HashiCorp Vault v7.3.1 published on Tuesday, Oct 21, 2025 by Pulumi
vault.transit.getDecrypt
This is a data source which can be used to decrypt ciphertext using a Vault Transit key.
Example Usage
import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";
const test = vault.transit.getDecrypt({
    backend: "transit",
    key: "test",
    ciphertext: "vault:v1:S3GtnJ5GUNCWV+/pdL9+g1Feu/nzAv+RlmTmE91Tu0rBkeIU8MEb2nSspC/1IQ==",
});
import pulumi
import pulumi_vault as vault
test = vault.transit.get_decrypt(backend="transit",
    key="test",
    ciphertext="vault:v1:S3GtnJ5GUNCWV+/pdL9+g1Feu/nzAv+RlmTmE91Tu0rBkeIU8MEb2nSspC/1IQ==")
package main
import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/transit"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := transit.GetDecrypt(ctx, &transit.GetDecryptArgs{
			Backend:    "transit",
			Key:        "test",
			Ciphertext: "vault:v1:S3GtnJ5GUNCWV+/pdL9+g1Feu/nzAv+RlmTmE91Tu0rBkeIU8MEb2nSspC/1IQ==",
		}, nil)
		if err != nil {
			return err
		}
		return nil
	})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;
return await Deployment.RunAsync(() => 
{
    var test = Vault.Transit.GetDecrypt.Invoke(new()
    {
        Backend = "transit",
        Key = "test",
        Ciphertext = "vault:v1:S3GtnJ5GUNCWV+/pdL9+g1Feu/nzAv+RlmTmE91Tu0rBkeIU8MEb2nSspC/1IQ==",
    });
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.transit.TransitFunctions;
import com.pulumi.vault.transit.inputs.GetDecryptArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }
    public static void stack(Context ctx) {
        final var test = TransitFunctions.getDecrypt(GetDecryptArgs.builder()
            .backend("transit")
            .key("test")
            .ciphertext("vault:v1:S3GtnJ5GUNCWV+/pdL9+g1Feu/nzAv+RlmTmE91Tu0rBkeIU8MEb2nSspC/1IQ==")
            .build());
    }
}
variables:
  test:
    fn::invoke:
      function: vault:transit:getDecrypt
      arguments:
        backend: transit
        key: test
        ciphertext: vault:v1:S3GtnJ5GUNCWV+/pdL9+g1Feu/nzAv+RlmTmE91Tu0rBkeIU8MEb2nSspC/1IQ==
Using getDecrypt
Two invocation forms are available. The direct form accepts plain arguments and either blocks until the result value is available, or returns a Promise-wrapped result. The output form accepts Input-wrapped arguments and returns an Output-wrapped result.
function getDecrypt(args: GetDecryptArgs, opts?: InvokeOptions): Promise<GetDecryptResult>
function getDecryptOutput(args: GetDecryptOutputArgs, opts?: InvokeOptions): Output<GetDecryptResult>def get_decrypt(backend: Optional[str] = None,
                ciphertext: Optional[str] = None,
                context: Optional[str] = None,
                key: Optional[str] = None,
                namespace: Optional[str] = None,
                opts: Optional[InvokeOptions] = None) -> GetDecryptResult
def get_decrypt_output(backend: Optional[pulumi.Input[str]] = None,
                ciphertext: Optional[pulumi.Input[str]] = None,
                context: Optional[pulumi.Input[str]] = None,
                key: Optional[pulumi.Input[str]] = None,
                namespace: Optional[pulumi.Input[str]] = None,
                opts: Optional[InvokeOptions] = None) -> Output[GetDecryptResult]func GetDecrypt(ctx *Context, args *GetDecryptArgs, opts ...InvokeOption) (*GetDecryptResult, error)
func GetDecryptOutput(ctx *Context, args *GetDecryptOutputArgs, opts ...InvokeOption) GetDecryptResultOutput> Note: This function is named GetDecrypt in the Go SDK.
public static class GetDecrypt 
{
    public static Task<GetDecryptResult> InvokeAsync(GetDecryptArgs args, InvokeOptions? opts = null)
    public static Output<GetDecryptResult> Invoke(GetDecryptInvokeArgs args, InvokeOptions? opts = null)
}public static CompletableFuture<GetDecryptResult> getDecrypt(GetDecryptArgs args, InvokeOptions options)
public static Output<GetDecryptResult> getDecrypt(GetDecryptArgs args, InvokeOptions options)
fn::invoke:
  function: vault:transit/getDecrypt:getDecrypt
  arguments:
    # arguments dictionaryThe following arguments are supported:
- Backend string
- Ciphertext string
- Key string
- Context string
- Namespace string
- Backend string
- Ciphertext string
- Key string
- Context string
- Namespace string
- backend String
- ciphertext String
- key String
- context String
- namespace String
- backend string
- ciphertext string
- key string
- context string
- namespace string
- backend str
- ciphertext str
- key str
- context str
- namespace str
- backend String
- ciphertext String
- key String
- context String
- namespace String
getDecrypt Result
The following output properties are available:
Package Details
- Repository
- Vault pulumi/pulumi-vault
- License
- Apache-2.0
- Notes
- This Pulumi package is based on the vaultTerraform Provider.
