Configuration | HashiCorp

No Fixed Server

Vault is self-hosted per tenant, so this node carries no base URL in application settings at all — unlike nodes that call one fixed public API. Every operation supplies its own target server via the vaultAddress config key:

Key	Required	Description
`vaultAddress`	✓ Yes	The tenant's Vault server base URL, e.g. `https://vault.internal.example.com:8200`.

Why no default: HashiCorpApiClientOptions (the HTTP client's own options class) deliberately carries no base URL field — only MaxRetries (default 2) and InitialRetryDelay (default 1s, doubling per attempt). Baking in a shared Vault address would be meaningless across tenants who each run their own server.

Project Layout

src/
├── BizFirst.Integration.HashiCorp.Domain     # 18 result records + shared value types, zero deps
├── BizFirst.Integration.HashiCorp.Services   # HTTP client, AppRole/Token auth, one service per resource
└── BizFirst.Ai.ExecutionNodes.Blockchain.HashiCorp  # Executor: routing, config parsing, DI registration

Project	Purpose
`BizFirst.Integration.HashiCorp.Domain`	Pure types: 18 result records (Secrets/Token/Lease/System) plus shared value types (`HashiCorpCallContext`, `HashiCorpSecretMetadata`, `HashiCorpSecretVersionInfo`, `HashiCorpTokenInfo`). No project references.
`BizFirst.Integration.HashiCorp.Services`	HTTP client with no fixed host, AppRole/Token credential resolution and caching, one service class per resource (`HashiCorpSecretService`, `HashiCorpTokenService`, `HashiCorpLeaseService`, `HashiCorpSystemService`).
`BizFirst.Ai.ExecutionNodes.Blockchain.HashiCorp`	The ExecutionNode itself: `HashiCorpNodeExecutor` (routing), settings/operation-info classes, DI registration via `HashiCorpDependency`.

Targets .NET 9. Node type code: hashicorp.

Registration

HashiCorpDependency.RegisterDefaults(services) registers:

The Vault HTTP client and per-resource services (AddDependenciesHashiCorpServices())
HashiCorpNodeExecutor, scoped
The ExecutorRegistry entry for node type hashicorp

Registration alone is not enough: per this codebase's plugin-loading mechanism (ServiceCollectionExtensionsForAI.cs), an assembly that is only ProjectReference'd but never force-loaded is not guaranteed to appear in AppDomain.CurrentDomain.GetAssemblies() when the assembly-scanning RegisterNodeExecutors() runs. Host applications must also call new HashiCorpDependency().RegisterDefaults(services); explicitly in their node-plugin bootstrap — alongside the equivalent lines already present for Ethereum and IPFS.

Credential Records

This node never stores a Vault credential itself — it resolves one from a BizFirst credential record via credentialID. See Authentication for exactly how authMethod: "token" and authMethod: "appRole" each map to a stored record type.