Vault "Code: 404 ... no handler for route" in CI

A 404 with "no handler for route" means Vault has nothing mounted at that path. The secrets engine is either not enabled, enabled at a different mount, or the path is missing the KV v2 data/ segment.

What this error means

A read fails with "Error making API request ... Code: 404 ... * no handler for route 'secret/data/ci/app'" or a similar path.

Error making API request.

URL: GET https://vault.example.com/v1/secret/data/ci/app
Code: 404. Errors:

* no handler for route "secret/data/ci/app". route entry not found.

Common causes

The secrets engine is not mounted at that prefix

No KV engine is enabled at secret/, or it is mounted at a different prefix like kv/, so the route does not exist.

The KV version segment is missing or wrong

A KV v2 read needs secret/data/...; calling secret/ci/app on a v2 mount hits no handler. A v1 mount, conversely, must not include data/.

How to fix it

List mounts and use the real prefix

1. Run vault secrets list to see mount prefixes and their types.
2. Enable the engine if missing, or correct the prefix in your read.
3. Insert data/ for KV v2 (or drop it for KV v1).

vault secrets list
# enable KV v2 at secret/ if absent:
vault secrets enable -path=secret -version=2 kv

Match the path to the KV version

Use secret/data/ci/app for v2 and secret/ci/app for v1.

# KV v2
vault kv get secret/ci/app        # CLI hides the data/ segment
curl -H "X-Vault-Token: $VAULT_TOKEN" \
  "$VAULT_ADDR/v1/secret/data/ci/app"  # API needs data/

How to prevent it

• Confirm mount prefixes with vault secrets list before wiring CI paths.
• Remember the CLI hides data/ but the raw API requires it for KV v2.
• Keep the KV version consistent between the engine and the read path.

Related guides