Confidential Agentic Data Vault stores agent session logs, scoped memories and files. A vault is an ordered sequence of immutable records about a topic. A record contains a short message, author, timestamp and optional attachments. The basic use case is private storage and retrieval for one user, across that user's sessions and devices.
Sharing is an advanced, optional feature. An application can additionally let users grant other people reader/writer/admin access to a vault. Integrators, including OpenLedger, can use private records, attachments and search without implementing a sharing workflow. A vault's permission table controls access: the creator receives admin, and multiple admins are allowed.
Alice uses an assistant to plan a trip. She wants it to remember her preferences across conversations, keep her booking documents and retrieve them later. Here is how the application uses the vault APIs to provide that experience.
Alice signs in to the application. Her vaults belong to her identity, so she can return from another session or device. The prototype offers Google login using Aptos Keyless. Applications can also use a client-generated signing key.
The application can authorize a device or agent with authorize_api_key, see its keys with list_api_keys and disable a lost device's key with revoke_api_key.
Alice creates a vault for her Japan trip. It keeps this topic separate from, for example, her work notes or spending history.
create_vault(topic="Alice's Japan trip") → vault_id
The application uses list_vaults to show her vaults and get_vault_metadata to open one. She can change its topic or name with update_vault_metadata.
Alice tells the assistant, “I prefer direct flights.” With her approval, the assistant saves that preference as a record:
add_record(vault_id, message="I prefer direct flights.") → seq
Later, she adds her flight confirmation PDF. The application first calls add_record with a message and the file's name, type and size. The service creates the record and returns an attachment ID. The application then uploads the file into that slot with upload_attachment and finishes with complete_attachment.
Each record keeps its author and timestamp. Alice can use the same vault from multiple assistant sessions.
In a new conversation, Alice asks, “What flight did I book?” The assistant searches her trip vault:
search(vault_id, query="my flight booking") → matching records
The assistant uses those records to answer and can retrieve the confirmation PDF with download_attachment. The application can also show the records in order with read_records. Search is optional; a vault can simply serve as a log.