Agent requests access to a vault item by name. Sends a push notification to the user for biometric approval. Poll GET /v1/vault/access/ for the status + decrypted payload.
EdDSA-signed JWT obtained via OAuth 2.1 client_credentials or CIBA
Default Response