------------------------------------------------------ |
| Someone can edit entries you meant them only to read     | They hold `can_update` on the **folder**, which covers every entry in it                  | Move the permission to the individual entry                              |
| A share you added disappeared                            | Shares are replaced wholesale, not merged. A later update submitted without it removed it | Resubmit the complete list of shares                                     |
| An entry is not in the folder you expected               | It was saved without a folder, so it went to your Default                                 | Move it, and set the folder explicitly next time                         |
| Entries survived a folder you deleted                    | That is the intended behaviour                                                            | They are in Default                                                      |
| The secret will not reveal                               | MFA is not confirmed, or not configured for the user                                      | See [Multi-factor authentication](/pam/administration/identities/mfa.md) |
| The import is refused                                    | The file is not `.xlsx` or `.csv`, or it is corrupt                                       | Re-export from the template                                              |
| A colleague cannot create entries in a folder you shared | `can_view` does not include creating                                                      | Grant `can_create` on the folder                                         |

## Related pages

* [The credential vault](/pam/administration/accounts/vault.md) — the secrets of managed accounts, which are a different store
* [Managed accounts](/pam/administration/accounts/managed-accounts.md) — credentials the solution rotates and uses to open sessions
* [Multi-factor authentication](/pam/administration/identities/mfa.md) — the second factor every reveal requires
* [Users and groups](/pam/administration/identities/users-and-groups.md) — who a folder or entry can be shared with