The Vault management API, a visual guide

[dnl]

First things first - BITWARDEN CLI

The Vault Management API allows most actions that can be taken by the Bitwarden CLI to be taken in the form of RESTful API calls from an HTTP interface. Using the Vault Management API request that you use the servecommand from the CLI to start a local express web server from which to make requests. Password Manager APIs | Bitwarden

The setup

bw status

If you are self hosting - Ensure that you run bw status to check which server you are trying to authenticate from and that you configure your domain.

an example of configuring your server to authenticate against(self hosted)

CLI bw login fails is an example of a user authenticating using the wrong server. This can also be caused by using the Organization API Key instead of the Personal API key if using login via API Key

Choose the login method of your preference here

Once authenticated you should receive this popup, after this is confirmed - you’re good to go!

bw serve

To access the vault management api - which is basically a way to ‘perform’ CLI commands via an API

bw serve

The bw serve command is crucial in setting up a local express web server - If no port is specified, it defaults to port 8087.

You should now able to make calls using API calls on my local server using port 8080!

Time to play around!

There are multiple ways to make api calls to the api using different tools -

Thunderclient(https://www.thunderclient.com/)

Postman(https://www.postman.com/)

Curl using CLI(How to Make Basic API Requests (Part 2: Using cURL) | by Joon Solutions | Joon Solutions Global | Medium)

An example request using Postman

There are a bunch of endpoints that are defined in the API Documentation that can be explored.

[ben.jenkins (Woolfie)]

This doesn’t really explain what the API is intended for, and nor does the documentation, and that quoted line.. yikes. From what I’m gathering from different posts and AI explanations, the ‘Vault Management API’ is really just ‘CLI Usage’ API, for…. idk, whatever scenario you would start the CLI, start an express server, but then have everything after that come from REST queries from somewhere.

If this is right, it would be useful if somewhere, the following words were included: ‘This is not an API to authenticate and pull specific vault items from the cloud. It is an API to control the CLI, which authenticates to the cloud, and pulls your entire vault into memory’, so people can be fully aware before they host a server to take API calls to a fully-authenticated BitWarden client