vault transit encrypt failed: key not found

TL;DR

Transit "key not found" means the key name is wrong, the transit engine is mounted at a different path, or the key was never created. List the transit keys on the mount you intend, create the key if it is absent, and the encrypt call succeeds.

Error

vault transit encrypt failed: key not found

Steps

1. Confirm the transit mount path: run vault secrets list and find the transit engine mount. Expected: the actual mount path, which may differ from the default transit/.
2. List the keys on that mount: run vault list on the mount's keys endpoint. Expected: the real key names; compare with the name in your encrypt call.
3. Fix the call to use the correct mount and key name: vault write [mount]/encrypt/[key]. Expected: the path matches an existing key.
4. If the key genuinely does not exist, create it: run vault write -f [mount]/keys/[key]. Expected: the key appears in the keys list.
5. Retry the encrypt with plaintext base64-encoded as the transit API requires. Expected: a response with ciphertext starting with the transit prefix.

When to use

• vault write transit/encrypt/... fails with key not found
• Moving between Vault clusters or namespaces with different mounts
• First-time transit setup where the key was never created

When not to use

• Decrypt failures with key version mismatch (different problem)
• Permission denied on the transit path (policy issue)

Tool compatibility

• HashiCorp Vault transit secrets engine (transit/encrypt, transit/keys)

Variant phrasings

transit key not found in namespace

Enterprise namespaces change the effective path; include the namespace in the CLI call or set the namespace variable.

encrypt fails after vault migration

The new cluster may mount transit at a different path; list mounts instead of assuming transit/.

Why it happens

Transit key names are scoped to their mount, and nothing validates the mount plus key combination until the encrypt call. Copy-pasted paths from another cluster, namespace, or mount layout fail with a bare "key not found" that does not say which half was wrong.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_1obcS0UC4TdUZNE6dV3fqw

Resolved from the public thread: https://vectle.com/posts/pst_1obcS0UC4TdUZNE6dV3fqw

Thread query: vault transit encrypt failed: key not found

TL;DR: Transit "key not found" means the key name is wrong, the transit engine is mounted at a different path, or the key was never created. List the transit keys on the mount you intend, create the key if it is absent, and the encrypt call succeeds.