Module client 

The Vaultwarden HTTP client. Stateless about auth: every authed call takes the access token the workspace’s VaultSession holds, so the session is the one owner of the tokens and the client can be shared across seats.

Re-exports

use std::time::Duration; 🔒

use futures::StreamExt; 🔒

use serde::de::DeserializeOwned; 🔒

use serde_json::Value; 🔒

use zeroize::Zeroize; 🔒

use zeroize::Zeroize; 🔒

use crate::vault::VaultError; 🔒

use crate::vault::models::AttachmentMeta; 🔒

use crate::vault::models::Folder; 🔒

use crate::vault::models::FolderList; 🔒

use crate::vault::models::Prelogin; 🔒

use crate::vault::models::SyncData; 🔒

use crate::vault::models::TokenResponse; 🔒

use crate::vault::models::TwoFactorCode; 🔒

Structs

VaultClient

Enums

ErrorFields 🔒

Which fields of an error body a route may surface.

Constants

API_ERROR_POINTERS 🔒

CLIENT_ID

The OAuth client id Vaultwarden’s token endpoint expects for a password grant. There is no secret: the password grant is a public client.

CLIENT_VERSION

The client version every request carries. GET /api/sync omits SSH keys unless this is at least 2024.12.0, so the value is load-bearing rather than decorative.

CONNECT_TIMEOUT

Bounds for one ordinary vault call. A stalled server must fail the call rather than hold the unlock or refresh gate for ever, which would queue every later vault call behind it.

DOWNLOAD_READ_TIMEOUT

A download is opaque ciphertext up to the attachment cap, so its idle read bound and total bound are longer than an API call’s.

DOWNLOAD_TIMEOUT

OAUTH_ERROR_POINTERS 🔒

READ_TIMEOUT

REQUEST_TIMEOUT

Functions

api_error 🔒

Map a non-2xx response to the error the facade branches on.

path_segment 🔒

Percent-encode one id for a path segment. An empty id is refused rather than sent as a route with a hole in it.

retry_after 🔒

The server’s Retry-After hint, when it sends a whole number of seconds.

safe_error 🔒

The server’s own error text and nothing else. Vaultwarden states an API refusal in message, Rocket’s catcher nests its reason under error, and the identity endpoint uses the OAuth error pair. A body that does not parse contributes nothing.

send_request 🔒

Send one request, dropping the URL from any transport error: a signed download URL carries its token in the query string.

user_agent

The user agent every vault request carries.