Skip to main content
The Vault tab enables you to add and manage values that you can reuse throughout the CData Arc admin console. This feature can save time and prevent errors when configuring connectors that reuse certain data. Arc supports external vault providers that let you reference secrets managed outside of Arc, and a built-in local vault. Both types of items appear in the vault table.

​
Managing Vault Providers

Vault providers determine where Arc resolves vault item values. The local vault is always present and is the only provider you can write to. External providers are read-only and let you surface secrets that already exist in your infrastructure without duplicating them in Arc. To open the provider list, click Vault Provider Config on the Vault tab. The Vault Providers Config pane opens, listing each configured provider with its Name and Provider type. The Local provider is always the first row and cannot be edited or removed. Vault Providers Config pane showing the Local provider and the Add dropdown

​
Adding an Azure Key Vault Provider

  1. In the Vault Providers Config pane, click Add > Azure Key Vault.
  2. Fill in the required fields:
    • Name: The display name for this provider. Must be unique.
    • Vault URI: The Vault URL from the Azure Portal Overview page. Read-only after the provider is created.
    • Application ID: The Client Id from the Azure Portal Overview page.
    • Client Secret: The client secret assigned to the application.
    • Directory ID: The Tenant Id from the Azure Portal Overview page.
  3. Click Add and Test to save the provider and verify the connection. Add Azure Key Vault form
Every secret in the connected Key Vault appears in Arc and is classified as Encrypted. You can add more than one Azure Key Vault provider if necessary. For example, you might need to connect to separate vaults for different environments.
External providers (like Azure Key Vault) are only available on the Enterprise license tier.

​
Adding an Environment Variable Provider

The Environment Variable provider surfaces host machine environment variables as vault items.
  1. In the Vault Providers Config pane, click Add > Environment Variable. The Name and Type are auto-generated.
  2. Under Included Patterns, check the appropriate checkboxes and enter at least one pattern in Standard Patterns, Encrypted Patterns, or both. Each field accepts a comma-separated list of names or wildcard patterns using * and ?. Add Environment Variable form
  3. Click Add to save the provider. Only one environment variable provider is permitted.
Only variables whose names match at least one pattern are visible in Arc, and at least one pattern (Standard or Encrypted) is required to add the provider. If the vault table appears empty after adding an Environment Variable provider, check that the patterns you entered actually match environment variable names that exist on the host.
The pattern type controls how a matching variable is classified:
  • Standard Patterns: Matched variables are treated as Standard items and can be used in any non-sensitive field.
  • Encrypted Patterns: Matched variables are treated as Encrypted items and can only be used in sensitive fields.
If a variable name matches both lists, an exact name match takes precedence over a wildcard match. If both matches are of the same kind (for example, two wildcards), Encrypted takes precedence over Standard. Variable names are matched case-insensitively on Windows and case-sensitively on other platforms.

​
Managing Local Vault Items

​
Adding Items to the Local Vault

There are two ways to add an item to the local vault:
  1. Navigate to Settings > Vault and click Add Vault Item at the top of the vault table.
  2. Enter a value in a field elsewhere in Arc, click the key symbol, and select Add to Vault.
Add vault item from a field using the key symbol Either option opens the Add Vault Item pane. Complete the following fields:
  • Name: The name of the vault item as it appears when you use it.
  • Type: The classification for the vault item.
    • Standard items can be used in all non-sensitive fields. Examples of standard items include URLs, usernames, and ports.
    • Encrypted items can only be used in sensitive fields. Examples of encrypted items include passwords and authtokens.
  • Value: The actual value that the vault item contains. For example, the URL, username, or password that you want to use when this vault item is selected.
  • Labels: (Optional) Labels for the vault item that make it easier to manage and search through large vaults. Separate each label with a comma or new-line character. Add vault item pane
Click Add Vault Item to save the item to your vault.

​
Editing Vault Items

To edit a vault item, click its name or hover over it, then click the ellipsis and choose Edit. The Edit Vault Item pane opens and allows you to edit the name, value, and labels for the item. Note that item Ids and types (standard or encrypted) cannot be edited after creation. To delete multiple vault items, check the box next to each item and click Remove. Items sourced from an external provider cannot be edited or removed in Arc. Hovering over an external item shows the tooltip: “This item is managed by an external vault provider and cannot be edited or removed.” To change or remove an external item, update it in the originating system.

​
Using Vault Items

When an item is added to the vault, it can be used in fields that match the item type (standard or encrypted) and display a key symbol in the Arc UI: Key symbol on a connector field Click the key to open a list of matching vault values for the field. Vault item selection dropdown The list includes items from all configured providers. Each item shows the provider it comes from. Use the Providers filter at the top of the vault table to narrow the list to items from a specific provider. Select a value to populate it in the field.
If you already have a value in the field, you can click Add to Vault to open the Add Vault Item pane as outlined above.

​
Scripting

Vault items can be used in ArcScript contexts. For more information, please see Functions.
Use caution when referring to encrypted vault items in scripting contexts to ensure that sensitive information is not included in the logs.