add java.io.Serial annotations to serialVersionUID fields

Mapping these fields as Integer limits the possible maximum TTL value to
roughly 68 years. This may or may not be a reasonable value, but is
technically a valid number in the JSON response. Convert all TTL-related
fields to Long, so we can map such values.

.github/workflows/ci-it.yml

@@ -14,11 +14,11 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        jdk: [ 11, 17, 21 ]
-        vault: [ '1.2.0', '1.18.2' ]
+        jdk: [ 17, 21 ]
+        vault: [ '1.2.0', '1.20.0' ]
         include:
           - jdk: 21
-            vault: '1.18.2'
+            vault: '1.20.0'
             analysis: true
     steps:
       - name: Checkout

.github/workflows/ci.yml

@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        jdk: [ 11, 17, 21 ]
+        jdk: [ 17, 21 ]
         include:
           - jdk: 21
             analysis: true

CHANGELOG.md

@@ -1,3 +1,49 @@
+## unreleased
+
+### Breaking
+* Requires Java 17 or later (#100)
+
+### Dependencies
+* Updated Jackson to 2.19.1 (#101)
+
+### Fix
+* Use `Long` for numeric TTL fields (#103) (#104)
+
+### Test
+* Tested against Vault 1.2 to 1.20 (#102)
+
+
+## 1.5.1 (2025-06-02)
+
+### Improvements
+* Use `lookup-self` for token check instead of `lookup` (#98) (#99)
+
+### Dependencies
+* Updated Jackson to 2.19.0 (#97)
+
+
+## 1.5.0 (2025-04-13)
+
+### Deprecations
+* `read...Credentials()` methods for specific database mounts (#92)
+
+### Features
+* Support Vault transit API (#89)
+* Support PEM certificate string from `VAULT_CACERT` environment variable (#93)
+
+### Improvements
+* Replace deprecated `java.net.URL` usage with `java.net.URI` (#94)
+
+### Fix
+* Fix initialization from environment without explicit port
+
+### Dependencies
+* Updated Jackson to 2.18.3 (#90)
+
+### Test
+* Tested against Vault 1.2 to 1.19
+
+
 ## 1.4.0 (2024-12-07)
 
 ### Removal

README.md

@@ -28,10 +28,11 @@ Java Vault Connector is a connector library for [Vault](https://www.vaultproject
     * Delete secrets
     * Renew/revoke leases
     * Raw secret content or JSON decoding
-    * SQL secret handling
     * KV v1 and v2 support
+    * Database secret handling
+* Transit API support
 * Connector Factory with builder pattern
-* Tested against Vault 1.2 to 1.18
+* Tested against Vault 1.2 to 1.20
 
 
 ## Maven Artifact
@@ -39,7 +40,7 @@ Java Vault Connector is a connector library for [Vault](https://www.vaultproject
 <dependency>
     <groupId>de.stklcode.jvault</groupId>
     <artifactId>jvault-connector</artifactId>
-    <version>1.4.0</version>
+    <version>1.5.1</version>
 </dependency>
 ```
 

pom.xml

@@ -4,7 +4,7 @@
 
     <groupId>de.stklcode.jvault</groupId>
     <artifactId>jvault-connector</artifactId>
-    <version>1.4.0</version>
+    <version>2.0.0-SNAPSHOT</version>
 
     <packaging>jar</packaging>
 
@@ -33,6 +33,7 @@
         <connection>scm:git:git://github.com/stklcode/jvaultconnector.git</connection>
         <developerConnection>scm:git:git@github.com:stklcode/jvaultconnector.git</developerConnection>
         <url>https://github.com/stklcode/jvaultconnector</url>
+        <tag>HEAD</tag>
     </scm>
 
     <issueManagement>
@@ -42,31 +43,31 @@
 
     <properties>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
-        <argLine></argLine>
+        <argLine />
     </properties>
 
     <dependencies>
         <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-databind</artifactId>
-             <version>2.18.2</version>
+             <version>2.19.1</version>
         </dependency>
         <dependency>
             <groupId>com.fasterxml.jackson.datatype</groupId>
             <artifactId>jackson-datatype-jsr310</artifactId>
-            <version>2.18.2</version>
+            <version>2.19.1</version>
         </dependency>
 
         <dependency>
             <groupId>org.junit.jupiter</groupId>
             <artifactId>junit-jupiter</artifactId>
-            <version>5.11.3</version>
+            <version>5.13.2</version>
             <scope>test</scope>
         </dependency>
         <dependency>
             <groupId>org.mockito</groupId>
             <artifactId>mockito-core</artifactId>
-            <version>5.14.2</version>
+            <version>5.18.0</version>
             <scope>test</scope>
         </dependency>
         <dependency>
@@ -78,25 +79,25 @@
         <dependency>
             <groupId>org.wiremock</groupId>
             <artifactId>wiremock</artifactId>
-            <version>3.10.0</version>
+            <version>3.13.1</version>
             <scope>test</scope>
         </dependency>
         <dependency>
             <groupId>commons-io</groupId>
             <artifactId>commons-io</artifactId>
-            <version>2.18.0</version>
+            <version>2.19.0</version>
             <scope>test</scope>
         </dependency>
         <dependency>
             <groupId>nl.jqno.equalsverifier</groupId>
             <artifactId>equalsverifier</artifactId>
-            <version>3.17.5</version>
+            <version>4.0.4</version>
             <scope>test</scope>
         </dependency>
         <dependency>
             <groupId>org.awaitility</groupId>
             <artifactId>awaitility</artifactId>
-            <version>4.2.2</version>
+            <version>4.3.0</version>
             <scope>test</scope>
         </dependency>
     </dependencies>
@@ -107,25 +108,25 @@
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
                     <artifactId>maven-compiler-plugin</artifactId>
-                    <version>3.13.0</version>
+                    <version>3.14.0</version>
                     <configuration>
-                        <release>11</release>
+                        <release>17</release>
                     </configuration>
                 </plugin>
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
                     <artifactId>maven-clean-plugin</artifactId>
-                    <version>3.4.0</version>
+                    <version>3.5.0</version>
                 </plugin>
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
                     <artifactId>maven-deploy-plugin</artifactId>
-                    <version>3.1.3</version>
+                    <version>3.1.4</version>
                 </plugin>
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
                     <artifactId>maven-failsafe-plugin</artifactId>
-                    <version>3.5.2</version>
+                    <version>3.5.3</version>
                     <configuration>
                         <argLine>
                             @{argLine}
@@ -136,7 +137,7 @@
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
                     <artifactId>maven-install-plugin</artifactId>
-                    <version>3.1.3</version>
+                    <version>3.1.4</version>
                 </plugin>
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
@@ -156,7 +157,7 @@
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
                     <artifactId>maven-surefire-plugin</artifactId>
-                    <version>3.5.2</version>
+                    <version>3.5.3</version>
                     <configuration>
                         <argLine>
                             @{argLine}
@@ -179,15 +180,41 @@
                 <plugin>
                     <groupId>org.jacoco</groupId>
                     <artifactId>jacoco-maven-plugin</artifactId>
-                    <version>0.8.12</version>
+                    <version>0.8.13</version>
                 </plugin>
                 <plugin>
                     <groupId>org.sonarsource.scanner.maven</groupId>
                     <artifactId>sonar-maven-plugin</artifactId>
-                    <version>5.0.0.4389</version>
+                    <version>5.1.0.4751</version>
                 </plugin>
             </plugins>
         </pluginManagement>
+
+        <plugins>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-enforcer-plugin</artifactId>
+                <version>3.5.0</version>
+                <executions>
+                    <execution>
+                        <id>enforce-versions</id>
+                        <goals>
+                            <goal>enforce</goal>
+                        </goals>
+                        <configuration>
+                            <rules>
+                                <requireMavenVersion>
+                                    <version>[3.6.3,)</version>
+                                </requireMavenVersion>
+                                <requireJavaVersion>
+                                    <version>[17,)</version>
+                                </requireJavaVersion>
+                            </rules>
+                        </configuration>
+                    </execution>
+                </executions>
+            </plugin>
+        </plugins>
     </build>
 
     <profiles>
@@ -224,9 +251,9 @@
                     <plugin>
                         <groupId>org.apache.maven.plugins</groupId>
                         <artifactId>maven-javadoc-plugin</artifactId>
-                        <version>3.11.1</version>
+                        <version>3.11.2</version>
                         <configuration>
-                            <source>11</source>
+                            <source>17</source>
                         </configuration>
                         <executions>
                             <execution>
@@ -342,7 +369,7 @@
                     <plugin>
                         <groupId>org.owasp</groupId>
                         <artifactId>dependency-check-maven</artifactId>
-                        <version>11.1.1</version>
+                        <version>12.1.3</version>
                         <configuration>
                             <nvdApiKey>${env.NVD_API_KEY}</nvdApiKey>
                             <nvdDatafeedUrl>${env.NVD_DATAFEED_URL}</nvdDatafeedUrl>
@@ -366,7 +393,7 @@
                     <plugin>
                         <groupId>org.sonatype.central</groupId>
                         <artifactId>central-publishing-maven-plugin</artifactId>
-                        <version>0.6.0</version>
+                        <version>0.8.0</version>
                         <extensions>true</extensions>
                         <configuration>
                             <publishingServerId>central</publishingServerId>

src/main/java/de/stklcode/jvault/connector/HTTPVaultConnector.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -54,6 +54,7 @@ public class HTTPVaultConnector implements VaultConnector {
     private static final String PATH_AUTH = "auth";
     private static final String PATH_AUTH_TOKEN = PATH_AUTH + "/token";
     private static final String PATH_LOOKUP = "/lookup";
+    private static final String PATH_LOOKUP_SELF = "/lookup-self";
     private static final String PATH_CREATE = "/create";
     private static final String PATH_ROLES = "/roles";
     private static final String PATH_CREATE_ORPHAN = "/create-orphan";
@@ -68,6 +69,11 @@ public class HTTPVaultConnector implements VaultConnector {
     private static final String PATH_UNDELETE = "/undelete/";
     private static final String PATH_DESTROY = "/destroy/";
 
+    private static final String PATH_TRANSIT = "transit";
+    private static final String PATH_TRANSIT_ENCRYPT = PATH_TRANSIT + "/encrypt/";
+    private static final String PATH_TRANSIT_DECRYPT = PATH_TRANSIT + "/decrypt/";
+    private static final String PATH_TRANSIT_HASH = PATH_TRANSIT + "/hash/";
+
     private final RequestHelper request;
 
     private boolean authorized = false;     // Authorization status.
@@ -81,14 +87,14 @@ public class HTTPVaultConnector implements VaultConnector {
      */
     HTTPVaultConnector(final HTTPVaultConnectorBuilder builder) {
         this.request = new RequestHelper(
-                ((builder.isWithTLS()) ? "https" : "http") + "://" +
-                        builder.getHost() +
-                        ((builder.getPort() != null) ? ":" + builder.getPort() : "") +
-                        builder.getPrefix(),
-                builder.getNumberOfRetries(),
-                builder.getTimeout(),
-                builder.getTlsVersion(),
-                builder.getTrustedCA()
+            ((builder.isWithTLS()) ? "https" : "http") + "://" +
+                builder.getHost() +
+                ((builder.getPort() != null) ? ":" + builder.getPort() : "") +
+                builder.getPrefix(),
+            builder.getNumberOfRetries(),
+            builder.getTimeout(),
+            builder.getTlsVersion(),
+            builder.getTrustedCA()
         );
     }
 
@@ -145,8 +151,8 @@ public class HTTPVaultConnector implements VaultConnector {
     @Override
     public final SealResponse unseal(final String key, final Boolean reset) throws VaultConnectorException {
         Map<String, String> param = mapOfStrings(
-                "key", key,
-                "reset", reset
+            "key", key,
+            "reset", reset
         );
 
         return request.put(PATH_UNSEAL, param, token, SealResponse.class);
@@ -156,15 +162,15 @@ public class HTTPVaultConnector implements VaultConnector {
     public HealthResponse getHealth() throws VaultConnectorException {
 
         return request.get(
-                PATH_HEALTH,
-                // Force status code to be 200, so we don't need to modify the request sequence.
-                Map.of(
-                        "standbycode", "200",   // Default: 429.
-                        "sealedcode", "200",    // Default: 503.
-                        "uninitcode", "200"     // Default: 501.
-                ),
-                token,
-                HealthResponse.class
+            PATH_HEALTH,
+            // Force status code to be 200, so we don't need to modify the request sequence.
+            Map.of(
+                "standbycode", "200",   // Default: 429.
+                "sealedcode", "200",    // Default: 503.
+                "uninitcode", "200"     // Default: 501.
+            ),
+            token,
+            HealthResponse.class
         );
     }
 
@@ -186,7 +192,7 @@ public class HTTPVaultConnector implements VaultConnector {
         /* set token */
         this.token = token;
         this.tokenTTL = 0;
-        TokenResponse res = request.post(PATH_AUTH_TOKEN + PATH_LOOKUP, emptyMap(), token, TokenResponse.class);
+        TokenResponse res = request.get(PATH_AUTH_TOKEN + PATH_LOOKUP_SELF, emptyMap(), token, TokenResponse.class);
         authorized = true;
 
         return res;
@@ -194,7 +200,7 @@ public class HTTPVaultConnector implements VaultConnector {
 
     @Override
     public final AuthResponse authUserPass(final String username, final String password)
-            throws VaultConnectorException {
+        throws VaultConnectorException {
         final Map<String, String> payload = singletonMap("password", password);
         return queryAuth(PATH_AUTH_USERPASS + username, payload);
     }
@@ -202,8 +208,8 @@ public class HTTPVaultConnector implements VaultConnector {
     @Override
     public final AuthResponse authAppRole(final String roleID, final String secretID) throws VaultConnectorException {
         final Map<String, String> payload = mapOfStrings(
-                "role_id", roleID,
-                "secret_id", secretID
+            "role_id", roleID,
+            "secret_id", secretID
         );
         return queryAuth(PATH_AUTH_APPROLE + PATH_LOGIN, payload);
     }
@@ -217,7 +223,7 @@ public class HTTPVaultConnector implements VaultConnector {
      * @throws VaultConnectorException on errors
      */
     private AuthResponse queryAuth(final String path, final Map<String, String> payload)
-            throws VaultConnectorException {
+        throws VaultConnectorException {
         /* Issue request and parse response */
         AuthResponse auth = request.post(path, payload, token, AuthResponse.class);
         /* verify response */
@@ -244,10 +250,10 @@ public class HTTPVaultConnector implements VaultConnector {
         requireAuth();
         /* Request HTTP response and parse Secret */
         return request.get(
-                String.format(PATH_AUTH_APPROLE_ROLE, roleName, ""),
-                emptyMap(),
-                token,
-                AppRoleResponse.class
+            String.format(PATH_AUTH_APPROLE_ROLE, roleName, ""),
+            emptyMap(),
+            token,
+            AppRoleResponse.class
         );
     }
 
@@ -266,10 +272,10 @@ public class HTTPVaultConnector implements VaultConnector {
         requireAuth();
         /* Issue request, parse response and extract Role ID */
         return request.get(
-                String.format(PATH_AUTH_APPROLE_ROLE, roleName, "/role-id"),
-                emptyMap(),
-                token,
-                RawDataResponse.class
+            String.format(PATH_AUTH_APPROLE_ROLE, roleName, "/role-id"),
+            emptyMap(),
+            token,
+            RawDataResponse.class
         ).getData().get("role_id").toString();
     }
 
@@ -279,9 +285,9 @@ public class HTTPVaultConnector implements VaultConnector {
 
         /* Issue request and expect code 204 with empty response */
         request.postWithoutResponse(
-                String.format(PATH_AUTH_APPROLE_ROLE, roleName, "/role-id"),
-                singletonMap("role_id", roleID),
-                token
+            String.format(PATH_AUTH_APPROLE_ROLE, roleName, "/role-id"),
+            singletonMap("role_id", roleID),
+            token
         );
 
         return true;
@@ -289,49 +295,49 @@ public class HTTPVaultConnector implements VaultConnector {
 
     @Override
     public final AppRoleSecretResponse createAppRoleSecret(final String roleName, final AppRoleSecret secret)
-            throws VaultConnectorException {
+        throws VaultConnectorException {
         requireAuth();
 
         if (secret.getId() != null && !secret.getId().isEmpty()) {
             return request.post(
-                    String.format(PATH_AUTH_APPROLE_ROLE, roleName, "/custom-secret-id"),
-                    secret,
-                    token,
-                    AppRoleSecretResponse.class
+                String.format(PATH_AUTH_APPROLE_ROLE, roleName, "/custom-secret-id"),
+                secret,
+                token,
+                AppRoleSecretResponse.class
             );
         } else {
             return request.post(
-                    String.format(PATH_AUTH_APPROLE_ROLE, roleName, "/secret-id"),
-                    secret, token,
-                    AppRoleSecretResponse.class
+                String.format(PATH_AUTH_APPROLE_ROLE, roleName, "/secret-id"),
+                secret, token,
+                AppRoleSecretResponse.class
             );
         }
     }
 
     @Override
     public final AppRoleSecretResponse lookupAppRoleSecret(final String roleName, final String secretID)
-            throws VaultConnectorException {
+        throws VaultConnectorException {
         requireAuth();
 
         /* Issue request and parse secret response */
         return request.post(
-                String.format(PATH_AUTH_APPROLE_ROLE, roleName, "/secret-id/lookup"),
-                new AppRoleSecret(secretID),
-                token,
-                AppRoleSecretResponse.class
+            String.format(PATH_AUTH_APPROLE_ROLE, roleName, "/secret-id/lookup"),
+            new AppRoleSecret(secretID),
+            token,
+            AppRoleSecretResponse.class
         );
     }
 
     @Override
     public final boolean destroyAppRoleSecret(final String roleName, final String secretID)
-            throws VaultConnectorException {
+        throws VaultConnectorException {
         requireAuth();
 
         /* Issue request and expect code 204 with empty response */
         request.postWithoutResponse(
-                String.format(PATH_AUTH_APPROLE_ROLE, roleName, "/secret-id/destroy"),
-                new AppRoleSecret(secretID),
-                token);
+            String.format(PATH_AUTH_APPROLE_ROLE, roleName, "/secret-id/destroy"),
+            new AppRoleSecret(secretID),
+            token);
 
         return true;
     }
@@ -341,10 +347,10 @@ public class HTTPVaultConnector implements VaultConnector {
         requireAuth();
 
         SecretListResponse secrets = request.get(
-                PATH_AUTH_APPROLE + "/role?list=true",
-                emptyMap(),
-                token,
-                SecretListResponse.class
+            PATH_AUTH_APPROLE + "/role?list=true",
+            emptyMap(),
+            token,
+            SecretListResponse.class
         );
 
         return secrets.getKeys();
@@ -355,10 +361,10 @@ public class HTTPVaultConnector implements VaultConnector {
         requireAuth();
 
         SecretListResponse secrets = request.get(
-                String.format(PATH_AUTH_APPROLE_ROLE, roleName, "/secret-id?list=true"),
-                emptyMap(),
-                token,
-                SecretListResponse.class
+            String.format(PATH_AUTH_APPROLE_ROLE, roleName, "/secret-id?list=true"),
+            emptyMap(),
+            token,
+            SecretListResponse.class
         );
 
         return secrets.getKeys();
@@ -373,7 +379,7 @@ public class HTTPVaultConnector implements VaultConnector {
 
     @Override
     public final SecretResponse readSecretVersion(final String mount, final String key, final Integer version)
-            throws VaultConnectorException {
+        throws VaultConnectorException {
         requireAuth();
         /* Request HTTP response and parse secret metadata */
         Map<String, String> args = mapOfStrings("version", version);
@@ -383,7 +389,7 @@ public class HTTPVaultConnector implements VaultConnector {
 
     @Override
     public final MetadataResponse readSecretMetadata(final String mount, final String key)
-            throws VaultConnectorException {
+        throws VaultConnectorException {
         requireAuth();
 
         /* Request HTTP response and parse secret metadata */
@@ -398,8 +404,8 @@ public class HTTPVaultConnector implements VaultConnector {
         requireAuth();
 
         Map<String, Object> payload = mapOf(
-                "max_versions", maxVersions,
-                "cas_required", casRequired
+            "max_versions", maxVersions,
+            "cas_required", casRequired
         );
 
         write(mount + PATH_METADATA + key, payload);
@@ -421,13 +427,13 @@ public class HTTPVaultConnector implements VaultConnector {
 
         /* Issue request and parse metadata response */
         return request.post(
-                mount + PATH_DATA + key,
-                Map.of(
-                        "data", data,
-                        "options", options
-                ),
-                token,
-                SecretVersionResponse.class
+            mount + PATH_DATA + key,
+            Map.of(
+                "data", data,
+                "options", options
+            ),
+            token,
+            SecretVersionResponse.class
         );
     }
 
@@ -442,7 +448,7 @@ public class HTTPVaultConnector implements VaultConnector {
 
     @Override
     public final void write(final String key, final Map<String, Object> data, final Map<String, Object> options)
-            throws VaultConnectorException {
+        throws VaultConnectorException {
         requireAuth();
 
         if (key == null || key.isEmpty()) {
@@ -455,8 +461,8 @@ public class HTTPVaultConnector implements VaultConnector {
         // If options are given, split payload in two parts.
         if (options != null) {
             payload = Map.of(
-                    "data", data,
-                    "options", options
+                "data", data,
+                "options", options
             );
         }
 
@@ -484,19 +490,19 @@ public class HTTPVaultConnector implements VaultConnector {
 
     @Override
     public final void deleteSecretVersions(final String mount, final String key, final int... versions)
-            throws VaultConnectorException {
+        throws VaultConnectorException {
         handleSecretVersions(mount, PATH_DELETE, key, versions);
     }
 
     @Override
     public final void undeleteSecretVersions(final String mount, final String key, final int... versions)
-            throws VaultConnectorException {
+        throws VaultConnectorException {
         handleSecretVersions(mount, PATH_UNDELETE, key, versions);
     }
 
     @Override
     public final void destroySecretVersions(final String mount, final String key, final int... versions)
-            throws VaultConnectorException {
+        throws VaultConnectorException {
         handleSecretVersions(mount, PATH_DESTROY, key, versions);
     }
 
@@ -536,8 +542,8 @@ public class HTTPVaultConnector implements VaultConnector {
         requireAuth();
 
         Map<String, String> payload = mapOfStrings(
-                "lease_id", leaseID,
-                "increment", increment
+            "lease_id", leaseID,
+            "increment", increment
         );
 
         /* Issue request and parse secret response */
@@ -594,10 +600,10 @@ public class HTTPVaultConnector implements VaultConnector {
 
         /* Request HTTP response and parse Secret */
         return request.get(
-                PATH_AUTH_TOKEN + PATH_LOOKUP,
-                singletonMap("token", token),
-                token,
-                TokenResponse.class
+            PATH_AUTH_TOKEN + PATH_LOOKUP,
+            singletonMap("token", token),
+            token,
+            TokenResponse.class
         );
     }
 
@@ -646,6 +652,47 @@ public class HTTPVaultConnector implements VaultConnector {
         return true;
     }
 
+    @Override
+    public final TransitResponse transitEncrypt(final String keyName, final String plaintext)
+        throws VaultConnectorException {
+        requireAuth();
+
+        Map<String, Object> payload = mapOf(
+            "plaintext", plaintext
+        );
+
+        return request.post(PATH_TRANSIT_ENCRYPT + keyName, payload, token, TransitResponse.class);
+    }
+
+    @Override
+    public final TransitResponse transitDecrypt(final String keyName, final String ciphertext)
+        throws VaultConnectorException {
+        requireAuth();
+
+        Map<String, Object> payload = mapOf(
+            "ciphertext", ciphertext
+        );
+
+        return request.post(PATH_TRANSIT_DECRYPT + keyName, payload, token, TransitResponse.class);
+    }
+
+    @Override
+    public final TransitResponse transitHash(final String algorithm, final String input, final String format)
+        throws VaultConnectorException {
+        if (format != null && !"hex".equals(format) && !"base64".equals(format)) {
+            throw new IllegalArgumentException("Unsupported format " + format);
+        }
+
+        requireAuth();
+
+        Map<String, Object> payload = mapOf(
+            "input", input,
+            "format", format
+        );
+
+        return request.post(PATH_TRANSIT_HASH + algorithm, payload, token, TransitResponse.class);
+    }
+
     /**
      * Check for required authorization.
      *

src/main/java/de/stklcode/jvault/connector/HTTPVaultConnectorBuilder.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -20,18 +20,17 @@ import de.stklcode.jvault.connector.exception.ConnectionException;
 import de.stklcode.jvault.connector.exception.TlsException;
 import de.stklcode.jvault.connector.exception.VaultConnectorException;
 
+import java.io.ByteArrayInputStream;
 import java.io.IOException;
-import java.net.MalformedURLException;
 import java.net.URI;
 import java.net.URISyntaxException;
-import java.net.URL;
+import java.nio.charset.StandardCharsets;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.nio.file.Paths;
 import java.security.cert.CertificateException;
 import java.security.cert.CertificateFactory;
 import java.security.cert.X509Certificate;
-import java.util.Objects;
 
 /**
  * Vault Connector Builder implementation for HTTP Vault connectors.
@@ -96,10 +95,14 @@ public final class HTTPVaultConnectorBuilder {
      * @since 1.0
      */
     public HTTPVaultConnectorBuilder withBaseURL(final URI baseURL) {
-        return withTLS(!("http".equalsIgnoreCase(Objects.requireNonNullElse(baseURL.getScheme(), ""))))
-                .withHost(baseURL.getHost())
-                .withPort(baseURL.getPort())
-                .withPrefix(baseURL.getPath());
+        String path = baseURL.getPath();
+        if (path == null || path.isBlank()) {
+            path = DEFAULT_PREFIX;
+        }
+        return withTLS(!("http".equalsIgnoreCase(baseURL.getScheme())))
+            .withHost(baseURL.getHost())
+            .withPort(baseURL.getPort())
+            .withPrefix(path);
     }
 
     /**
@@ -301,13 +304,10 @@ public final class HTTPVaultConnectorBuilder {
      */
     public HTTPVaultConnectorBuilder fromEnv() throws VaultConnectorException {
         /* Parse URL from environment variable */
-        if (System.getenv(ENV_VAULT_ADDR) != null && !System.getenv(ENV_VAULT_ADDR).trim().isEmpty()) {
+        if (System.getenv(ENV_VAULT_ADDR) != null && !System.getenv(ENV_VAULT_ADDR).isBlank()) {
             try {
-                var url = new URL(System.getenv(ENV_VAULT_ADDR));
-                this.host = url.getHost();
-                this.port = url.getPort();
-                this.tls = url.getProtocol().equals("https");
-            } catch (MalformedURLException e) {
+                withBaseURL(System.getenv(ENV_VAULT_ADDR));
+            } catch (URISyntaxException e) {
                 throw new ConnectionException("URL provided in environment variable malformed", e);
             }
         }
@@ -315,7 +315,7 @@ public final class HTTPVaultConnectorBuilder {
         /* Read number of retries */
         if (System.getenv(ENV_VAULT_MAX_RETRIES) != null) {
             try {
-                numberOfRetries = Integer.parseInt(System.getenv(ENV_VAULT_MAX_RETRIES));
+                withNumberOfRetries(Integer.parseInt(System.getenv(ENV_VAULT_MAX_RETRIES)));
             } catch (NumberFormatException ignored) {
                 /* Ignore malformed values. */
             }
@@ -325,8 +325,12 @@ public final class HTTPVaultConnectorBuilder {
         token = System.getenv(ENV_VAULT_TOKEN);
 
         /* Parse certificate, if set */
-        if (System.getenv(ENV_VAULT_CACERT) != null && !System.getenv(ENV_VAULT_CACERT).trim().isEmpty()) {
-            return withTrustedCA(Paths.get(System.getenv(ENV_VAULT_CACERT)));
+        if (System.getenv(ENV_VAULT_CACERT) != null && !System.getenv(ENV_VAULT_CACERT).isBlank()) {
+            X509Certificate cert = certificateFromString(System.getenv(ENV_VAULT_CACERT));
+            if (cert == null) {
+                cert = certificateFromFile(Paths.get(System.getenv(ENV_VAULT_CACERT)));
+            }
+            return withTrustedCA(cert);
         }
         return this;
     }
@@ -398,6 +402,28 @@ public final class HTTPVaultConnectorBuilder {
         return con;
     }
 
+    /**
+     * Read given certificate file to X.509 certificate.
+     *
+     * @param cert Certificate string (optionally PEM)
+     * @return X.509 Certificate object if parseable, else {@code null}
+     * @throws TlsException on error
+     * @since 1.5.0
+     */
+    private X509Certificate certificateFromString(final String cert) throws TlsException {
+        // Check if PEM header is present in given string
+        if (cert.contains("-BEGIN ") && cert.contains("-END")) {
+            try (var is = new ByteArrayInputStream(cert.getBytes(StandardCharsets.UTF_8))) {
+                return (X509Certificate) CertificateFactory.getInstance("X.509").generateCertificate(is);
+            } catch (IOException | CertificateException e) {
+                throw new TlsException("Unable to read certificate.", e);
+            }
+        }
+
+        // Not am PEM string, skip
+        return null;
+    }
+
     /**
      * Read given certificate file to X.509 certificate.
      *

src/main/java/de/stklcode/jvault/connector/VaultConnector.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -21,10 +21,7 @@ import de.stklcode.jvault.connector.model.*;
 import de.stklcode.jvault.connector.model.response.*;
 
 import java.io.Serializable;
-import java.util.ArrayList;
-import java.util.Collections;
-import java.util.List;
-import java.util.Map;
+import java.util.*;
 
 /**
  * Vault Connector interface.
@@ -194,7 +191,7 @@ public interface VaultConnector extends AutoCloseable, Serializable {
      * @since 0.4.0
      */
     default boolean createAppRole(final String roleName, final List<String> policies, final String roleID)
-            throws VaultConnectorException {
+        throws VaultConnectorException {
         return createAppRole(AppRole.builder(roleName).withTokenPolicies(policies).withId(roleID).build());
     }
 
@@ -260,7 +257,7 @@ public interface VaultConnector extends AutoCloseable, Serializable {
      * @since 0.4.0
      */
     default AppRoleSecretResponse createAppRoleSecret(final String roleName, final String secretID)
-            throws VaultConnectorException {
+        throws VaultConnectorException {
         return createAppRoleSecret(roleName, new AppRoleSecret(secretID));
     }
 
@@ -274,7 +271,7 @@ public interface VaultConnector extends AutoCloseable, Serializable {
      * @since 0.4.0
      */
     AppRoleSecretResponse createAppRoleSecret(final String roleName, final AppRoleSecret secret)
-            throws VaultConnectorException;
+        throws VaultConnectorException;
 
     /**
      * Lookup an AppRole secret.
@@ -286,7 +283,7 @@ public interface VaultConnector extends AutoCloseable, Serializable {
      * @since 0.4.0
      */
     AppRoleSecretResponse lookupAppRoleSecret(final String roleName, final String secretID)
-            throws VaultConnectorException;
+        throws VaultConnectorException;
 
     /**
      * Destroy an AppRole secret.
@@ -401,7 +398,7 @@ public interface VaultConnector extends AutoCloseable, Serializable {
      * @since 0.8
      */
     SecretResponse readSecretVersion(final String mount, final String key, final Integer version)
-            throws VaultConnectorException;
+        throws VaultConnectorException;
 
     /**
      * Retrieve secret metadata from Vault.
@@ -479,7 +476,7 @@ public interface VaultConnector extends AutoCloseable, Serializable {
      * @since 0.8 {@code options} parameter added
      */
     void write(final String key, final Map<String, Object> data, final Map<String, Object> options)
-            throws VaultConnectorException;
+        throws VaultConnectorException;
 
     /**
      * Delete key from Vault.
@@ -527,7 +524,7 @@ public interface VaultConnector extends AutoCloseable, Serializable {
      * @since 0.8
      */
     void deleteSecretVersions(final String mount, final String key, final int... versions)
-            throws VaultConnectorException;
+        throws VaultConnectorException;
 
     /**
      * Undelete (restore) secret versions from Vault.
@@ -540,7 +537,7 @@ public interface VaultConnector extends AutoCloseable, Serializable {
      * @since 0.8
      */
     void undeleteSecretVersions(final String mount, final String key, final int... versions)
-            throws VaultConnectorException;
+        throws VaultConnectorException;
 
     /**
      * Destroy secret versions from Vault.
@@ -553,7 +550,7 @@ public interface VaultConnector extends AutoCloseable, Serializable {
      * @since 0.8
      */
     void destroySecretVersions(final String mount, final String key, final int... versions)
-            throws VaultConnectorException;
+        throws VaultConnectorException;
 
     /**
      * Revoke given lease immediately.
@@ -674,6 +671,82 @@ public interface VaultConnector extends AutoCloseable, Serializable {
      */
     boolean deleteTokenRole(final String name) throws VaultConnectorException;
 
+    /**
+     * Encrypt plaintext via transit engine from Vault.
+     *
+     * @param keyName   Transit key name
+     * @param plaintext Text to encrypt (Base64 encoded)
+     * @return Transit response
+     * @throws VaultConnectorException on error
+     * @since 1.5.0
+     */
+    TransitResponse transitEncrypt(final String keyName, final String plaintext) throws VaultConnectorException;
+
+    /**
+     * Encrypt plaintext via transit engine from Vault.
+     *
+     * @param keyName   Transit key name
+     * @param plaintext Binary data to encrypt
+     * @return Transit response
+     * @throws VaultConnectorException on error
+     * @since 1.5.0
+     */
+    default TransitResponse transitEncrypt(final String keyName, final byte[] plaintext)
+        throws VaultConnectorException {
+        return transitEncrypt(keyName, Base64.getEncoder().encodeToString(plaintext));
+    }
+
+    /**
+     * Decrypt ciphertext via transit engine from Vault.
+     *
+     * @param keyName    Transit key name
+     * @param ciphertext Text to decrypt
+     * @return Transit response
+     * @throws VaultConnectorException on error
+     * @since 1.5.0
+     */
+    TransitResponse transitDecrypt(final String keyName, final String ciphertext) throws VaultConnectorException;
+
+    /**
+     * Hash data in hex format via transit engine from Vault.
+     *
+     * @param algorithm Specifies the hash algorithm to use
+     * @param input     Data to hash
+     * @return Transit response
+     * @throws VaultConnectorException on error
+     * @since 1.5.0
+     */
+    default TransitResponse transitHash(final String algorithm, final String input) throws VaultConnectorException {
+        return transitHash(algorithm, input, "hex");
+    }
+
+    /**
+     * Hash data via transit engine from Vault.
+     *
+     * @param algorithm Specifies the hash algorithm to use
+     * @param input     Data to hash (Base64 encoded)
+     * @param format    Specifies the output encoding (hex/base64)
+     * @return Transit response
+     * @throws VaultConnectorException on error
+     * @since 1.5.0
+     */
+    TransitResponse transitHash(final String algorithm, final String input, final String format)
+        throws VaultConnectorException;
+
+    /**
+     * Hash data via transit engine from Vault.
+     *
+     * @param algorithm Specifies the hash algorithm to use
+     * @param input     Data to hash
+     * @return Transit response
+     * @throws VaultConnectorException on error
+     * @since 1.5.0
+     */
+    default TransitResponse transitHash(final String algorithm, final byte[] input, final String format)
+        throws VaultConnectorException {
+        return transitHash(algorithm, Base64.getEncoder().encodeToString(input), format);
+    }
+
     /**
      * Read credentials for MySQL backend at default mount point.
      *
@@ -681,7 +754,9 @@ public interface VaultConnector extends AutoCloseable, Serializable {
      * @return the credentials response
      * @throws VaultConnectorException on error
      * @since 0.5.0
+     * @deprecated use {@link #readDbCredentials(String, String)} your MySQL mountpoint
      */
+    @Deprecated(since = "1.5.0", forRemoval = true)
     default CredentialsResponse readMySqlCredentials(final String role) throws VaultConnectorException {
         return readDbCredentials(role, "mysql");
     }
@@ -693,7 +768,9 @@ public interface VaultConnector extends AutoCloseable, Serializable {
      * @return the credentials response
      * @throws VaultConnectorException on error
      * @since 0.5.0
+     * @deprecated use {@link #readDbCredentials(String, String)} your PostgreSQL mountpoint
      */
+    @Deprecated(since = "1.5.0", forRemoval = true)
     default CredentialsResponse readPostgreSqlCredentials(final String role) throws VaultConnectorException {
         return readDbCredentials(role, "postgresql");
     }
@@ -705,34 +782,38 @@ public interface VaultConnector extends AutoCloseable, Serializable {
      * @return the credentials response
      * @throws VaultConnectorException on error
      * @since 0.5.0
+     * @deprecated use {@link #readDbCredentials(String, String)} your MSSQL mountpoint
      */
+    @Deprecated(since = "1.5.0", forRemoval = true)
     default CredentialsResponse readMsSqlCredentials(final String role) throws VaultConnectorException {
         return readDbCredentials(role, "mssql");
     }
 
     /**
-     * Read credentials for MSSQL backend at default mount point.
+     * Read credentials for MongoDB backend at default mount point.
      *
      * @param role the role name
      * @return the credentials response
      * @throws VaultConnectorException on error
      * @since 0.5.0
+     * @deprecated use {@link #readDbCredentials(String, String)} your MongoDB mountpoint
      */
+    @Deprecated(since = "1.5.0", forRemoval = true)
     default CredentialsResponse readMongoDbCredentials(final String role) throws VaultConnectorException {
         return readDbCredentials(role, "mongodb");
     }
 
     /**
-     * Read credentials for SQL backends.
+     * Read credentials for database backends.
      *
      * @param role  the role name
-     * @param mount mount point of the SQL backend
+     * @param mount mount point of the database backend
      * @return the credentials response
      * @throws VaultConnectorException on error
      * @since 0.5.0
      */
     default CredentialsResponse readDbCredentials(final String role, final String mount)
-            throws VaultConnectorException {
+        throws VaultConnectorException {
         return (CredentialsResponse) read(mount + "/creds/" + role);
     }
 }

src/main/java/de/stklcode/jvault/connector/exception/AuthorizationRequiredException.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -16,6 +16,8 @@
 
 package de.stklcode.jvault.connector.exception;
 
+import java.io.Serial;
+
 /**
  * Exception thrown trying to do a request without any authorization handles.
  *
@@ -23,5 +25,6 @@ package de.stklcode.jvault.connector.exception;
  * @since 0.1
  */
 public class AuthorizationRequiredException extends VaultConnectorException {
+    @Serial
     private static final long serialVersionUID = 2629577936657393880L;
 }

src/main/java/de/stklcode/jvault/connector/exception/ConnectionException.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -16,6 +16,8 @@
 
 package de.stklcode.jvault.connector.exception;
 
+import java.io.Serial;
+
 /**
  * Exception thrown on problems with connection to Vault backend.
  *
@@ -23,6 +25,7 @@ package de.stklcode.jvault.connector.exception;
  * @since 0.1
  */
 public class ConnectionException extends VaultConnectorException {
+    @Serial
     private static final long serialVersionUID = 3005430116002990418L;
 
     /**

src/main/java/de/stklcode/jvault/connector/exception/InvalidRequestException.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -16,6 +16,8 @@
 
 package de.stklcode.jvault.connector.exception;
 
+import java.io.Serial;
+
 /**
  * Exception thrown when trying to send malformed request.
  *
@@ -23,6 +25,7 @@ package de.stklcode.jvault.connector.exception;
  * @since 0.1
  */
 public class InvalidRequestException extends VaultConnectorException {
+    @Serial
     private static final long serialVersionUID = -6712239648281809159L;
 
     /**

src/main/java/de/stklcode/jvault/connector/exception/InvalidResponseException.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -16,6 +16,8 @@
 
 package de.stklcode.jvault.connector.exception;
 
+import java.io.Serial;
+
 /**
  * Exception thrown when response from vault returned with erroneous status code or payload could not be parsed
  * to entity class.
@@ -24,6 +26,7 @@ package de.stklcode.jvault.connector.exception;
  * @since 0.1
  */
 public final class InvalidResponseException extends VaultConnectorException {
+    @Serial
     private static final long serialVersionUID = 2003151038614163479L;
 
     private final Integer statusCode;

src/main/java/de/stklcode/jvault/connector/exception/PermissionDeniedException.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -16,6 +16,8 @@
 
 package de.stklcode.jvault.connector.exception;
 
+import java.io.Serial;
+
 /**
  * Exception thrown when trying to access a path the current user/token does not have permission to access.
  *
@@ -23,6 +25,7 @@ package de.stklcode.jvault.connector.exception;
  * @since 0.1
  */
 public class PermissionDeniedException extends VaultConnectorException {
+    @Serial
     private static final long serialVersionUID = -7149134015090750776L;
 
     /**

src/main/java/de/stklcode/jvault/connector/exception/TlsException.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -16,6 +16,8 @@
 
 package de.stklcode.jvault.connector.exception;
 
+import java.io.Serial;
+
 /**
  * Exception thrown on errors with TLS connection.
  *
@@ -23,6 +25,7 @@ package de.stklcode.jvault.connector.exception;
  * @since 0.4.0
  */
 public class TlsException extends VaultConnectorException {
+    @Serial
     private static final long serialVersionUID = -5139276834988258086L;
 
     /**

src/main/java/de/stklcode/jvault/connector/exception/VaultConnectorException.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -16,6 +16,8 @@
 
 package de.stklcode.jvault.connector.exception;
 
+import java.io.Serial;
+
 /**
  * Abstract Exception class for Vault Connector internal exceptions.
  *
@@ -23,6 +25,7 @@ package de.stklcode.jvault.connector.exception;
  * @since 0.1
  */
 public abstract class VaultConnectorException extends Exception {
+    @Serial
     private static final long serialVersionUID = -2612477894310906036L;
 
     /**

src/main/java/de/stklcode/jvault/connector/exception/package-info.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

src/main/java/de/stklcode/jvault/connector/internal/Error.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

src/main/java/de/stklcode/jvault/connector/internal/RequestHelper.java

@@ -2,8 +2,8 @@ package de.stklcode.jvault.connector.internal;
 
 import com.fasterxml.jackson.core.JsonProcessingException;
 import com.fasterxml.jackson.databind.DeserializationFeature;
-import com.fasterxml.jackson.databind.ObjectMapper;
 import com.fasterxml.jackson.databind.SerializationFeature;
+import com.fasterxml.jackson.databind.json.JsonMapper;
 import com.fasterxml.jackson.datatype.jsr310.JavaTimeModule;
 import de.stklcode.jvault.connector.exception.*;
 import de.stklcode.jvault.connector.model.response.ErrorResponse;
@@ -44,7 +44,7 @@ public final class RequestHelper implements Serializable {
     private final int retries;                      // Number of retries on 5xx errors.
     private final String tlsVersion;                // TLS version (#22).
     private final X509Certificate trustedCaCert;    // Trusted CA certificate.
-    private final ObjectMapper jsonMapper;
+    private final JsonMapper jsonMapper;
 
     /**
      * Constructor of the request helper.
@@ -65,10 +65,11 @@ public final class RequestHelper implements Serializable {
         this.timeout = timeout;
         this.tlsVersion = tlsVersion;
         this.trustedCaCert = trustedCaCert;
-        this.jsonMapper = new ObjectMapper()
-                .registerModule(new JavaTimeModule())
-                .enable(SerializationFeature.WRITE_DATES_AS_TIMESTAMPS)
-                .disable(DeserializationFeature.ADJUST_DATES_TO_CONTEXT_TIME_ZONE);
+        this.jsonMapper = JsonMapper.builder()
+            .addModule(new JavaTimeModule())
+            .enable(SerializationFeature.WRITE_DATES_AS_TIMESTAMPS)
+            .disable(DeserializationFeature.ADJUST_DATES_TO_CONTEXT_TIME_ZONE)
+            .build();
     }
 
     /**
@@ -115,7 +116,7 @@ public final class RequestHelper implements Serializable {
      * @since 0.8
      */
     public <T> T post(final String path, final Object payload, final String token, final Class<T> target)
-            throws VaultConnectorException {
+        throws VaultConnectorException {
         try {
             String response = post(path, payload, token);
             return jsonMapper.readValue(response, target);
@@ -134,7 +135,7 @@ public final class RequestHelper implements Serializable {
      * @since 0.8
      */
     public void postWithoutResponse(final String path, final Object payload, final String token)
-            throws VaultConnectorException {
+        throws VaultConnectorException {
         if (!post(path, payload, token).isEmpty()) {
             throw new InvalidResponseException(Error.UNEXPECTED_RESPONSE);
         }
@@ -151,7 +152,7 @@ public final class RequestHelper implements Serializable {
      * @since 0.8 Added {@code token} parameter.
      */
     public String put(final String path, final Map<String, String> payload, final String token)
-            throws VaultConnectorException {
+        throws VaultConnectorException {
         // Initialize PUT.
         var req = HttpRequest.newBuilder(URI.create(baseURL + path));
 
@@ -185,7 +186,7 @@ public final class RequestHelper implements Serializable {
      * @since 0.8
      */
     public <T> T put(final String path, final Map<String, String> payload, final String token, final Class<T> target)
-            throws VaultConnectorException {
+        throws VaultConnectorException {
         try {
             String response = put(path, payload, token);
             return jsonMapper.readValue(response, target);
@@ -204,7 +205,7 @@ public final class RequestHelper implements Serializable {
      * @since 0.8
      */
     public void putWithoutResponse(final String path, final Map<String, String> payload, final String token)
-            throws VaultConnectorException {
+        throws VaultConnectorException {
         if (!put(path, payload, token).isEmpty()) {
             throw new InvalidResponseException(Error.UNEXPECTED_RESPONSE);
         }
@@ -256,15 +257,15 @@ public final class RequestHelper implements Serializable {
      * @since 0.8 Added {@code token} parameter.
      */
     public String get(final String path, final Map<String, String> payload, final String token)
-            throws VaultConnectorException {
+        throws VaultConnectorException {
         // Add parameters to URI.
         var uriBuilder = new StringBuilder(baseURL + path);
 
         if (!payload.isEmpty()) {
             uriBuilder.append("?").append(
-                    payload.entrySet().stream().map(par ->
-                            URLEncoder.encode(par.getKey(), UTF_8) + "=" + URLEncoder.encode(par.getValue(), UTF_8)
-                    ).collect(Collectors.joining("&"))
+                payload.entrySet().stream().map(par ->
+                    URLEncoder.encode(par.getKey(), UTF_8) + "=" + URLEncoder.encode(par.getValue(), UTF_8)
+                ).collect(Collectors.joining("&"))
             );
         }
 
@@ -297,7 +298,7 @@ public final class RequestHelper implements Serializable {
      * @since 0.8
      */
     public <T> T get(final String path, final Map<String, String> payload, final String token, final Class<T> target)
-            throws VaultConnectorException {
+        throws VaultConnectorException {
         try {
             String response = get(path, payload, token);
             return jsonMapper.readValue(response, target);
@@ -333,8 +334,8 @@ public final class RequestHelper implements Serializable {
         // Execute request.
         try {
             HttpResponse<InputStream> response = client.sendAsync(
-                    requestBuilder.build(),
-                    HttpResponse.BodyHandlers.ofInputStream()
+                requestBuilder.build(),
+                HttpResponse.BodyHandlers.ofInputStream()
             ).join();
 
             /* Check if response is valid */

src/main/java/de/stklcode/jvault/connector/model/AppRole.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -18,6 +18,8 @@ package de.stklcode.jvault.connector.model;
 
 import com.fasterxml.jackson.annotation.*;
 
+import java.io.Serial;
+import java.io.Serial;
 import java.io.Serializable;
 import java.util.ArrayList;
 import java.util.List;
@@ -32,7 +34,8 @@ import java.util.Objects;
  */
 @JsonIgnoreProperties(ignoreUnknown = true)
 public final class AppRole implements Serializable {
-    private static final long serialVersionUID = 693228837510483448L;
+    @Serial
+    private static final long serialVersionUID = 1546673231280751679L;
 
     @JsonProperty("role_name")
     private String name;
@@ -53,7 +56,7 @@ public final class AppRole implements Serializable {
 
     @JsonProperty("secret_id_ttl")
     @JsonInclude(JsonInclude.Include.NON_NULL)
-    private Integer secretIdTtl;
+    private Long secretIdTtl;
 
     @JsonProperty("local_secret_ids")
     @JsonInclude(JsonInclude.Include.NON_NULL)
@@ -61,11 +64,11 @@ public final class AppRole implements Serializable {
 
     @JsonProperty("token_ttl")
     @JsonInclude(JsonInclude.Include.NON_NULL)
-    private Integer tokenTtl;
+    private Long tokenTtl;
 
     @JsonProperty("token_max_ttl")
     @JsonInclude(JsonInclude.Include.NON_NULL)
-    private Integer tokenMaxTtl;
+    private Long tokenMaxTtl;
 
     private List<String> tokenPolicies;
 
@@ -75,7 +78,7 @@ public final class AppRole implements Serializable {
 
     @JsonProperty("token_explicit_max_ttl")
     @JsonInclude(JsonInclude.Include.NON_NULL)
-    private Integer tokenExplicitMaxTtl;
+    private Long tokenExplicitMaxTtl;
 
     @JsonProperty("token_no_default_policy")
     @JsonInclude(JsonInclude.Include.NON_NULL)
@@ -255,7 +258,7 @@ public final class AppRole implements Serializable {
     /**
      * @return maximum TTL in seconds for secrets
      */
-    public Integer getSecretIdTtl() {
+    public Long getSecretIdTtl() {
         return secretIdTtl;
     }
 
@@ -271,14 +274,14 @@ public final class AppRole implements Serializable {
     /**
      * @return token TTL in seconds
      */
-    public Integer getTokenTtl() {
+    public Long getTokenTtl() {
         return tokenTtl;
     }
 
     /**
      * @return maximum token TTL in seconds, including renewals
      */
-    public Integer getTokenMaxTtl() {
+    public Long getTokenMaxTtl() {
         return tokenMaxTtl;
     }
 
@@ -286,7 +289,7 @@ public final class AppRole implements Serializable {
      * @return explicit maximum token TTL in seconds, including renewals
      * @since 0.9
      */
-    public Integer getTokenExplicitMaxTtl() {
+    public Long getTokenExplicitMaxTtl() {
         return tokenExplicitMaxTtl;
     }
 
@@ -331,28 +334,28 @@ public final class AppRole implements Serializable {
         }
         AppRole appRole = (AppRole) o;
         return Objects.equals(name, appRole.name) &&
-                Objects.equals(id, appRole.id) &&
-                Objects.equals(bindSecretId, appRole.bindSecretId) &&
-                Objects.equals(secretIdBoundCidrs, appRole.secretIdBoundCidrs) &&
-                Objects.equals(secretIdNumUses, appRole.secretIdNumUses) &&
-                Objects.equals(secretIdTtl, appRole.secretIdTtl) &&
-                Objects.equals(localSecretIds, appRole.localSecretIds) &&
-                Objects.equals(tokenTtl, appRole.tokenTtl) &&
-                Objects.equals(tokenMaxTtl, appRole.tokenMaxTtl) &&
-                Objects.equals(tokenPolicies, appRole.tokenPolicies) &&
-                Objects.equals(tokenBoundCidrs, appRole.tokenBoundCidrs) &&
-                Objects.equals(tokenExplicitMaxTtl, appRole.tokenExplicitMaxTtl) &&
-                Objects.equals(tokenNoDefaultPolicy, appRole.tokenNoDefaultPolicy) &&
-                Objects.equals(tokenNumUses, appRole.tokenNumUses) &&
-                Objects.equals(tokenPeriod, appRole.tokenPeriod) &&
-                Objects.equals(tokenType, appRole.tokenType);
+            Objects.equals(id, appRole.id) &&
+            Objects.equals(bindSecretId, appRole.bindSecretId) &&
+            Objects.equals(secretIdBoundCidrs, appRole.secretIdBoundCidrs) &&
+            Objects.equals(secretIdNumUses, appRole.secretIdNumUses) &&
+            Objects.equals(secretIdTtl, appRole.secretIdTtl) &&
+            Objects.equals(localSecretIds, appRole.localSecretIds) &&
+            Objects.equals(tokenTtl, appRole.tokenTtl) &&
+            Objects.equals(tokenMaxTtl, appRole.tokenMaxTtl) &&
+            Objects.equals(tokenPolicies, appRole.tokenPolicies) &&
+            Objects.equals(tokenBoundCidrs, appRole.tokenBoundCidrs) &&
+            Objects.equals(tokenExplicitMaxTtl, appRole.tokenExplicitMaxTtl) &&
+            Objects.equals(tokenNoDefaultPolicy, appRole.tokenNoDefaultPolicy) &&
+            Objects.equals(tokenNumUses, appRole.tokenNumUses) &&
+            Objects.equals(tokenPeriod, appRole.tokenPeriod) &&
+            Objects.equals(tokenType, appRole.tokenType);
     }
 
     @Override
     public int hashCode() {
         return Objects.hash(name, id, bindSecretId, secretIdBoundCidrs, secretIdNumUses, secretIdTtl,
-                localSecretIds, tokenTtl, tokenMaxTtl, tokenPolicies, tokenBoundCidrs, tokenExplicitMaxTtl,
-                tokenNoDefaultPolicy, tokenNumUses, tokenPeriod, tokenType);
+            localSecretIds, tokenTtl, tokenMaxTtl, tokenPolicies, tokenBoundCidrs, tokenExplicitMaxTtl,
+            tokenNoDefaultPolicy, tokenNumUses, tokenPeriod, tokenType);
     }
 
 
@@ -370,12 +373,12 @@ public final class AppRole implements Serializable {
         private List<String> secretIdBoundCidrs;
         private List<String> tokenPolicies;
         private Integer secretIdNumUses;
-        private Integer secretIdTtl;
+        private Long secretIdTtl;
         private Boolean localSecretIds;
-        private Integer tokenTtl;
-        private Integer tokenMaxTtl;
+        private Long tokenTtl;
+        private Long tokenMaxTtl;
         private List<String> tokenBoundCidrs;
-        private Integer tokenExplicitMaxTtl;
+        private Long tokenExplicitMaxTtl;
         private Boolean tokenNoDefaultPolicy;
         private Integer tokenNumUses;
         private Integer tokenPeriod;
@@ -520,7 +523,7 @@ public final class AppRole implements Serializable {
          * @param secretIdTtl the TTL
          * @return self
          */
-        public Builder withSecretIdTtl(final Integer secretIdTtl) {
+        public Builder withSecretIdTtl(final Long secretIdTtl) {
             this.secretIdTtl = secretIdTtl;
             return this;
         }
@@ -544,7 +547,7 @@ public final class AppRole implements Serializable {
          * @param tokenTtl the TTL
          * @return self
          */
-        public Builder withTokenTtl(final Integer tokenTtl) {
+        public Builder withTokenTtl(final Long tokenTtl) {
             this.tokenTtl = tokenTtl;
             return this;
         }
@@ -555,7 +558,7 @@ public final class AppRole implements Serializable {
          * @param tokenMaxTtl the TTL
          * @return self
          */
-        public Builder withTokenMaxTtl(final Integer tokenMaxTtl) {
+        public Builder withTokenMaxTtl(final Long tokenMaxTtl) {
             this.tokenMaxTtl = tokenMaxTtl;
             return this;
         }
@@ -596,7 +599,7 @@ public final class AppRole implements Serializable {
          * @param tokenExplicitMaxTtl the TTL
          * @return self
          */
-        public Builder withTokenExplicitMaxTtl(final Integer tokenExplicitMaxTtl) {
+        public Builder withTokenExplicitMaxTtl(final Long tokenExplicitMaxTtl) {
             this.tokenExplicitMaxTtl = tokenExplicitMaxTtl;
             return this;
         }

src/main/java/de/stklcode/jvault/connector/model/AppRoleSecret.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -18,6 +18,7 @@ package de.stklcode.jvault.connector.model;
 
 import com.fasterxml.jackson.annotation.*;
 
+import java.io.Serial;
 import java.io.Serializable;
 import java.util.List;
 import java.util.Map;
@@ -32,6 +33,7 @@ import java.util.Objects;
  */
 @JsonIgnoreProperties(ignoreUnknown = true)
 public final class AppRoleSecret implements Serializable {
+    @Serial
     private static final long serialVersionUID = -3401074170145792641L;
 
     @JsonProperty("secret_id")
@@ -181,19 +183,19 @@ public final class AppRoleSecret implements Serializable {
         }
         AppRoleSecret that = (AppRoleSecret) o;
         return Objects.equals(id, that.id) &&
-                Objects.equals(accessor, that.accessor) &&
-                Objects.equals(metadata, that.metadata) &&
-                Objects.equals(cidrList, that.cidrList) &&
-                Objects.equals(creationTime, that.creationTime) &&
-                Objects.equals(expirationTime, that.expirationTime) &&
-                Objects.equals(lastUpdatedTime, that.lastUpdatedTime) &&
-                Objects.equals(numUses, that.numUses) &&
-                Objects.equals(ttl, that.ttl);
+            Objects.equals(accessor, that.accessor) &&
+            Objects.equals(metadata, that.metadata) &&
+            Objects.equals(cidrList, that.cidrList) &&
+            Objects.equals(creationTime, that.creationTime) &&
+            Objects.equals(expirationTime, that.expirationTime) &&
+            Objects.equals(lastUpdatedTime, that.lastUpdatedTime) &&
+            Objects.equals(numUses, that.numUses) &&
+            Objects.equals(ttl, that.ttl);
     }
 
     @Override
     public int hashCode() {
         return Objects.hash(id, accessor, metadata, cidrList, creationTime, expirationTime, lastUpdatedTime, numUses,
-                ttl);
+            ttl);
     }
 }

src/main/java/de/stklcode/jvault/connector/model/AuthBackend.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

src/main/java/de/stklcode/jvault/connector/model/Token.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -20,6 +20,7 @@ import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
 
+import java.io.Serial;
 import java.io.Serializable;
 import java.util.*;
 
@@ -32,7 +33,8 @@ import java.util.*;
  */
 @JsonIgnoreProperties(ignoreUnknown = true)
 public final class Token implements Serializable {
-    private static final long serialVersionUID = 5208508683665365287L;
+    @Serial
+    private static final long serialVersionUID = 7003016071684507115L;
 
     @JsonProperty("id")
     @JsonInclude(JsonInclude.Include.NON_NULL)
@@ -56,11 +58,11 @@ public final class Token implements Serializable {
 
     @JsonProperty("ttl")
     @JsonInclude(JsonInclude.Include.NON_NULL)
-    private Integer ttl;
+    private Long ttl;
 
     @JsonProperty("explicit_max_ttl")
     @JsonInclude(JsonInclude.Include.NON_NULL)
-    private Integer explicitMaxTtl;
+    private Long explicitMaxTtl;
 
     @JsonProperty("num_uses")
     @JsonInclude(JsonInclude.Include.NON_NULL)
@@ -162,7 +164,7 @@ public final class Token implements Serializable {
     /**
      * @return Time-to-live in seconds
      */
-    public Integer getTtl() {
+    public Long getTtl() {
         return ttl;
     }
 
@@ -170,7 +172,7 @@ public final class Token implements Serializable {
      * @return Explicit maximum time-to-live in seconds
      * @since 0.9
      */
-    public Integer getExplicitMaxTtl() {
+    public Long getExplicitMaxTtl() {
         return explicitMaxTtl;
     }
 
@@ -227,24 +229,24 @@ public final class Token implements Serializable {
         }
         Token token = (Token) o;
         return Objects.equals(id, token.id) &&
-                Objects.equals(type, token.type) &&
-                Objects.equals(displayName, token.displayName) &&
-                Objects.equals(noParent, token.noParent) &&
-                Objects.equals(noDefaultPolicy, token.noDefaultPolicy) &&
-                Objects.equals(ttl, token.ttl) &&
-                Objects.equals(explicitMaxTtl, token.explicitMaxTtl) &&
-                Objects.equals(numUses, token.numUses) &&
-                Objects.equals(policies, token.policies) &&
-                Objects.equals(meta, token.meta) &&
-                Objects.equals(renewable, token.renewable) &&
-                Objects.equals(period, token.period) &&
-                Objects.equals(entityAlias, token.entityAlias);
+            Objects.equals(type, token.type) &&
+            Objects.equals(displayName, token.displayName) &&
+            Objects.equals(noParent, token.noParent) &&
+            Objects.equals(noDefaultPolicy, token.noDefaultPolicy) &&
+            Objects.equals(ttl, token.ttl) &&
+            Objects.equals(explicitMaxTtl, token.explicitMaxTtl) &&
+            Objects.equals(numUses, token.numUses) &&
+            Objects.equals(policies, token.policies) &&
+            Objects.equals(meta, token.meta) &&
+            Objects.equals(renewable, token.renewable) &&
+            Objects.equals(period, token.period) &&
+            Objects.equals(entityAlias, token.entityAlias);
     }
 
     @Override
     public int hashCode() {
         return Objects.hash(id, type, displayName, noParent, noDefaultPolicy, ttl, explicitMaxTtl, numUses, policies,
-                meta, renewable, period, entityAlias);
+            meta, renewable, period, entityAlias);
     }
 
     /**
@@ -282,8 +284,8 @@ public final class Token implements Serializable {
         private String displayName;
         private Boolean noParent;
         private Boolean noDefaultPolicy;
-        private Integer ttl;
-        private Integer explicitMaxTtl;
+        private Long ttl;
+        private Long explicitMaxTtl;
         private Integer numUses;
         private List<String> policies;
         private Map<String, String> meta;
@@ -331,7 +333,7 @@ public final class Token implements Serializable {
          * @param ttl the ttl
          * @return self
          */
-        public Builder withTtl(final Integer ttl) {
+        public Builder withTtl(final Long ttl) {
             this.ttl = ttl;
             return this;
         }
@@ -342,7 +344,7 @@ public final class Token implements Serializable {
          * @param explicitMaxTtl the explicit max. TTL
          * @return self
          */
-        public Builder withExplicitMaxTtl(final Integer explicitMaxTtl) {
+        public Builder withExplicitMaxTtl(final Long explicitMaxTtl) {
             this.explicitMaxTtl = explicitMaxTtl;
             return this;
         }

src/main/java/de/stklcode/jvault/connector/model/TokenRole.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -20,6 +20,7 @@ import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
 
+import java.io.Serial;
 import java.io.Serializable;
 import java.util.ArrayList;
 import java.util.List;
@@ -34,7 +35,8 @@ import java.util.Objects;
  */
 @JsonIgnoreProperties(ignoreUnknown = true)
 public final class TokenRole implements Serializable {
-    private static final long serialVersionUID = -3505215215838576321L;
+    @Serial
+    private static final long serialVersionUID = -4856948364869438439L;
 
     @JsonProperty("name")
     @JsonInclude(JsonInclude.Include.NON_NULL)
@@ -78,7 +80,7 @@ public final class TokenRole implements Serializable {
 
     @JsonProperty("token_explicit_max_ttl")
     @JsonInclude(JsonInclude.Include.NON_NULL)
-    private Integer tokenExplicitMaxTtl;
+    private Long tokenExplicitMaxTtl;
 
     @JsonProperty("token_no_default_policy")
     @JsonInclude(JsonInclude.Include.NON_NULL)
@@ -204,7 +206,7 @@ public final class TokenRole implements Serializable {
     /**
      * @return Token explicit maximum TTL
      */
-    public Integer getTokenExplicitMaxTtl() {
+    public Long getTokenExplicitMaxTtl() {
         return tokenExplicitMaxTtl;
     }
 
@@ -245,27 +247,27 @@ public final class TokenRole implements Serializable {
         }
         TokenRole tokenRole = (TokenRole) o;
         return Objects.equals(name, tokenRole.name) &&
-                Objects.equals(allowedPolicies, tokenRole.allowedPolicies) &&
-                Objects.equals(allowedPoliciesGlob, tokenRole.allowedPoliciesGlob) &&
-                Objects.equals(disallowedPolicies, tokenRole.disallowedPolicies) &&
-                Objects.equals(disallowedPoliciesGlob, tokenRole.disallowedPoliciesGlob) &&
-                Objects.equals(orphan, tokenRole.orphan) &&
-                Objects.equals(renewable, tokenRole.renewable) &&
-                Objects.equals(pathSuffix, tokenRole.pathSuffix) &&
-                Objects.equals(allowedEntityAliases, tokenRole.allowedEntityAliases) &&
-                Objects.equals(tokenBoundCidrs, tokenRole.tokenBoundCidrs) &&
-                Objects.equals(tokenExplicitMaxTtl, tokenRole.tokenExplicitMaxTtl) &&
-                Objects.equals(tokenNoDefaultPolicy, tokenRole.tokenNoDefaultPolicy) &&
-                Objects.equals(tokenNumUses, tokenRole.tokenNumUses) &&
-                Objects.equals(tokenPeriod, tokenRole.tokenPeriod) &&
-                Objects.equals(tokenType, tokenRole.tokenType);
+            Objects.equals(allowedPolicies, tokenRole.allowedPolicies) &&
+            Objects.equals(allowedPoliciesGlob, tokenRole.allowedPoliciesGlob) &&
+            Objects.equals(disallowedPolicies, tokenRole.disallowedPolicies) &&
+            Objects.equals(disallowedPoliciesGlob, tokenRole.disallowedPoliciesGlob) &&
+            Objects.equals(orphan, tokenRole.orphan) &&
+            Objects.equals(renewable, tokenRole.renewable) &&
+            Objects.equals(pathSuffix, tokenRole.pathSuffix) &&
+            Objects.equals(allowedEntityAliases, tokenRole.allowedEntityAliases) &&
+            Objects.equals(tokenBoundCidrs, tokenRole.tokenBoundCidrs) &&
+            Objects.equals(tokenExplicitMaxTtl, tokenRole.tokenExplicitMaxTtl) &&
+            Objects.equals(tokenNoDefaultPolicy, tokenRole.tokenNoDefaultPolicy) &&
+            Objects.equals(tokenNumUses, tokenRole.tokenNumUses) &&
+            Objects.equals(tokenPeriod, tokenRole.tokenPeriod) &&
+            Objects.equals(tokenType, tokenRole.tokenType);
     }
 
     @Override
     public int hashCode() {
         return Objects.hash(name, allowedPolicies, allowedPoliciesGlob, disallowedPolicies, disallowedPoliciesGlob,
-                orphan, renewable, pathSuffix, allowedEntityAliases, tokenBoundCidrs, tokenExplicitMaxTtl,
-                tokenNoDefaultPolicy, tokenNumUses, tokenPeriod, tokenType);
+            orphan, renewable, pathSuffix, allowedEntityAliases, tokenBoundCidrs, tokenExplicitMaxTtl,
+            tokenNoDefaultPolicy, tokenNumUses, tokenPeriod, tokenType);
     }
 
     /**
@@ -285,7 +287,7 @@ public final class TokenRole implements Serializable {
         private String pathSuffix;
         private List<String> allowedEntityAliases;
         private List<String> tokenBoundCidrs;
-        private Integer tokenExplicitMaxTtl;
+        private Long tokenExplicitMaxTtl;
         private Boolean tokenNoDefaultPolicy;
         private Integer tokenNumUses;
         private Integer tokenPeriod;
@@ -537,7 +539,7 @@ public final class TokenRole implements Serializable {
          * @param tokenExplicitMaxTtl explicit maximum TTL
          * @return self
          */
-        public Builder withTokenExplicitMaxTtl(final Integer tokenExplicitMaxTtl) {
+        public Builder withTokenExplicitMaxTtl(final Long tokenExplicitMaxTtl) {
             this.tokenExplicitMaxTtl = tokenExplicitMaxTtl;
             return this;
         }

src/main/java/de/stklcode/jvault/connector/model/package-info.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

src/main/java/de/stklcode/jvault/connector/model/response/AppRoleResponse.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -20,6 +20,7 @@ import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonProperty;
 import de.stklcode.jvault.connector.model.AppRole;
 
+import java.io.Serial;
 import java.util.Objects;
 
 /**
@@ -30,6 +31,7 @@ import java.util.Objects;
  */
 @JsonIgnoreProperties(ignoreUnknown = true)
 public final class AppRoleResponse extends VaultDataResponse {
+    @Serial
     private static final long serialVersionUID = -6536422219633829177L;
 
     @JsonProperty("data")

src/main/java/de/stklcode/jvault/connector/model/response/AppRoleSecretResponse.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -20,6 +20,7 @@ import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonProperty;
 import de.stklcode.jvault.connector.model.AppRoleSecret;
 
+import java.io.Serial;
 import java.util.Objects;
 
 /**
@@ -30,6 +31,7 @@ import java.util.Objects;
  */
 @JsonIgnoreProperties(ignoreUnknown = true)
 public final class AppRoleSecretResponse extends VaultDataResponse {
+    @Serial
     private static final long serialVersionUID = -2484103304072370585L;
 
     @JsonProperty("data")

src/main/java/de/stklcode/jvault/connector/model/response/AuthMethodsResponse.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -20,6 +20,7 @@ import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonProperty;
 import de.stklcode.jvault.connector.model.response.embedded.AuthMethod;
 
+import java.io.Serial;
 import java.util.HashMap;
 import java.util.Map;
 import java.util.Objects;
@@ -32,6 +33,7 @@ import java.util.Objects;
  */
 @JsonIgnoreProperties(ignoreUnknown = true)
 public final class AuthMethodsResponse extends VaultDataResponse {
+    @Serial
     private static final long serialVersionUID = -1802724129533405375L;
 
     @JsonProperty("data")

src/main/java/de/stklcode/jvault/connector/model/response/AuthResponse.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -19,6 +19,8 @@ package de.stklcode.jvault.connector.model.response;
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import de.stklcode.jvault.connector.model.response.embedded.AuthData;
 
+import java.io.Serial;
+
 /**
  * Vault response for authentication providing auth info in {@link AuthData} field.
  *
@@ -27,5 +29,6 @@ import de.stklcode.jvault.connector.model.response.embedded.AuthData;
  */
 @JsonIgnoreProperties(ignoreUnknown = true)
 public final class AuthResponse extends VaultDataResponse {
+    @Serial
     private static final long serialVersionUID = 1628851361067456715L;
 }

src/main/java/de/stklcode/jvault/connector/model/response/CredentialsResponse.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -18,6 +18,8 @@ package de.stklcode.jvault.connector.model.response;
 
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 
+import java.io.Serial;
+
 /**
  * Vault response from credentials lookup. Simple wrapper for data objects containing username and password fields.
  *
@@ -26,6 +28,7 @@ import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
  */
 @JsonIgnoreProperties(ignoreUnknown = true)
 public final class CredentialsResponse extends PlainSecretResponse {
+    @Serial
     private static final long serialVersionUID = -1439692963299045425L;
 
     /**

src/main/java/de/stklcode/jvault/connector/model/response/ErrorResponse.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -19,6 +19,7 @@ package de.stklcode.jvault.connector.model.response;
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonProperty;
 
+import java.io.Serial;
 import java.util.List;
 import java.util.Objects;
 
@@ -30,6 +31,7 @@ import java.util.Objects;
  */
 @JsonIgnoreProperties(ignoreUnknown = true)
 public final class ErrorResponse implements VaultResponse {
+    @Serial
     private static final long serialVersionUID = -6227368087842549149L;
 
     @JsonProperty("errors")

src/main/java/de/stklcode/jvault/connector/model/response/HealthResponse.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -19,6 +19,7 @@ package de.stklcode.jvault.connector.model.response;
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonProperty;
 
+import java.io.Serial;
 import java.util.Objects;
 
 /**
@@ -29,6 +30,7 @@ import java.util.Objects;
  */
 @JsonIgnoreProperties(ignoreUnknown = true)
 public final class HealthResponse implements VaultResponse {
+    @Serial
     private static final long serialVersionUID = 8675155916902904516L;
 
     @JsonProperty("cluster_id")
@@ -187,19 +189,19 @@ public final class HealthResponse implements VaultResponse {
         }
         HealthResponse that = (HealthResponse) o;
         return Objects.equals(clusterID, that.clusterID) &&
-                Objects.equals(clusterName, that.clusterName) &&
-                Objects.equals(version, that.version) &&
-                Objects.equals(serverTimeUTC, that.serverTimeUTC) &&
-                Objects.equals(standby, that.standby) &&
-                Objects.equals(sealed, that.sealed) &&
-                Objects.equals(initialized, that.initialized) &&
-                Objects.equals(replicationPerfMode, that.replicationPerfMode) &&
-                Objects.equals(replicationDrMode, that.replicationDrMode) &&
-                Objects.equals(performanceStandby, that.performanceStandby) &&
-                Objects.equals(echoDurationMs, that.echoDurationMs) &&
-                Objects.equals(clockSkewMs, that.clockSkewMs) &&
-                Objects.equals(replicationPrimaryCanaryAgeMs, that.replicationPrimaryCanaryAgeMs) &&
-                Objects.equals(enterprise, that.enterprise);
+            Objects.equals(clusterName, that.clusterName) &&
+            Objects.equals(version, that.version) &&
+            Objects.equals(serverTimeUTC, that.serverTimeUTC) &&
+            Objects.equals(standby, that.standby) &&
+            Objects.equals(sealed, that.sealed) &&
+            Objects.equals(initialized, that.initialized) &&
+            Objects.equals(replicationPerfMode, that.replicationPerfMode) &&
+            Objects.equals(replicationDrMode, that.replicationDrMode) &&
+            Objects.equals(performanceStandby, that.performanceStandby) &&
+            Objects.equals(echoDurationMs, that.echoDurationMs) &&
+            Objects.equals(clockSkewMs, that.clockSkewMs) &&
+            Objects.equals(replicationPrimaryCanaryAgeMs, that.replicationPrimaryCanaryAgeMs) &&
+            Objects.equals(enterprise, that.enterprise);
     }
 
     @Override

src/main/java/de/stklcode/jvault/connector/model/response/HelpResponse.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -19,6 +19,7 @@ package de.stklcode.jvault.connector.model.response;
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonProperty;
 
+import java.io.Serial;
 import java.util.Objects;
 
 /**
@@ -29,6 +30,7 @@ import java.util.Objects;
  */
 @JsonIgnoreProperties(ignoreUnknown = true)
 public final class HelpResponse implements VaultResponse {
+    @Serial
     private static final long serialVersionUID = -1152070966642848490L;
 
     @JsonProperty("help")

src/main/java/de/stklcode/jvault/connector/model/response/MetaSecretResponse.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2021 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -21,6 +21,7 @@ import com.fasterxml.jackson.annotation.JsonProperty;
 import de.stklcode.jvault.connector.model.response.embedded.SecretWrapper;
 import de.stklcode.jvault.connector.model.response.embedded.VersionMetadata;
 
+import java.io.Serial;
 import java.io.Serializable;
 import java.util.Collections;
 import java.util.Map;
@@ -34,6 +35,7 @@ import java.util.Objects;
  */
 @JsonIgnoreProperties(ignoreUnknown = true)
 public class MetaSecretResponse extends SecretResponse {
+    @Serial
     private static final long serialVersionUID = -1076542846391240162L;
 
     @JsonProperty("data")

src/main/java/de/stklcode/jvault/connector/model/response/MetadataResponse.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -20,6 +20,7 @@ import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonProperty;
 import de.stklcode.jvault.connector.model.response.embedded.SecretMetadata;
 
+import java.io.Serial;
 import java.util.Objects;
 
 
@@ -31,6 +32,7 @@ import java.util.Objects;
  */
 @JsonIgnoreProperties(ignoreUnknown = true)
 public class MetadataResponse extends VaultDataResponse {
+    @Serial
     private static final long serialVersionUID = -3679762333630984679L;
 
     @JsonProperty("data")

src/main/java/de/stklcode/jvault/connector/model/response/PlainSecretResponse.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2021 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -20,6 +20,7 @@ import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonProperty;
 import de.stklcode.jvault.connector.model.response.embedded.VersionMetadata;
 
+import java.io.Serial;
 import java.io.Serializable;
 import java.util.Collections;
 import java.util.Map;
@@ -33,6 +34,7 @@ import java.util.Objects;
  */
 @JsonIgnoreProperties(ignoreUnknown = true)
 public class PlainSecretResponse extends SecretResponse {
+    @Serial
     private static final long serialVersionUID = 3010138542437913023L;
 
     @JsonProperty("data")

src/main/java/de/stklcode/jvault/connector/model/response/RawDataResponse.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -19,6 +19,7 @@ package de.stklcode.jvault.connector.model.response;
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonProperty;
 
+import java.io.Serial;
 import java.io.Serializable;
 import java.util.Map;
 import java.util.Objects;
@@ -31,6 +32,7 @@ import java.util.Objects;
  */
 @JsonIgnoreProperties(ignoreUnknown = true)
 public final class RawDataResponse extends VaultDataResponse {
+    @Serial
     private static final long serialVersionUID = -319727427792124071L;
 
     @JsonProperty("data")

src/main/java/de/stklcode/jvault/connector/model/response/SealResponse.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -19,6 +19,7 @@ package de.stklcode.jvault.connector.model.response;
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonProperty;
 
+import java.io.Serial;
 import java.time.ZonedDateTime;
 import java.util.Objects;
 
@@ -30,6 +31,7 @@ import java.util.Objects;
  */
 @JsonIgnoreProperties(ignoreUnknown = true)
 public final class SealResponse implements VaultResponse {
+    @Serial
     private static final long serialVersionUID = -6000309255473305787L;
 
     @JsonProperty("type")
@@ -191,24 +193,24 @@ public final class SealResponse implements VaultResponse {
         }
         SealResponse that = (SealResponse) o;
         return sealed == that.sealed &&
-                initialized == that.initialized &&
-                Objects.equals(type, that.type) &&
-                Objects.equals(threshold, that.threshold) &&
-                Objects.equals(numberOfShares, that.numberOfShares) &&
-                Objects.equals(progress, that.progress) &&
-                Objects.equals(version, that.version) &&
-                Objects.equals(buildDate, that.buildDate) &&
-                Objects.equals(nonce, that.nonce) &&
-                Objects.equals(clusterName, that.clusterName) &&
-                Objects.equals(clusterId, that.clusterId) &&
-                Objects.equals(migration, that.migration) &&
-                Objects.equals(recoverySeal, that.recoverySeal) &&
-                Objects.equals(storageType, that.storageType);
+            initialized == that.initialized &&
+            Objects.equals(type, that.type) &&
+            Objects.equals(threshold, that.threshold) &&
+            Objects.equals(numberOfShares, that.numberOfShares) &&
+            Objects.equals(progress, that.progress) &&
+            Objects.equals(version, that.version) &&
+            Objects.equals(buildDate, that.buildDate) &&
+            Objects.equals(nonce, that.nonce) &&
+            Objects.equals(clusterName, that.clusterName) &&
+            Objects.equals(clusterId, that.clusterId) &&
+            Objects.equals(migration, that.migration) &&
+            Objects.equals(recoverySeal, that.recoverySeal) &&
+            Objects.equals(storageType, that.storageType);
     }
 
     @Override
     public int hashCode() {
         return Objects.hash(type, sealed, initialized, threshold, numberOfShares, progress, version, buildDate, nonce,
-                clusterName, clusterId, migration, recoverySeal, storageType);
+            clusterName, clusterId, migration, recoverySeal, storageType);
     }
 }

src/main/java/de/stklcode/jvault/connector/model/response/SecretListResponse.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -20,6 +20,7 @@ import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonProperty;
 import de.stklcode.jvault.connector.model.response.embedded.SecretListWrapper;
 
+import java.io.Serial;
 import java.util.Collections;
 import java.util.List;
 import java.util.Objects;
@@ -32,8 +33,9 @@ import java.util.Objects;
  */
 @JsonIgnoreProperties(ignoreUnknown = true)
 public final class SecretListResponse extends VaultDataResponse {
-
+    @Serial
     private static final long serialVersionUID = 8597121175002967213L;
+
     @JsonProperty("data")
     private SecretListWrapper data;
 

src/main/java/de/stklcode/jvault/connector/model/response/SecretResponse.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -18,13 +18,14 @@ package de.stklcode.jvault.connector.model.response;
 
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.databind.DeserializationFeature;
-import com.fasterxml.jackson.databind.ObjectMapper;
 import com.fasterxml.jackson.databind.SerializationFeature;
+import com.fasterxml.jackson.databind.json.JsonMapper;
 import com.fasterxml.jackson.datatype.jsr310.JavaTimeModule;
 import de.stklcode.jvault.connector.exception.InvalidResponseException;
 import de.stklcode.jvault.connector.model.response.embedded.VersionMetadata;
 
 import java.io.IOException;
+import java.io.Serial;
 import java.io.Serializable;
 import java.util.Map;
 
@@ -37,6 +38,7 @@ import java.util.Map;
  */
 @JsonIgnoreProperties(ignoreUnknown = true)
 public abstract class SecretResponse extends VaultDataResponse {
+    @Serial
     private static final long serialVersionUID = 5198088815871692951L;
 
     /**
@@ -85,10 +87,11 @@ public abstract class SecretResponse extends VaultDataResponse {
             } else if (type.isInstance(rawValue)) {
                 return type.cast(rawValue);
             } else {
-                var om = new ObjectMapper()
-                        .registerModule(new JavaTimeModule())
-                        .enable(SerializationFeature.WRITE_DATES_AS_TIMESTAMPS)
-                        .disable(DeserializationFeature.ADJUST_DATES_TO_CONTEXT_TIME_ZONE);
+                var om = JsonMapper.builder()
+                    .addModule(new JavaTimeModule())
+                    .enable(SerializationFeature.WRITE_DATES_AS_TIMESTAMPS)
+                    .disable(DeserializationFeature.ADJUST_DATES_TO_CONTEXT_TIME_ZONE)
+                    .build();
 
                 if (rawValue instanceof String) {
                     return om.readValue((String) rawValue, type);

src/main/java/de/stklcode/jvault/connector/model/response/SecretVersionResponse.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -20,6 +20,7 @@ import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonProperty;
 import de.stklcode.jvault.connector.model.response.embedded.VersionMetadata;
 
+import java.io.Serial;
 import java.util.Objects;
 
 /**
@@ -30,6 +31,7 @@ import java.util.Objects;
  */
 @JsonIgnoreProperties(ignoreUnknown = true)
 public class SecretVersionResponse extends VaultDataResponse {
+    @Serial
     private static final long serialVersionUID = 2748635005258576174L;
 
     @JsonProperty("data")

src/main/java/de/stklcode/jvault/connector/model/response/TokenResponse.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -20,6 +20,7 @@ import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonProperty;
 import de.stklcode.jvault.connector.model.response.embedded.TokenData;
 
+import java.io.Serial;
 import java.util.Objects;
 
 /**
@@ -30,6 +31,7 @@ import java.util.Objects;
  */
 @JsonIgnoreProperties(ignoreUnknown = true)
 public final class TokenResponse extends VaultDataResponse {
+    @Serial
     private static final long serialVersionUID = -4341114947980033457L;
 
     @JsonProperty("data")

src/main/java/de/stklcode/jvault/connector/model/response/TokenRoleResponse.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -21,6 +21,7 @@ import com.fasterxml.jackson.annotation.JsonProperty;
 import de.stklcode.jvault.connector.model.TokenRole;
 import de.stklcode.jvault.connector.model.response.embedded.TokenData;
 
+import java.io.Serial;
 import java.util.Objects;
 
 /**
@@ -31,6 +32,7 @@ import java.util.Objects;
  */
 @JsonIgnoreProperties(ignoreUnknown = true)
 public final class TokenRoleResponse extends VaultDataResponse {
+    @Serial
     private static final long serialVersionUID = 5265363857731948626L;
 
     @JsonProperty("data")

src/main/java/de/stklcode/jvault/connector/model/response/TransitResponse.java

@@ -0,0 +1,94 @@
+/*
+ * Copyright 2016-2025 Stefan Kalscheuer
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package de.stklcode.jvault.connector.model.response;
+
+import com.fasterxml.jackson.annotation.JsonSetter;
+
+import java.io.Serial;
+import java.util.Map;
+import java.util.Objects;
+
+/**
+ * Response entity for transit operations.
+ *
+ * @author Stefan Kalscheuer
+ * @since 1.5.0
+ */
+public class TransitResponse extends VaultDataResponse {
+
+    @Serial
+    private static final long serialVersionUID = 6873804240772242771L;
+
+    private String ciphertext;
+    private String plaintext;
+    private String sum;
+
+    @JsonSetter("data")
+    private void setData(Map<String, String> data) {
+        ciphertext = data.get("ciphertext");
+        plaintext = data.get("plaintext");
+        sum = data.get("sum");
+    }
+
+    /**
+     * Get ciphertext.
+     * Populated after encryption.
+     *
+     * @return Ciphertext
+     */
+    public String getCiphertext() {
+        return ciphertext;
+    }
+
+    /**
+     * Get plaintext.
+     * Base64 encoded, populated after decryption.
+     *
+     * @return Plaintext
+     */
+    public String getPlaintext() {
+        return plaintext;
+    }
+
+    /**
+     * Get hash sum.
+     * Hex or Base64 string. Populated after hashing.
+     *
+     * @return Hash sum
+     */
+    public String getSum() {
+        return sum;
+    }
+
+    @Override
+    public boolean equals(Object o) {
+        if (this == o) {
+            return true;
+        } else if (o == null || getClass() != o.getClass() || !super.equals(o)) {
+            return false;
+        }
+        TransitResponse that = (TransitResponse) o;
+        return Objects.equals(ciphertext, that.ciphertext) &&
+            Objects.equals(plaintext, that.plaintext) &&
+            Objects.equals(sum, that.sum);
+    }
+
+    @Override
+    public int hashCode() {
+        return Objects.hash(super.hashCode(), ciphertext, plaintext, sum);
+    }
+}

src/main/java/de/stklcode/jvault/connector/model/response/VaultDataResponse.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -20,6 +20,7 @@ import com.fasterxml.jackson.annotation.JsonProperty;
 import de.stklcode.jvault.connector.model.response.embedded.AuthData;
 import de.stklcode.jvault.connector.model.response.embedded.WrapInfo;
 
+import java.io.Serial;
 import java.util.List;
 import java.util.Objects;
 
@@ -30,6 +31,7 @@ import java.util.Objects;
  * @since 0.1
  */
 public abstract class VaultDataResponse implements VaultResponse {
+    @Serial
     private static final long serialVersionUID = 4787715235558510045L;
 
     @JsonProperty("request_id")
@@ -115,6 +117,7 @@ public abstract class VaultDataResponse implements VaultResponse {
     public final String getMountType() {
         return mountType;
     }
+
     @Override
     public boolean equals(Object o) {
         if (this == o) {
@@ -124,13 +127,13 @@ public abstract class VaultDataResponse implements VaultResponse {
         }
         VaultDataResponse that = (VaultDataResponse) o;
         return renewable == that.renewable &&
-                Objects.equals(requestId, that.requestId) &&
-                Objects.equals(leaseId, that.leaseId) &&
-                Objects.equals(leaseDuration, that.leaseDuration) &&
-                Objects.equals(warnings, that.warnings) &&
-                Objects.equals(wrapInfo, that.wrapInfo) &&
-                Objects.equals(auth, that.auth) &&
-                Objects.equals(mountType, that.mountType);
+            Objects.equals(requestId, that.requestId) &&
+            Objects.equals(leaseId, that.leaseId) &&
+            Objects.equals(leaseDuration, that.leaseDuration) &&
+            Objects.equals(warnings, that.warnings) &&
+            Objects.equals(wrapInfo, that.wrapInfo) &&
+            Objects.equals(auth, that.auth) &&
+            Objects.equals(mountType, that.mountType);
     }
 
     @Override

src/main/java/de/stklcode/jvault/connector/model/response/VaultResponse.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

src/main/java/de/stklcode/jvault/connector/model/response/embedded/AuthData.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -19,6 +19,7 @@ package de.stklcode.jvault.connector.model.response.embedded;
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonProperty;
 
+import java.io.Serial;
 import java.io.Serializable;
 import java.util.List;
 import java.util.Map;
@@ -33,6 +34,7 @@ import java.util.Objects;
  */
 @JsonIgnoreProperties(ignoreUnknown = true)
 public final class AuthData implements Serializable {
+    @Serial
     private static final long serialVersionUID = 5969334512309655317L;
 
     @JsonProperty("client_token")
@@ -171,22 +173,22 @@ public final class AuthData implements Serializable {
         }
         AuthData authData = (AuthData) o;
         return renewable == authData.renewable &&
-                orphan == authData.orphan &&
-                Objects.equals(clientToken, authData.clientToken) &&
-                Objects.equals(accessor, authData.accessor) &&
-                Objects.equals(policies, authData.policies) &&
-                Objects.equals(tokenPolicies, authData.tokenPolicies) &&
-                Objects.equals(metadata, authData.metadata) &&
-                Objects.equals(leaseDuration, authData.leaseDuration) &&
-                Objects.equals(entityId, authData.entityId) &&
-                Objects.equals(tokenType, authData.tokenType) &&
-                Objects.equals(numUses, authData.numUses) &&
-                Objects.equals(mfaRequirement, authData.mfaRequirement);
+            orphan == authData.orphan &&
+            Objects.equals(clientToken, authData.clientToken) &&
+            Objects.equals(accessor, authData.accessor) &&
+            Objects.equals(policies, authData.policies) &&
+            Objects.equals(tokenPolicies, authData.tokenPolicies) &&
+            Objects.equals(metadata, authData.metadata) &&
+            Objects.equals(leaseDuration, authData.leaseDuration) &&
+            Objects.equals(entityId, authData.entityId) &&
+            Objects.equals(tokenType, authData.tokenType) &&
+            Objects.equals(numUses, authData.numUses) &&
+            Objects.equals(mfaRequirement, authData.mfaRequirement);
     }
 
     @Override
     public int hashCode() {
         return Objects.hash(clientToken, accessor, policies, tokenPolicies, metadata, leaseDuration, renewable,
-                entityId, tokenType, orphan, numUses, mfaRequirement);
+            entityId, tokenType, orphan, numUses, mfaRequirement);
     }
 }

src/main/java/de/stklcode/jvault/connector/model/response/embedded/AuthMethod.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -21,6 +21,7 @@ import com.fasterxml.jackson.annotation.JsonProperty;
 import com.fasterxml.jackson.annotation.JsonSetter;
 import de.stklcode.jvault.connector.model.AuthBackend;
 
+import java.io.Serial;
 import java.io.Serializable;
 import java.util.Map;
 import java.util.Objects;
@@ -34,6 +35,7 @@ import java.util.Objects;
  */
 @JsonIgnoreProperties(ignoreUnknown = true)
 public final class AuthMethod implements Serializable {
+    @Serial
     private static final long serialVersionUID = -439987082190917691L;
 
     private AuthBackend type;
@@ -202,19 +204,19 @@ public final class AuthMethod implements Serializable {
         }
         AuthMethod that = (AuthMethod) o;
         return local == that.local &&
-                type == that.type &&
-                externalEntropyAccess == that.externalEntropyAccess &&
-                sealWrap == that.sealWrap &&
-                Objects.equals(rawType, that.rawType) &&
-                Objects.equals(accessor, that.accessor) &&
-                Objects.equals(deprecationStatus, that.deprecationStatus) &&
-                Objects.equals(description, that.description) &&
-                Objects.equals(config, that.config) &&
-                Objects.equals(options, that.options) &&
-                Objects.equals(pluginVersion, that.pluginVersion) &&
-                Objects.equals(runningPluginVersion, that.runningPluginVersion) &&
-                Objects.equals(runningSha256, that.runningSha256) &&
-                Objects.equals(uuid, that.uuid);
+            type == that.type &&
+            externalEntropyAccess == that.externalEntropyAccess &&
+            sealWrap == that.sealWrap &&
+            Objects.equals(rawType, that.rawType) &&
+            Objects.equals(accessor, that.accessor) &&
+            Objects.equals(deprecationStatus, that.deprecationStatus) &&
+            Objects.equals(description, that.description) &&
+            Objects.equals(config, that.config) &&
+            Objects.equals(options, that.options) &&
+            Objects.equals(pluginVersion, that.pluginVersion) &&
+            Objects.equals(runningPluginVersion, that.runningPluginVersion) &&
+            Objects.equals(runningSha256, that.runningSha256) &&
+            Objects.equals(uuid, that.uuid);
     }
 
     @Override

src/main/java/de/stklcode/jvault/connector/model/response/embedded/MfaConstraintAny.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -19,6 +19,7 @@ package de.stklcode.jvault.connector.model.response.embedded;
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonProperty;
 
+import java.io.Serial;
 import java.io.Serializable;
 import java.util.List;
 import java.util.Objects;
@@ -31,6 +32,7 @@ import java.util.Objects;
  */
 @JsonIgnoreProperties(ignoreUnknown = true)
 public final class MfaConstraintAny implements Serializable {
+    @Serial
     private static final long serialVersionUID = 1226126781813149627L;
 
     @JsonProperty("any")

src/main/java/de/stklcode/jvault/connector/model/response/embedded/MfaMethodId.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -19,6 +19,7 @@ package de.stklcode.jvault.connector.model.response.embedded;
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonProperty;
 
+import java.io.Serial;
 import java.io.Serializable;
 import java.util.Objects;
 
@@ -30,6 +31,7 @@ import java.util.Objects;
  */
 @JsonIgnoreProperties(ignoreUnknown = true)
 public final class MfaMethodId implements Serializable {
+    @Serial
     private static final long serialVersionUID = 691298070242998814L;
 
     @JsonProperty("type")

src/main/java/de/stklcode/jvault/connector/model/response/embedded/MfaRequirement.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -19,6 +19,7 @@ package de.stklcode.jvault.connector.model.response.embedded;
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonProperty;
 
+import java.io.Serial;
 import java.io.Serializable;
 import java.util.Map;
 import java.util.Objects;
@@ -31,6 +32,7 @@ import java.util.Objects;
  */
 @JsonIgnoreProperties(ignoreUnknown = true)
 public final class MfaRequirement implements Serializable {
+    @Serial
     private static final long serialVersionUID = -2516941512455319638L;
 
     @JsonProperty("mfa_request_id")

src/main/java/de/stklcode/jvault/connector/model/response/embedded/MountConfig.java

@@ -3,6 +3,8 @@ package de.stklcode.jvault.connector.model.response.embedded;
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonProperty;
 
+import java.io.Serial;
+import java.io.Serial;
 import java.io.Serializable;
 import java.util.List;
 import java.util.Objects;
@@ -15,13 +17,14 @@ import java.util.Objects;
  */
 @JsonIgnoreProperties(ignoreUnknown = true)
 public class MountConfig implements Serializable {
-    private static final long serialVersionUID = -8653909672663717792L;
+    @Serial
+    private static final long serialVersionUID = 7241631159224756605L;
 
     @JsonProperty("default_lease_ttl")
-    private Integer defaultLeaseTtl;
+    private Long defaultLeaseTtl;
 
     @JsonProperty("max_lease_ttl")
-    private Integer maxLeaseTtl;
+    private Long maxLeaseTtl;
 
     @JsonProperty("force_no_cache")
     private Boolean forceNoCache;
@@ -56,14 +59,14 @@ public class MountConfig implements Serializable {
     /**
      * @return Default lease TTL
      */
-    public Integer getDefaultLeaseTtl() {
+    public Long getDefaultLeaseTtl() {
         return defaultLeaseTtl;
     }
 
     /**
      * @return Maximum lease TTL
      */
-    public Integer getMaxLeaseTtl() {
+    public Long getMaxLeaseTtl() {
         return maxLeaseTtl;
     }
 

src/main/java/de/stklcode/jvault/connector/model/response/embedded/SecretListWrapper.java

@@ -3,6 +3,7 @@ package de.stklcode.jvault.connector.model.response.embedded;
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonProperty;
 
+import java.io.Serial;
 import java.io.Serializable;
 import java.util.List;
 import java.util.Objects;
@@ -16,7 +17,9 @@ import java.util.Objects;
 @JsonIgnoreProperties(ignoreUnknown = true)
 public class SecretListWrapper implements Serializable {
 
+    @Serial
     private static final long serialVersionUID = -8777605197063766125L;
+
     @JsonProperty("keys")
     private List<String> keys;
 

src/main/java/de/stklcode/jvault/connector/model/response/embedded/SecretMetadata.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -19,6 +19,7 @@ package de.stklcode.jvault.connector.model.response.embedded;
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonProperty;
 
+import java.io.Serial;
 import java.io.Serializable;
 import java.time.ZonedDateTime;
 import java.util.HashMap;
@@ -34,6 +35,7 @@ import java.util.Objects;
  */
 @JsonIgnoreProperties(ignoreUnknown = true)
 public final class SecretMetadata implements Serializable {
+    @Serial
     private static final long serialVersionUID = -905059942871916214L;
 
     @JsonProperty("created_time")
@@ -138,14 +140,14 @@ public final class SecretMetadata implements Serializable {
         }
         SecretMetadata that = (SecretMetadata) o;
         return Objects.equals(createdTime, that.createdTime) &&
-                Objects.equals(currentVersion, that.currentVersion) &&
-                Objects.equals(maxVersions, that.maxVersions) &&
-                Objects.equals(oldestVersion, that.oldestVersion) &&
-                Objects.equals(updatedTime, that.updatedTime) &&
-                Objects.equals(versions, that.versions) &&
-                Objects.equals(casRequired, that.casRequired) &&
-                Objects.equals(customMetadata, that.customMetadata) &&
-                Objects.equals(deleteVersionAfter, that.deleteVersionAfter);
+            Objects.equals(currentVersion, that.currentVersion) &&
+            Objects.equals(maxVersions, that.maxVersions) &&
+            Objects.equals(oldestVersion, that.oldestVersion) &&
+            Objects.equals(updatedTime, that.updatedTime) &&
+            Objects.equals(versions, that.versions) &&
+            Objects.equals(casRequired, that.casRequired) &&
+            Objects.equals(customMetadata, that.customMetadata) &&
+            Objects.equals(deleteVersionAfter, that.deleteVersionAfter);
     }
 
     @Override

src/main/java/de/stklcode/jvault/connector/model/response/embedded/SecretWrapper.java

@@ -3,6 +3,7 @@ package de.stklcode.jvault.connector.model.response.embedded;
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonProperty;
 
+import java.io.Serial;
 import java.io.Serializable;
 import java.util.Map;
 import java.util.Objects;
@@ -15,6 +16,7 @@ import java.util.Objects;
  */
 @JsonIgnoreProperties(ignoreUnknown = true)
 public class SecretWrapper implements Serializable {
+    @Serial
     private static final long serialVersionUID = 8600413181758893378L;
 
     @JsonProperty("data")

src/main/java/de/stklcode/jvault/connector/model/response/embedded/TokenData.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -19,6 +19,7 @@ package de.stklcode.jvault.connector.model.response.embedded;
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonProperty;
 
+import java.io.Serial;
 import java.io.Serializable;
 import java.time.ZonedDateTime;
 import java.util.List;
@@ -34,7 +35,8 @@ import java.util.Objects;
  */
 @JsonIgnoreProperties(ignoreUnknown = true)
 public final class TokenData implements Serializable {
-    private static final long serialVersionUID = -5749716740973138916L;
+    @Serial
+    private static final long serialVersionUID = -4168046151053509784L;
 
     @JsonProperty("accessor")
     private String accessor;
@@ -43,7 +45,7 @@ public final class TokenData implements Serializable {
     private Integer creationTime;
 
     @JsonProperty("creation_ttl")
-    private Integer creationTtl;
+    private Long creationTtl;
 
     @JsonProperty("display_name")
     private String name;
@@ -55,7 +57,7 @@ public final class TokenData implements Serializable {
     private ZonedDateTime expireTime;
 
     @JsonProperty("explicit_max_ttl")
-    private Integer explicitMaxTtl;
+    private Long explicitMaxTtl;
 
     @JsonProperty("id")
     private String id;
@@ -82,7 +84,7 @@ public final class TokenData implements Serializable {
     private boolean renewable;
 
     @JsonProperty("ttl")
-    private Integer ttl;
+    private Long ttl;
 
     @JsonProperty("type")
     private String type;
@@ -104,7 +106,7 @@ public final class TokenData implements Serializable {
     /**
      * @return Creation TTL (in seconds)
      */
-    public Integer getCreationTtl() {
+    public Long getCreationTtl() {
         return creationTtl;
     }
 
@@ -135,7 +137,7 @@ public final class TokenData implements Serializable {
      * @return Explicit maximum TTL
      * @since 0.9
      */
-    public Integer getExplicitMaxTtl() {
+    public Long getExplicitMaxTtl() {
         return explicitMaxTtl;
     }
 
@@ -202,7 +204,7 @@ public final class TokenData implements Serializable {
     /**
      * @return Token TTL (in seconds)
      */
-    public Integer getTtl() {
+    public Long getTtl() {
         return ttl;
     }
 
@@ -222,27 +224,27 @@ public final class TokenData implements Serializable {
         }
         TokenData tokenData = (TokenData) o;
         return orphan == tokenData.orphan &&
-                renewable == tokenData.renewable &&
-                Objects.equals(accessor, tokenData.accessor) &&
-                Objects.equals(creationTime, tokenData.creationTime) &&
-                Objects.equals(creationTtl, tokenData.creationTtl) &&
-                Objects.equals(name, tokenData.name) &&
-                Objects.equals(entityId, tokenData.entityId) &&
-                Objects.equals(expireTime, tokenData.expireTime) &&
-                Objects.equals(explicitMaxTtl, tokenData.explicitMaxTtl) &&
-                Objects.equals(id, tokenData.id) &&
-                Objects.equals(issueTime, tokenData.issueTime) &&
-                Objects.equals(meta, tokenData.meta) &&
-                Objects.equals(numUses, tokenData.numUses) &&
-                Objects.equals(path, tokenData.path) &&
-                Objects.equals(policies, tokenData.policies) &&
-                Objects.equals(ttl, tokenData.ttl) &&
-                Objects.equals(type, tokenData.type);
+            renewable == tokenData.renewable &&
+            Objects.equals(accessor, tokenData.accessor) &&
+            Objects.equals(creationTime, tokenData.creationTime) &&
+            Objects.equals(creationTtl, tokenData.creationTtl) &&
+            Objects.equals(name, tokenData.name) &&
+            Objects.equals(entityId, tokenData.entityId) &&
+            Objects.equals(expireTime, tokenData.expireTime) &&
+            Objects.equals(explicitMaxTtl, tokenData.explicitMaxTtl) &&
+            Objects.equals(id, tokenData.id) &&
+            Objects.equals(issueTime, tokenData.issueTime) &&
+            Objects.equals(meta, tokenData.meta) &&
+            Objects.equals(numUses, tokenData.numUses) &&
+            Objects.equals(path, tokenData.path) &&
+            Objects.equals(policies, tokenData.policies) &&
+            Objects.equals(ttl, tokenData.ttl) &&
+            Objects.equals(type, tokenData.type);
     }
 
     @Override
     public int hashCode() {
         return Objects.hash(accessor, creationTime, creationTtl, name, entityId, expireTime, explicitMaxTtl, id,
-                issueTime, meta, numUses, orphan, path, policies, renewable, ttl, type);
+            issueTime, meta, numUses, orphan, path, policies, renewable, ttl, type);
     }
 }

src/main/java/de/stklcode/jvault/connector/model/response/embedded/UserLockoutConfig.java

@@ -3,6 +3,7 @@ package de.stklcode.jvault.connector.model.response.embedded;
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonProperty;
 
+import java.io.Serial;
 import java.io.Serializable;
 import java.util.Objects;
 
@@ -14,6 +15,7 @@ import java.util.Objects;
  */
 @JsonIgnoreProperties(ignoreUnknown = true)
 public class UserLockoutConfig implements Serializable {
+    @Serial
     private static final long serialVersionUID = -8051060041593140550L;
 
     @JsonProperty("lockout_threshold")

src/main/java/de/stklcode/jvault/connector/model/response/embedded/VersionMetadata.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -19,6 +19,7 @@ package de.stklcode.jvault.connector.model.response.embedded;
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonProperty;
 
+import java.io.Serial;
 import java.io.Serializable;
 import java.time.ZonedDateTime;
 import java.util.HashMap;
@@ -34,6 +35,7 @@ import java.util.Objects;
  */
 @JsonIgnoreProperties(ignoreUnknown = true)
 public final class VersionMetadata implements Serializable {
+    @Serial
     private static final long serialVersionUID = 8495687554714216478L;
 
     @JsonProperty("created_time")
@@ -96,10 +98,10 @@ public final class VersionMetadata implements Serializable {
         }
         VersionMetadata that = (VersionMetadata) o;
         return destroyed == that.destroyed &&
-                Objects.equals(createdTime, that.createdTime) &&
-                Objects.equals(deletionTime, that.deletionTime) &&
-                Objects.equals(version, that.version) &&
-                Objects.equals(customMetadata, that.customMetadata);
+            Objects.equals(createdTime, that.createdTime) &&
+            Objects.equals(deletionTime, that.deletionTime) &&
+            Objects.equals(version, that.version) &&
+            Objects.equals(customMetadata, that.customMetadata);
     }
 
     @Override

src/main/java/de/stklcode/jvault/connector/model/response/embedded/WrapInfo.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -18,6 +18,7 @@ package de.stklcode.jvault.connector.model.response.embedded;
 
 import com.fasterxml.jackson.annotation.JsonProperty;
 
+import java.io.Serial;
 import java.io.Serializable;
 import java.time.ZonedDateTime;
 import java.util.Objects;
@@ -29,6 +30,7 @@ import java.util.Objects;
  * @since 1.1
  */
 public class WrapInfo implements Serializable {
+    @Serial
     private static final long serialVersionUID = 4864973237090355607L;
 
     @JsonProperty("token")
@@ -80,9 +82,9 @@ public class WrapInfo implements Serializable {
         }
         WrapInfo that = (WrapInfo) o;
         return Objects.equals(token, that.token) &&
-                Objects.equals(ttl, that.ttl) &&
-                Objects.equals(creationTime, that.creationTime) &&
-                Objects.equals(creationPath, that.creationPath);
+            Objects.equals(ttl, that.ttl) &&
+            Objects.equals(creationTime, that.creationTime) &&
+            Objects.equals(creationPath, that.creationPath);
     }
 
     @Override

src/main/java/de/stklcode/jvault/connector/model/response/embedded/package-info.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

src/main/java/de/stklcode/jvault/connector/model/response/package-info.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

src/main/java/de/stklcode/jvault/connector/package-info.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

src/main/java/module-info.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

src/test/java/de/stklcode/jvault/connector/HTTPVaultConnectorBuilderTest.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -25,7 +25,10 @@ import org.junit.jupiter.api.io.TempDir;
 import java.io.File;
 import java.lang.reflect.Field;
 import java.net.URISyntaxException;
+import java.nio.file.Files;
 import java.nio.file.NoSuchFileException;
+import java.nio.file.Paths;
+import java.util.concurrent.atomic.AtomicReference;
 
 import static com.github.stefanbirkner.systemlambda.SystemLambda.withEnvironmentVariable;
 import static org.junit.jupiter.api.Assertions.*;
@@ -38,6 +41,8 @@ import static org.junit.jupiter.api.Assertions.*;
  */
 class HTTPVaultConnectorBuilderTest {
     private static final String VAULT_ADDR = "https://localhost:8201";
+    private static final String VAULT_ADDR_2 = "http://localhost";
+    private static final String VAULT_ADDR_3 = "https://localhost/vault/";
     private static final Integer VAULT_MAX_RETRIES = 13;
     private static final String VAULT_TOKEN = "00001111-2222-3333-4444-555566667777";
 
@@ -58,12 +63,12 @@ class HTTPVaultConnectorBuilderTest {
 
         // Specify all options.
         HTTPVaultConnectorBuilder builder = HTTPVaultConnector.builder()
-                .withHost("vault2.example.com")
-                .withoutTLS()
-                .withPort(1234)
-                .withPrefix("/foo/")
-                .withTimeout(5678)
-                .withNumberOfRetries(9);
+            .withHost("vault2.example.com")
+            .withoutTLS()
+            .withPort(1234)
+            .withPrefix("/foo/")
+            .withTimeout(5678)
+            .withNumberOfRetries(9);
         connector = builder.build();
 
         assertEquals("http://vault2.example.com:1234/foo/", getRequestHelperPrivate(connector, "baseURL"), "URL not set correctly");
@@ -74,13 +79,13 @@ class HTTPVaultConnectorBuilderTest {
 
         // Initialization from URL.
         assertThrows(
-                URISyntaxException.class,
-                () -> HTTPVaultConnector.builder().withBaseURL("foo:/\\1nv4l1d_UrL"),
-                "Initialization from invalid URL should fail"
+            URISyntaxException.class,
+            () -> HTTPVaultConnector.builder().withBaseURL("foo:/\\1nv4l1d_UrL"),
+            "Initialization from invalid URL should fail"
         );
         connector = assertDoesNotThrow(
-                () -> HTTPVaultConnector.builder().withBaseURL("https://vault3.example.com:5678/bar/").build(),
-                "Initialization from valid URL should not fail"
+            () -> HTTPVaultConnector.builder().withBaseURL("https://vault3.example.com:5678/bar/").build(),
+            "Initialization from valid URL should not fail"
         );
         assertEquals("https://vault3.example.com:5678/bar/", getRequestHelperPrivate(connector, "baseURL"), "URL not set correctly");
 
@@ -101,8 +106,8 @@ class HTTPVaultConnectorBuilderTest {
         // Provide address only should be enough.
         withVaultEnv(VAULT_ADDR, null, null, null).execute(() -> {
             HTTPVaultConnectorBuilder builder = assertDoesNotThrow(
-                    () -> HTTPVaultConnector.builder().fromEnv(),
-                    "Factory creation from minimal environment failed"
+                () -> HTTPVaultConnector.builder().fromEnv(),
+                "Factory creation from minimal environment failed"
             );
             HTTPVaultConnector connector = builder.build();
 
@@ -112,12 +117,28 @@ class HTTPVaultConnectorBuilderTest {
 
             return null;
         });
+        withVaultEnv(VAULT_ADDR_2, null, null, null).execute(() -> {
+            HTTPVaultConnectorBuilder builder = assertDoesNotThrow(
+                () -> HTTPVaultConnector.builder().fromEnv(),
+                "Factory creation from minimal environment failed"
+            );
+            assertEquals(VAULT_ADDR_2 + "/v1/", getRequestHelperPrivate(builder.build(), "baseURL"), "URL without port not set correctly");
+            return null;
+        });
+        withVaultEnv(VAULT_ADDR_3, null, null, null).execute(() -> {
+            HTTPVaultConnectorBuilder builder = assertDoesNotThrow(
+                () -> HTTPVaultConnector.builder().fromEnv(),
+                "Factory creation from minimal environment failed"
+            );
+            assertEquals(VAULT_ADDR_3, getRequestHelperPrivate(builder.build(), "baseURL"), "URL with custom path not set correctly");
+            return null;
+        });
 
         // Provide address and number of retries.
         withVaultEnv(VAULT_ADDR, null, VAULT_MAX_RETRIES.toString(), null).execute(() -> {
             HTTPVaultConnectorBuilder builder = assertDoesNotThrow(
-                    () -> HTTPVaultConnector.builder().fromEnv(),
-                    "Factory creation from environment failed"
+                () -> HTTPVaultConnector.builder().fromEnv(),
+                "Factory creation from environment failed"
             );
             HTTPVaultConnector connector = builder.build();
 
@@ -128,24 +149,11 @@ class HTTPVaultConnectorBuilderTest {
             return null;
         });
 
-        // Provide CA certificate.
-        String vaultCacert = tempDir.toString() + "/doesnotexist";
-        withVaultEnv(VAULT_ADDR, vaultCacert, VAULT_MAX_RETRIES.toString(), null).execute(() -> {
-            TlsException e = assertThrows(
-                    TlsException.class,
-                    () -> HTTPVaultConnector.builder().fromEnv(),
-                    "Creation with unknown cert path failed"
-            );
-            assertEquals(vaultCacert, assertInstanceOf(NoSuchFileException.class, e.getCause()).getFile());
-
-            return null;
-        });
-
         // Automatic authentication.
         withVaultEnv(VAULT_ADDR, null, VAULT_MAX_RETRIES.toString(), VAULT_TOKEN).execute(() -> {
             HTTPVaultConnectorBuilder builder = assertDoesNotThrow(
-                    () -> HTTPVaultConnector.builder().fromEnv(),
-                    "Factory creation from minimal environment failed"
+                () -> HTTPVaultConnector.builder().fromEnv(),
+                "Factory creation from minimal environment failed"
             );
             assertEquals(VAULT_TOKEN, getPrivate(builder, "token"), "Token not set correctly");
 
@@ -155,20 +163,73 @@ class HTTPVaultConnectorBuilderTest {
         // Invalid URL.
         withVaultEnv("This is not a valid URL!", null, VAULT_MAX_RETRIES.toString(), VAULT_TOKEN).execute(() -> {
             assertThrows(
-                    ConnectionException.class,
-                    () -> HTTPVaultConnector.builder().fromEnv(),
-                    "Invalid URL from environment should raise an exception"
+                ConnectionException.class,
+                () -> HTTPVaultConnector.builder().fromEnv(),
+                "Invalid URL from environment should raise an exception"
             );
 
             return null;
         });
     }
 
+    /**
+     * Test CA certificate handling from environment variables
+     */
+    @Test
+    void testCertificateFromEnv() throws Exception {
+        // From direct PEM content
+        String pem = Files.readString(Paths.get(getClass().getResource("/tls/ca.pem").toURI()));
+        AtomicReference<Object> certFromPem = new AtomicReference<>();
+        withVaultEnv(VAULT_ADDR, pem, null, null).execute(() -> {
+            HTTPVaultConnectorBuilder builder = assertDoesNotThrow(
+                () -> HTTPVaultConnector.builder().fromEnv(),
+                "Builder with PEM certificate from environment failed"
+            );
+            HTTPVaultConnector connector = builder.build();
+
+            certFromPem.set(getRequestHelperPrivate(connector, "trustedCaCert"));
+            assertNotNull(certFromPem.get(), "Trusted CA cert from PEM not set");
+
+            return null;
+        });
+
+        // From file path
+        String file = Paths.get(getClass().getResource("/tls/ca.pem").toURI()).toString();
+        AtomicReference<Object> certFromFile = new AtomicReference<>();
+        withVaultEnv(VAULT_ADDR, file, null, null).execute(() -> {
+            HTTPVaultConnectorBuilder builder = assertDoesNotThrow(
+                () -> HTTPVaultConnector.builder().fromEnv(),
+                "Builder with certificate path from environment failed"
+            );
+            HTTPVaultConnector connector = builder.build();
+
+            certFromFile.set(getRequestHelperPrivate(connector, "trustedCaCert"));
+            assertNotNull(certFromFile.get(), "Trusted CA cert from file not set");
+
+            return null;
+        });
+
+        assertEquals(certFromPem.get(), certFromFile.get(), "Certificates from PEM and file should be equal");
+
+        // Non-existing path CA certificate path
+        String doesNotExist = tempDir.toString() + "/doesnotexist";
+        withVaultEnv(VAULT_ADDR, doesNotExist, VAULT_MAX_RETRIES.toString(), null).execute(() -> {
+            TlsException e = assertThrows(
+                TlsException.class,
+                () -> HTTPVaultConnector.builder().fromEnv(),
+                "Creation with unknown cert path failed"
+            );
+            assertEquals(doesNotExist, assertInstanceOf(NoSuchFileException.class, e.getCause()).getFile());
+
+            return null;
+        });
+    }
+
     private SystemLambda.WithEnvironmentVariables withVaultEnv(String vaultAddr, String vaultCacert, String vaultMaxRetries, String vaultToken) {
         return withEnvironmentVariable("VAULT_ADDR", vaultAddr)
-                .and("VAULT_CACERT", vaultCacert)
-                .and("VAULT_MAX_RETRIES", vaultMaxRetries)
-                .and("VAULT_TOKEN", vaultToken);
+            .and("VAULT_CACERT", vaultCacert)
+            .and("VAULT_MAX_RETRIES", vaultMaxRetries)
+            .and("VAULT_TOKEN", vaultToken);
     }
 
     private Object getRequestHelperPrivate(HTTPVaultConnector connector, String fieldName) throws NoSuchFieldException, IllegalAccessException {

src/test/java/de/stklcode/jvault/connector/HTTPVaultConnectorIT.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -52,7 +52,7 @@ import static org.junit.jupiter.api.Assumptions.assumeTrue;
  * @since 0.1
  */
 class HTTPVaultConnectorIT {
-    private static String VAULT_VERSION = "1.18.2";  // The vault version this test is supposed to run against.
+    private static String VAULT_VERSION = "1.20.0";  // The vault version this test is supposed to run against.
     private static final String KEY1 = "E38bkCm0VhUvpdCKGQpcohhD9XmcHJ/2hreOSY019Lho";
     private static final String KEY2 = "O5OHwDleY3IiPdgw61cgHlhsrEm6tVJkrxhF6QAnILd1";
     private static final String KEY3 = "mw7Bm3nbt/UWa/juDjjL2EPQ04kiJ0saC5JEXwJvXYsB";
@@ -86,9 +86,9 @@ class HTTPVaultConnectorIT {
 
         // Initialize connector.
         HTTPVaultConnectorBuilder builder = HTTPVaultConnector.builder()
-                .withHost(config.getHost())
-                .withPort(config.getPort())
-                .withTLS(isTls);
+            .withHost(config.getHost())
+            .withPort(config.getPort())
+            .withTLS(isTls);
         if (isTls) {
             builder.withTrustedCA(Paths.get(getClass().getResource("/tls/ca.pem").getPath()));
         }
@@ -134,9 +134,9 @@ class HTTPVaultConnectorIT {
             final String invalidPath = "secret/invalid/path";
 
             VaultConnectorException e = assertThrows(
-                    PermissionDeniedException.class,
-                    () -> connector.read(invalidPath),
-                    "Invalid secret path should raise an exception"
+                PermissionDeniedException.class,
+                () -> connector.read(invalidPath),
+                "Invalid secret path should raise an exception"
             );
 
             // Assert that the exception does not reveal secret or credentials.
@@ -147,15 +147,15 @@ class HTTPVaultConnectorIT {
 
             // Try to read accessible path with known value.
             SecretResponse res = assertDoesNotThrow(
-                    () -> connector.read(SECRET_PATH + "/" + SECRET_KEY),
-                    "Valid secret path could not be read"
+                () -> connector.read(SECRET_PATH + "/" + SECRET_KEY),
+                "Valid secret path could not be read"
             );
             assertEquals(SECRET_VALUE, res.get("value"), "Known secret returned invalid value");
 
             // Try to read accessible path with JSON value.
             res = assertDoesNotThrow(
-                    () -> connector.read(SECRET_PATH + "/" + SECRET_KEY_JSON),
-                    "Valid secret path could not be read"
+                () -> connector.read(SECRET_PATH + "/" + SECRET_KEY_JSON),
+                "Valid secret path could not be read"
             );
             assertNotNull(res.get("value"), "Known secret returned null value");
 
@@ -167,8 +167,8 @@ class HTTPVaultConnectorIT {
 
             // Try to read accessible path with JSON value.
             res = assertDoesNotThrow(
-                    () -> connector.read(SECRET_PATH + "/" + SECRET_KEY_JSON),
-                    "Valid secret path could not be read"
+                () -> connector.read(SECRET_PATH + "/" + SECRET_KEY_JSON),
+                "Valid secret path could not be read"
             );
             assertNotNull(res.get("value"), "Known secret returned null value");
 
@@ -180,8 +180,8 @@ class HTTPVaultConnectorIT {
 
             // Try to read accessible complex secret.
             res = assertDoesNotThrow(
-                    () -> connector.read(SECRET_PATH + "/" + SECRET_KEY_COMPLEX),
-                    "Valid secret path could not be read"
+                () -> connector.read(SECRET_PATH + "/" + SECRET_KEY_COMPLEX),
+                "Valid secret path could not be read"
             );
             assertNotNull(res.getData(), "Known secret returned null value");
             assertEquals(Map.of("key1", "value1", "key2", "value2"), res.getData(), "Unexpected data");
@@ -198,8 +198,8 @@ class HTTPVaultConnectorIT {
             assumeTrue(connector.isAuthorized());
             // Try to list secrets from valid path.
             List<String> secrets = assertDoesNotThrow(
-                    () -> connector.list(SECRET_PATH),
-                    "Secrets could not be listed"
+                () -> connector.list(SECRET_PATH),
+                "Secrets could not be listed"
             );
             assertNotEquals(0, secrets.size(), "Invalid number of secrets");
             assertTrue(secrets.contains(SECRET_KEY), "Known secret key not found");
@@ -217,33 +217,33 @@ class HTTPVaultConnectorIT {
 
             // Try to write to null path.
             assertThrows(
-                    InvalidRequestException.class,
-                    () -> connector.write(null, "someValue"),
-                    "Secret written to null path"
+                InvalidRequestException.class,
+                () -> connector.write(null, "someValue"),
+                "Secret written to null path"
             );
 
             // Try to write to invalid path.
             assertThrows(
-                    InvalidRequestException.class,
-                    () -> connector.write("", "someValue"),
-                    "Secret written to invalid path"
+                InvalidRequestException.class,
+                () -> connector.write("", "someValue"),
+                "Secret written to invalid path"
             );
 
             // Try to write to a path the user has no access for.
             assertThrows(
-                    PermissionDeniedException.class,
-                    () -> connector.write("invalid/path", "someValue"),
-                    "Secret written to inaccessible path"
+                PermissionDeniedException.class,
+                () -> connector.write("invalid/path", "someValue"),
+                "Secret written to inaccessible path"
             );
 
             // Perform a valid write/read roundtrip to valid path. Also check UTF8-encoding.
             assertDoesNotThrow(
-                    () -> connector.write(SECRET_PATH + "/temp", "Abc123äöü,!"),
-                    "Failed to write secret to accessible path"
+                () -> connector.write(SECRET_PATH + "/temp", "Abc123äöü,!"),
+                "Failed to write secret to accessible path"
             );
             SecretResponse res = assertDoesNotThrow(
-                    () -> connector.read(SECRET_PATH + "/temp"),
-                    "Written secret could not be read"
+                () -> connector.read(SECRET_PATH + "/temp"),
+                "Written secret could not be read"
             );
             assertEquals("Abc123äöü,!", res.get("value"));
         }
@@ -260,26 +260,26 @@ class HTTPVaultConnectorIT {
 
             // Write a test secret to vault.
             assertDoesNotThrow(
-                    () -> connector.write(SECRET_PATH + "/toDelete", "secret content"),
-                    "Secret written to inaccessible path"
+                () -> connector.write(SECRET_PATH + "/toDelete", "secret content"),
+                "Secret written to inaccessible path"
             );
             SecretResponse res = assertDoesNotThrow(
-                    () -> connector.read(SECRET_PATH + "/toDelete"),
-                    "Written secret could not be read"
+                () -> connector.read(SECRET_PATH + "/toDelete"),
+                "Written secret could not be read"
             );
             assumeTrue(res != null);
 
             // Delete secret.
             assertDoesNotThrow(
-                    () -> connector.delete(SECRET_PATH + "/toDelete"),
-                    "Revocation threw unexpected exception"
+                () -> connector.delete(SECRET_PATH + "/toDelete"),
+                "Revocation threw unexpected exception"
             );
 
             // Try to read again.
             InvalidResponseException e = assertThrows(
-                    InvalidResponseException.class,
-                    () -> connector.read(SECRET_PATH + "/toDelete"),
-                    "Successfully read deleted secret"
+                InvalidResponseException.class,
+                () -> connector.read(SECRET_PATH + "/toDelete"),
+                "Successfully read deleted secret"
             );
             assertEquals(404, e.getStatusCode());
         }
@@ -296,19 +296,19 @@ class HTTPVaultConnectorIT {
 
             // Write a test secret to vault.
             assertDoesNotThrow(
-                    () -> connector.write(SECRET_PATH + "/toRevoke", "secret content"),
-                    "Secret written to inaccessible path"
+                () -> connector.write(SECRET_PATH + "/toRevoke", "secret content"),
+                "Secret written to inaccessible path"
             );
             SecretResponse res = assertDoesNotThrow(
-                    () -> connector.read(SECRET_PATH + "/toRevoke"),
-                    "Written secret could not be read"
+                () -> connector.read(SECRET_PATH + "/toRevoke"),
+                "Written secret could not be read"
             );
             assumeTrue(res != null);
 
             // Revoke secret.
             assertDoesNotThrow(
-                    () -> connector.revoke(SECRET_PATH + "/toRevoke"),
-                    "Revocation threw unexpected exception"
+                () -> connector.revoke(SECRET_PATH + "/toRevoke"),
+                "Revocation threw unexpected exception"
             );
         }
     }
@@ -337,8 +337,8 @@ class HTTPVaultConnectorIT {
 
             // Try to read accessible path with known value.
             SecretResponse res = assertDoesNotThrow(
-                    () -> connector.readSecretData(MOUNT_KV2, SECRET2_KEY),
-                    "Valid secret path could not be read"
+                () -> connector.readSecretData(MOUNT_KV2, SECRET2_KEY),
+                "Valid secret path could not be read"
             );
             assertNotNull(res.getMetadata(), "Metadata not populated for KV v2 secret");
             assertEquals(2, res.getMetadata().getVersion(), "Unexpected secret version");
@@ -346,8 +346,8 @@ class HTTPVaultConnectorIT {
 
             // Try to read different version of same secret.
             res = assertDoesNotThrow(
-                    () -> connector.readSecretVersion(MOUNT_KV2, SECRET2_KEY, 1),
-                    "Valid secret version could not be read"
+                () -> connector.readSecretVersion(MOUNT_KV2, SECRET2_KEY, 1),
+                "Valid secret version could not be read"
             );
             assertEquals(1, res.getMetadata().getVersion(), "Unexpected secret version");
             assertEquals(SECRET2_VALUE1, res.get("value"), "Known secret returned invalid value");
@@ -365,8 +365,8 @@ class HTTPVaultConnectorIT {
 
             // First get the current version of the secret.
             MetadataResponse res = assertDoesNotThrow(
-                    () -> connector.readSecretMetadata(MOUNT_KV2, SECRET2_KEY),
-                    "Reading secret metadata failed"
+                () -> connector.readSecretMetadata(MOUNT_KV2, SECRET2_KEY),
+                "Reading secret metadata failed"
             );
             int currentVersion = res.getMetadata().getCurrentVersion();
 
@@ -374,25 +374,25 @@ class HTTPVaultConnectorIT {
             Map<String, Object> data = new HashMap<>();
             data.put("value", SECRET2_VALUE3);
             SecretVersionResponse res2 = assertDoesNotThrow(
-                    () -> connector.writeSecretData(MOUNT_KV2, SECRET2_KEY, data),
-                    "Writing secret to KV v2 store failed"
+                () -> connector.writeSecretData(MOUNT_KV2, SECRET2_KEY, data),
+                "Writing secret to KV v2 store failed"
             );
             assertEquals(currentVersion + 1, res2.getMetadata().getVersion(), "Version not updated after writing secret");
             int currentVersion2 = res2.getMetadata().getVersion();
 
             // Verify the content.
             SecretResponse res3 = assertDoesNotThrow(
-                    () -> connector.readSecretData(MOUNT_KV2, SECRET2_KEY),
-                    "Reading secret from KV v2 store failed"
+                () -> connector.readSecretData(MOUNT_KV2, SECRET2_KEY),
+                "Reading secret from KV v2 store failed"
             );
             assertEquals(SECRET2_VALUE3, res3.get("value"), "Data not updated correctly");
 
             // Now try with explicit CAS value (invalid).
             Map<String, Object> data4 = singletonMap("value", SECRET2_VALUE4);
             assertThrows(
-                    InvalidResponseException.class,
-                    () -> connector.writeSecretData(MOUNT_KV2, SECRET2_KEY, data4, currentVersion2 - 1),
-                    "Writing secret to KV v2 with invalid CAS value succeeded"
+                InvalidResponseException.class,
+                () -> connector.writeSecretData(MOUNT_KV2, SECRET2_KEY, data4, currentVersion2 - 1),
+                "Writing secret to KV v2 with invalid CAS value succeeded"
             );
 
             // And finally with a correct CAS value.
@@ -412,22 +412,22 @@ class HTTPVaultConnectorIT {
 
             // Read current metadata first.
             MetadataResponse res = assertDoesNotThrow(
-                    () -> connector.readSecretMetadata(MOUNT_KV2, SECRET2_KEY),
-                    "Reading secret metadata failed"
+                () -> connector.readSecretMetadata(MOUNT_KV2, SECRET2_KEY),
+                "Reading secret metadata failed"
             );
             Integer maxVersions = res.getMetadata().getMaxVersions();
             assumeTrue(10 == res.getMetadata().getMaxVersions(), "Unexpected maximum number of versions");
 
             // Now update the metadata.
             assertDoesNotThrow(
-                    () -> connector.updateSecretMetadata(MOUNT_KV2, SECRET2_KEY, maxVersions + 1, true),
-                    "Updating secret metadata failed"
+                () -> connector.updateSecretMetadata(MOUNT_KV2, SECRET2_KEY, maxVersions + 1, true),
+                "Updating secret metadata failed"
             );
 
             // And verify the result.
             res = assertDoesNotThrow(
-                    () -> connector.readSecretMetadata(MOUNT_KV2, SECRET2_KEY),
-                    "Reading secret metadata failed"
+                () -> connector.readSecretMetadata(MOUNT_KV2, SECRET2_KEY),
+                "Reading secret metadata failed"
             );
             assertEquals(maxVersions + 1, res.getMetadata().getMaxVersions(), "Unexpected maximum number of versions");
         }
@@ -444,8 +444,8 @@ class HTTPVaultConnectorIT {
 
             // Try to read accessible path with known value.
             MetadataResponse res = assertDoesNotThrow(
-                    () -> connector.readSecretMetadata(MOUNT_KV2, SECRET2_KEY),
-                    "Valid secret path could not be read"
+                () -> connector.readSecretMetadata(MOUNT_KV2, SECRET2_KEY),
+                "Valid secret path could not be read"
             );
             assertNotNull(res.getMetadata(), "Metadata not populated for KV v2 secret");
             assertEquals(2, res.getMetadata().getCurrentVersion(), "Unexpected secret version");
@@ -467,79 +467,79 @@ class HTTPVaultConnectorIT {
 
             // Try to delete non-existing versions.
             assertDoesNotThrow(
-                    () -> connector.deleteSecretVersions(MOUNT_KV2, SECRET2_KEY, 5, 42),
-                    "Revealed non-existence of secret versions"
+                () -> connector.deleteSecretVersions(MOUNT_KV2, SECRET2_KEY, 5, 42),
+                "Revealed non-existence of secret versions"
             );
             assertDoesNotThrow(
-                    () -> connector.readSecretMetadata(MOUNT_KV2, SECRET2_KEY),
-                    "Revealed non-existence of secret versions"
+                () -> connector.readSecretMetadata(MOUNT_KV2, SECRET2_KEY),
+                "Revealed non-existence of secret versions"
             );
 
             // Now delete existing version and verify.
             assertDoesNotThrow(
-                    () -> connector.deleteSecretVersions(MOUNT_KV2, SECRET2_KEY, 1),
-                    "Deleting existing version failed"
+                () -> connector.deleteSecretVersions(MOUNT_KV2, SECRET2_KEY, 1),
+                "Deleting existing version failed"
             );
             MetadataResponse meta = assertDoesNotThrow(
-                    () -> connector.readSecretMetadata(MOUNT_KV2, SECRET2_KEY),
-                    "Reading deleted secret metadata failed"
+                () -> connector.readSecretMetadata(MOUNT_KV2, SECRET2_KEY),
+                "Reading deleted secret metadata failed"
             );
             assertNotNull(
-                    meta.getMetadata().getVersions().get(1).getDeletionTime(),
-                    "Expected deletion time for secret 1"
+                meta.getMetadata().getVersions().get(1).getDeletionTime(),
+                "Expected deletion time for secret 1"
             );
 
             // Undelete the just deleted version.
             assertDoesNotThrow(
-                    () -> connector.undeleteSecretVersions(MOUNT_KV2, SECRET2_KEY, 1),
-                    "Undeleting existing version failed"
+                () -> connector.undeleteSecretVersions(MOUNT_KV2, SECRET2_KEY, 1),
+                "Undeleting existing version failed"
             );
             meta = assertDoesNotThrow(
-                    () -> connector.readSecretMetadata(MOUNT_KV2, SECRET2_KEY),
-                    "Reading deleted secret metadata failed"
+                () -> connector.readSecretMetadata(MOUNT_KV2, SECRET2_KEY),
+                "Reading deleted secret metadata failed"
             );
             assertNull(
-                    meta.getMetadata().getVersions().get(1).getDeletionTime(),
-                    "Expected deletion time for secret 1 to be reset"
+                meta.getMetadata().getVersions().get(1).getDeletionTime(),
+                "Expected deletion time for secret 1 to be reset"
             );
 
             // Now destroy it.
             assertDoesNotThrow(
-                    () -> connector.destroySecretVersions(MOUNT_KV2, SECRET2_KEY, 1),
-                    "Destroying existing version failed"
+                () -> connector.destroySecretVersions(MOUNT_KV2, SECRET2_KEY, 1),
+                "Destroying existing version failed"
             );
             meta = assertDoesNotThrow(
-                    () -> connector.readSecretMetadata(MOUNT_KV2, SECRET2_KEY),
-                    "Reading destroyed secret metadata failed"
+                () -> connector.readSecretMetadata(MOUNT_KV2, SECRET2_KEY),
+                "Reading destroyed secret metadata failed"
             );
             assertTrue(
-                    meta.getMetadata().getVersions().get(1).isDestroyed(),
-                    "Expected secret 1 to be marked destroyed"
+                meta.getMetadata().getVersions().get(1).isDestroyed(),
+                "Expected secret 1 to be marked destroyed"
             );
 
             // Delete latest version.
             assertDoesNotThrow(
-                    () -> connector.deleteLatestSecretVersion(MOUNT_KV2, SECRET2_KEY),
-                    "Deleting latest version failed"
+                () -> connector.deleteLatestSecretVersion(MOUNT_KV2, SECRET2_KEY),
+                "Deleting latest version failed"
             );
             meta = assertDoesNotThrow(
-                    () -> connector.readSecretMetadata(MOUNT_KV2, SECRET2_KEY),
-                    "Reading deleted secret metadata failed"
+                () -> connector.readSecretMetadata(MOUNT_KV2, SECRET2_KEY),
+                "Reading deleted secret metadata failed"
             );
             assertNotNull(
-                    meta.getMetadata().getVersions().get(2).getDeletionTime(),
-                    "Expected secret 2 to be deleted"
+                meta.getMetadata().getVersions().get(2).getDeletionTime(),
+                "Expected secret 2 to be deleted"
             );
 
             // Delete all versions.
             assertDoesNotThrow(
-                    () -> connector.deleteAllSecretVersions(MOUNT_KV2, SECRET2_KEY),
-                    "Deleting latest version failed"
+                () -> connector.deleteAllSecretVersions(MOUNT_KV2, SECRET2_KEY),
+                "Deleting latest version failed"
             );
             assertThrows(
-                    InvalidResponseException.class,
-                    () -> connector.readSecretMetadata(MOUNT_KV2, SECRET2_KEY),
-                    "Reading metadata of deleted secret should not succeed"
+                InvalidResponseException.class,
+                () -> connector.readSecretMetadata(MOUNT_KV2, SECRET2_KEY),
+                "Reading metadata of deleted secret should not succeed"
             );
         }
     }
@@ -566,17 +566,17 @@ class HTTPVaultConnectorIT {
 
             // Authenticate with correct credentials.
             assertDoesNotThrow(
-                    () -> connector.authAppRole(APPROLE_ROLE, APPROLE_SECRET),
-                    "Failed to authenticate using AppRole"
+                () -> connector.authAppRole(APPROLE_ROLE, APPROLE_SECRET),
+                "Failed to authenticate using AppRole"
             );
             assertTrue(connector.isAuthorized(), "Authorization flag not set after AppRole login");
 
             // Authenticate with valid secret ID against unknown role.
             final String invalidRole = "foo";
             InvalidResponseException e = assertThrows(
-                    InvalidResponseException.class,
-                    () -> connector.authAppRole(invalidRole, APPROLE_SECRET),
-                    "Successfully logged in with unknown role"
+                InvalidResponseException.class,
+                () -> connector.authAppRole(invalidRole, APPROLE_SECRET),
+                "Successfully logged in with unknown role"
             );
             // Assert that the exception does not reveal role ID or secret.
             assertFalse(stackTrace(e).contains(invalidRole));
@@ -585,9 +585,9 @@ class HTTPVaultConnectorIT {
             // Authenticate without wrong secret ID.
             final String invalidSecret = "foo";
             e = assertThrows(
-                    InvalidResponseException.class,
-                    () -> connector.authAppRole(APPROLE_ROLE, "foo"),
-                    "Successfully logged in without secret ID"
+                InvalidResponseException.class,
+                () -> connector.authAppRole(APPROLE_ROLE, "foo"),
+                "Successfully logged in without secret ID"
             );
             // Assert that the exception does not reveal role ID or secret.
             assertFalse(stackTrace(e).contains(APPROLE_ROLE));
@@ -595,17 +595,17 @@ class HTTPVaultConnectorIT {
 
             // Authenticate without secret ID.
             e = assertThrows(
-                    InvalidResponseException.class,
-                    () -> connector.authAppRole(APPROLE_ROLE),
-                    "Successfully logged in without secret ID"
+                InvalidResponseException.class,
+                () -> connector.authAppRole(APPROLE_ROLE),
+                "Successfully logged in without secret ID"
             );
             // Assert that the exception does not reveal role ID.
             assertFalse(stackTrace(e).contains(APPROLE_ROLE));
 
             // Authenticate with secret ID on role with CIDR whitelist.
             assertDoesNotThrow(
-                    () -> connector.authAppRole(APPROLE_ROLE2, APPROLE_SECRET),
-                    "Failed to log in without secret ID"
+                () -> connector.authAppRole(APPROLE_ROLE2, APPROLE_SECRET),
+                "Failed to log in without secret ID"
             );
             assertTrue(connector.isAuthorized(), "Authorization flag not set after AppRole login");
         }
@@ -687,8 +687,8 @@ class HTTPVaultConnectorIT {
 
             // Update role model with custom flags.
             AppRole role2 = AppRole.builder(roleName)
-                    .withTokenPeriod(321)
-                    .build();
+                .withTokenPeriod(321)
+                .build();
 
             // Create role.
             boolean res3 = assertDoesNotThrow(() -> connector.createAppRole(role2), "Role creation failed");
@@ -717,8 +717,8 @@ class HTTPVaultConnectorIT {
 
             // Create role by name with policies.
             assertDoesNotThrow(
-                    () -> connector.createAppRole(roleName3, Collections.singletonList("testpolicy")),
-                    "Creation of role by name failed"
+                () -> connector.createAppRole(roleName3, Collections.singletonList("testpolicy")),
+                "Creation of role by name failed"
             );
             res = assertDoesNotThrow(() -> connector.lookupAppRole(roleName3), "Creation of role by name failed");
             // Note: As of Vault 0.8.3 default policy is not added automatically, so this test should return 1, not 2.
@@ -727,9 +727,9 @@ class HTTPVaultConnectorIT {
             // Delete role.
             assertDoesNotThrow(() -> connector.deleteAppRole(roleName3), "Deletion of role failed");
             assertThrows(
-                    InvalidResponseException.class,
-                    () -> connector.lookupAppRole(roleName3),
-                    "Deleted role could be looked up"
+                InvalidResponseException.class,
+                () -> connector.lookupAppRole(roleName3),
+                "Deleted role could be looked up"
             );
         }
 
@@ -745,35 +745,35 @@ class HTTPVaultConnectorIT {
 
             // Create default (random) secret for existing role.
             AppRoleSecretResponse res = assertDoesNotThrow(
-                    () -> connector.createAppRoleSecret(APPROLE_ROLE_NAME),
-                    "AppRole secret creation failed"
+                () -> connector.createAppRoleSecret(APPROLE_ROLE_NAME),
+                "AppRole secret creation failed"
             );
             assertNotNull(res.getSecret(), "No secret returned");
 
             // Create secret with custom ID.
             String secretID = "customSecretId";
             res = assertDoesNotThrow(
-                    () -> connector.createAppRoleSecret(APPROLE_ROLE_NAME, secretID),
-                    "AppRole secret creation failed"
+                () -> connector.createAppRoleSecret(APPROLE_ROLE_NAME, secretID),
+                "AppRole secret creation failed"
             );
             assertEquals(secretID, res.getSecret().getId(), "Unexpected secret ID returned");
 
             // Lookup secret.
             res = assertDoesNotThrow(
-                    () -> connector.lookupAppRoleSecret(APPROLE_ROLE_NAME, secretID),
-                    "AppRole secret lookup failed"
+                () -> connector.lookupAppRoleSecret(APPROLE_ROLE_NAME, secretID),
+                "AppRole secret lookup failed"
             );
             assertNotNull(res.getSecret(), "No secret information returned");
 
             // Destroy secret.
             assertDoesNotThrow(
-                    () -> connector.destroyAppRoleSecret(APPROLE_ROLE_NAME, secretID),
-                    "AppRole secret destruction failed"
+                () -> connector.destroyAppRoleSecret(APPROLE_ROLE_NAME, secretID),
+                "AppRole secret destruction failed"
             );
             assertThrows(
-                    InvalidResponseException.class,
-                    () -> connector.lookupAppRoleSecret(APPROLE_ROLE_NAME, secretID),
-                    "Destroyed AppRole secret successfully read"
+                InvalidResponseException.class,
+                () -> connector.lookupAppRoleSecret(APPROLE_ROLE_NAME, secretID),
+                "Destroyed AppRole secret successfully read"
             );
         }
     }
@@ -791,17 +791,17 @@ class HTTPVaultConnectorIT {
         void authTokenTest() {
             final String invalidToken = "52135869df23a5e64c5d33a9785af5edb456b8a4a235d1fe135e6fba1c35edf6";
             VaultConnectorException e = assertThrows(
-                    VaultConnectorException.class,
-                    () -> connector.authToken(invalidToken),
-                    "Logged in with invalid token"
+                VaultConnectorException.class,
+                () -> connector.authToken(invalidToken),
+                "Logged in with invalid token"
             );
             // Assert that the exception does not reveal the token.
             assertFalse(stackTrace(e).contains(invalidToken));
 
 
             TokenResponse res = assertDoesNotThrow(
-                    () -> connector.authToken(TOKEN_ROOT),
-                    "Login failed with valid token"
+                () -> connector.authToken(TOKEN_ROOT),
+                "Login failed with valid token"
             );
             assertNotNull(res, "Login failed with valid token");
             assertTrue(connector.isAuthorized(), "Login failed with valid token");
@@ -819,10 +819,10 @@ class HTTPVaultConnectorIT {
 
             // Create token.
             Token token = Token.builder()
-                    .withId("test-id")
-                    .withType(Token.Type.SERVICE)
-                    .withDisplayName("test name")
-                    .build();
+                .withId("test-id")
+                .withType(Token.Type.SERVICE)
+                .withDisplayName("test name")
+                .build();
 
             // Create token.
             AuthResponse res = assertDoesNotThrow(() -> connector.createToken(token), "Token creation failed");
@@ -841,12 +841,12 @@ class HTTPVaultConnectorIT {
 
             // Create token with attributes.
             Token token2 = Token.builder()
-                    .withId("test-id2")
-                    .withDisplayName("test name 2")
-                    .withPolicies(Collections.singletonList("testpolicy"))
-                    .withoutDefaultPolicy()
-                    .withMeta("foo", "bar")
-                    .build();
+                .withId("test-id2")
+                .withDisplayName("test name 2")
+                .withPolicies(Collections.singletonList("testpolicy"))
+                .withoutDefaultPolicy()
+                .withMeta("foo", "bar")
+                .build();
             res = assertDoesNotThrow(() -> connector.createToken(token2), "Token creation failed");
             assertEquals("test-id2", res.getAuth().getClientToken(), "Invalid token ID returned");
             assertEquals(List.of("testpolicy"), res.getAuth().getPolicies(), "Invalid policies returned");
@@ -856,18 +856,18 @@ class HTTPVaultConnectorIT {
 
             // Overwrite token should fail as of Vault 0.8.0.
             Token token3 = Token.builder()
-                    .withId("test-id2")
-                    .withDisplayName("test name 3")
-                    .withPolicies(Arrays.asList("pol1", "pol2"))
-                    .withDefaultPolicy()
-                    .withMeta("test", "success")
-                    .withMeta("key", "value")
-                    .withTtl(1234)
-                    .build();
+                .withId("test-id2")
+                .withDisplayName("test name 3")
+                .withPolicies(Arrays.asList("pol1", "pol2"))
+                .withDefaultPolicy()
+                .withMeta("test", "success")
+                .withMeta("key", "value")
+                .withTtl(1234L)
+                .build();
             InvalidResponseException e = assertThrows(
-                    InvalidResponseException.class,
-                    () -> connector.createToken(token3),
-                    "Overwriting token should fail as of Vault 0.8.0"
+                InvalidResponseException.class,
+                () -> connector.createToken(token3),
+                "Overwriting token should fail as of Vault 0.8.0"
             );
             assertEquals(400, e.getStatusCode());
             // Assert that the exception does not reveal token ID.
@@ -875,16 +875,16 @@ class HTTPVaultConnectorIT {
 
             // Create token with batch type.
             Token token4 = Token.builder()
-                    .withDisplayName("test name 3")
-                    .withPolicy("batchpolicy")
-                    .withoutDefaultPolicy()
-                    .withType(Token.Type.BATCH)
-                    .build();
+                .withDisplayName("test name 3")
+                .withPolicy("batchpolicy")
+                .withoutDefaultPolicy()
+                .withType(Token.Type.BATCH)
+                .build();
             res = assertDoesNotThrow(() -> connector.createToken(token4), "Token creation failed");
             assertTrue(
-                    // Expecting batch token. "hvb." Prefix as of Vault 1.10, "b." before.
-                    res.getAuth().getClientToken().startsWith("b.") || res.getAuth().getClientToken().startsWith("hvb."),
-                    "Unexpected token prefix"
+                // Expecting batch token. "hvb." Prefix as of Vault 1.10, "b." before.
+                res.getAuth().getClientToken().startsWith("b.") || res.getAuth().getClientToken().startsWith("hvb."),
+                "Unexpected token prefix"
             );
             assertEquals(1, res.getAuth().getPolicies().size(), "Invalid number of policies returned");
             assertTrue(res.getAuth().getPolicies().contains("batchpolicy"), "Custom policy policy not set");
@@ -905,9 +905,9 @@ class HTTPVaultConnectorIT {
 
             // Create token with attributes.
             Token token = Token.builder()
-                    .withId("my-token")
-                    .withType(Token.Type.SERVICE)
-                    .build();
+                .withId("my-token")
+                .withType(Token.Type.SERVICE)
+                .build();
             assertDoesNotThrow(() -> connector.createToken(token), "Token creation failed");
 
             authRoot();
@@ -936,15 +936,15 @@ class HTTPVaultConnectorIT {
             final TokenRole role = TokenRole.builder().build();
 
             boolean creationRes = assertDoesNotThrow(
-                    () -> connector.createOrUpdateTokenRole(roleName, role),
-                    "Token role creation failed"
+                () -> connector.createOrUpdateTokenRole(roleName, role),
+                "Token role creation failed"
             );
             assertTrue(creationRes, "Token role creation failed");
 
             // Read the role.
             TokenRoleResponse res = assertDoesNotThrow(
-                    () -> connector.readTokenRole(roleName),
-                    "Reading token role failed"
+                () -> connector.readTokenRole(roleName),
+                "Reading token role failed"
             );
             assertNotNull(res, "Token role response must not be null");
             assertNotNull(res.getData(), "Token role must not be null");
@@ -955,16 +955,16 @@ class HTTPVaultConnectorIT {
 
             // Update the role, i.e. change some attributes.
             final TokenRole role2 = TokenRole.builder()
-                    .forName(roleName)
-                    .withPathSuffix("suffix")
-                    .orphan(true)
-                    .renewable(false)
-                    .withTokenNumUses(42)
-                    .build();
+                .forName(roleName)
+                .withPathSuffix("suffix")
+                .orphan(true)
+                .renewable(false)
+                .withTokenNumUses(42)
+                .build();
 
             creationRes = assertDoesNotThrow(
-                    () -> connector.createOrUpdateTokenRole(role2),
-                    "Token role update failed"
+                () -> connector.createOrUpdateTokenRole(role2),
+                "Token role update failed"
             );
             assertTrue(creationRes, "Token role update failed");
 
@@ -989,6 +989,75 @@ class HTTPVaultConnectorIT {
         }
     }
 
+    @Nested
+    @DisplayName("Transit Tests")
+    class TransitTests {
+
+        @Test
+        @DisplayName("Transit encryption")
+        void transitEncryptTest() {
+            assertDoesNotThrow(() -> connector.authToken(TOKEN_ROOT));
+            assumeTrue(connector.isAuthorized());
+
+            TransitResponse transitResponse = assertDoesNotThrow(
+                () -> connector.transitEncrypt("my-key", "dGVzdCBtZQ=="),
+                "Failed to encrypt via transit"
+            );
+            assertNotNull(transitResponse.getCiphertext());
+            assertTrue(transitResponse.getCiphertext().startsWith("vault:v1:"));
+
+            transitResponse = assertDoesNotThrow(
+                () -> connector.transitEncrypt("my-key", "test me".getBytes(UTF_8)),
+                "Failed to encrypt binary data via transit"
+            );
+            assertNotNull(transitResponse.getCiphertext());
+            assertTrue(transitResponse.getCiphertext().startsWith("vault:v1:"));
+
+        }
+
+        @Test
+        @DisplayName("Transit decryption")
+        void transitDecryptTest() {
+            assertDoesNotThrow(() -> connector.authToken(TOKEN_ROOT));
+            assumeTrue(connector.isAuthorized());
+
+            TransitResponse transitResponse = assertDoesNotThrow(
+                () -> connector.transitDecrypt("my-key", "vault:v1:1mhLVkBAR2nrFtIkJF/qg57DWfRj0FWgR6tvkGO8XOnL6sw="),
+                "Failed to decrypt via transit"
+            );
+
+            assertEquals("dGVzdCBtZQ==", transitResponse.getPlaintext());
+        }
+
+        @Test
+        @DisplayName("Transit hash")
+        void transitHashText() {
+            assertDoesNotThrow(() -> connector.authToken(TOKEN_ROOT));
+            assumeTrue(connector.isAuthorized());
+
+            TransitResponse transitResponse = assertDoesNotThrow(
+                () -> connector.transitHash("sha2-512", "dGVzdCBtZQ=="),
+                "Failed to hash via transit"
+            );
+
+            assertEquals("7677af0ee4effaa9f35e9b1e82d182f79516ab8321786baa23002de7c06851059492dd37d5fc3791f17d81d4b58198d24a6fd8bbd62c42c1c30b371da500f193", transitResponse.getSum());
+
+            TransitResponse transitResponseBase64 = assertDoesNotThrow(
+                () -> connector.transitHash("sha2-256", "dGVzdCBtZQ==", "base64"),
+                "Failed to hash via transit with base64 output"
+            );
+
+            assertEquals("5DfYkW7cvGLkfy36cXhqmZcygEy9HpnFNB4WWXKOl1M=", transitResponseBase64.getSum());
+
+            transitResponseBase64 = assertDoesNotThrow(
+                () -> connector.transitHash("sha2-256", "test me".getBytes(UTF_8), "base64"),
+                "Failed to hash binary data via transit"
+            );
+
+            assertEquals("5DfYkW7cvGLkfy36cXhqmZcygEy9HpnFNB4WWXKOl1M=", transitResponseBase64.getSum());
+        }
+    }
+
     @Nested
     @DisplayName("Misc Tests")
     class MiscTests {
@@ -1003,8 +1072,8 @@ class HTTPVaultConnectorIT {
             assumeTrue(connector.isAuthorized());
 
             List<AuthBackend> supportedBackends = assertDoesNotThrow(
-                    () -> connector.getAuthBackends(),
-                    "Could not list supported auth backends"
+                () -> connector.getAuthBackends(),
+                "Could not list supported auth backends"
             );
 
             assertEquals(3, supportedBackends.size());
@@ -1020,17 +1089,17 @@ class HTTPVaultConnectorIT {
             final String invalidUser = "foo";
             final String invalidPass = "bar";
             VaultConnectorException e = assertThrows(
-                    VaultConnectorException.class,
-                    () -> connector.authUserPass(invalidUser, invalidPass),
-                    "Logged in with invalid credentials"
+                VaultConnectorException.class,
+                () -> connector.authUserPass(invalidUser, invalidPass),
+                "Logged in with invalid credentials"
             );
             // Assert that the exception does not reveal credentials.
             assertFalse(stackTrace(e).contains(invalidUser));
             assertFalse(stackTrace(e).contains(invalidPass));
 
             AuthResponse res = assertDoesNotThrow(
-                    () -> connector.authUserPass(USER_VALID, PASS_VALID),
-                    "Login failed with valid credentials: Exception thrown"
+                () -> connector.authUserPass(USER_VALID, PASS_VALID),
+                "Login failed with valid credentials: Exception thrown"
             );
             assertNotNull(res.getAuth(), "Login failed with valid credentials: Response not available");
             assertTrue(connector.isAuthorized(), "Login failed with valid credentials: Connector not authorized");
@@ -1044,14 +1113,14 @@ class HTTPVaultConnectorIT {
         @DisplayName("TLS connection test")
         void tlsConnectionTest() {
             assertThrows(
-                    VaultConnectorException.class,
-                    () -> connector.authToken("52135869df23a5e64c5d33a9785af5edb456b8a4a235d1fe135e6fba1c35edf6"),
-                    "Logged in with invalid token"
+                VaultConnectorException.class,
+                () -> connector.authToken("52135869df23a5e64c5d33a9785af5edb456b8a4a235d1fe135e6fba1c35edf6"),
+                "Logged in with invalid token"
             );
 
             TokenResponse res = assertDoesNotThrow(
-                    () -> connector.authToken(TOKEN_ROOT),
-                    "Login failed with valid token"
+                () -> connector.authToken(TOKEN_ROOT),
+                "Login failed with valid token"
             );
             assertNotNull(res, "Login failed with valid token");
             assertTrue(connector.isAuthorized(), "Login failed with valid token");
@@ -1138,22 +1207,22 @@ class HTTPVaultConnectorIT {
 
         // Generate vault local unencrypted configuration.
         VaultConfiguration config = new VaultConfiguration()
-                .withHost("localhost")
-                .withPort(getFreePort())
-                .withDataLocation(dataDir.toPath())
-                .disableMlock();
+            .withHost("localhost")
+            .withPort(getFreePort())
+            .withDataLocation(dataDir.toPath())
+            .disableMlock();
 
         // Enable TLS with custom certificate and key, if required.
         if (tls) {
             config.enableTLS()
-                    .withCert(getClass().getResource("/tls/server.pem").getPath())
-                    .withKey(getClass().getResource("/tls/server.key").getPath());
+                .withCert(getClass().getResource("/tls/server.pem").getPath())
+                .withKey(getClass().getResource("/tls/server.key").getPath());
         }
 
         // Write configuration file.
         File configFile = new File(dir, "vault.conf");
         try {
-            Files.write(configFile.toPath(), config.toString().getBytes(UTF_8));
+            Files.writeString(configFile.toPath(), config.toString(), UTF_8);
         } catch (IOException e) {
             throw new IllegalStateException("Unable to generate config file", e);
         }
@@ -1213,10 +1282,8 @@ class HTTPVaultConnectorIT {
 
             return socket.getLocalPort();
         } catch (IOException e) {
-            e.printStackTrace();
+            throw new IllegalStateException("Unable to find a free TCP port", e);
         }
-
-        throw new IllegalStateException("Unable to find a free TCP port");
     }
 
     /**

src/test/java/de/stklcode/jvault/connector/HTTPVaultConnectorTest.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -17,13 +17,13 @@
 package de.stklcode.jvault.connector;
 
 import com.github.tomakehurst.wiremock.client.WireMock;
-import com.github.tomakehurst.wiremock.junit5.WireMockExtension;
+import com.github.tomakehurst.wiremock.junit5.WireMockRuntimeInfo;
+import com.github.tomakehurst.wiremock.junit5.WireMockTest;
 import de.stklcode.jvault.connector.exception.ConnectionException;
 import de.stklcode.jvault.connector.exception.InvalidResponseException;
 import de.stklcode.jvault.connector.exception.PermissionDeniedException;
 import de.stklcode.jvault.connector.exception.VaultConnectorException;
 import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.extension.RegisterExtension;
 import org.junit.jupiter.api.function.Executable;
 
 import java.io.IOException;
@@ -36,9 +36,7 @@ import java.security.cert.CertificateFactory;
 import java.security.cert.X509Certificate;
 import java.util.Collections;
 
-import static com.github.tomakehurst.wiremock.client.WireMock.aResponse;
-import static com.github.tomakehurst.wiremock.client.WireMock.anyUrl;
-import static com.github.tomakehurst.wiremock.core.WireMockConfiguration.wireMockConfig;
+import static com.github.tomakehurst.wiremock.client.WireMock.*;
 import static org.junit.jupiter.api.Assertions.*;
 
 /**
@@ -48,26 +46,23 @@ import static org.junit.jupiter.api.Assertions.*;
  * @author Stefan Kalscheuer
  * @since 0.7.0
  */
+@WireMockTest
 class HTTPVaultConnectorTest {
-    @RegisterExtension
-    static WireMockExtension wireMock = WireMockExtension.newInstance()
-            .options(wireMockConfig().dynamicPort())
-            .build();
 
     /**
      * Test exceptions thrown during request.
      */
     @Test
-    void requestExceptionTest() throws IOException, URISyntaxException {
-        HTTPVaultConnector connector = HTTPVaultConnector.builder(wireMock.url("/")).withTimeout(250).build();
+    void requestExceptionTest(WireMockRuntimeInfo wireMock) throws IOException, URISyntaxException {
+        HTTPVaultConnector connector = HTTPVaultConnector.builder(wireMock.getHttpBaseUrl()).withTimeout(250).build();
 
         // Test invalid response code.
         final int responseCode = 400;
         mockHttpResponse(responseCode, "", "application/json");
         VaultConnectorException e = assertThrows(
-                InvalidResponseException.class,
-                connector::getHealth,
-                "Querying health status succeeded on invalid instance"
+            InvalidResponseException.class,
+            connector::getHealth,
+            "Querying health status succeeded on invalid instance"
         );
         assertEquals("Invalid response code", e.getMessage(), "Unexpected exception message");
         assertEquals(responseCode, ((InvalidResponseException) e).getStatusCode(), "Unexpected status code in exception");
@@ -76,9 +71,9 @@ class HTTPVaultConnectorTest {
         // Simulate permission denied response.
         mockHttpResponse(responseCode, "{\"errors\":[\"permission denied\"]}", "application/json");
         assertThrows(
-                PermissionDeniedException.class,
-                connector::getHealth,
-                "Querying health status succeeded on invalid instance"
+            PermissionDeniedException.class,
+            connector::getHealth,
+            "Querying health status succeeded on invalid instance"
         );
 
         // Test exception thrown during request.
@@ -86,22 +81,22 @@ class HTTPVaultConnectorTest {
             connector = HTTPVaultConnector.builder("http://localst:" + s.getLocalPort() + "/").withTimeout(250).build();
         }
         e = assertThrows(
-                ConnectionException.class,
-                connector::getHealth,
-                "Querying health status succeeded on invalid instance"
+            ConnectionException.class,
+            connector::getHealth,
+            "Querying health status succeeded on invalid instance"
         );
         assertEquals("Unable to connect to Vault server", e.getMessage(), "Unexpected exception message");
         assertInstanceOf(IOException.class, e.getCause(), "Unexpected cause");
 
         // Now simulate a failing request that succeeds on second try.
-        connector = HTTPVaultConnector.builder(wireMock.url("/")).withNumberOfRetries(1).withTimeout(250).build();
+        connector = HTTPVaultConnector.builder(wireMock.getHttpBaseUrl()).withNumberOfRetries(1).withTimeout(250).build();
 
-        wireMock.stubFor(
-                WireMock.any(anyUrl())
-                        .willReturn(aResponse().withStatus(500))
-                        .willReturn(aResponse().withStatus(500))
-                        .willReturn(aResponse().withStatus(500))
-                        .willReturn(aResponse().withStatus(200).withBody("{}").withHeader("Content-Type", "application/json"))
+        stubFor(
+            WireMock.any(anyUrl())
+                .willReturn(aResponse().withStatus(500))
+                .willReturn(aResponse().withStatus(500))
+                .willReturn(aResponse().withStatus(500))
+                .willReturn(aResponse().withStatus(200).withBody("{}").withHeader("Content-Type", "application/json"))
         );
         assertDoesNotThrow(connector::getHealth, "Request failed unexpectedly");
     }
@@ -164,9 +159,9 @@ class HTTPVaultConnectorTest {
             connector = HTTPVaultConnector.builder("http://localst:" + s.getLocalPort()).withTimeout(250).build();
         }
         ConnectionException e = assertThrows(
-                ConnectionException.class,
-                connector::sealStatus,
-                "Querying seal status succeeded on invalid instance"
+            ConnectionException.class,
+            connector::sealStatus,
+            "Querying seal status succeeded on invalid instance"
         );
         assertEquals("Unable to connect to Vault server", e.getMessage(), "Unexpected exception message");
     }
@@ -182,9 +177,9 @@ class HTTPVaultConnectorTest {
             connector = HTTPVaultConnector.builder("http://localhost:" + s.getLocalPort() + "/").withTimeout(250).build();
         }
         ConnectionException e = assertThrows(
-                ConnectionException.class,
-                connector::getHealth,
-                "Querying health status succeeded on invalid instance"
+            ConnectionException.class,
+            connector::getHealth,
+            "Querying health status succeeded on invalid instance"
         );
         assertEquals("Unable to connect to Vault server", e.getMessage(), "Unexpected exception message");
     }
@@ -193,8 +188,8 @@ class HTTPVaultConnectorTest {
      * Test behavior on unparsable responses.
      */
     @Test
-    void parseExceptionTest() throws URISyntaxException {
-        HTTPVaultConnector connector = HTTPVaultConnector.builder(wireMock.url("/")).withTimeout(250).build();
+    void parseExceptionTest(WireMockRuntimeInfo wireMock) throws URISyntaxException {
+        HTTPVaultConnector connector = HTTPVaultConnector.builder(wireMock.getHttpBaseUrl()).withTimeout(250).build();
         // Mock authorization.
         setPrivate(connector, "authorized", true);
         // Mock response.
@@ -227,8 +222,8 @@ class HTTPVaultConnectorTest {
      * Test requests that expect an empty response with code 204, but receive a 200 body.
      */
     @Test
-    void nonEmpty204ResponseTest() throws URISyntaxException {
-        HTTPVaultConnector connector = HTTPVaultConnector.builder(wireMock.url("/")).withTimeout(250).build();
+    void nonEmpty204ResponseTest(WireMockRuntimeInfo wireMock) throws URISyntaxException {
+        HTTPVaultConnector connector = HTTPVaultConnector.builder(wireMock.getHttpBaseUrl()).withTimeout(250).build();
         // Mock authorization.
         setPrivate(connector, "authorized", true);
         // Mock response.
@@ -236,45 +231,45 @@ class HTTPVaultConnectorTest {
 
         // Now test the methods expecting a 204.
         assertThrows(
-                InvalidResponseException.class,
-                () -> connector.createAppRole("appID", Collections.singletonList("policy")),
-                "createAppRole() with 200 response succeeded"
+            InvalidResponseException.class,
+            () -> connector.createAppRole("appID", Collections.singletonList("policy")),
+            "createAppRole() with 200 response succeeded"
         );
 
         assertThrows(
-                InvalidResponseException.class,
-                () -> connector.deleteAppRole("roleName"),
-                "deleteAppRole() with 200 response succeeded"
+            InvalidResponseException.class,
+            () -> connector.deleteAppRole("roleName"),
+            "deleteAppRole() with 200 response succeeded"
         );
 
         assertThrows(
-                InvalidResponseException.class,
-                () -> connector.setAppRoleID("roleName", "roleID"),
-                "setAppRoleID() with 200 response succeeded"
+            InvalidResponseException.class,
+            () -> connector.setAppRoleID("roleName", "roleID"),
+            "setAppRoleID() with 200 response succeeded"
         );
 
         assertThrows(
-                InvalidResponseException.class,
-                () -> connector.destroyAppRoleSecret("roleName", "secretID"),
-                "destroyAppRoleSecret() with 200 response succeeded"
+            InvalidResponseException.class,
+            () -> connector.destroyAppRoleSecret("roleName", "secretID"),
+            "destroyAppRoleSecret() with 200 response succeeded"
         );
 
         assertThrows(
-                InvalidResponseException.class,
-                () -> connector.destroyAppRoleSecret("roleName", "secretUD"),
-                "destroyAppRoleSecret() with 200 response succeeded"
+            InvalidResponseException.class,
+            () -> connector.destroyAppRoleSecret("roleName", "secretUD"),
+            "destroyAppRoleSecret() with 200 response succeeded"
         );
 
         assertThrows(
-                InvalidResponseException.class,
-                () -> connector.delete("key"),
-                "delete() with 200 response succeeded"
+            InvalidResponseException.class,
+            () -> connector.delete("key"),
+            "delete() with 200 response succeeded"
         );
 
         assertThrows(
-                InvalidResponseException.class,
-                () -> connector.revoke("leaseID"),
-                "destroyAppRoleSecret() with 200 response succeeded"
+            InvalidResponseException.class,
+            () -> connector.revoke("leaseID"),
+            "destroyAppRoleSecret() with 200 response succeeded"
         );
     }
 
@@ -310,10 +305,10 @@ class HTTPVaultConnectorTest {
     }
 
     private void mockHttpResponse(int status, String body, String contentType) {
-        wireMock.stubFor(
-                WireMock.any(anyUrl()).willReturn(
-                        aResponse().withStatus(status).withBody(body).withHeader("Content-Type", contentType)
-                )
+        stubFor(
+            WireMock.any(anyUrl()).willReturn(
+                aResponse().withStatus(status).withBody(body).withHeader("Content-Type", contentType)
+            )
         );
     }
 }

src/test/java/de/stklcode/jvault/connector/exception/VaultConnectorExceptionTest.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

src/test/java/de/stklcode/jvault/connector/model/AbstractModelTest.java

@@ -3,6 +3,7 @@ package de.stklcode.jvault.connector.model;
 import com.fasterxml.jackson.databind.DeserializationFeature;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import com.fasterxml.jackson.databind.SerializationFeature;
+import com.fasterxml.jackson.databind.json.JsonMapper;
 import com.fasterxml.jackson.datatype.jsr310.JavaTimeModule;
 import nl.jqno.equalsverifier.EqualsVerifier;
 import org.junit.jupiter.api.Test;
@@ -29,10 +30,11 @@ public abstract class AbstractModelTest<T> {
      */
     protected AbstractModelTest(Class<T> modelClass) {
         this.modelClass = modelClass;
-        this.objectMapper = new ObjectMapper()
-                .registerModule(new JavaTimeModule())
-                .enable(SerializationFeature.WRITE_DATES_AS_TIMESTAMPS)
-                .disable(DeserializationFeature.ADJUST_DATES_TO_CONTEXT_TIME_ZONE);
+        this.objectMapper = JsonMapper.builder()
+            .addModule(new JavaTimeModule())
+            .enable(SerializationFeature.WRITE_DATES_AS_TIMESTAMPS)
+            .disable(DeserializationFeature.ADJUST_DATES_TO_CONTEXT_TIME_ZONE)
+            .build();
     }
 
     /**

src/test/java/de/stklcode/jvault/connector/model/AppRoleSecretTest.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -35,8 +35,8 @@ import static org.junit.jupiter.api.Assumptions.assumeTrue;
 class AppRoleSecretTest extends AbstractModelTest<AppRoleSecret> {
     private static final String TEST_ID = "abc123";
     private static final Map<String, Object> TEST_META = Map.of(
-            "foo", "bar",
-            "number", 1337
+        "foo", "bar",
+        "number", 1337
     );
     private static final List<String> TEST_CIDR = List.of("203.0.113.0/24", "198.51.100.0/24");
 
@@ -122,8 +122,8 @@ class AppRoleSecretTest extends AbstractModelTest<AppRoleSecret> {
         String secretJson2 = commaSeparatedToList(secretJson);
 
         AppRoleSecret secret2 = assertDoesNotThrow(
-                () -> objectMapper.readValue(secretJson2, AppRoleSecret.class),
-                "Deserialization failed"
+            () -> objectMapper.readValue(secretJson2, AppRoleSecret.class),
+            "Deserialization failed"
         );
         assertEquals(secret2.getId(), secret.getId());
         assertEquals(secret2.getMetadata(), secret.getMetadata());
@@ -144,8 +144,8 @@ class AppRoleSecretTest extends AbstractModelTest<AppRoleSecret> {
         assumeTrue(secret.getTtl() == 12345);
         String secretJson3 = assertDoesNotThrow(() -> objectMapper.writeValueAsString(secret), "Serialization failed");
         secret2 = assertDoesNotThrow(
-                () -> objectMapper.readValue(commaSeparatedToList(secretJson3), AppRoleSecret.class),
-                "Deserialization failed"
+            () -> objectMapper.readValue(commaSeparatedToList(secretJson3), AppRoleSecret.class),
+            "Deserialization failed"
         );
         assertEquals(secret2.getId(), secret.getId());
         assertEquals(secret2.getMetadata(), secret.getMetadata());
@@ -159,9 +159,9 @@ class AppRoleSecretTest extends AbstractModelTest<AppRoleSecret> {
 
         // Those fields should be deserialized from JSON though.
         String secretJson4 = "{\"secret_id\":\"abc123\",\"metadata\":{\"number\":1337,\"foo\":\"bar\"}," +
-                "\"cidr_list\":[\"203.0.113.0/24\",\"198.51.100.0/24\"],\"secret_id_accessor\":\"TEST_ACCESSOR\"," +
-                "\"creation_time\":\"TEST_CREATION\",\"expiration_time\":\"TEST_EXPIRATION\"," +
-                "\"last_updated_time\":\"TEST_LASTUPDATE\",\"secret_id_num_uses\":678,\"secret_id_ttl\":12345}";
+            "\"cidr_list\":[\"203.0.113.0/24\",\"198.51.100.0/24\"],\"secret_id_accessor\":\"TEST_ACCESSOR\"," +
+            "\"creation_time\":\"TEST_CREATION\",\"expiration_time\":\"TEST_EXPIRATION\"," +
+            "\"last_updated_time\":\"TEST_LASTUPDATE\",\"secret_id_num_uses\":678,\"secret_id_ttl\":12345}";
         secret2 = assertDoesNotThrow(() -> objectMapper.readValue(secretJson4, AppRoleSecret.class), "Deserialization failed");
         assertEquals("TEST_ACCESSOR", secret2.getAccessor());
         assertEquals("TEST_CREATION", secret2.getCreationTime());
@@ -181,6 +181,6 @@ class AppRoleSecretTest extends AbstractModelTest<AppRoleSecret> {
 
     private static String commaSeparatedToList(String json) {
         return json.replaceAll("\"cidr_list\":\"([^\"]*)\"", "\"cidr_list\":[$1]")
-                .replaceAll("(\\d+\\.\\d+\\.\\d+\\.\\d+/\\d+)", "\"$1\"");
+            .replaceAll("(\\d+\\.\\d+\\.\\d+\\.\\d+/\\d+)", "\"$1\"");
     }
 }

src/test/java/de/stklcode/jvault/connector/model/AppRoleTest.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -42,18 +42,18 @@ class AppRoleTest extends AbstractModelTest<AppRole> {
     private static final String POLICY = "policy";
     private static final String POLICY_2 = "policy2";
     private static final Integer SECRET_ID_NUM_USES = 10;
-    private static final Integer SECRET_ID_TTL = 7200;
+    private static final Long SECRET_ID_TTL = 7200L;
     private static final Boolean LOCAL_SECRET_IDS = false;
-    private static final Integer TOKEN_TTL = 4800;
-    private static final Integer TOKEN_MAX_TTL = 9600;
-    private static final Integer TOKEN_EXPLICIT_MAX_TTL = 14400;
+    private static final Long TOKEN_TTL = 4800L;
+    private static final Long TOKEN_MAX_TTL = 9600L;
+    private static final Long TOKEN_EXPLICIT_MAX_TTL = 14400L;
     private static final Boolean TOKEN_NO_DEFAULT_POLICY = false;
     private static final Integer TOKEN_NUM_USES = 42;
     private static final Integer TOKEN_PERIOD = 1234;
     private static final Token.Type TOKEN_TYPE = Token.Type.DEFAULT_SERVICE;
     private static final String JSON_MIN = "{\"role_name\":\"" + NAME + "\"}";
     private static final String JSON_FULL = String.format("{\"role_name\":\"%s\",\"role_id\":\"%s\",\"bind_secret_id\":%s,\"secret_id_bound_cidrs\":\"%s\",\"secret_id_num_uses\":%d,\"secret_id_ttl\":%d,\"local_secret_ids\":%s,\"token_ttl\":%d,\"token_max_ttl\":%d,\"token_policies\":\"%s\",\"token_bound_cidrs\":\"%s\",\"token_explicit_max_ttl\":%d,\"token_no_default_policy\":%s,\"token_num_uses\":%d,\"token_period\":%d,\"token_type\":\"%s\"}",
-            NAME, ID, BIND_SECRET_ID, CIDR_1, SECRET_ID_NUM_USES, SECRET_ID_TTL, LOCAL_SECRET_IDS, TOKEN_TTL, TOKEN_MAX_TTL, POLICY, CIDR_1, TOKEN_EXPLICIT_MAX_TTL, TOKEN_NO_DEFAULT_POLICY, TOKEN_NUM_USES, TOKEN_PERIOD, TOKEN_TYPE.value());
+        NAME, ID, BIND_SECRET_ID, CIDR_1, SECRET_ID_NUM_USES, SECRET_ID_TTL, LOCAL_SECRET_IDS, TOKEN_TTL, TOKEN_MAX_TTL, POLICY, CIDR_1, TOKEN_EXPLICIT_MAX_TTL, TOKEN_NO_DEFAULT_POLICY, TOKEN_NUM_USES, TOKEN_PERIOD, TOKEN_TYPE.value());
 
     AppRoleTest() {
         super(AppRole.class);
@@ -62,22 +62,22 @@ class AppRoleTest extends AbstractModelTest<AppRole> {
     @Override
     protected AppRole createFull() {
         return AppRole.builder(NAME)
-                .withId(ID)
-                .withBindSecretID(BIND_SECRET_ID)
-                .withSecretIdBoundCidrs(BOUND_CIDR_LIST)
-                .withTokenPolicies(POLICIES)
-                .withSecretIdNumUses(SECRET_ID_NUM_USES)
-                .withSecretIdTtl(SECRET_ID_TTL)
-                .withLocalSecretIds(LOCAL_SECRET_IDS)
-                .withTokenTtl(TOKEN_TTL)
-                .withTokenMaxTtl(TOKEN_MAX_TTL)
-                .withTokenBoundCidrs(BOUND_CIDR_LIST)
-                .withTokenExplicitMaxTtl(TOKEN_EXPLICIT_MAX_TTL)
-                .withTokenNoDefaultPolicy(TOKEN_NO_DEFAULT_POLICY)
-                .withTokenNumUses(TOKEN_NUM_USES)
-                .withTokenPeriod(TOKEN_PERIOD)
-                .withTokenType(TOKEN_TYPE)
-                .build();
+            .withId(ID)
+            .withBindSecretID(BIND_SECRET_ID)
+            .withSecretIdBoundCidrs(BOUND_CIDR_LIST)
+            .withTokenPolicies(POLICIES)
+            .withSecretIdNumUses(SECRET_ID_NUM_USES)
+            .withSecretIdTtl(SECRET_ID_TTL)
+            .withLocalSecretIds(LOCAL_SECRET_IDS)
+            .withTokenTtl(TOKEN_TTL)
+            .withTokenMaxTtl(TOKEN_MAX_TTL)
+            .withTokenBoundCidrs(BOUND_CIDR_LIST)
+            .withTokenExplicitMaxTtl(TOKEN_EXPLICIT_MAX_TTL)
+            .withTokenNoDefaultPolicy(TOKEN_NO_DEFAULT_POLICY)
+            .withTokenNumUses(TOKEN_NUM_USES)
+            .withTokenPeriod(TOKEN_PERIOD)
+            .withTokenType(TOKEN_TYPE)
+            .build();
     }
 
     @BeforeAll
@@ -159,11 +159,11 @@ class AppRoleTest extends AbstractModelTest<AppRole> {
         assertEquals(1, role.getTokenBoundCidrs().size());
         assertEquals(CIDR_2, role.getTokenBoundCidrs().get(0));
         role = AppRole.builder(NAME)
-                .withSecretIdBoundCidrs(BOUND_CIDR_LIST)
-                .withSecretBoundCidr(CIDR_2)
-                .withTokenBoundCidrs(BOUND_CIDR_LIST)
-                .withTokenBoundCidr(CIDR_2)
-                .build();
+            .withSecretIdBoundCidrs(BOUND_CIDR_LIST)
+            .withSecretBoundCidr(CIDR_2)
+            .withTokenBoundCidrs(BOUND_CIDR_LIST)
+            .withTokenBoundCidr(CIDR_2)
+            .build();
         assertEquals(2, role.getSecretIdBoundCidrs().size());
         assertTrue(role.getSecretIdBoundCidrs().containsAll(List.of(CIDR_1, CIDR_2)));
         assertEquals(2, role.getTokenBoundCidrs().size());
@@ -174,9 +174,9 @@ class AppRoleTest extends AbstractModelTest<AppRole> {
         assertEquals(1, role.getTokenPolicies().size());
         assertEquals(POLICY_2, role.getTokenPolicies().get(0));
         role = AppRole.builder(NAME)
-                .withTokenPolicies(POLICIES)
-                .withTokenPolicy(POLICY_2)
-                .build();
+            .withTokenPolicies(POLICIES)
+            .withTokenPolicy(POLICY_2)
+            .build();
         assertEquals(2, role.getTokenPolicies().size());
         assertTrue(role.getTokenPolicies().containsAll(List.of(POLICY, POLICY_2)));
     }

src/test/java/de/stklcode/jvault/connector/model/AuthBackendTest.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

src/test/java/de/stklcode/jvault/connector/model/TokenRoleTest.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -59,28 +59,28 @@ class TokenRoleTest extends AbstractModelTest<TokenRole> {
     private static final String TOKEN_BOUND_CIDR_2 = "198.51.100.0/24";
     private static final String TOKEN_BOUND_CIDR_3 = "203.0.113.0/24";
     private static final List<String> TOKEN_BOUND_CIDRS = Arrays.asList(TOKEN_BOUND_CIDR_2, TOKEN_BOUND_CIDR_1);
-    private static final Integer TOKEN_EXPLICIT_MAX_TTL = 1234;
+    private static final Long TOKEN_EXPLICIT_MAX_TTL = 1234L;
     private static final Boolean TOKEN_NO_DEFAULT_POLICY = false;
     private static final Integer TOKEN_NUM_USES = 5;
     private static final Integer TOKEN_PERIOD = 2345;
     private static final Token.Type TOKEN_TYPE = Token.Type.SERVICE;
 
     private static final String JSON_FULL = "{" +
-            "\"name\":\"" + NAME + "\"," +
-            "\"allowed_policies\":[\"" + ALLOWED_POLICY_1 + "\",\"" + ALLOWED_POLICY_2 + "\",\"" + ALLOWED_POLICY_3 + "\"]," +
-            "\"allowed_policies_glob\":[\"" + ALLOWED_POLICY_GLOB_1 + "\",\"" + ALLOWED_POLICY_GLOB_2 + "\",\"" + ALLOWED_POLICY_GLOB_3 + "\"]," +
-            "\"disallowed_policies\":[\"" + DISALLOWED_POLICY_1 + "\",\"" + DISALLOWED_POLICY_2 + "\",\"" + DISALLOWED_POLICY_3 + "\"]," +
-            "\"disallowed_policies_glob\":[\"" + DISALLOWED_POLICY_GLOB_1 + "\",\"" + DISALLOWED_POLICY_GLOB_2 + "\",\"" + DISALLOWED_POLICY_GLOB_3 + "\"]," +
-            "\"orphan\":" + ORPHAN + "," +
-            "\"renewable\":" + RENEWABLE + "," +
-            "\"path_suffix\":\"" + PATH_SUFFIX + "\"," +
-            "\"allowed_entity_aliases\":[\"" + ALLOWED_ENTITY_ALIAS_1 + "\",\"" + ALLOWED_ENTITY_ALIAS_3 + "\",\"" + ALLOWED_ENTITY_ALIAS_2 + "\"]," +
-            "\"token_bound_cidrs\":[\"" + TOKEN_BOUND_CIDR_3 + "\",\"" + TOKEN_BOUND_CIDR_2 + "\",\"" + TOKEN_BOUND_CIDR_1 + "\"]," +
-            "\"token_explicit_max_ttl\":" + TOKEN_EXPLICIT_MAX_TTL + "," +
-            "\"token_no_default_policy\":" + TOKEN_NO_DEFAULT_POLICY + "," +
-            "\"token_num_uses\":" + TOKEN_NUM_USES + "," +
-            "\"token_period\":" + TOKEN_PERIOD + "," +
-            "\"token_type\":\"" + TOKEN_TYPE.value() + "\"}";
+        "\"name\":\"" + NAME + "\"," +
+        "\"allowed_policies\":[\"" + ALLOWED_POLICY_1 + "\",\"" + ALLOWED_POLICY_2 + "\",\"" + ALLOWED_POLICY_3 + "\"]," +
+        "\"allowed_policies_glob\":[\"" + ALLOWED_POLICY_GLOB_1 + "\",\"" + ALLOWED_POLICY_GLOB_2 + "\",\"" + ALLOWED_POLICY_GLOB_3 + "\"]," +
+        "\"disallowed_policies\":[\"" + DISALLOWED_POLICY_1 + "\",\"" + DISALLOWED_POLICY_2 + "\",\"" + DISALLOWED_POLICY_3 + "\"]," +
+        "\"disallowed_policies_glob\":[\"" + DISALLOWED_POLICY_GLOB_1 + "\",\"" + DISALLOWED_POLICY_GLOB_2 + "\",\"" + DISALLOWED_POLICY_GLOB_3 + "\"]," +
+        "\"orphan\":" + ORPHAN + "," +
+        "\"renewable\":" + RENEWABLE + "," +
+        "\"path_suffix\":\"" + PATH_SUFFIX + "\"," +
+        "\"allowed_entity_aliases\":[\"" + ALLOWED_ENTITY_ALIAS_1 + "\",\"" + ALLOWED_ENTITY_ALIAS_3 + "\",\"" + ALLOWED_ENTITY_ALIAS_2 + "\"]," +
+        "\"token_bound_cidrs\":[\"" + TOKEN_BOUND_CIDR_3 + "\",\"" + TOKEN_BOUND_CIDR_2 + "\",\"" + TOKEN_BOUND_CIDR_1 + "\"]," +
+        "\"token_explicit_max_ttl\":" + TOKEN_EXPLICIT_MAX_TTL + "," +
+        "\"token_no_default_policy\":" + TOKEN_NO_DEFAULT_POLICY + "," +
+        "\"token_num_uses\":" + TOKEN_NUM_USES + "," +
+        "\"token_period\":" + TOKEN_PERIOD + "," +
+        "\"token_type\":\"" + TOKEN_TYPE.value() + "\"}";
 
     TokenRoleTest() {
         super(TokenRole.class);
@@ -89,28 +89,28 @@ class TokenRoleTest extends AbstractModelTest<TokenRole> {
     @Override
     protected TokenRole createFull() {
         return TokenRole.builder()
-                .forName(NAME)
-                .withAllowedPolicies(ALLOWED_POLICIES)
-                .withAllowedPolicy(ALLOWED_POLICY_3)
-                .withAllowedPolicyGlob(ALLOWED_POLICY_GLOB_1)
-                .withAllowedPoliciesGlob(ALLOWED_POLICIES_GLOB)
-                .withDisallowedPolicy(DISALLOWED_POLICY_1)
-                .withDisallowedPolicies(DISALLOWED_POLICIES)
-                .withDisallowedPoliciesGlob(DISALLOWED_POLICIES_GLOB)
-                .withDisallowedPolicyGlob(DISALLOWED_POLICY_GLOB_3)
-                .orphan(ORPHAN)
-                .renewable(RENEWABLE)
-                .withPathSuffix(PATH_SUFFIX)
-                .withAllowedEntityAliases(ALLOWED_ENTITY_ALIASES)
-                .withAllowedEntityAlias(ALLOWED_ENTITY_ALIAS_2)
-                .withTokenBoundCidr(TOKEN_BOUND_CIDR_3)
-                .withTokenBoundCidrs(TOKEN_BOUND_CIDRS)
-                .withTokenExplicitMaxTtl(TOKEN_EXPLICIT_MAX_TTL)
-                .withTokenNoDefaultPolicy(TOKEN_NO_DEFAULT_POLICY)
-                .withTokenNumUses(TOKEN_NUM_USES)
-                .withTokenPeriod(TOKEN_PERIOD)
-                .withTokenType(TOKEN_TYPE)
-                .build();
+            .forName(NAME)
+            .withAllowedPolicies(ALLOWED_POLICIES)
+            .withAllowedPolicy(ALLOWED_POLICY_3)
+            .withAllowedPolicyGlob(ALLOWED_POLICY_GLOB_1)
+            .withAllowedPoliciesGlob(ALLOWED_POLICIES_GLOB)
+            .withDisallowedPolicy(DISALLOWED_POLICY_1)
+            .withDisallowedPolicies(DISALLOWED_POLICIES)
+            .withDisallowedPoliciesGlob(DISALLOWED_POLICIES_GLOB)
+            .withDisallowedPolicyGlob(DISALLOWED_POLICY_GLOB_3)
+            .orphan(ORPHAN)
+            .renewable(RENEWABLE)
+            .withPathSuffix(PATH_SUFFIX)
+            .withAllowedEntityAliases(ALLOWED_ENTITY_ALIASES)
+            .withAllowedEntityAlias(ALLOWED_ENTITY_ALIAS_2)
+            .withTokenBoundCidr(TOKEN_BOUND_CIDR_3)
+            .withTokenBoundCidrs(TOKEN_BOUND_CIDRS)
+            .withTokenExplicitMaxTtl(TOKEN_EXPLICIT_MAX_TTL)
+            .withTokenNoDefaultPolicy(TOKEN_NO_DEFAULT_POLICY)
+            .withTokenNumUses(TOKEN_NUM_USES)
+            .withTokenPeriod(TOKEN_PERIOD)
+            .withTokenType(TOKEN_TYPE)
+            .build();
     }
 
     /**
@@ -141,24 +141,24 @@ class TokenRoleTest extends AbstractModelTest<TokenRole> {
     @Test
     void buildNullTest() throws JsonProcessingException {
         TokenRole role = TokenRole.builder()
-                .forName(null)
-                .withAllowedPolicies(null)
-                .withAllowedPolicy(null)
-                .withDisallowedPolicy(null)
-                .withDisallowedPolicies(null)
-                .orphan(null)
-                .renewable(null)
-                .withPathSuffix(null)
-                .withAllowedEntityAliases(null)
-                .withAllowedEntityAlias(null)
-                .withTokenBoundCidr(null)
-                .withTokenBoundCidrs(null)
-                .withTokenExplicitMaxTtl(null)
-                .withTokenNoDefaultPolicy(null)
-                .withTokenNumUses(null)
-                .withTokenPeriod(null)
-                .withTokenType(null)
-                .build();
+            .forName(null)
+            .withAllowedPolicies(null)
+            .withAllowedPolicy(null)
+            .withDisallowedPolicy(null)
+            .withDisallowedPolicies(null)
+            .orphan(null)
+            .renewable(null)
+            .withPathSuffix(null)
+            .withAllowedEntityAliases(null)
+            .withAllowedEntityAlias(null)
+            .withTokenBoundCidr(null)
+            .withTokenBoundCidrs(null)
+            .withTokenExplicitMaxTtl(null)
+            .withTokenNoDefaultPolicy(null)
+            .withTokenNumUses(null)
+            .withTokenPeriod(null)
+            .withTokenType(null)
+            .build();
 
         assertNull(role.getAllowedPolicies());
         assertNull(role.getDisallowedPolicies());
@@ -173,7 +173,7 @@ class TokenRoleTest extends AbstractModelTest<TokenRole> {
         assertNull(role.getTokenType());
 
         // Empty builder should be equal to no-arg construction.
-        assertEquals(role, new TokenRole());
+        assertEquals(new TokenRole(), role);
 
         // Optional fields should be ignored, so JSON string should be empty.
         assertEquals("{}", objectMapper.writeValueAsString(role));

src/test/java/de/stklcode/jvault/connector/model/TokenTest.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -35,8 +35,8 @@ class TokenTest extends AbstractModelTest<Token> {
     private static final String DISPLAY_NAME = "display-name";
     private static final Boolean NO_PARENT = false;
     private static final Boolean NO_DEFAULT_POLICY = false;
-    private static final Integer TTL = 123;
-    private static final Integer EXPLICIT_MAX_TTL = 456;
+    private static final Long TTL = 123L;
+    private static final Long EXPLICIT_MAX_TTL = 456L;
     private static final Integer NUM_USES = 4;
     private static final List<String> POLICIES = new ArrayList<>();
     private static final String POLICY = "policy";
@@ -59,20 +59,20 @@ class TokenTest extends AbstractModelTest<Token> {
     @Override
     protected Token createFull() {
         return Token.builder()
-                .withId(ID)
-                .withType(Token.Type.SERVICE)
-                .withDisplayName(DISPLAY_NAME)
-                .withNoParent(NO_PARENT)
-                .withNoDefaultPolicy(NO_DEFAULT_POLICY)
-                .withTtl(TTL)
-                .withExplicitMaxTtl(EXPLICIT_MAX_TTL)
-                .withNumUses(NUM_USES)
-                .withPolicies(POLICIES)
-                .withMeta(META)
-                .withRenewable(RENEWABLE)
-                .withPeriod(PERIOD)
-                .withEntityAlias(ENTITY_ALIAS)
-                .build();
+            .withId(ID)
+            .withType(Token.Type.SERVICE)
+            .withDisplayName(DISPLAY_NAME)
+            .withNoParent(NO_PARENT)
+            .withNoDefaultPolicy(NO_DEFAULT_POLICY)
+            .withTtl(TTL)
+            .withExplicitMaxTtl(EXPLICIT_MAX_TTL)
+            .withNumUses(NUM_USES)
+            .withPolicies(POLICIES)
+            .withMeta(META)
+            .withRenewable(RENEWABLE)
+            .withPeriod(PERIOD)
+            .withEntityAlias(ENTITY_ALIAS)
+            .build();
     }
 
     @BeforeAll
@@ -105,7 +105,7 @@ class TokenTest extends AbstractModelTest<Token> {
         assertEquals("{}", objectMapper.writeValueAsString(token));
 
         // Empty builder should be equal to no-arg construction.
-        assertEquals(token, new Token());
+        assertEquals(new Token(), token);
     }
 
     /**
@@ -159,9 +159,9 @@ class TokenTest extends AbstractModelTest<Token> {
         assertEquals(1, token.getPolicies().size());
         assertEquals(List.of(POLICY_2), token.getPolicies());
         token = Token.builder()
-                .withPolicies(POLICY, POLICY_2)
-                .withPolicy(POLICY_3)
-                .build();
+            .withPolicies(POLICY, POLICY_2)
+            .withPolicy(POLICY_3)
+            .build();
         assertEquals(3, token.getPolicies().size());
         assertTrue(token.getPolicies().containsAll(List.of(POLICY, POLICY_2, POLICY_3)));
 
@@ -171,9 +171,9 @@ class TokenTest extends AbstractModelTest<Token> {
         assertEquals(Set.of(META_KEY_2), token.getMeta().keySet());
         assertEquals(META_VALUE_2, token.getMeta().get(META_KEY_2));
         token = Token.builder()
-                .withMeta(META)
-                .withMeta(META_KEY_2, META_VALUE_2)
-                .build();
+            .withMeta(META)
+            .withMeta(META_KEY_2, META_VALUE_2)
+            .build();
         assertEquals(2, token.getMeta().size());
         assertEquals(META_VALUE, token.getMeta().get(META_KEY));
         assertEquals(META_VALUE_2, token.getMeta().get(META_KEY_2));

src/test/java/de/stklcode/jvault/connector/model/response/AppRoleResponseTest.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -16,7 +16,6 @@
 
 package de.stklcode.jvault.connector.model.response;
 
-import com.fasterxml.jackson.core.JsonProcessingException;
 import de.stklcode.jvault.connector.model.AbstractModelTest;
 import de.stklcode.jvault.connector.model.AppRole;
 import org.junit.jupiter.api.Test;
@@ -32,34 +31,34 @@ import static org.junit.jupiter.api.Assertions.*;
  * @since 0.6.2
  */
 class AppRoleResponseTest extends AbstractModelTest<AppRoleResponse> {
-    private static final Integer ROLE_TOKEN_TTL = 1200;
-    private static final Integer ROLE_TOKEN_MAX_TTL = 1800;
-    private static final Integer ROLE_SECRET_TTL = 600;
+    private static final Long ROLE_TOKEN_TTL = 1200L;
+    private static final Long ROLE_TOKEN_MAX_TTL = 1800L;
+    private static final Long ROLE_SECRET_TTL = 600L;
     private static final Integer ROLE_SECRET_NUM_USES = 40;
     private static final String ROLE_POLICY = "default";
     private static final Integer ROLE_PERIOD = 0;
     private static final Boolean ROLE_BIND_SECRET = true;
 
     private static final String RES_JSON = "{\n" +
-            "  \"auth\": null,\n" +
-            "  \"warnings\": null,\n" +
-            "  \"wrap_info\": null,\n" +
-            "  \"data\": {\n" +
-            "    \"token_ttl\": " + ROLE_TOKEN_TTL + ",\n" +
-            "    \"token_max_ttl\": " + ROLE_TOKEN_MAX_TTL + ",\n" +
-            "    \"secret_id_ttl\": " + ROLE_SECRET_TTL + ",\n" +
-            "    \"secret_id_num_uses\": " + ROLE_SECRET_NUM_USES + ",\n" +
-            "    \"token_policies\": [\n" +
-            "      \"" + ROLE_POLICY + "\"\n" +
-            "    ],\n" +
-            "    \"token_period\": " + ROLE_PERIOD + ",\n" +
-            "    \"bind_secret_id\": " + ROLE_BIND_SECRET + ",\n" +
-            "    \"bound_cidr_list\": \"\"\n" +
-            "  },\n" +
-            "  \"lease_duration\": 0,\n" +
-            "  \"renewable\": false,\n" +
-            "  \"lease_id\": \"\"\n" +
-            "}";
+        "  \"auth\": null,\n" +
+        "  \"warnings\": null,\n" +
+        "  \"wrap_info\": null,\n" +
+        "  \"data\": {\n" +
+        "    \"token_ttl\": " + ROLE_TOKEN_TTL + ",\n" +
+        "    \"token_max_ttl\": " + ROLE_TOKEN_MAX_TTL + ",\n" +
+        "    \"secret_id_ttl\": " + ROLE_SECRET_TTL + ",\n" +
+        "    \"secret_id_num_uses\": " + ROLE_SECRET_NUM_USES + ",\n" +
+        "    \"token_policies\": [\n" +
+        "      \"" + ROLE_POLICY + "\"\n" +
+        "    ],\n" +
+        "    \"token_period\": " + ROLE_PERIOD + ",\n" +
+        "    \"bind_secret_id\": " + ROLE_BIND_SECRET + ",\n" +
+        "    \"bound_cidr_list\": \"\"\n" +
+        "  },\n" +
+        "  \"lease_duration\": 0,\n" +
+        "  \"renewable\": false,\n" +
+        "  \"lease_id\": \"\"\n" +
+        "}";
 
     AppRoleResponseTest() {
         super(AppRoleResponse.class);
@@ -67,12 +66,10 @@ class AppRoleResponseTest extends AbstractModelTest<AppRoleResponse> {
 
     @Override
     protected AppRoleResponse createFull() {
-        try {
-            return objectMapper.readValue(RES_JSON, AppRoleResponse.class);
-        } catch (JsonProcessingException e) {
-            fail("Creation of full model instance failed", e);
-            return null;
-        }
+        return assertDoesNotThrow(
+            () -> objectMapper.readValue(RES_JSON, AppRoleResponse.class),
+            "Creation of full model instance failed"
+        );
     }
 
     /**
@@ -91,8 +88,8 @@ class AppRoleResponseTest extends AbstractModelTest<AppRoleResponse> {
     @Test
     void jsonRoundtrip() {
         AppRoleResponse res = assertDoesNotThrow(
-                () -> objectMapper.readValue(RES_JSON, AppRoleResponse.class),
-                "AuthResponse deserialization failed"
+            () -> objectMapper.readValue(RES_JSON, AppRoleResponse.class),
+            "AuthResponse deserialization failed"
         );
         assertNotNull(res, "Parsed response is NULL");
         // Extract role data.

src/test/java/de/stklcode/jvault/connector/model/response/AuthMethodsResponseTest.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -16,7 +16,6 @@
 
 package de.stklcode.jvault.connector.model.response;
 
-import com.fasterxml.jackson.core.JsonProcessingException;
 import de.stklcode.jvault.connector.model.AbstractModelTest;
 import de.stklcode.jvault.connector.model.AuthBackend;
 import de.stklcode.jvault.connector.model.response.embedded.AuthMethod;
@@ -45,44 +44,44 @@ class AuthMethodsResponseTest extends AbstractModelTest<AuthMethodsResponse> {
     private static final String TK_UUID = "32ea9681-6bd6-6cec-eec3-d11260ba9741";
     private static final String TK_ACCESSOR = "auth_token_ac0dd95a";
     private static final String TK_DESCR = "token based credentials";
-    private static final Integer TK_LEASE_TTL = 0;
+    private static final Long TK_LEASE_TTL = 0L;
     private static final Boolean TK_FORCE_NO_CACHE = false;
-    private static final Integer TK_MAX_LEASE_TTL = 0;
+    private static final Long TK_MAX_LEASE_TTL = 0L;
     private static final String TK_TOKEN_TYPE = "default-service";
     private static final String TK_RUNNING_PLUGIN_VERSION = "v1.15.3+builtin.vault";
 
     private static final String RES_JSON = "{\n" +
-            "  \"data\": {" +
-            "    \"" + GH_PATH + "\": {\n" +
-            "      \"uuid\": \"" + GH_UUID + "\",\n" +
-            "      \"type\": \"" + GH_TYPE + "\",\n" +
-            "      \"accessor\": \"" + GH_ACCESSOR + "\",\n" +
-            "      \"description\": \"" + GH_DESCR + "\",\n" +
-            "      \"external_entropy_access\": false,\n" +
-            "      \"local\": false,\n" +
-            "      \"seal_wrap\": false\n" +
-            "    },\n" +
-            "    \"" + TK_PATH + "\": {\n" +
-            "      \"config\": {\n" +
-            "        \"default_lease_ttl\": " + TK_LEASE_TTL + ",\n" +
-            "        \"force_no_cache\": " + TK_FORCE_NO_CACHE + ",\n" +
-            "        \"max_lease_ttl\": " + TK_MAX_LEASE_TTL + ",\n" +
-            "        \"token_type\": \"" + TK_TOKEN_TYPE + "\"\n" +
-            "      },\n" +
-            "      \"description\": \"" + TK_DESCR + "\",\n" +
-            "      \"options\": null,\n" +
-            "      \"plugin_version\": \"\",\n" +
-            "      \"running_plugin_version\": \"" + TK_RUNNING_PLUGIN_VERSION + "\",\n" +
-            "      \"running_sha256\": \"\",\n" +
-            "      \"type\": \"" + TK_TYPE + "\",\n" +
-            "      \"uuid\": \"" + TK_UUID + "\",\n" +
-            "      \"accessor\": \"" + TK_ACCESSOR + "\",\n" +
-            "      \"external_entropy_access\": false,\n" +
-            "      \"local\": true,\n" +
-            "      \"seal_wrap\": false\n" +
-            "    }\n" +
-            "  }\n" +
-            "}";
+        "  \"data\": {" +
+        "    \"" + GH_PATH + "\": {\n" +
+        "      \"uuid\": \"" + GH_UUID + "\",\n" +
+        "      \"type\": \"" + GH_TYPE + "\",\n" +
+        "      \"accessor\": \"" + GH_ACCESSOR + "\",\n" +
+        "      \"description\": \"" + GH_DESCR + "\",\n" +
+        "      \"external_entropy_access\": false,\n" +
+        "      \"local\": false,\n" +
+        "      \"seal_wrap\": false\n" +
+        "    },\n" +
+        "    \"" + TK_PATH + "\": {\n" +
+        "      \"config\": {\n" +
+        "        \"default_lease_ttl\": " + TK_LEASE_TTL + ",\n" +
+        "        \"force_no_cache\": " + TK_FORCE_NO_CACHE + ",\n" +
+        "        \"max_lease_ttl\": " + TK_MAX_LEASE_TTL + ",\n" +
+        "        \"token_type\": \"" + TK_TOKEN_TYPE + "\"\n" +
+        "      },\n" +
+        "      \"description\": \"" + TK_DESCR + "\",\n" +
+        "      \"options\": null,\n" +
+        "      \"plugin_version\": \"\",\n" +
+        "      \"running_plugin_version\": \"" + TK_RUNNING_PLUGIN_VERSION + "\",\n" +
+        "      \"running_sha256\": \"\",\n" +
+        "      \"type\": \"" + TK_TYPE + "\",\n" +
+        "      \"uuid\": \"" + TK_UUID + "\",\n" +
+        "      \"accessor\": \"" + TK_ACCESSOR + "\",\n" +
+        "      \"external_entropy_access\": false,\n" +
+        "      \"local\": true,\n" +
+        "      \"seal_wrap\": false\n" +
+        "    }\n" +
+        "  }\n" +
+        "}";
 
     AuthMethodsResponseTest() {
         super(AuthMethodsResponse.class);
@@ -90,12 +89,10 @@ class AuthMethodsResponseTest extends AbstractModelTest<AuthMethodsResponse> {
 
     @Override
     protected AuthMethodsResponse createFull() {
-        try {
-            return objectMapper.readValue(RES_JSON, AuthMethodsResponse.class);
-        } catch (JsonProcessingException e) {
-            fail("Creation of full model instance failed", e);
-            return null;
-        }
+        return assertDoesNotThrow(
+            () -> objectMapper.readValue(RES_JSON, AuthMethodsResponse.class),
+            "Creation of full model instance failed"
+        );
     }
 
     /**
@@ -114,8 +111,8 @@ class AuthMethodsResponseTest extends AbstractModelTest<AuthMethodsResponse> {
     @Test
     void jsonRoundtrip() {
         AuthMethodsResponse res = assertDoesNotThrow(
-                () -> objectMapper.readValue(RES_JSON, AuthMethodsResponse.class),
-                "AuthResponse deserialization failed"
+            () -> objectMapper.readValue(RES_JSON, AuthMethodsResponse.class),
+            "AuthResponse deserialization failed"
         );
         assertNotNull(res, "Parsed response is NULL");
         // Extract auth data.

src/test/java/de/stklcode/jvault/connector/model/response/AuthResponseTest.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -16,7 +16,6 @@
 
 package de.stklcode.jvault.connector.model.response;
 
-import com.fasterxml.jackson.core.JsonProcessingException;
 import de.stklcode.jvault.connector.model.AbstractModelTest;
 import de.stklcode.jvault.connector.model.response.embedded.AuthData;
 import de.stklcode.jvault.connector.model.response.embedded.MfaConstraintAny;
@@ -101,12 +100,10 @@ class AuthResponseTest extends AbstractModelTest<AuthResponse> {
 
     @Override
     protected AuthResponse createFull() {
-        try {
-            return objectMapper.readValue(RES_JSON, AuthResponse.class);
-        } catch (JsonProcessingException e) {
-            fail("Creation of full model instance failed", e);
-            return null;
-        }
+        return assertDoesNotThrow(
+            () -> objectMapper.readValue(RES_JSON, AuthResponse.class),
+            "Creation of full model instance failed"
+        );
     }
 
     @Test
@@ -122,8 +119,8 @@ class AuthResponseTest extends AbstractModelTest<AuthResponse> {
     @Test
     void jsonRoundtrip() {
         AuthResponse res = assertDoesNotThrow(
-                () -> objectMapper.readValue(RES_JSON, AuthResponse.class),
-                "AuthResponse deserialization failed"
+            () -> objectMapper.readValue(RES_JSON, AuthResponse.class),
+            "AuthResponse deserialization failed"
         );
         assertNotNull(res, "Parsed response is NULL");
         // Extract auth data.

src/test/java/de/stklcode/jvault/connector/model/response/CredentialsResponseTest.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -16,7 +16,6 @@
 
 package de.stklcode.jvault.connector.model.response;
 
-import com.fasterxml.jackson.core.JsonProcessingException;
 import de.stklcode.jvault.connector.model.AbstractModelTest;
 import org.junit.jupiter.api.Test;
 
@@ -32,16 +31,16 @@ class CredentialsResponseTest extends AbstractModelTest<CredentialsResponse> {
     private static final String VAL_USER = "testUserName";
     private static final String VAL_PASS = "5up3r5ecr3tP455";
     private static final String JSON = "{\n" +
-            "    \"request_id\": \"68315073-6658-e3ff-2da7-67939fb91bbd\",\n" +
-            "    \"lease_id\": \"\",\n" +
-            "    \"lease_duration\": 2764800,\n" +
-            "    \"renewable\": false,\n" +
-            "    \"data\": {\n" +
-            "        \"username\": \"" + VAL_USER + "\",\n" +
-            "        \"password\": \"" + VAL_PASS + "\"\n" +
-            "    },\n" +
-            "    \"warnings\": null\n" +
-            "}";
+        "    \"request_id\": \"68315073-6658-e3ff-2da7-67939fb91bbd\",\n" +
+        "    \"lease_id\": \"\",\n" +
+        "    \"lease_duration\": 2764800,\n" +
+        "    \"renewable\": false,\n" +
+        "    \"data\": {\n" +
+        "        \"username\": \"" + VAL_USER + "\",\n" +
+        "        \"password\": \"" + VAL_PASS + "\"\n" +
+        "    },\n" +
+        "    \"warnings\": null\n" +
+        "}";
 
     CredentialsResponseTest() {
         super(CredentialsResponse.class);
@@ -49,12 +48,10 @@ class CredentialsResponseTest extends AbstractModelTest<CredentialsResponse> {
 
     @Override
     protected CredentialsResponse createFull() {
-        try {
-            return objectMapper.readValue(JSON, CredentialsResponse.class);
-        } catch (JsonProcessingException e) {
-            fail("Creation of full model instance failed", e);
-            return null;
-        }
+        return assertDoesNotThrow(
+            () -> objectMapper.readValue(JSON, CredentialsResponse.class),
+            "Creation of full model instance failed"
+        );
     }
 
     /**
@@ -68,8 +65,8 @@ class CredentialsResponseTest extends AbstractModelTest<CredentialsResponse> {
         assertNull(res.getPassword(), "Password not present in data map should not return anything");
 
         res = assertDoesNotThrow(
-                () -> objectMapper.readValue(JSON, CredentialsResponse.class),
-                "Deserialization of CredentialsResponse failed"
+            () -> objectMapper.readValue(JSON, CredentialsResponse.class),
+            "Deserialization of CredentialsResponse failed"
         );
         assertEquals(VAL_USER, res.getUsername(), "Incorrect username");
         assertEquals(VAL_PASS, res.getPassword(), "Incorrect password");

src/test/java/de/stklcode/jvault/connector/model/response/ErrorResponseTest.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2021 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -16,7 +16,6 @@
 
 package de.stklcode.jvault.connector.model.response;
 
-import com.fasterxml.jackson.core.JsonProcessingException;
 import de.stklcode.jvault.connector.model.AbstractModelTest;
 import org.junit.jupiter.api.Test;
 
@@ -42,12 +41,10 @@ class ErrorResponseTest extends AbstractModelTest<ErrorResponse> {
 
     @Override
     protected ErrorResponse createFull() {
-        try {
-            return objectMapper.readValue(JSON, ErrorResponse.class);
-        } catch (JsonProcessingException e) {
-            fail("Creation of full model instance failed", e);
-            return null;
-        }
+        return assertDoesNotThrow(
+            () -> objectMapper.readValue(JSON, ErrorResponse.class),
+            "Creation of full model instance failed"
+        );
     }
 
     /**
@@ -56,15 +53,15 @@ class ErrorResponseTest extends AbstractModelTest<ErrorResponse> {
     @Test
     void jsonRoundtrip() {
         ErrorResponse res = assertDoesNotThrow(
-                () -> objectMapper.readValue(JSON, ErrorResponse.class),
-                "ErrorResponse deserialization failed"
+            () -> objectMapper.readValue(JSON, ErrorResponse.class),
+            "ErrorResponse deserialization failed"
         );
         assertNotNull(res, "Parsed response is NULL");
         assertEquals(List.of(ERROR_1, ERROR_2), res.getErrors(), "Unexpected error messages");
         assertEquals(
-                JSON,
-                assertDoesNotThrow(() -> objectMapper.writeValueAsString(res), "ErrorResponse serialization failed"),
-                "Unexpected JSON string after serialization"
+            JSON,
+            assertDoesNotThrow(() -> objectMapper.writeValueAsString(res), "ErrorResponse serialization failed"),
+            "Unexpected JSON string after serialization"
         );
     }
 
@@ -72,14 +69,14 @@ class ErrorResponseTest extends AbstractModelTest<ErrorResponse> {
     @Test
     void testToString() {
         ErrorResponse res = assertDoesNotThrow(
-                () -> objectMapper.readValue(JSON, ErrorResponse.class),
-                "ErrorResponse deserialization failed"
+            () -> objectMapper.readValue(JSON, ErrorResponse.class),
+            "ErrorResponse deserialization failed"
         );
         assertEquals(ERROR_1, res.toString());
 
         res = assertDoesNotThrow(
-                () -> objectMapper.readValue(JSON_EMPTY, ErrorResponse.class),
-                "ErrorResponse deserialization failed with empty list"
+            () -> objectMapper.readValue(JSON_EMPTY, ErrorResponse.class),
+            "ErrorResponse deserialization failed with empty list"
         );
         assertEquals("error response", res.toString());
 

src/test/java/de/stklcode/jvault/connector/model/response/HealthResponseTest.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -16,7 +16,6 @@
 
 package de.stklcode.jvault.connector.model.response;
 
-import com.fasterxml.jackson.core.JsonProcessingException;
 import de.stklcode.jvault.connector.model.AbstractModelTest;
 import org.junit.jupiter.api.Test;
 
@@ -45,21 +44,21 @@ class HealthResponseTest extends AbstractModelTest<HealthResponse> {
     private static final Boolean ENTERPRISE = false;
 
     private static final String RES_JSON = "{\n" +
-            "  \"cluster_id\": \"" + CLUSTER_ID + "\",\n" +
-            "  \"cluster_name\": \"" + CLUSTER_NAME + "\",\n" +
-            "  \"version\": \"" + VERSION + "\",\n" +
-            "  \"server_time_utc\": " + SERVER_TIME_UTC + ",\n" +
-            "  \"standby\": " + STANDBY + ",\n" +
-            "  \"sealed\": " + SEALED + ",\n" +
-            "  \"initialized\": " + INITIALIZED + ",\n" +
-            "  \"replication_performance_mode\": \"" + REPL_PERF_MODE + "\",\n" +
-            "  \"replication_dr_mode\": \"" + REPL_DR_MODE + "\",\n" +
-            "  \"performance_standby\": " + PERF_STANDBY + ",\n" +
-            "  \"echo_duration_ms\": " + ECHO_DURATION + ",\n" +
-            "  \"clock_skew_ms\": " + CLOCK_SKEW + ",\n" +
-            "  \"replication_primary_canary_age_ms\": " + REPL_PRIM_CANARY_AGE + ",\n" +
-            "  \"enterprise\": " + ENTERPRISE + "\n" +
-            "}";
+        "  \"cluster_id\": \"" + CLUSTER_ID + "\",\n" +
+        "  \"cluster_name\": \"" + CLUSTER_NAME + "\",\n" +
+        "  \"version\": \"" + VERSION + "\",\n" +
+        "  \"server_time_utc\": " + SERVER_TIME_UTC + ",\n" +
+        "  \"standby\": " + STANDBY + ",\n" +
+        "  \"sealed\": " + SEALED + ",\n" +
+        "  \"initialized\": " + INITIALIZED + ",\n" +
+        "  \"replication_performance_mode\": \"" + REPL_PERF_MODE + "\",\n" +
+        "  \"replication_dr_mode\": \"" + REPL_DR_MODE + "\",\n" +
+        "  \"performance_standby\": " + PERF_STANDBY + ",\n" +
+        "  \"echo_duration_ms\": " + ECHO_DURATION + ",\n" +
+        "  \"clock_skew_ms\": " + CLOCK_SKEW + ",\n" +
+        "  \"replication_primary_canary_age_ms\": " + REPL_PRIM_CANARY_AGE + ",\n" +
+        "  \"enterprise\": " + ENTERPRISE + "\n" +
+        "}";
 
     HealthResponseTest() {
         super(HealthResponse.class);
@@ -67,12 +66,10 @@ class HealthResponseTest extends AbstractModelTest<HealthResponse> {
 
     @Override
     protected HealthResponse createFull() {
-        try {
-            return objectMapper.readValue(RES_JSON, HealthResponse.class);
-        } catch (JsonProcessingException e) {
-            fail("Creation of full model instance failed", e);
-            return null;
-        }
+        return assertDoesNotThrow(
+            () -> objectMapper.readValue(RES_JSON, HealthResponse.class),
+            "Creation of full model instance failed"
+        );
     }
 
     /**
@@ -81,8 +78,8 @@ class HealthResponseTest extends AbstractModelTest<HealthResponse> {
     @Test
     void jsonRoundtrip() {
         HealthResponse res = assertDoesNotThrow(
-                () -> objectMapper.readValue(RES_JSON, HealthResponse.class),
-                "Health deserialization failed"
+            () -> objectMapper.readValue(RES_JSON, HealthResponse.class),
+            "Health deserialization failed"
         );
         assertNotNull(res, "Parsed response is NULL");
         assertEquals(CLUSTER_ID, res.getClusterID(), "Incorrect cluster ID");

src/test/java/de/stklcode/jvault/connector/model/response/HelpResponseTest.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2021 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -16,7 +16,6 @@
 
 package de.stklcode.jvault.connector.model.response;
 
-import com.fasterxml.jackson.core.JsonProcessingException;
 import de.stklcode.jvault.connector.model.AbstractModelTest;
 import org.junit.jupiter.api.Test;
 
@@ -38,12 +37,10 @@ class HelpResponseTest extends AbstractModelTest<HelpResponse> {
 
     @Override
     protected HelpResponse createFull() {
-        try {
-            return objectMapper.readValue(JSON, HelpResponse.class);
-        } catch (JsonProcessingException e) {
-            fail("Creation of full model instance failed", e);
-            return null;
-        }
+        return assertDoesNotThrow(
+            () -> objectMapper.readValue(JSON, HelpResponse.class),
+            "Creation of full model instance failed"
+        );
     }
 
     /**
@@ -52,15 +49,15 @@ class HelpResponseTest extends AbstractModelTest<HelpResponse> {
     @Test
     void jsonRoundtrip() {
         HelpResponse res = assertDoesNotThrow(
-                () -> objectMapper.readValue(JSON, HelpResponse.class),
-                "HelpResponse deserialization failed"
+            () -> objectMapper.readValue(JSON, HelpResponse.class),
+            "HelpResponse deserialization failed"
         );
         assertNotNull(res, "Parsed response is NULL");
         assertEquals(HELP, res.getHelp(), "Unexpected help text");
         assertEquals(
-                JSON,
-                assertDoesNotThrow(() -> objectMapper.writeValueAsString(res), "HelpResponse serialization failed"),
-                "Unexpected JSON string after serialization"
+            JSON,
+            assertDoesNotThrow(() -> objectMapper.writeValueAsString(res), "HelpResponse serialization failed"),
+            "Unexpected JSON string after serialization"
         );
     }
 }

src/test/java/de/stklcode/jvault/connector/model/response/MetaSecretResponseTest.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -16,7 +16,6 @@
 
 package de.stklcode.jvault.connector.model.response;
 
-import com.fasterxml.jackson.core.JsonProcessingException;
 import de.stklcode.jvault.connector.model.AbstractModelTest;
 import org.junit.jupiter.api.Test;
 
@@ -47,47 +46,47 @@ class MetaSecretResponseTest extends AbstractModelTest<MetaSecretResponse> {
     private static final String CUSTOM_META_VAL = "bar";
 
     private static final String SECRET_JSON_V2 = "{\n" +
-            "    \"request_id\": \"" + SECRET_REQUEST_ID + "\",\n" +
-            "    \"lease_id\": \"" + SECRET_LEASE_ID + "\",\n" +
-            "    \"lease_duration\": " + SECRET_LEASE_DURATION + ",\n" +
-            "    \"renewable\": " + SECRET_RENEWABLE + ",\n" +
-            "    \"data\": {\n" +
-            "      \"data\": {\n" +
-            "          \"" + SECRET_DATA_K1 + "\": \"" + SECRET_DATA_V1 + "\",\n" +
-            "          \"" + SECRET_DATA_K2 + "\": \"" + SECRET_DATA_V2 + "\"\n" +
-            "      },\n" +
-            "      \"metadata\": {\n" +
-            "          \"created_time\": \"" + SECRET_META_CREATED + "\",\n" +
-            "          \"custom_metadata\": null,\n" +
-            "          \"deletion_time\": \"\",\n" +
-            "          \"destroyed\": false,\n" +
-            "          \"version\": 1\n" +
-            "      }\n" +
-            "    },\n" +
-            "    \"warnings\": " + SECRET_WARNINGS + "\n" +
-            "}";
+        "    \"request_id\": \"" + SECRET_REQUEST_ID + "\",\n" +
+        "    \"lease_id\": \"" + SECRET_LEASE_ID + "\",\n" +
+        "    \"lease_duration\": " + SECRET_LEASE_DURATION + ",\n" +
+        "    \"renewable\": " + SECRET_RENEWABLE + ",\n" +
+        "    \"data\": {\n" +
+        "      \"data\": {\n" +
+        "          \"" + SECRET_DATA_K1 + "\": \"" + SECRET_DATA_V1 + "\",\n" +
+        "          \"" + SECRET_DATA_K2 + "\": \"" + SECRET_DATA_V2 + "\"\n" +
+        "      },\n" +
+        "      \"metadata\": {\n" +
+        "          \"created_time\": \"" + SECRET_META_CREATED + "\",\n" +
+        "          \"custom_metadata\": null,\n" +
+        "          \"deletion_time\": \"\",\n" +
+        "          \"destroyed\": false,\n" +
+        "          \"version\": 1\n" +
+        "      }\n" +
+        "    },\n" +
+        "    \"warnings\": " + SECRET_WARNINGS + "\n" +
+        "}";
     private static final String SECRET_JSON_V2_2 = "{\n" +
-            "    \"request_id\": \"" + SECRET_REQUEST_ID + "\",\n" +
-            "    \"lease_id\": \"" + SECRET_LEASE_ID + "\",\n" +
-            "    \"lease_duration\": " + SECRET_LEASE_DURATION + ",\n" +
-            "    \"renewable\": " + SECRET_RENEWABLE + ",\n" +
-            "    \"data\": {\n" +
-            "      \"data\": {\n" +
-            "          \"" + SECRET_DATA_K1 + "\": \"" + SECRET_DATA_V1 + "\",\n" +
-            "          \"" + SECRET_DATA_K2 + "\": \"" + SECRET_DATA_V2 + "\"\n" +
-            "      },\n" +
-            "      \"metadata\": {\n" +
-            "          \"created_time\": \"" + SECRET_META_CREATED + "\",\n" +
-            "          \"custom_metadata\": {" +
-            "            \"" + CUSTOM_META_KEY + "\": \"" + CUSTOM_META_VAL + "\"" +
-            "          },\n" +
-            "          \"deletion_time\": \"" + SECRET_META_DELETED + "\",\n" +
-            "          \"destroyed\": true,\n" +
-            "          \"version\": 2\n" +
-            "      }\n" +
-            "    },\n" +
-            "    \"warnings\": " + SECRET_WARNINGS + "\n" +
-            "}";
+        "    \"request_id\": \"" + SECRET_REQUEST_ID + "\",\n" +
+        "    \"lease_id\": \"" + SECRET_LEASE_ID + "\",\n" +
+        "    \"lease_duration\": " + SECRET_LEASE_DURATION + ",\n" +
+        "    \"renewable\": " + SECRET_RENEWABLE + ",\n" +
+        "    \"data\": {\n" +
+        "      \"data\": {\n" +
+        "          \"" + SECRET_DATA_K1 + "\": \"" + SECRET_DATA_V1 + "\",\n" +
+        "          \"" + SECRET_DATA_K2 + "\": \"" + SECRET_DATA_V2 + "\"\n" +
+        "      },\n" +
+        "      \"metadata\": {\n" +
+        "          \"created_time\": \"" + SECRET_META_CREATED + "\",\n" +
+        "          \"custom_metadata\": {" +
+        "            \"" + CUSTOM_META_KEY + "\": \"" + CUSTOM_META_VAL + "\"" +
+        "          },\n" +
+        "          \"deletion_time\": \"" + SECRET_META_DELETED + "\",\n" +
+        "          \"destroyed\": true,\n" +
+        "          \"version\": 2\n" +
+        "      }\n" +
+        "    },\n" +
+        "    \"warnings\": " + SECRET_WARNINGS + "\n" +
+        "}";
 
     MetaSecretResponseTest() {
         super(MetaSecretResponse.class);
@@ -95,12 +94,10 @@ class MetaSecretResponseTest extends AbstractModelTest<MetaSecretResponse> {
 
     @Override
     protected MetaSecretResponse createFull() {
-        try {
-            return objectMapper.readValue(SECRET_JSON_V2, MetaSecretResponse.class);
-        } catch (JsonProcessingException e) {
-            fail("Creation of full model instance failed", e);
-            return null;
-        }
+        return assertDoesNotThrow(
+            () -> objectMapper.readValue(SECRET_JSON_V2, MetaSecretResponse.class),
+            "Creation of full model instance failed"
+        );
     }
 
     /**
@@ -110,8 +107,8 @@ class MetaSecretResponseTest extends AbstractModelTest<MetaSecretResponse> {
     void jsonRoundtrip() {
         // KV v2 secret.
         MetaSecretResponse res = assertDoesNotThrow(
-                () -> objectMapper.readValue(SECRET_JSON_V2, MetaSecretResponse.class),
-                "SecretResponse deserialization failed"
+            () -> objectMapper.readValue(SECRET_JSON_V2, MetaSecretResponse.class),
+            "SecretResponse deserialization failed"
         );
         assertSecretData(res);
         assertNotNull(res.getMetadata(), "SecretResponse does not contain metadata");
@@ -123,8 +120,8 @@ class MetaSecretResponseTest extends AbstractModelTest<MetaSecretResponse> {
 
         // Deleted KV v2 secret.
         res = assertDoesNotThrow(
-                () -> objectMapper.readValue(SECRET_JSON_V2_2, MetaSecretResponse.class),
-                "SecretResponse deserialization failed"
+            () -> objectMapper.readValue(SECRET_JSON_V2_2, MetaSecretResponse.class),
+            "SecretResponse deserialization failed"
         );
         assertSecretData(res);
         assertNotNull(res.getMetadata(), "SecretResponse does not contain metadata");

src/test/java/de/stklcode/jvault/connector/model/response/MetadataResponseTest.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -16,7 +16,6 @@
 
 package de.stklcode.jvault.connector.model.response;
 
-import com.fasterxml.jackson.core.JsonProcessingException;
 import de.stklcode.jvault.connector.model.AbstractModelTest;
 import org.junit.jupiter.api.Test;
 
@@ -43,36 +42,36 @@ class MetadataResponseTest extends AbstractModelTest<MetadataResponse> {
     private static final String DELETE_VERSION_AFTER = "0s";
 
     private static final String META_JSON = "{\n" +
-            "  \"data\": {\n" +
-            "    \"cas_required\": " + CAS_REQUIRED + ",\n" +
-            "    \"created_time\": \"" + V1_TIME + "\",\n" +
-            "    \"current_version\": " + CURRENT_VERSION + ",\n" +
-            "    \"custom_metadata\": {" +
-            "      \"" + CUSTOM_META_KEY + "\": \"" + CUSTOM_META_VAL + "\"" +
-            "    },\n" +
-            "    \"delete_version_after\": \"" + DELETE_VERSION_AFTER + "\"," +
-            "    \"max_versions\": " + MAX_VERSIONS + ",\n" +
-            "    \"oldest_version\": " + OLDEST_VERSION + ",\n" +
-            "    \"updated_time\": \"" + V3_TIME + "\",\n" +
-            "    \"versions\": {\n" +
-            "      \"1\": {\n" +
-            "        \"created_time\": \"" + V1_TIME + "\",\n" +
-            "        \"deletion_time\": \"" + V2_TIME + "\",\n" +
-            "        \"destroyed\": true\n" +
-            "      },\n" +
-            "      \"2\": {\n" +
-            "        \"created_time\": \"" + V2_TIME + "\",\n" +
-            "        \"deletion_time\": \"\",\n" +
-            "        \"destroyed\": false\n" +
-            "      },\n" +
-            "      \"3\": {\n" +
-            "        \"created_time\": \"" + V3_TIME + "\",\n" +
-            "        \"deletion_time\": \"\",\n" +
-            "        \"destroyed\": false\n" +
-            "      }\n" +
-            "    }\n" +
-            "  }\n" +
-            "}";
+        "  \"data\": {\n" +
+        "    \"cas_required\": " + CAS_REQUIRED + ",\n" +
+        "    \"created_time\": \"" + V1_TIME + "\",\n" +
+        "    \"current_version\": " + CURRENT_VERSION + ",\n" +
+        "    \"custom_metadata\": {" +
+        "      \"" + CUSTOM_META_KEY + "\": \"" + CUSTOM_META_VAL + "\"" +
+        "    },\n" +
+        "    \"delete_version_after\": \"" + DELETE_VERSION_AFTER + "\"," +
+        "    \"max_versions\": " + MAX_VERSIONS + ",\n" +
+        "    \"oldest_version\": " + OLDEST_VERSION + ",\n" +
+        "    \"updated_time\": \"" + V3_TIME + "\",\n" +
+        "    \"versions\": {\n" +
+        "      \"1\": {\n" +
+        "        \"created_time\": \"" + V1_TIME + "\",\n" +
+        "        \"deletion_time\": \"" + V2_TIME + "\",\n" +
+        "        \"destroyed\": true\n" +
+        "      },\n" +
+        "      \"2\": {\n" +
+        "        \"created_time\": \"" + V2_TIME + "\",\n" +
+        "        \"deletion_time\": \"\",\n" +
+        "        \"destroyed\": false\n" +
+        "      },\n" +
+        "      \"3\": {\n" +
+        "        \"created_time\": \"" + V3_TIME + "\",\n" +
+        "        \"deletion_time\": \"\",\n" +
+        "        \"destroyed\": false\n" +
+        "      }\n" +
+        "    }\n" +
+        "  }\n" +
+        "}";
 
     MetadataResponseTest() {
         super(MetadataResponse.class);
@@ -80,12 +79,10 @@ class MetadataResponseTest extends AbstractModelTest<MetadataResponse> {
 
     @Override
     protected MetadataResponse createFull() {
-        try {
-            return objectMapper.readValue(META_JSON, MetadataResponse.class);
-        } catch (JsonProcessingException e) {
-            fail("Creation of full model instance failed", e);
-            return null;
-        }
+        return assertDoesNotThrow(
+            () -> objectMapper.readValue(META_JSON, MetadataResponse.class),
+            "Creation of full model instance failed"
+        );
     }
 
     /**
@@ -94,8 +91,8 @@ class MetadataResponseTest extends AbstractModelTest<MetadataResponse> {
     @Test
     void jsonRoundtrip() {
         MetadataResponse res = assertDoesNotThrow(
-                () -> objectMapper.readValue(META_JSON, MetadataResponse.class),
-                "MetadataResponse deserialization failed"
+            () -> objectMapper.readValue(META_JSON, MetadataResponse.class),
+            "MetadataResponse deserialization failed"
         );
         assertNotNull(res, "Parsed response is NULL");
         assertNotNull(res.getMetadata(), "Parsed metadata is NULL");

src/test/java/de/stklcode/jvault/connector/model/response/PlainSecretResponseTest.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2021 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -17,7 +17,6 @@
 package de.stklcode.jvault.connector.model.response;
 
 import com.fasterxml.jackson.annotation.JsonProperty;
-import com.fasterxml.jackson.core.JsonProcessingException;
 import de.stklcode.jvault.connector.exception.InvalidResponseException;
 import de.stklcode.jvault.connector.model.AbstractModelTest;
 import org.junit.jupiter.api.Test;
@@ -43,16 +42,16 @@ class PlainSecretResponseTest extends AbstractModelTest<PlainSecretResponse> {
     private static final String SECRET_DATA_V2 = "world";
     private static final List<String> SECRET_WARNINGS = null;
     private static final String SECRET_JSON = "{\n" +
-            "    \"request_id\": \"" + SECRET_REQUEST_ID + "\",\n" +
-            "    \"lease_id\": \"" + SECRET_LEASE_ID + "\",\n" +
-            "    \"lease_duration\": " + SECRET_LEASE_DURATION + ",\n" +
-            "    \"renewable\": " + SECRET_RENEWABLE + ",\n" +
-            "    \"data\": {\n" +
-            "        \"" + SECRET_DATA_K1 + "\": \"" + SECRET_DATA_V1 + "\",\n" +
-            "        \"" + SECRET_DATA_K2 + "\": \"" + SECRET_DATA_V2 + "\"\n" +
-            "    },\n" +
-            "    \"warnings\": " + SECRET_WARNINGS + "\n" +
-            "}";
+        "    \"request_id\": \"" + SECRET_REQUEST_ID + "\",\n" +
+        "    \"lease_id\": \"" + SECRET_LEASE_ID + "\",\n" +
+        "    \"lease_duration\": " + SECRET_LEASE_DURATION + ",\n" +
+        "    \"renewable\": " + SECRET_RENEWABLE + ",\n" +
+        "    \"data\": {\n" +
+        "        \"" + SECRET_DATA_K1 + "\": \"" + SECRET_DATA_V1 + "\",\n" +
+        "        \"" + SECRET_DATA_K2 + "\": \"" + SECRET_DATA_V2 + "\"\n" +
+        "    },\n" +
+        "    \"warnings\": " + SECRET_WARNINGS + "\n" +
+        "}";
 
     PlainSecretResponseTest() {
         super(PlainSecretResponse.class);
@@ -60,12 +59,10 @@ class PlainSecretResponseTest extends AbstractModelTest<PlainSecretResponse> {
 
     @Override
     protected PlainSecretResponse createFull() {
-        try {
-            return objectMapper.readValue(SECRET_JSON, PlainSecretResponse.class);
-        } catch (JsonProcessingException e) {
-            fail("Creation of full model instance failed", e);
-            return null;
-        }
+        return assertDoesNotThrow(
+            () -> objectMapper.readValue(SECRET_JSON, PlainSecretResponse.class),
+            "Creation of full model instance failed"
+        );
     }
 
     /**
@@ -74,8 +71,8 @@ class PlainSecretResponseTest extends AbstractModelTest<PlainSecretResponse> {
     @Test
     void jsonRoundtrip() {
         SecretResponse res = assertDoesNotThrow(
-                () -> objectMapper.readValue(SECRET_JSON, PlainSecretResponse.class),
-                "SecretResponse deserialization failed"
+            () -> objectMapper.readValue(SECRET_JSON, PlainSecretResponse.class),
+            "SecretResponse deserialization failed"
         );
 
         assertNotNull(res, "Parsed response is NULL");
@@ -106,74 +103,74 @@ class PlainSecretResponseTest extends AbstractModelTest<PlainSecretResponse> {
         final var complexVal = new ComplexType("val1", 678);
 
         SecretResponse res = assertDoesNotThrow(
-                () -> objectMapper.readValue(
-                        "{\n" +
-                                "  \"request_id\": \"req-id\",\n" +
-                                "  \"lease_id\": \"lea-id\",\n" +
-                                "  \"lease_duration\": " + 123456 + ",\n" +
-                                "  \"renewable\": true,\n" +
-                                "  \"data\": {\n" +
-                                "    \"" + stringKey + "\": \"" + stringVal + "\",\n" +
-                                "    \"" + numberKey + "\": \"" + numberVal + "\",\n" +
-                                "    \"" + listKey + "\": [\"" + String.join("\", \"", listVal) + "\"],\n" +
-                                "    \"" + complexKey + "\": {" +
-                                "      \"field1\": \"" + complexVal.field1 + "\",\n" +
-                                "      \"field2\": " + complexVal.field2 + "\n" +
-                                "    },\n" +
-                                "    \"" + complexKey + "Json\": \"" + objectMapper.writeValueAsString(complexVal).replace("\"", "\\\"") + "\"\n" +
-                                "  }\n" +
-                                "}",
-                        PlainSecretResponse.class
-                ),
-                "SecretResponse deserialization failed"
+            () -> objectMapper.readValue(
+                "{\n" +
+                    "  \"request_id\": \"req-id\",\n" +
+                    "  \"lease_id\": \"lea-id\",\n" +
+                    "  \"lease_duration\": " + 123456 + ",\n" +
+                    "  \"renewable\": true,\n" +
+                    "  \"data\": {\n" +
+                    "    \"" + stringKey + "\": \"" + stringVal + "\",\n" +
+                    "    \"" + numberKey + "\": \"" + numberVal + "\",\n" +
+                    "    \"" + listKey + "\": [\"" + String.join("\", \"", listVal) + "\"],\n" +
+                    "    \"" + complexKey + "\": {" +
+                    "      \"field1\": \"" + complexVal.field1 + "\",\n" +
+                    "      \"field2\": " + complexVal.field2 + "\n" +
+                    "    },\n" +
+                    "    \"" + complexKey + "Json\": \"" + objectMapper.writeValueAsString(complexVal).replace("\"", "\\\"") + "\"\n" +
+                    "  }\n" +
+                    "}",
+                PlainSecretResponse.class
+            ),
+            "SecretResponse deserialization failed"
         );
 
         assertEquals(stringVal, res.get(stringKey), "unexpected value for string (implicit)");
         assertEquals(
-                stringVal,
-                assertDoesNotThrow(() -> res.get(stringKey, String.class), "getting string failed"),
-                "unexpected value for string (explicit)"
+            stringVal,
+            assertDoesNotThrow(() -> res.get(stringKey, String.class), "getting string failed"),
+            "unexpected value for string (explicit)"
         );
 
         assertEquals(String.valueOf(numberVal), res.get(numberKey), "unexpected value for number (implicit)");
         assertEquals(
-                numberVal,
-                assertDoesNotThrow(() -> res.get(numberKey, Double.class), "getting number failed"),
-                "unexpected value for number (explicit)"
+            numberVal,
+            assertDoesNotThrow(() -> res.get(numberKey, Double.class), "getting number failed"),
+            "unexpected value for number (explicit)"
         );
         assertEquals(
-                String.valueOf(numberVal),
-                assertDoesNotThrow(() -> res.get(numberKey, String.class), "getting number as string failed"),
-                "unexpected value for number as string (explicit)"
+            String.valueOf(numberVal),
+            assertDoesNotThrow(() -> res.get(numberKey, String.class), "getting number as string failed"),
+            "unexpected value for number as string (explicit)"
         );
 
         assertEquals(listVal, res.get(listKey), "unexpected value for list (implicit)");
         assertEquals(
-                listVal,
-                assertDoesNotThrow(() -> res.get(listKey, ArrayList.class), "getting list failed"),
-                "unexpected value for list (explicit)"
+            listVal,
+            assertDoesNotThrow(() -> res.get(listKey, ArrayList.class), "getting list failed"),
+            "unexpected value for list (explicit)"
         );
 
         assertEquals(complexVal.toMap(), res.get(complexKey), "unexpected value for complex type (implicit)");
         assertEquals(
-                complexVal.toMap(),
-                assertDoesNotThrow(() -> res.get(complexKey, HashMap.class), "getting complex type as map failed"),
-                "unexpected value for complex type as map (explicit)"
+            complexVal.toMap(),
+            assertDoesNotThrow(() -> res.get(complexKey, HashMap.class), "getting complex type as map failed"),
+            "unexpected value for complex type as map (explicit)"
         );
         assertEquals(
-                complexVal,
-                assertDoesNotThrow(() -> res.get(complexKey, ComplexType.class), "getting complex type failed"),
-                "unexpected value for complex type (explicit)"
+            complexVal,
+            assertDoesNotThrow(() -> res.get(complexKey, ComplexType.class), "getting complex type failed"),
+            "unexpected value for complex type (explicit)"
         );
         assertThrows(
-                InvalidResponseException.class,
-                () -> res.get(complexKey, Integer.class),
-                "getting complex type as integer should fail"
+            InvalidResponseException.class,
+            () -> res.get(complexKey, Integer.class),
+            "getting complex type as integer should fail"
         );
         assertEquals(
-                complexVal,
-                assertDoesNotThrow(() -> res.get(complexKey + "Json", ComplexType.class), "getting complex type from JSON string failed"),
-                "unexpected value for complex type from JSON string"
+            complexVal,
+            assertDoesNotThrow(() -> res.get(complexKey + "Json", ComplexType.class), "getting complex type from JSON string failed"),
+            "unexpected value for complex type from JSON string"
         );
     }
 
@@ -199,8 +196,8 @@ class PlainSecretResponseTest extends AbstractModelTest<PlainSecretResponse> {
 
         private Map<String, Object> toMap() {
             return Map.of(
-                    "field1", field1,
-                    "field2", field2
+                "field1", field1,
+                "field2", field2
             );
         }
 

src/test/java/de/stklcode/jvault/connector/model/response/SealResponseTest.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -16,7 +16,6 @@
 
 package de.stklcode.jvault.connector.model.response;
 
-import com.fasterxml.jackson.core.JsonProcessingException;
 import de.stklcode.jvault.connector.model.AbstractModelTest;
 import org.junit.jupiter.api.Test;
 
@@ -46,36 +45,36 @@ class SealResponseTest extends AbstractModelTest<SealResponse> {
     private static final String STORAGE_TYPE = "file";
 
     private static final String RES_SEALED = "{\n" +
-            "  \"type\": \"" + TYPE + "\",\n" +
-            "  \"sealed\": true,\n" +
-            "  \"initialized\": true,\n" +
-            "  \"t\": " + THRESHOLD + ",\n" +
-            "  \"n\": " + SHARES + ",\n" +
-            "  \"progress\": " + PROGRESS_SEALED + ",\n" +
-            "  \"nonce\": \"\",\n" +
-            "  \"version\": \"" + VERSION + "\",\n" +
-            "  \"build_date\": \"" + BUILD_DATE + "\",\n" +
-            "  \"migration\": \"" + MIGRATION + "\",\n" +
-            "  \"recovery_seal\": \"" + RECOVERY_SEAL + "\",\n" +
-            "  \"storage_type\": \"" + STORAGE_TYPE + "\"\n" +
-            "}";
+        "  \"type\": \"" + TYPE + "\",\n" +
+        "  \"sealed\": true,\n" +
+        "  \"initialized\": true,\n" +
+        "  \"t\": " + THRESHOLD + ",\n" +
+        "  \"n\": " + SHARES + ",\n" +
+        "  \"progress\": " + PROGRESS_SEALED + ",\n" +
+        "  \"nonce\": \"\",\n" +
+        "  \"version\": \"" + VERSION + "\",\n" +
+        "  \"build_date\": \"" + BUILD_DATE + "\",\n" +
+        "  \"migration\": \"" + MIGRATION + "\",\n" +
+        "  \"recovery_seal\": \"" + RECOVERY_SEAL + "\",\n" +
+        "  \"storage_type\": \"" + STORAGE_TYPE + "\"\n" +
+        "}";
 
     private static final String RES_UNSEALED = "{\n" +
-            "  \"type\": \"" + TYPE + "\",\n" +
-            "  \"sealed\": false,\n" +
-            "  \"initialized\": true,\n" +
-            "  \"t\": " + THRESHOLD + ",\n" +
-            "  \"n\": " + SHARES + ",\n" +
-            "  \"progress\": " + PROGRESS_UNSEALED + ",\n" +
-            "  \"version\": \"" + VERSION + "\",\n" +
-            "  \"build_date\": \"" + BUILD_DATE + "\",\n" +
-            "  \"cluster_name\": \"" + CLUSTER_NAME + "\",\n" +
-            "  \"cluster_id\": \"" + CLUSTER_ID + "\",\n" +
-            "  \"nonce\": \"" + NONCE + "\",\n" +
-            "  \"migration\": \"" + MIGRATION + "\",\n" +
-            "  \"recovery_seal\": \"" + RECOVERY_SEAL + "\",\n" +
-            "  \"storage_type\": \"" + STORAGE_TYPE + "\"\n" +
-            "}";
+        "  \"type\": \"" + TYPE + "\",\n" +
+        "  \"sealed\": false,\n" +
+        "  \"initialized\": true,\n" +
+        "  \"t\": " + THRESHOLD + ",\n" +
+        "  \"n\": " + SHARES + ",\n" +
+        "  \"progress\": " + PROGRESS_UNSEALED + ",\n" +
+        "  \"version\": \"" + VERSION + "\",\n" +
+        "  \"build_date\": \"" + BUILD_DATE + "\",\n" +
+        "  \"cluster_name\": \"" + CLUSTER_NAME + "\",\n" +
+        "  \"cluster_id\": \"" + CLUSTER_ID + "\",\n" +
+        "  \"nonce\": \"" + NONCE + "\",\n" +
+        "  \"migration\": \"" + MIGRATION + "\",\n" +
+        "  \"recovery_seal\": \"" + RECOVERY_SEAL + "\",\n" +
+        "  \"storage_type\": \"" + STORAGE_TYPE + "\"\n" +
+        "}";
 
     SealResponseTest() {
         super(SealResponse.class);
@@ -83,12 +82,10 @@ class SealResponseTest extends AbstractModelTest<SealResponse> {
 
     @Override
     protected SealResponse createFull() {
-        try {
-            return objectMapper.readValue(RES_UNSEALED, SealResponse.class);
-        } catch (JsonProcessingException e) {
-            fail("Creation of full model instance failed", e);
-            return null;
-        }
+        return assertDoesNotThrow(
+            () -> objectMapper.readValue(RES_UNSEALED, SealResponse.class),
+            "Creation of full model instance failed"
+        );
     }
 
     /**
@@ -98,8 +95,8 @@ class SealResponseTest extends AbstractModelTest<SealResponse> {
     void jsonRoundtripSealed() {
         // First test sealed Vault's response.
         SealResponse res = assertDoesNotThrow(
-                () -> objectMapper.readValue(RES_SEALED, SealResponse.class),
-                "SealResponse deserialization failed"
+            () -> objectMapper.readValue(RES_SEALED, SealResponse.class),
+            "SealResponse deserialization failed"
         );
         assertNotNull(res, "Parsed response is NULL");
         assertEquals(TYPE, res.getType(), "Incorrect seal type");
@@ -121,8 +118,8 @@ class SealResponseTest extends AbstractModelTest<SealResponse> {
 
         // Not test unsealed Vault's response.
         res = assertDoesNotThrow(
-                () -> objectMapper.readValue(RES_UNSEALED, SealResponse.class),
-                "SealResponse deserialization failed"
+            () -> objectMapper.readValue(RES_UNSEALED, SealResponse.class),
+            "SealResponse deserialization failed"
         );
         assertNotNull(res, "Parsed response is NULL");
         assertEquals(TYPE, res.getType(), "Incorrect seal type");

src/test/java/de/stklcode/jvault/connector/model/response/SecretListResponseTest.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -16,13 +16,13 @@
 
 package de.stklcode.jvault.connector.model.response;
 
-import com.fasterxml.jackson.core.JsonProcessingException;
 import de.stklcode.jvault.connector.model.AbstractModelTest;
 import org.junit.jupiter.api.Test;
 
 import java.util.List;
 
-import static org.junit.jupiter.api.Assertions.*;
+import static org.junit.jupiter.api.Assertions.assertDoesNotThrow;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 
 /**
  * JUnit Test for {@link SecretListResponse} model.
@@ -34,17 +34,17 @@ class SecretListResponseTest extends AbstractModelTest<SecretListResponse> {
     private static final String KEY1 = "key1";
     private static final String KEY2 = "key-2";
     private static final String JSON = "{\n" +
-            "  \"auth\": null,\n" +
-            "  \"data\": {\n" +
-            "    \"keys\": [" +
-            "      \"" + KEY1 + "\",\n" +
-            "      \"" + KEY2 + "\"\n" +
-            "    ]\n" +
-            "  },\n" +
-            "  \"lease_duration\": 2764800,\n" +
-            "  \"lease_id\": \"\",\n" +
-            "  \"renewable\": false\n" +
-            "}";
+        "  \"auth\": null,\n" +
+        "  \"data\": {\n" +
+        "    \"keys\": [" +
+        "      \"" + KEY1 + "\",\n" +
+        "      \"" + KEY2 + "\"\n" +
+        "    ]\n" +
+        "  },\n" +
+        "  \"lease_duration\": 2764800,\n" +
+        "  \"lease_id\": \"\",\n" +
+        "  \"renewable\": false\n" +
+        "}";
 
     SecretListResponseTest() {
         super(SecretListResponse.class);
@@ -52,12 +52,10 @@ class SecretListResponseTest extends AbstractModelTest<SecretListResponse> {
 
     @Override
     protected SecretListResponse createFull() {
-        try {
-            return objectMapper.readValue(JSON, SecretListResponse.class);
-        } catch (JsonProcessingException e) {
-            fail("Creation of full model instance failed", e);
-            return null;
-        }
+        return assertDoesNotThrow(
+            () -> objectMapper.readValue(JSON, SecretListResponse.class),
+            "Creation of full model instance failed"
+        );
     }
 
     /**
@@ -66,8 +64,8 @@ class SecretListResponseTest extends AbstractModelTest<SecretListResponse> {
     @Test
     void getKeysTest() {
         SecretListResponse res = assertDoesNotThrow(
-                () -> objectMapper.readValue(JSON, SecretListResponse.class),
-                "SecretListResponse deserialization failed"
+            () -> objectMapper.readValue(JSON, SecretListResponse.class),
+            "SecretListResponse deserialization failed"
         );
 
         assertEquals(List.of(KEY1, KEY2), res.getKeys(), "Unexpected secret keys");

src/test/java/de/stklcode/jvault/connector/model/response/SecretVersionResponseTest.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -16,7 +16,6 @@
 
 package de.stklcode.jvault.connector.model.response;
 
-import com.fasterxml.jackson.core.JsonProcessingException;
 import de.stklcode.jvault.connector.model.AbstractModelTest;
 import org.junit.jupiter.api.Test;
 
@@ -34,13 +33,13 @@ class SecretVersionResponseTest extends AbstractModelTest<SecretVersionResponse>
     private static final Integer VERSION = 42;
 
     private static final String META_JSON = "{\n" +
-            "  \"data\": {\n" +
-            "    \"created_time\": \"" + CREATION_TIME + "\",\n" +
-            "    \"deletion_time\": \"" + DELETION_TIME + "\",\n" +
-            "    \"destroyed\": false,\n" +
-            "    \"version\": " + VERSION + "\n" +
-            "  }\n" +
-            "}";
+        "  \"data\": {\n" +
+        "    \"created_time\": \"" + CREATION_TIME + "\",\n" +
+        "    \"deletion_time\": \"" + DELETION_TIME + "\",\n" +
+        "    \"destroyed\": false,\n" +
+        "    \"version\": " + VERSION + "\n" +
+        "  }\n" +
+        "}";
 
     SecretVersionResponseTest() {
         super(SecretVersionResponse.class);
@@ -48,12 +47,10 @@ class SecretVersionResponseTest extends AbstractModelTest<SecretVersionResponse>
 
     @Override
     protected SecretVersionResponse createFull() {
-        try {
-            return objectMapper.readValue(META_JSON, SecretVersionResponse.class);
-        } catch (JsonProcessingException e) {
-            fail("Creation of full model instance failed", e);
-            return null;
-        }
+        return assertDoesNotThrow(
+            () -> objectMapper.readValue(META_JSON, SecretVersionResponse.class),
+            "Creation of full model instance failed"
+        );
     }
 
     /**
@@ -62,8 +59,8 @@ class SecretVersionResponseTest extends AbstractModelTest<SecretVersionResponse>
     @Test
     void jsonRoundtrip() {
         SecretVersionResponse res = assertDoesNotThrow(
-                () -> objectMapper.readValue(META_JSON, SecretVersionResponse.class),
-                "SecretVersionResponse deserialization failed"
+            () -> objectMapper.readValue(META_JSON, SecretVersionResponse.class),
+            "SecretVersionResponse deserialization failed"
         );
         assertNotNull(res, "Parsed response is NULL");
         assertNotNull(res.getMetadata(), "Parsed metadata is NULL");

src/test/java/de/stklcode/jvault/connector/model/response/TokenResponseTest.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -16,7 +16,6 @@
 
 package de.stklcode.jvault.connector.model.response;
 
-import com.fasterxml.jackson.core.JsonProcessingException;
 import de.stklcode.jvault.connector.model.AbstractModelTest;
 import de.stklcode.jvault.connector.model.response.embedded.TokenData;
 import org.junit.jupiter.api.Test;
@@ -35,8 +34,8 @@ import static org.junit.jupiter.api.Assertions.*;
  */
 class TokenResponseTest extends AbstractModelTest<TokenResponse> {
     private static final Integer TOKEN_CREATION_TIME = 1457533232;
-    private static final Integer TOKEN_TTL = 2764800;
-    private static final Integer TOKEN_EXPLICIT_MAX_TTL = 0;
+    private static final Long TOKEN_TTL = 2764800L;
+    private static final Long TOKEN_EXPLICIT_MAX_TTL = 0L;
     private static final String TOKEN_DISPLAY_NAME = "token";
     private static final String TOKEN_META_KEY = "foo";
     private static final String TOKEN_META_VALUE = "bar";
@@ -47,7 +46,7 @@ class TokenResponseTest extends AbstractModelTest<TokenResponse> {
     private static final String TOKEN_POLICY_1 = "default";
     private static final String TOKEN_POLICY_2 = "web";
     private static final Boolean RES_RENEWABLE = false;
-    private static final Integer RES_TTL = 2591976;
+    private static final Long RES_TTL = 2591976L;
     private static final Integer RES_LEASE_DURATION = 0;
     private static final String TOKEN_ACCESSOR = "VKvzT2fKHFsZFUus9LyoXCvu";
     private static final String TOKEN_ENTITY_ID = "7d2e3179-f69b-450c-7179-ac8ee8bd8ca9";
@@ -58,37 +57,37 @@ class TokenResponseTest extends AbstractModelTest<TokenResponse> {
     private static final String MOUNT_TYPE = "token";
 
     private static final String RES_JSON = "{\n" +
-            "  \"lease_id\": \"\",\n" +
-            "  \"renewable\": " + RES_RENEWABLE + ",\n" +
-            "  \"lease_duration\": " + RES_LEASE_DURATION + ",\n" +
-            "  \"data\": {\n" +
-            "    \"accessor\": \"" + TOKEN_ACCESSOR + "\",\n" +
-            "    \"creation_time\": " + TOKEN_CREATION_TIME + ",\n" +
-            "    \"creation_ttl\": " + TOKEN_TTL + ",\n" +
-            "    \"display_name\": \"" + TOKEN_DISPLAY_NAME + "\",\n" +
-            "    \"entity_id\": \"" + TOKEN_ENTITY_ID + "\",\n" +
-            "    \"expire_time\": \"" + TOKEN_EXPIRE_TIME + "\",\n" +
-            "    \"explicit_max_ttl\": \"" + TOKEN_EXPLICIT_MAX_TTL + "\",\n" +
-            "    \"id\": \"" + TOKEN_ID + "\",\n" +
-            "    \"issue_time\": \"" + TOKEN_ISSUE_TIME + "\",\n" +
-            "    \"meta\": {\n" +
-            "      \"" + TOKEN_META_KEY + "\": \"" + TOKEN_META_VALUE + "\"\n" +
-            "    },\n" +
-            "    \"num_uses\": " + TOKEN_NUM_USES + ",\n" +
-            "    \"orphan\": " + TOKEN_ORPHAN + ",\n" +
-            "    \"path\": \"" + TOKEN_PATH + "\",\n" +
-            "    \"policies\": [\n" +
-            "      \"" + TOKEN_POLICY_1 + "\", \n" +
-            "      \"" + TOKEN_POLICY_2 + "\"\n" +
-            "    ],\n" +
-            "    \"renewable\": " + TOKEN_RENEWABLE + ",\n" +
-            "    \"ttl\": " + RES_TTL + ",\n" +
-            "    \"type\": \"" + TOKEN_TYPE + "\"\n" +
-            "  },\n" +
-            "  \"warnings\": null,\n" +
-            "  \"auth\": null,\n" +
-            "  \"mount_type\": \"" + MOUNT_TYPE + "\"\n" +
-            "}";
+        "  \"lease_id\": \"\",\n" +
+        "  \"renewable\": " + RES_RENEWABLE + ",\n" +
+        "  \"lease_duration\": " + RES_LEASE_DURATION + ",\n" +
+        "  \"data\": {\n" +
+        "    \"accessor\": \"" + TOKEN_ACCESSOR + "\",\n" +
+        "    \"creation_time\": " + TOKEN_CREATION_TIME + ",\n" +
+        "    \"creation_ttl\": " + TOKEN_TTL + ",\n" +
+        "    \"display_name\": \"" + TOKEN_DISPLAY_NAME + "\",\n" +
+        "    \"entity_id\": \"" + TOKEN_ENTITY_ID + "\",\n" +
+        "    \"expire_time\": \"" + TOKEN_EXPIRE_TIME + "\",\n" +
+        "    \"explicit_max_ttl\": \"" + TOKEN_EXPLICIT_MAX_TTL + "\",\n" +
+        "    \"id\": \"" + TOKEN_ID + "\",\n" +
+        "    \"issue_time\": \"" + TOKEN_ISSUE_TIME + "\",\n" +
+        "    \"meta\": {\n" +
+        "      \"" + TOKEN_META_KEY + "\": \"" + TOKEN_META_VALUE + "\"\n" +
+        "    },\n" +
+        "    \"num_uses\": " + TOKEN_NUM_USES + ",\n" +
+        "    \"orphan\": " + TOKEN_ORPHAN + ",\n" +
+        "    \"path\": \"" + TOKEN_PATH + "\",\n" +
+        "    \"policies\": [\n" +
+        "      \"" + TOKEN_POLICY_1 + "\", \n" +
+        "      \"" + TOKEN_POLICY_2 + "\"\n" +
+        "    ],\n" +
+        "    \"renewable\": " + TOKEN_RENEWABLE + ",\n" +
+        "    \"ttl\": " + RES_TTL + ",\n" +
+        "    \"type\": \"" + TOKEN_TYPE + "\"\n" +
+        "  },\n" +
+        "  \"warnings\": null,\n" +
+        "  \"auth\": null,\n" +
+        "  \"mount_type\": \"" + MOUNT_TYPE + "\"\n" +
+        "}";
 
     TokenResponseTest() {
         super(TokenResponse.class);
@@ -96,12 +95,10 @@ class TokenResponseTest extends AbstractModelTest<TokenResponse> {
 
     @Override
     protected TokenResponse createFull() {
-        try {
-            return objectMapper.readValue(RES_JSON, TokenResponse.class);
-        } catch (JsonProcessingException e) {
-            fail("Creation of full model instance failed", e);
-            return null;
-        }
+        return assertDoesNotThrow(
+            () -> objectMapper.readValue(RES_JSON, TokenResponse.class),
+            "Creation of full model instance failed"
+        );
     }
 
     /**
@@ -120,8 +117,8 @@ class TokenResponseTest extends AbstractModelTest<TokenResponse> {
     @Test
     void jsonRoundtrip() {
         TokenResponse res = assertDoesNotThrow(
-                () -> objectMapper.readValue(RES_JSON, TokenResponse.class),
-                "TokenResponse deserialization failed"
+            () -> objectMapper.readValue(RES_JSON, TokenResponse.class),
+            "TokenResponse deserialization failed"
         );
         assertNotNull(res, "Parsed response is NULL");
         assertEquals(RES_LEASE_DURATION, res.getLeaseDuration(), "Incorrect lease duration");

src/test/java/de/stklcode/jvault/connector/model/response/TransitResponseTest.java

@@ -0,0 +1,134 @@
+/*
+ * Copyright 2016-2025 Stefan Kalscheuer
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package de.stklcode.jvault.connector.model.response;
+
+import de.stklcode.jvault.connector.model.AbstractModelTest;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.*;
+
+/**
+ * JUnit Test for {@link TransitResponse} model.
+ *
+ * @author Stefan Kalscheuer
+ * @since 1.5.0
+ */
+class TransitResponseTest extends AbstractModelTest<TransitResponse> {
+    private static final String CIPHERTEXT = "vault:v1:XjsPWPjqPrBi1N2Ms2s1QM798YyFWnO4TR4lsFA=";
+    private static final String PLAINTEXT = "dGhlIHF1aWNrIGJyb3duIGZveAo=";
+    private static final String SUM = "dGhlIHF1aWNrIGJyb3duIGZveAo=";
+
+    TransitResponseTest() {
+        super(TransitResponse.class);
+    }
+
+    @Override
+    protected TransitResponse createFull() {
+        return assertDoesNotThrow(
+            () -> objectMapper.readValue(
+                json(
+                    "\"ciphertext\": \"" + CIPHERTEXT + "\", " +
+                        "\"plaintext\": \"" + PLAINTEXT + "\", " +
+                        "\"sum\": \"" + SUM + "\""
+                ),
+                TransitResponse.class
+            ),
+            "Creation of full model failed"
+        );
+    }
+
+    @Test
+    void encryptionTest() {
+        TransitResponse res = assertDoesNotThrow(
+            () -> objectMapper.readValue(
+                json("\"ciphertext\": \"" + CIPHERTEXT + "\""),
+                TransitResponse.class
+            ),
+            "TransitResponse deserialization failed"
+        );
+        assertNotNull(res, "Parsed response is NULL");
+        assertEquals("987c6daf-b0e2-4142-a970-1e61fdb249d7", res.getRequestId(), "Incorrect request id");
+        assertEquals("", res.getLeaseId(), "Unexpected lease id");
+        assertFalse(res.isRenewable(), "Unexpected renewable flag");
+        assertEquals(0, res.getLeaseDuration(), "Unexpected lease duration");
+        assertEquals(CIPHERTEXT, res.getCiphertext(), "Incorrect ciphertext");
+        assertNull(res.getPlaintext(), "Unexpected plaintext");
+        assertNull(res.getSum(), "Unexpected sum");
+        assertNull(res.getWrapInfo(), "Unexpected wrap info");
+        assertNull(res.getWarnings(), "Unexpected warnings");
+        assertNull(res.getAuth(), "Unexpected auth");
+    }
+
+    @Test
+    void decryptionTest() {
+        TransitResponse res = assertDoesNotThrow(
+            () -> objectMapper.readValue(
+                json("\"plaintext\": \"" + PLAINTEXT + "\""),
+                TransitResponse.class
+            ),
+            "TransitResponse deserialization failed"
+        );
+        assertNotNull(res, "Parsed response is NULL");
+        assertEquals("987c6daf-b0e2-4142-a970-1e61fdb249d7", res.getRequestId(), "Incorrect request id");
+        assertEquals("", res.getLeaseId(), "Unexpected lease id");
+        assertFalse(res.isRenewable(), "Unexpected renewable flag");
+        assertEquals(0, res.getLeaseDuration(), "Unexpected lease duration");
+        assertNull(res.getCiphertext(), "Unexpected ciphertext");
+        assertEquals(PLAINTEXT, res.getPlaintext(), "Incorrect plaintext");
+        assertNull(res.getSum(), "Unexpected sum");
+        assertNull(res.getWrapInfo(), "Unexpected wrap info");
+        assertNull(res.getWarnings(), "Unexpected warnings");
+        assertNull(res.getAuth(), "Unexpected auth");
+    }
+
+    @Test
+    void hashTest() {
+        TransitResponse res = assertDoesNotThrow(
+            () -> objectMapper.readValue(
+                json("\"sum\": \"" + SUM + "\""),
+                TransitResponse.class
+            ),
+            "TransitResponse deserialization failed"
+        );
+        assertNotNull(res, "Parsed response is NULL");
+        assertEquals("987c6daf-b0e2-4142-a970-1e61fdb249d7", res.getRequestId(), "Incorrect request id");
+        assertEquals("", res.getLeaseId(), "Unexpected lease id");
+        assertFalse(res.isRenewable(), "Unexpected renewable flag");
+        assertEquals(0, res.getLeaseDuration(), "Unexpected lease duration");
+        assertNull(res.getCiphertext(), "Unexpected ciphertext");
+        assertNull(res.getPlaintext(), "Unexpected plaintext");
+        assertEquals(SUM, res.getSum(), "Incorrect sum");
+        assertNull(res.getWrapInfo(), "Unexpected wrap info");
+        assertNull(res.getWarnings(), "Unexpected warnings");
+        assertNull(res.getAuth(), "Unexpected auth");
+    }
+
+    private static String json(String data) {
+        return "{\n" +
+            "  \"request_id\" : \"987c6daf-b0e2-4142-a970-1e61fdb249d7\",\n" +
+            "  \"lease_id\" : \"\",\n" +
+            "  \"renewable\" : false,\n" +
+            "  \"lease_duration\" : 0,\n" +
+            "  \"data\" : {\n" +
+            "    " + data + "\n" +
+            "  },\n" +
+            "  \"wrap_info\" : null,\n" +
+            "  \"warnings\" : null,\n" +
+            "  \"auth\" : null\n" +
+            "}";
+    }
+}

src/test/java/de/stklcode/jvault/connector/model/response/embedded/MountConfigTest.java

@@ -1,6 +1,5 @@
 package de.stklcode.jvault.connector.model.response.embedded;
 
-import com.fasterxml.jackson.core.JsonProcessingException;
 import de.stklcode.jvault.connector.model.AbstractModelTest;
 import org.junit.jupiter.api.Test;
 
@@ -14,8 +13,8 @@ import static org.junit.jupiter.api.Assertions.*;
  * @author Stefan Kalscheuer
  */
 class MountConfigTest extends AbstractModelTest<MountConfig> {
-    private static final Integer DEFAULT_LEASE_TTL = 1800;
-    private static final Integer MAX_LEASE_TTL = 3600;
+    private static final Long DEFAULT_LEASE_TTL = 1800L;
+    private static final Long MAX_LEASE_TTL = 3600L;
     private static final Boolean FORCE_NO_CACHE = false;
     private static final String TOKEN_TYPE = "default-service";
     private static final String AUDIT_NON_HMAC_REQ_KEYS_1 = "req1";
@@ -62,12 +61,10 @@ class MountConfigTest extends AbstractModelTest<MountConfig> {
 
     @Override
     protected MountConfig createFull() {
-        try {
-            return objectMapper.readValue(RES_JSON, MountConfig.class);
-        } catch (JsonProcessingException e) {
-            fail("Creation of full model instance failed", e);
-            return null;
-        }
+        return assertDoesNotThrow(
+            () -> objectMapper.readValue(RES_JSON, MountConfig.class),
+            "Creation of full model instance failed"
+        );
     }
 
     /**

src/test/java/de/stklcode/jvault/connector/test/Credentials.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

src/test/java/de/stklcode/jvault/connector/test/VaultConfiguration.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 Stefan Kalscheuer
+ * Copyright 2016-2025 Stefan Kalscheuer
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -93,14 +93,14 @@ public class VaultConfiguration {
     @Override
     public String toString() {
         return "storage \"file\" {\n" +
-                "  path = \"" + dataLocation + "\"\n" +
-                "}\n" +
-                "listener \"tcp\" {\n" +
-                "  address = \"" + host + ":" + port + "\"\n" +
-                ((disableTLS) ? "  tls_disable = 1\n" : "") +
-                ((certFile != null) ? "  tls_cert_file = \"" + certFile + "\"\n" : "") +
-                ((keyFile != null) ? "  tls_key_file = \"" + keyFile + "\"\n" : "") +
-                "}\n" +
-                ((disableMlock) ? "disable_mlock = true" : "");
+            "  path = \"" + dataLocation + "\"\n" +
+            "}\n" +
+            "listener \"tcp\" {\n" +
+            "  address = \"" + host + ":" + port + "\"\n" +
+            ((disableTLS) ? "  tls_disable = 1\n" : "") +
+            ((certFile != null) ? "  tls_cert_file = \"" + certFile + "\"\n" : "") +
+            ((keyFile != null) ? "  tls_key_file = \"" + keyFile + "\"\n" : "") +
+            "}\n" +
+            ((disableMlock) ? "disable_mlock = true" : "");
     }
 }

src/test/resources/data_dir/core/_mounts

@@ -1 +1 @@
-{"Value":"AAAAAQIOTEuNxtf2ZfGu6k9+65GFonDBiaetJnyLYFk1qfWPrE/VqUunbxuTv/QyK4pgC/q14sqypdxPe4Ygp/5mxzzuY6JXB0VKiDMXe9R5BltTG7++rLmKH/j+G7nEh71LER1/qVktU6x8dmDmTbpTgl5xzAB5DIXLMMKjjWda/7qJ3ivNI0pEOQ3JyT27SkqjqM49Dp1JIgKnjIEVQORqKcsSP+aqIncMjIo2iGXOGlDYAesp5tZ4hln3VCwXaIlrU8z6Mmntgcg7NeK/O2WTl86K644dbJUh6frGFDujrjOh/Pgp9n9u0BI3E9K9GD1Z1S1wEb1MCqzT/e9oHG7I7D8ku8PH11wGWGH6BmYlESYUG/KRVqu0XOQEfroLHZQiLE00yHBdStW/UJ9y5pmGpu1aiQ88Q8fpjF5xmRey99b4c6KUIpHjw5Af0XA9ZKsEJUyjS/dbMKPM6PBOW21LYefXH5b0poXMWgLW6LJV0zLuVMyVZJqANbzCVtheDPSsEjkHHwR/CLa2zs2Z6wJF3j1GDZxUFf4nbnuXQzz3M3kVPPtS6htlb0d8RN0/dkOrqUue+c4UjnXhiacXyVUnQQzUVu0sGak4vrQi0020aBzMXM2ZG7rNgvw+wcYFS4txO90kwJL6aOMXT2BeJiQ3wjjHb7M74/sSd0ffRTUlJSODSDotO7Q7Dfcnc1FLrIhXPRFPavTjFoL5HRy77xuGG7U7jTMoGra+rK54v0sxqKbS5WZi1hADQmAVIO8bPb+jA1qoejRFygW6sLgAdmEFQQJOhCV/BoKP3A=="}
+{"Value":"AAAAAQJ7mykBIbHX5k81qdXEpvlLgRF1ZSlODETcB1JBZ7nj0Muskpvvl3jofN5XH1Td8ibJlrR0o5o/OUjZAz9t0Da+ZzCy4ga9G2SmgWkUAravTqfPO/ZxWh2hqTso2WPBXRM3/IeR0SAv/zh7m7JILxjKybJmnl9U6fkjPID/us0AscckZ9kgJ4g8jwaTzPfRp5U8jMebHYbABXZ65PeUOvNiDVcOvQDWPJrMxICz12xbeJ8mKs5MHpcNkLtPoRCQSpsh0YYTwkuF7NvpIciqIJ4/Yb7wYO+vp9AATbiIs3sSFBWxXEl0OAg/SAmOvaR27Y7/NHN//mg81jkMOHv62/Fxf11I8t1d63oyWFQhP0xR9eoq5hGNQ/30I2m1prhZtLRC2ieKASBDMxTzyNS5G5bsVXvhCsxn8tiC0Ma+ySOfxMQzBRfbx8rtoGmLFP+l/d6VMOPGFxmYqzLS5HvvpCryscCqLn7A8i6TMSrZiF7ZevyfEBpThqhJiYHzUxf07O5IAe6JBSGuNV9gLE+uJXaiYLedJwSfjRKwdQyzer730dU1IegW3KYTb/5hSW4eaETKkjc/alC536WlvAv+5FyckDBc3aVC+hHB7lKZG5YANkOUS3m5I8epemOmuKQ5pnXLOdDkQ14DyNCC79NwLltkp0d6sTNstQ44XAbs0HlLjs4EFwg5Hps9qHeXgTOXeAvwUerJgM20nKszlB+Oy+JzZm0xOK5xoJwy+z0/U3PtJ+7pwAipesIa2QEzqMt3EneuPuwEcv3bPUcowukq542sCEK0CuZjLqTUU9nNqiZan5f5pWuL0hYw4NFIkNfQyRlqgKpMaplDk/2fBqaV98yn0DWceEMWRY4NXpEMS+ysPDIeamX99auWqakb95AZ7tySpkRAkZYtq1nY5Nu0w7NyJrJZ1lhBHs2ZjW0tpXn2CL0MhMVArg=="}

src/test/resources/data_dir/logical/c49ee9eb-94d9-928c-c958-95d092130c30/archive/_my-key

@@ -0,0 +1 @@
+{"Value":"AAAAAQIwsBgPcs7Hxl7UnB8OkTq9+5HERx4Fzn8jAzR8uIhoQZfpNG/15m2LEEsDJw1o+lxc6u+h7XcOB1QRqrKz8k7CFR15A+qsxD0UclHZdnk+MmMwXL9SSvYugp7XPiXmpG/uTZVf1QtigXQuehEEJeFfJVI7aFACu2AHEGVt+5b6yDQEgTUruo0seazRXuVU+J6NFCDU3ZvkR8e0al6OcMail59KamzjSCYiqDF4TeUuOQ6Zyr7zIG7gSaas1sog2JIlvrh+wkHW6I+OyD9SJSTinGEGRXl0tq15qoBJ4srfXdWODmKtExEupArbiDR5PyvSI3KlIHKIFduslJZKkJwiV3dBscdva4Rqb98FffMVYuM4G4s+VpvDDX+WVsqWF1ssoHRAFWCNAJGsenVDTxblzAF/4rGkJ7LC9yjLGsBtMOCkCZAKDQ3C9VFu+LGhbMRA5p2RKxNKWGem4Cyp5AqMmx62UzDAgMLGgm89A0g9s1/3FnCoLPdVmlWc6cg4QahN30qJCInJeAmH7T9NwIjv6/QxyJxyDVtdMtcfnMNxx15Q29lbyWTcbaI1iabHpc16iS/gwAPQeBTSbcvc4OxqwC5PDFThFq6bwZXaekYz4ghC13j9Ht79GVKH9cPZb5M="}

src/test/resources/data_dir/logical/c49ee9eb-94d9-928c-c958-95d092130c30/policy/_my-key

@@ -0,0 +1 @@
+{"Value":"AAAAAQKfotDJ0SihB+f5i4PxZ6lq1kxtH4QMprGI7Hj8HimEwXsW0Gbj/1B7YM4DQt4t5JFD4gKwFVOwlJDyusaJj92ar0QLSreCWyJTKUadqZplMFyB/bAdK42QdH+ZS8Z9KHUNchbRpNhnvOFIahoDG8dZ+nbCIXblJONCaey4/ri3H+GQbk/jfre1VByh7zVIN0ISew5PzZRCTkbO1CvcQZhrRGoUGiPmLywKVbHEMsvimVuZY5py6OfL+70QmElBmN9O45bTgX9XPbfSmyQIcGrElO1foi0WwZLPsb/fZcAIgrhC768jOnzeimChoX4zc0DPxuyV1YPvsD1yAlsnsFuJW6CP7TGkszbJU+rwDpg0TgqKtvFr1Lgkxyfcxg0h++1BSiEgoJU7b2IgIWP7reJVjc1tbAsoR1tOBCSAAhvqWZVpn2oht5rfe9aN370bV3Jcu17hFWyhB+VhzbCCPRcofPXX3f2U2dcQ0X7bU4nMiq1v6NQP6u/D5GAPj4Jc0519tPW4KQrd9SNqR20ct6OvqxjMFWV4GZXVcsL4+3xup87Yib6EDb0+hhe6XEpC6isYgD3D5OTTOWphHlsglGkGFi9lUc+h8zNPM4FHwha6uVTLmaqaLGbLziwT9WXF1ATacwtNW0t3kZlFUBvMwSwWzoPqO1+jxs+id4ie/VI6ZTOeowi4ceK2eWJ1/t9MB/gjvadpgE+FYt5QG6dFav4ujQN5Ne/yY78PGF5tp0CT4koox0rMUuxyD1xOIXkm0NBpJm1y9/J06yqLpMKqS40/jGcSQaycRngXDb+6H9rj7mheiO4qxcFGqViqECCUjDG3PnLP/fy9py5kFq7mf0pq7L0Jq/lLWC+iKJF9UaZmCaz8DwlQ9zC03XOFqABPNe8gMFlb8zU09VKBbY+g5gukOonjcBeoFOTRqQxuaWwwwB2lj8XnZScOyIcVJGkH"}