Vault

The Vault is the place where an instance keeps the values that its integrations need but nobody should see in plain text: mail server passwords, partner API keys, hospital system tokens. Configuration screens refer to a vault entry by name, and the server substitutes the real value only at the moment it is used.

Entry types

Type	Stored as	Shown in the interface	Use for
Secret	Encrypted at rest	Masked, never revealed	Passwords, tokens, API keys
Variable	Plain value	Visible	Base URLs, identifiers, feature switches, non-sensitive settings

Both types can be enabled or disabled. A disabled entry cannot be resolved, which makes every configuration that references it fail clearly instead of silently using an old value.

Managing entries

Open Admin Panel → Configuration → Vault and choose Add Entry.

Field	Notes
Key	The name used in references. Lowercase letters, digits and underscores, for example smtp_password.
Type	Secret or Variable.
Value	The value. For secrets, leave the field empty when editing to keep the current value.
Description	What the entry is for and who owns it.
Enabled	Whether the entry may be resolved.

Editing a secret replaces the value; the previous value is not recoverable. Deleting an entry breaks any configuration that references it, so disable first, check that nothing fails, then delete.

Referencing an entry

Anywhere a configuration accepts a vault reference, write the reference instead of the value:

Reference form	Resolves to
$secret:key	The decrypted value of the Secret named key.
$var:key	The value of the Variable named key.
$file:path	The contents of a file mounted into the instance. Reserved for deployment-managed credentials and enabled by the operator; see Deploying an Instance.

A reference must be the whole field value. $secret:smtp_password is a reference; Bearer $secret:token is a literal string.

Places that accept references:

• Plugin instance configuration. Fields that may hold a reference show a vault picker: search entries by key or description, filter by type, and pick one. See Plugins.
• Workflow node inputs and mappings, for example the API key header of an HTTP node. See Workflows.
• Clinical source credentials. See Clinical Sources (EHR).
• Configuration overrides (below).

References are resolved on the server immediately before use. They are never included in run histories, delivery logs or API responses.

Rotating a credential

1. Obtain the new value from the external system.
2. Edit the vault entry and paste the new value.
3. Nothing else changes: every plugin instance, workflow and clinical source that references the entry uses the new value from the next call onward.

This is the main reason to reference entries instead of typing values into configurations.

Configuration overrides

Some instance settings can be changed at runtime from a Variable or Secret without redeploying. Which settings are overridable is defined by the platform; a typical example is switching a feature from dry-run to enforced. The operator documentation lists the overridable keys and the naming convention for the corresponding vault entries.

Permissions

Viewing the Vault tab requires vault read rights; creating, editing, enabling and deleting entries require vault write rights. Neither is part of the standard clinician role. Resolving a reference does not require vault rights: a workflow authored by an administrator can use a secret that the person triggering the event cannot read.

Troubleshooting

Symptom	Likely cause	What to do
A plugin action fails with "unresolved reference"	The key does not exist, is misspelled or is disabled	Compare the reference with the Vault list; enable the entry.
A configuration field refuses the reference	The field type does not accept references (a choice list or a date)	Enter a literal value for that field.
The external system rejects the credential after rotation	The new value was pasted with whitespace, or is not yet valid on the other side	Re-enter the value; confirm activation with the provider.
The value column shows only asterisks	Expected for secrets	No action; secrets are never displayed.