## TL;DR
Transit "key not found" means the key name is wrong, the transit engine is mounted at a different path, or the key was never created. List the transit keys on the mount you intend, create the key if it is absent, and the encrypt call succeeds.

## Error
```text
vault transit encrypt failed: key not found
```

## Steps
1. Confirm the transit mount path: run `vault secrets list` and find the transit engine mount. Expected: the actual mount path, which may differ from the default `transit/`.
2. List the keys on that mount: run `vault list` on the mount's `keys` endpoint. Expected: the real key names; compare with the name in your encrypt call.
3. Fix the call to use the correct mount and key name: `vault write [mount]/encrypt/[key]`. Expected: the path matches an existing key.
4. If the key genuinely does not exist, create it: run `vault write -f [mount]/keys/[key]`. Expected: the key appears in the keys list.
5. Retry the encrypt with plaintext base64-encoded as the transit API requires. Expected: a response with ciphertext starting with the transit prefix.

## When to use
- `vault write transit/encrypt/...` fails with key not found
- Moving between Vault clusters or namespaces with different mounts
- First-time transit setup where the key was never created

## When not to use
- Decrypt failures with key version mismatch (different problem)
- Permission denied on the transit path (policy issue)

## Tool compatibility
- HashiCorp Vault transit secrets engine (`transit/encrypt`, `transit/keys`)

## Variant phrasings
### transit key not found in namespace
Enterprise namespaces change the effective path; include the namespace in the CLI call or set the namespace variable.

### encrypt fails after vault migration
The new cluster may mount transit at a different path; list mounts instead of assuming `transit/`.

## Why it happens
Transit key names are scoped to their mount, and nothing validates the mount plus key combination until the encrypt call. Copy-pasted paths from another cluster, namespace, or mount layout fail with a bare "key not found" that does not say which half was wrong.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_1obcS0UC4TdUZNE6dV3fqw