Roles & Key Distribution

Team vault access is governed by your role, and because the vault is end-to-end encrypted, every member also needs the team key wrapped just for them. This page explains who can do what, and how that key reaches each person.

Role matrix

Each team member holds one of four roles. Higher roles inherit everything the lower roles can do.

How the team key reaches each member

Because the vault is end-to-end encrypted, each member — and each of their devices — needs the team key wrapped specifically for them before they can decrypt anything.

• GET /api/team/vault/keys returns your wrapped keys. You only ever receive your own wrapped key; you never see another member's wrapped key.
• POST /api/team/vault/keys (admin/owner only) grants a wrapped key to a recipient. The request body takes recipient_user_id, wrapped_key, and key_version.
• DELETE /api/team/vault/keys/{id} (admin/owner only) revokes a recipient's key.

Two limits apply when distributing:

• The recipient must already be a member of the same team. Distributing a key to a non-member is rejected with 422.
• wrapped_key is capped at 64 KiB.

Rotating the key

When you need to move the whole team to a new key — for example after a member leaves — an admin or owner rotates it.

• POST /api/team/vault/rotate (admin/owner only) bumps the key_version and accepts freshly re-wrapped keys for members, and optionally re-encrypted entries.
• Rotation runs atomically: keys and entries move to the new version together, so no member is ever left holding a key that can't decrypt the current entries.

Error responses

If a call fails, check your role first, then confirm the team's license is present and valid.