1--- 2layout: "docs" 3page_title: "Path Help" 4sidebar_title: "<code>path-help</code>" 5sidebar_current: "docs-commands-path-help" 6description: |- 7 The Vault CLI has a built-in help system that can be used to get help for not only the CLI itself, but also any paths that the CLI can be used with within Vault. 8--- 9 10# Help 11 12In addition to standard CLI help using the `-h` or `-help` flag for 13commands, Vault has a built-in `path-help` command that can be used to get 14help for specific paths within Vault. These paths are used with the 15API or `read, write, delete` commands in order to interact with Vault. 16 17The help system is the easiest way to learn how to use the various systems 18in Vault, and also allows you to discover new paths. 19 20-> **Important!** The help system is incredibly important in day-to-day 21use of Vault. As a beginner or experienced user of Vault, you'll be using 22the help command a lot to remember how to use different components of 23Vault. Note that the Vault Server must be running and the client configured 24properly to execute this command to look up paths. 25 26## Discovering Paths 27 28Before using `path-help`, it is important to understand "paths" within Vault. 29Paths are the parameters used for `vault read`, `vault write`, etc. An 30example path is `secret/foo`, or `aws/config/root`. The paths available 31depend on the enabled secrets engines. Because of this, the interactive 32help is an indispensable tool to finding what paths are supported. 33 34To discover what paths are supported, use `vault path-help <mount point>`. 35For example, if you mounted the AWS secrets engine, you can use 36`vault path-help aws` to find the paths supported by that backend. The paths 37will be shown with regular expressions, which can make them hard to 38parse, but they're also extremely exact. 39 40You can try it right away with any Vault with `vault path-help secret`, since 41`secret` is always mounted initially. The output from this command is shown 42below and contains both a description of what that backend is for, along with 43the paths it supports. 44 45``` 46$ vault path-help secret 47## DESCRIPTION 48 49The key/value backend reads and writes arbitrary secrets to the backend. 50The secrets are encrypted/decrypted by Vault: they are never stored 51unencrypted in the backend and the backend never has an opportunity to 52see the unencrypted value. 53 54Leases can be set on a per-secret basis. These leases will be sent down 55when that secret is read, and it is assumed that some outside process will 56revoke and/or replace the secret at that path. 57 58## PATHS 59 60The following paths are supported by this backend. To view help for 61any of the paths below, use the help command with any route matching 62the path pattern. Note that depending on the policy of your auth token, 63you may or may not be able to access certain paths. 64 65 ^.*$ 66 Pass-through secret storage to the storage backend, allowing you to 67 read/write arbitrary data into secret storage. 68``` 69 70## Single Path 71 72Once you've found a path you like, you can learn more about it by 73using `vault path-help <path>` where "path" is a path that matches one of the 74regular expressions from the backend help. 75 76Or, if you saw an example online with `vault write` or some similar 77command, you can plug that directly into `vault path-help` to learn about it 78(assuming you have the proper backends mounted!). 79 80For example, below we get the help for a single secret in the `secret/` 81mount point. The help shows the operations that that path supports, the 82parameters it takes (for write), and a description of that specific path. 83 84``` 85$ vault path-help secret/password 86Request: password 87Matching Route: ^.*$ 88 89Pass-through secret storage to the storage backend, allowing you to 90read/write arbitrary data into secret storage. 91 92## PARAMETERS 93 94 lease (string) 95 Lease time for this key when read. Ex: 1h 96 97## DESCRIPTION 98 99The pass-through backend reads and writes arbitrary data into secret storage, 100encrypting it along the way. 101 102A lease can be specified when writing with the "lease" field. If given, then 103when the secret is read, Vault will report a lease with that duration. It 104is expected that the consumer of this backend properly writes renewed keys 105before the lease is up. In addition, revocation must be handled by the 106user of this backend. 107``` 108