# Vaults

Vaults are how secrets are organized. Every account has a personal vault;
team vaults are shared with the members of an org.

## Your personal vault

Created for you automatically — no setup, no password to remember. Anything
you save without picking a team vault lands there, private to you.

## Team vaults

A team vault belongs to an org. Members see it according to their role, and
the vault carries the caller's permission and an owner flag — the API
enforces both. Create, rename, and delete vaults from the Secrets panel
(**Connections → Secrets**).

## What a vault holds

Two record types:

- **Items** — the typed, current system of record: AI provider keys, API
  keys, database credentials, environment variables, certificates, SSH
  keys, webhooks, and more. Each item has a name, a value, and a category.
- **Notes** — freeform reference material kept alongside the items.

## The API

The vault REST surface sits behind authentication — the same endpoints
Poly's own clients call:

| Action | Request |
| --- | --- |
| List vaults | `GET /api/vaults` |
| Create a vault | `POST /api/vaults` |
| Delete a vault | `DELETE /api/vaults/{id}` |
| List a vault's notes | `GET /api/vaults/{vault_id}/notes` |
| Read one note | `GET /api/vaults/{vault_id}/notes/{note_id}` |

Vault limits by plan are not published yet — this page carries the table
when they are.