Examples

1. Pre-flight check before a batch of secret reads

Confirm the vault is reachable and unsealed before spending an authenticated call on anything else.

Step 1 — HashiCorp: system/sealStatus
  vaultAddress: https://vault.internal.example.com:8200
→ if sealed == true: route to notification/error path
→ if sealed == false: continue

Step 2 — HashiCorp: secrets/read
  vaultAddress: https://vault.internal.example.com:8200
  authMethod: token
  credentialID: 42
  mount: secret
  path: myapp/db-creds

2. Rotate a config value with Check-And-Set

Read the current version first, then write with cas set to that version so a concurrent writer can't silently overwrite the change.

Step 1 — HashiCorp: secrets/read
  mount: secret, path: myapp/feature-flags
→ output.version = 7

Step 2 — HashiCorp: secrets/write
  mount: secret, path: myapp/feature-flags
  data: { "newFeatureEnabled": "true" }
  cas: 7   # from Step 1's output.version
→ fails with HASHICORP_CAS_MISMATCH if someone else wrote version 8 in between

3. Use, then revoke, a dynamic database credential

A database secrets engine (issued outside this node) hands your workflow a lease ID; this node manages that lease's lifecycle.

Step 1 — (database engine, elsewhere) issues:
  leaseID = "database/creds/readonly/2f6a19b3"

Step 2 — HashiCorp: lease/lookup
  leaseID: database/creds/readonly/2f6a19b3
→ output.ttl = 900 (comfortably covers the next step)

Step 3 — (use the dynamic DB credential for the workflow's actual database work)

Step 4 — HashiCorp: lease/revoke
  leaseID: database/creds/readonly/2f6a19b3
→ credential stops working immediately, instead of waiting out its TTL

4. Credential health check at workflow start

token/lookupSelf mutates nothing, so it's a safe first step to confirm the resolved credential is still valid and see how much TTL is left.

Step 1 — HashiCorp: token/lookupSelf
  authMethod: appRole
  credentialID: 17
→ output.ttl = 2764800, output.renewable = true
→ if ttl is low and renewable: HashiCorp token/renewSelf before continuing
→ if renewable == false: notify that the credential needs re-issuing out of band

5. Cleanup a delegated child token at the end of a workflow

Step 1 — (earlier, some admin process minted a child token and handed the workflow its accessor)
  accessor = "8cLxNRJj..."

Step 2 — HashiCorp: token/revokeByAccessor
  accessor: 8cLxNRJj...
→ the child token stops working immediately