# References for using Ansible-Vault's APIs in a Python script

**URL:** <https://forum.ansible.com/t/references-for-using-ansible-vaults-apis-in-a-python-script/4805>\
**Category:** Get Help\
**Tags:** ansible-vault\
**Created:** [April 8, 2024, 6:59am UTC](https://forum.ansible.com/t/references-for-using-ansible-vaults-apis-in-a-python-script/4805 "2024-04-08T06:59:07Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![ShanDesai](https://avatars.discourse-cdn.com/v4/letter/s/838e76/32.png) [@ShanDesai](https://forum.ansible.com/u/ShanDesai)\
**Post date:** [April 8, 2024, 6:59am UTC](https://forum.ansible.com/t/references-for-using-ansible-vaults-apis-in-a-python-script/4805/1 "2024-04-08T06:59:07Z")

</div>

Is there some development documentation where I can implement the encrypt / decrypt functionality that the `ansible-vault` CLI provides via a python API that does not involve using `subprocess` ?

I have a very simple REST API where I wish to add dedicated secrets to some `vault.yml` files in the inventory directory and wish to encrypt and decrypt the files after writing to the file and before writing to the file respectively.

---

<div class="post-metadata">

**Author:** ![jpmens](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jpmens/32/5543_2.png) [@jpmens](https://forum.ansible.com/u/jpmens)\
**Post date:** [April 8, 2024, 8:10am UTC](https://forum.ansible.com/t/references-for-using-ansible-vaults-apis-in-a-python-script/4805/2 "2024-04-08T08:10:22Z")

</div>

~~I’ve not actually tried it, but~~ [tomoh1r/ansible-vault](https://github.com/tomoh1r/ansible-vault) might fit the bill.

```python
from ansible_vault import Vault

vault = Vault('password')
vault.dump(data, open('vault.yml', 'w'))

```

Note that in spite of its name, the project isn’t part of Ansible.

EDIT: I was curious and have now tried it. I did not run `pip install ansible-vault` as it wanted to download the full ansible package, so I created a virtualenv as so:

```console
$ python3 -mvenv va
$ source va/bin/activate
$ pip install ansible-core
$ pip install setuptools # required by a-v package
$ cd va/
$ git clone https://github.com/tomoh1r/ansible-vault

$ ./jp.py # my test program as above
$ ansible-vault view vault.yml # showed me my data

```

EDIT2: getting old sucks. It turns out [I blogged about this four years ago](https://jpmens.net/2020/02/08/reading-and-writing-ansible-vault-files/).

---

<div class="post-metadata">

**Author:** ![bcoca](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/bcoca/32/9269_2.png) [@bcoca](https://forum.ansible.com/u/bcoca)\
**Post date:** [April 8, 2024, 1:37pm UTC](https://forum.ansible.com/t/references-for-using-ansible-vaults-apis-in-a-python-script/4805/3 "2024-04-08T13:37:59Z")

</div>

Note that the vault API is not public and subject to change w/o deprecation, while this will work for now, it is not guaranteed to work for the future.

---

<div class="post-metadata">

**Author:** ![utoddl](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/utoddl/32/249_2.png) [@utoddl](https://forum.ansible.com/u/utoddl)\
**Post date:** [April 8, 2024, 5:18pm UTC](https://forum.ansible.com/t/references-for-using-ansible-vaults-apis-in-a-python-script/4805/4 "2024-04-08T17:18:05Z")

</div>

Rather than trying to use the internal API (which, as @bcoca points out is not public and subject to change), you could take the approach of [GitHub - utoddl/av-filter: Filter for "ansible-vault"ing YAML Data Values](https://github.com/utoddl/av-filter) and use the CLI interface to `ansible-vault`. I’m using it in that case on named strings rather than whole file vaulting, but the changes would be trivial.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\
**Post date:** [May 8, 2024, 5:18pm UTC](https://forum.ansible.com/t/references-for-using-ansible-vaults-apis-in-a-python-script/4805/5 "2024-05-08T17:18:34Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.