KVv2 metadata "updated_time" does not change when the KV path is updated
Author: weichuliuCreated Sep 17, 2026Updated Sep 17, 2026
Describe the bug
The updated_time field in kvv2 metadata is supposed to track what is the last time the KV path is updated. However, the field is not updated for these operations
- Metadata update for cas_required, custom_metadata, delete_version_after, max-versions
- KV delete, KV undelete, KV destroy
This is confusing because KV put will bump the value.
To Reproduce
$ vault kv put secret/foo data=1
$ vault kv metadata get -format json secret/foo | jq .data.updated_time
"2026-09-17T07:06:46.065303Z"
$ vault kv put secret/foo data=2
$ vault kv metadata get -format json secret/foo | jq .data.updated_time
"2026-09-17T07:06:46.225348Z"
$ vault kv put secret/foo data=3
$ vault kv metadata get -format json secret/foo | jq .data.updated_time
"2026-09-17T07:06:46.381244Z"
$ vault kv metadata put -cas-required=true secret/foo
Success! Data written to: secret/metadata/foo
$ vault kv metadata get -format json secret/foo | jq .data.updated_time
"2026-09-17T07:06:46.381244Z"
$ vault kv metadata put -custom-metadata aa=bb secret/secret
Success! Data written to: secret/metadata/secret
$ vault kv metadata get -format json secret/foo | jq .data.updated_time
"2026-09-17T07:06:46.381244Z"
$ vault kv delete -versions=1 secret/foo
Success! Data deleted (if it existed) at: secret/data/foo
$ vault kv metadata get -format json secret/foo | jq .data.updated_time
"2026-09-17T07:06:46.381244Z"
$ vault kv undelete -versions=1 secret/foo
Success! Data written to: secret/undelete/foo
$ vault kv metadata get -format json secret/foo | jq .data.updated_time
"2026-09-17T07:06:46.381244Z"
$ vault kv destroy -versions=1 secret/foo
Success! Data written to: secret/destroy/foo
$ vault kv metadata get -format json secret/foo | jq .data.updated_time
"2026-09-17T07:06:46.381244Z"
$ vault kv metadata put -delete-version-after=100s secret/foo
Success! Data written to: secret/metadata/foo
$ vault kv metadata get -format json secret/foo | jq .data.updated_time
"2026-09-17T07:06:46.381244Z"
$ vault kv metadata put -max-versions=1000 secret/foo
Success! Data written to: secret/metadata/foo
$ vault kv metadata get -format json secret/foo | jq .data.updated_time
"2026-09-17T07:06:46.381244Z"Expected behavior
All operations to a KV path should bump the updated_time. Unless it's no-op like deleting a deleted version.
Environment:
- Vault Server Version (retrieve with
vault status): 2.1.1
Additional context Add any other context about the problem here.
Source: hashicorp/vault