> ## Documentation Index > Fetch the complete documentation index at: https://orbit.nckrtl.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Set up Vaultwarden > Logs in to Vaultwarden with the account API key, unlocks it with the master password, finds the organization and collection by name or ID, and checks that the account can write to the collection. Only then stores the values, encrypted. `url` must be an HTTPS origin on a `.orbit` host, and the Gateway trusts only the Orbit root CA; another origin returns `validation.failed` (422). Returns `vault.login_failed`, `vault.kdf_unsupported`, `vault.organization_missing`, `vault.collection_missing`, or `vault.collection_read_only` (422), and `vault.items_published` (409) for another organization or collection while items are published. No response or Activity entry returns the client secret or the master password, but this tool takes them as arguments, so they reach the caller transcript; the CLI reads them from files. ## OpenAPI ````yaml /openapi.json put /api/v1/vault openapi: 3.1.0 info: title: Orbit Gateway API version: v1 description: >- The HTTP API of the active Orbit Gateway. The CLI and the PHP SDK send every fleet command through these endpoints over WireGuard. See [Using the API](/api/overview) for transport, authentication, envelopes, and errors. servers: - url: https://gateway.orbit description: >- The active Gateway on the private WireGuard network, resolved by Orbit private DNS. security: [] tags: - name: Gateway description: >- Status and trust of the active Gateway, and the releases of the Gateway itself. - name: Nodes description: Machines in the fleet, their roles, access grants, and storage settings. - name: Clusters description: Groups of Nodes with one Router and one development TLD. - name: Firewall description: Named UFW rules on one Node. - name: Fleet rollout description: >- The rollout of each verified Gateway release to the managed Nodes, and its catch-up. - name: Tools description: Packages that Orbit installs on a Node through a Tool Manager. - name: Metrics description: The Prometheus and Grafana role and its exporters. - name: GitHub App description: The Gateway's own read-only GitHub App and the accounts that installed it. - name: Analytics description: >- The analytics role, its Plausible version, and the Stats API key the Gateway uses to read visits. - name: Projects description: Repository records with one type, default branch, and web root each. - name: Instances description: Development checkouts and production releases of a Project on one Node. - name: Environment description: Stored Instance environment configuration and its .env projection. - name: Routes description: Domains that reach an Instance. - name: Database connections description: The registry of mysql, pgsql, and sqlite connections. - name: Processes description: >- systemd services and Docker containers owned by an Instance, a Node, or a Project definition. - name: Schedules description: Recurring commands run by native systemd timers. - name: Annotations description: Instance annotations, T3 delivery, and replayable status events. - name: Tasks description: Commander feature groups and ordered subtasks. - name: Extensions description: Gateway-owned extension switches. - name: Doctor description: Verify-only drift checks across the fleet. - name: Activities description: The Gateway log of authorized commands. - name: proxycli description: CLIProxyAPI quota snapshots, provider pools, and account controls. - name: Vaultwarden description: The copy of database credentials into a Vaultwarden collection. - name: Conn description: >- Profiles, shared workspace settings, registered T3 servers, and the pairing links the Gateway mints on them for each Node. - name: Realtime description: >- The record-change event feed broadcast to Reverb, its channel authorization, and Reverb connection discovery. - name: Node callbacks description: Endpoints that managed Nodes and Caddy call; operators do not call them. paths: /api/v1/vault: put: tags: - Vaultwarden summary: Set up Vaultwarden description: >- Logs in to Vaultwarden with the account API key, unlocks it with the master password, finds the organization and collection by name or ID, and checks that the account can write to the collection. Only then stores the values, encrypted. `url` must be an HTTPS origin on a `.orbit` host, and the Gateway trusts only the Orbit root CA; another origin returns `validation.failed` (422). Returns `vault.login_failed`, `vault.kdf_unsupported`, `vault.organization_missing`, `vault.collection_missing`, or `vault.collection_read_only` (422), and `vault.items_published` (409) for another organization or collection while items are published. No response or Activity entry returns the client secret or the master password, but this tool takes them as arguments, so they reach the caller transcript; the CLI reads them from files. operationId: vault-setup requestBody: required: true content: application/json: schema: type: object properties: url: type: string format: uri maxLength: 2048 description: Vaultwarden origin, for example https://vault.orbit client_id: type: string maxLength: 255 description: The client_id of the Gateway account personal API key client_secret: type: string maxLength: 1024 master_password: type: string maxLength: 1024 organization: type: string maxLength: 255 description: Organization name or ID collection: type: string maxLength: 255 description: Collection name or ID in that organization required: - url - client_id - client_secret - master_password - organization - collection additionalProperties: false responses: '200': description: The request succeeded. content: application/json: schema: type: object properties: data: type: object required: - configured - url - email - organization - collection - items - pending - skipped - last_synced_at - last_error properties: configured: type: boolean description: True while Vaultwarden is set up. url: type: - string - 'null' email: type: - string - 'null' description: Email of the Gateway account. organization: type: - object - 'null' properties: id: type: string name: type: string collection: type: - object - 'null' properties: id: type: string name: type: string items: type: integer description: Published items. pending: type: integer description: Wanted items that are not published or not current. skipped: type: array items: type: object properties: source: type: string slug: type: string username: type: - string - 'null' reason: type: string enum: - incomplete - password_unknown last_synced_at: type: - string - 'null' last_error: type: - object - 'null' properties: code: type: string message: type: string meta: $ref: '#/components/schemas/Meta' required: - data - meta '403': description: >- The caller is not an active WireGuard peer (`peer.identity_unknown`) or lacks Node access to the target (`node_access.required`). content: application/json: schema: $ref: '#/components/schemas/Error' '409': description: >- A guard refused the change and the Gateway changed nothing; `error.code` names the guard. content: application/json: schema: $ref: '#/components/schemas/Error' '422': description: >- The JSON body is not an object, has duplicate or unknown members, or fails validation (`validation.failed`). content: application/json: schema: $ref: '#/components/schemas/Error' x-codeSamples: - lang: bash label: curl source: | curl -sS -X PUT "https://gateway.orbit/api/v1/vault" \ --cacert /path/to/orbit-root-ca.pem \ -H 'Accept: application/json' \ -H 'X-Orbit-Request-Id: 9d6b1e5c-4a3f-4a1b-9f0e-6d2c3f5a7b81' \ -H 'Content-Type: application/json' \ -d '{"url": "example", "client_id": "example", "client_secret": "example", "master_password": "example", "organization": "example", "collection": "example"}' - lang: php label: PHP SDK source: | send(new SetupVaultRequest( url: 'value', clientId: 'value', clientSecret: 'value', masterPassword: 'value', organization: 'value', collection: 'value', ))->dto(); components: schemas: Meta: type: object properties: request_id: type: string format: uuid description: >- The request ID the Gateway assigned or accepted; the same value is in the `X-Orbit-Request-Id` response header and in the Activity record. required: - request_id Error: type: object properties: error: type: object properties: code: type: string description: >- Stable error code, namespaced by family, such as `node.not_active` or `route.target_conflict`. message: type: string description: >- Safe message without credentials, environment values, or remote output. details: type: object additionalProperties: true description: >- Bounded, redacted details such as the conflicting record IDs or the failed validation rule. request_id: type: string format: uuid required: - code - message required: - error ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.