# Custom X-Vault wrap TTL with API does not work, but with cli it does **URL:** \ **Category:** HCP Vault\ **Tags:** vault, windows\ **Created:** [August 12, 2024, 3:05pm UTC](https://discuss.hashicorp.com/t/custom-x-vault-wrap-ttl-with-api-does-not-work-but-with-cli-it-does/69217 "2024-08-12T15:05:03Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![MrL21413](https://avatars.discourse-cdn.com/v4/letter/m/3be4f8/32.png) [@MrL21413](https://discuss.hashicorp.com/u/MrL21413)\ **Post date:** [August 12, 2024, 3:05pm UTC](https://discuss.hashicorp.com/t/custom-x-vault-wrap-ttl-with-api-does-not-work-but-with-cli-it-does/69217/1 "2024-08-12T15:05:04Z")
I am using the Hashivault agent in a Windows environment. And I have set it up as a windows service. Other API calls and CLI commands are working. When i create a wrap request with some data in the request body i get the default TTL of 300s back. The “x-vault-wrap-ttl” value is somehow overwritten or ignored. ```auto Invoke-WebRequest -URI "$VaultAddress/v1/sys/wrapping/wrap" ` -Headers @{ "X-Vault-Token" = $Token; "X-Vault-Wrap-TTL" = "400s" } ` -Method POST ` -Body $Body ` -ContentType $ContentType ``` I have also tried this with curl, same exact issue. ```auto curl --header "X-Vault-Token:..." --header "X-Vault-Wrap-TTL=400s" --request POST --data "foo=bar" http://127.0.0.1:8200/v1/sys/wrapping/wrap ``` But if I use the vault agent CLI, it works and I get my preferred TTL. Therefore it can’t be an authorisation issue. ```auto PS C:\HashiVault> .\vault write -wrap-ttl=80m sys/wrapping/wrap foo=bar Key Value --- ----- wrapping_token: hvs.... wrapping_accessor: .... wrapping_token_ttl: 1h20m wrapping_token_creation_time: 2024-08-... wrapping_token_creation_path: sys/wrapping/wrap ``` I thank you for every help. ---
**Author:** ![vakere5289](https://avatars.discourse-cdn.com/v4/letter/v/ac91a4/32.png) [@vakere5289](https://discuss.hashicorp.com/u/vakere5289)\ **Post date:** [August 14, 2024, 10:25am UTC](https://discuss.hashicorp.com/t/custom-x-vault-wrap-ttl-with-api-does-not-work-but-with-cli-it-does/69217/2 "2024-08-14T10:25:35Z")
Odd, I’ve never used it with the API. Maybe you are using Hashi Vault Servier in an older version or it could be a bug. ---
**Author:** ![MrL21413](https://avatars.discourse-cdn.com/v4/letter/m/3be4f8/32.png) [@MrL21413](https://discuss.hashicorp.com/u/MrL21413)\ **Post date:** [August 14, 2024, 11:55am UTC](https://discuss.hashicorp.com/t/custom-x-vault-wrap-ttl-with-api-does-not-work-but-with-cli-it-does/69217/3 "2024-08-14T11:55:05Z")
I have figured out the issue. If I send the request directly to the vault server without using the vault agent as a forwarding proxy, it works. Somehow the vault agent overrides the setting. But I don’t know where I can change this override. ---
**Author:** ![jonathanfrappier](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/jonathanfrappier/32/28004_2.png) [@jonathanfrappier](https://discuss.hashicorp.com/u/jonathanfrappier)\ **Post date:** [August 15, 2024, 1:35pm UTC](https://discuss.hashicorp.com/t/custom-x-vault-wrap-ttl-with-api-does-not-work-but-with-cli-it-does/69217/4 "2024-08-15T13:35:28Z")
What does your Vault agent config look like (de-identified please)? I have not used Vault agent, but looking over this doc: > **[Vault Agent and Vault Proxy Auto-Auth | Vault | HashiCorp Developer](https://developer.hashicorp.com/vault/docs/agent-and-proxy/autoauth)** > > Vault Agent and Vault Proxy's Auto-Auth functionality allows easy and automatic > authentication to Vault in a variety of environments. Could `wrap_ttl` be causing what you are seeing? ---
**Author:** ![MrL21413](https://avatars.discourse-cdn.com/v4/letter/m/3be4f8/32.png) [@MrL21413](https://discuss.hashicorp.com/u/MrL21413)\ **Post date:** [August 19, 2024, 7:20am UTC](https://discuss.hashicorp.com/t/custom-x-vault-wrap-ttl-with-api-does-not-work-but-with-cli-it-does/69217/5 "2024-08-19T07:20:50Z")
I created the configuration as per the documentation and looked at the udemy course to see if I encountered any issues. ```auto pid_file = ".../agent.pid" log_file = ".../agent-warning.log" log_level = "trace" vault { address = "${env:VAULT_ADDR}" } auto_auth { method "approle" { mount_path = "auth/temp_approle" min_backoff = "5s" max_backoff = "60s" exit_on_err = true config = { role_id_file_path = "...role.txt" secret_id_file_path = "...secret.txt" remove_secret_id_file_after_reading = false } } sink "file" { wrap_ttl = "30m" config = { path = "...sink.json" } } } cache { use_auto_auth_token = true cache_duration = "60m" max_entry_count = 0 } listener "tcp" { address = "127.0.0.1:8200" tls_disable = true retry { num_retries = 5 retry_wait_min = "1s" retry_wait_max = "5s" } } ``` The first time the approle works and my wrap\_ttl is 30min. And for my approach, I need to unwrap and rewrap the token in the sink file. If I give the command directly to the server it works, but via the agent the agent overrides the value or ignores it - resulting in the default value for wrap\_ttl of 5 minutes being used. ---
**Author:** ![jonathanfrappier](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/jonathanfrappier/32/28004_2.png) [@jonathanfrappier](https://discuss.hashicorp.com/u/jonathanfrappier)\ **Post date:** [August 20, 2024, 12:48pm UTC](https://discuss.hashicorp.com/t/custom-x-vault-wrap-ttl-with-api-does-not-work-but-with-cli-it-does/69217/6 "2024-08-20T12:48:07Z")
Looks like this may be a known issue: > > > While working with one of the services in Kubernetes, we ran into a problem when… it is unable to set the wrap TTL for a token, created by the endpoint \`sys/wrapping/wrap\`. Whatever value was set, the TTL of the token was always 5 minutes. Although, the TTL worked fine with other endpoints. > After researching, we found out that it was caused by the vault-agent sidecar, which was running on the same pod with the service. > Because the vault agent doesn't have a custom wrapping lookup function, the default one will be used. \[The default function\](https://github.com/hashicorp/vault/blob/release/1.9.x/api/client.go#L1009.) always return the default value of \`5m\` for \`sys/wrapping/wrap\`. > The header of the request, which needs to be forwarded, then \[gets copied\](https://github.com/hashicorp/vault/blob/release/1.9.x/api/client.go#L1012) to a new one. > Because the \`r.WrapTTL\` of the request is not empty, it will \[overwrite the header\](https://github.com/hashicorp/vault/blob/release/1.9.x/api/request.go#L133) of the HTTP request, which will be sent out. > > We were looking for a way to set the env variable \`VAULT\_WRAP\_TTL\` for the vault agent, but it doesn't seem to support it. > > \*\*To Reproduce\*\* > 1. Run a vault instance > 2. Run a vault agent. It should point to the vault instance. > 3. Create a service that uses the golang API \[to write\](https://github.com/hashicorp/vault/blob/main/api/logical.go#L134) to \`sys/wrapping/wrap\`. The API client should point to the vault agent. Set up a custom wrapping look-up function to return a constant. > \`\`\` > client, \_ := vaultAPI.NewClient(&vaultAPI.Config{ > Address: "\", > }) > client.SetWrappingLookupFunc(func(operation, path string) string { > return "30m" > }) > ... > client.Logical().Write("sys/wrapping/wrap", data) > ... > \`\`\` > 4. Look up the token by \`vault token lookup\`. > 5. The token TTL is 5m > > \*\*Expected behavior\*\* > Token TTL is set to the value in the header \`X-Vault-Wrap-TTL\` May be worth commenting to raise that its still on-going.