Vault
Vault overview
Store user documents without exposing vault credentials or capabilities.
Model
- Files belong to an end-user of an application, identified by the id your app uses (
owner_user_id). - Authority Core derives the canonical tenant from the client secret and signs it as
origin_tenanton every vault call. - Your backend calls DevSewa. Authority Core creates and consumes short-lived vault grants and Trusted private URLs internally.
- The console can list safe metadata, revoke and delete. It cannot mint grants, read contents or see storage-area ids.