Systems

The internal building blocks of the Vault server. None of these is independently deployable; they all live inside the vault Go process and cooperate through vault.Core. The pages below cover the major moving parts in roughly request-flow order.

At a glance

graph TD
    HTTP[HTTP handler<br/>http/handler.go] --> Core
    Core[Core<br/>vault/core.go] --> Router[Router & mounts<br/>vault/router.go, vault/mount.go]
    Core --> ID[Identity store<br/>vault/identity_store.go]
    Core --> ACL[Policy / ACL<br/>vault/policy_store.go]
    Core --> Audit[Audit broker<br/>audit/]
    Core --> Exp[Expiration manager<br/>vault/expiration.go]
    Core --> Tok[Token store<br/>vault/token_store.go]
    Core --> Quotas[Quotas<br/>vault/quotas/]
    Core --> Plugin[Plugin catalog<br/>vault/plugincatalog/]
    Router --> AM[Auth methods<br/>builtin/credential/]
    Router --> SE[Secret engines<br/>builtin/logical/]
    Core --> Bus[Event bus<br/>vault/eventbus/]
    Core --> Seal[Seal & barrier<br/>vault/seal.go, vault/barrier_aes_gcm.go]
    Seal --> Phys[Physical / storage<br/>physical/, sdk/physical/]
    Core --> Repl[Replication seams<br/>vault/replication/]
    Core --> Raft[Integrated Raft<br/>vault/raft.go, physical/raft/]
    Core --> MFA[Login MFA<br/>vault/login_mfa.go]
    Core --> UI[UI custom messages<br/>vault/ui_custom_messages/]

Pages

Page	What it covers
Core	The vault.Core struct, lifecycle, fields, and what each major subsystem hangs off it.
HTTP handler	The mux in http/handler.go that fronts every request and translates HTTP ↔ logical.Request.
Router and mounts	vault/router.go and vault/mount.go: how URL prefixes route to backends, how mounts are tracked.
Auth methods	The auth subsystem: built-ins, plugins, login flow, MFA hooks.
Secret engines	The logical backend subsystem: built-ins (pki, kv, transit, ssh, database, totp) and how plugins extend it.
Identity store	vault/identity_store*.go (16 files): entities, aliases, groups, OIDC issuer.
Policy and ACL	vault/policy.go and vault/acl.go: HCL policies, capability checks.
Token store	vault/token_store.go (4,370 lines): token issuance, hierarchy, revocation.
Expiration / leases	The expiration manager that backs every lease and TTL.
Audit	The audit broker, event filtering, and built-in file/socket/syslog devices.
Storage backends	physical/ and sdk/physical/: every supported KV store.
Seal	Shamir, recovery keys, the barrier, auto-unseal seal types.
Raft and HA	Integrated Raft storage, autopilot, snapshots, request forwarding.
Replication	OSS hooks for performance and DR replication; what's stubbed and what's wired.
Plugin catalog	vault/plugincatalog/: tracking external plugins, runtimes, checksums.
Quotas	vault/quotas/: rate and lease-count limits per namespace/mount.
Event bus	vault/eventbus/: in-process pub/sub for events surfaced to clients.
UI	The Ember.js web UI bundled into the server binary.