sonr/docs/reference/queries/query-dwn-single-vault.mdx

---
title: Query Vault Details
description: Get comprehensive information about a secure vault instance
seo:
  title: "DWN Vault Information"
---

:::info
Vaults provide hardware-backed secure key management through WebAssembly enclaves.
:::

## Vault Components

### Core Information
- **vaultId**: Unique identifier
- **owner**: DID or address of owner
- **publicKey**: Public key for verification
- **createdAt**: Creation timestamp
- **lastRefreshed**: Last key rotation

### Enclave Data
- **enclaveId**: WASM enclave identifier
- **version**: Enclave version number
- **privateData**: Encrypted key material

### Security Metadata
- **encryptionMetadata**: Consensus encryption details
- **keyVersion**: Current key version
- **validatorSet**: Participating validators

## Vault Health Check

:::tip
Monitor vault refresh intervals to ensure keys are rotated on schedule.
:::

### Health Indicators
```javascript
// Check if refresh is due
const refreshDue = 
  (currentBlock - lastRefreshed) > minVaultRefreshInterval;

// Check key age
const keyAge = 
  (currentTime - lastRefreshed) / (24 * 60 * 60);
const needsRotation = keyAge > keyRotationDays;
```

## Security Features

### WebAssembly Isolation
- Sandboxed execution environment
- No direct memory access
- Deterministic operations

### Hardware Security
- TPM integration when available
- Secure enclave support
- Hardware key storage

:::warning
Never expose or log vault private data. It's encrypted for a reason.
:::

## Vault Operations

### Key Rotation Status
```bash
# Check rotation schedule
snrd query dwn vault vault_alice_123

# Compare with module params
snrd query dwn params
```

### Export/Import
```bash
# Export vault to IPFS (encrypted)
snrd tx dwn vault-export vault_alice_123

# Import from IPFS backup
snrd tx dwn vault-import <ipfs_cid>
```

:::note
Vault queries return public metadata only. Private keys remain encrypted in the enclave.
:::