new paths get created

backend/src/services/secret-sync/hc-vault/hc-vault-sync-fns.ts

@@ -1,3 +1,5 @@
+import { isAxiosError } from "axios";
+
 import { request } from "@app/lib/config/request";
 import { removeTrailingSlash } from "@app/lib/fn";
 import { blockLocalAndPrivateIpAddresses } from "@app/lib/validator";
@@ -14,17 +16,25 @@ import { TSecretMap } from "@app/services/secret-sync/secret-sync-types";
 const listHCVaultVariables = async ({ instanceUrl, namespace, mount, accessToken, path }: THCVaultListVariables) => {
   await blockLocalAndPrivateIpAddresses(instanceUrl);
 
-  const { data } = await request.get<THCVaultListVariablesResponse>(
+  try {
-    `${instanceUrl}/v1/${removeTrailingSlash(mount)}/data/${path}`,
+    const { data } = await request.get<THCVaultListVariablesResponse>(
-    {
+      `${instanceUrl}/v1/${removeTrailingSlash(mount)}/data/${path}`,
-      headers: {
+      {
-        "X-Vault-Token": accessToken,
+        headers: {
-        ...(namespace ? { "X-Vault-Namespace": namespace } : {})
+          "X-Vault-Token": accessToken,
+          ...(namespace ? { "X-Vault-Namespace": namespace } : {})
+        }
       }
-    }
+    );
-  );
 
-  return data.data.data;
+    return data.data.data;
+  } catch (error: unknown) {
+    // Returning an empty set when a path isn't found allows that path to be created by a later POST request
+    if (isAxiosError(error) && error.response?.status === 404) {
+      return {};
+    }
+    throw error;
+  }
 };
 
 // Hashicorp Vault updates all variables in one batch. This is to respect their versioning

docs/integrations/secret-syncs/hashicorp-vault.mdx

@@ -40,6 +40,10 @@ description: "Learn how to configure a Hashicorp Vault Sync for Infisical."
                 - **Path**: The specific path within the secrets engine where secrets will be stored.
 
                 After configuring these parameters, click the **Next** button to continue to the Sync Options step.
+
+                <Note>
+                    If the **path** you provide does not exist in Vault, it will be created.
+                </Note>
             </Step>
             <Step title="Configure Sync Options">
                 Configure the **Sync Options** to specify how secrets should be synced, then click **Next**.

frontend/src/components/secret-syncs/forms/SecretSyncDestinationFields/HCVaultSyncFields.tsx

@@ -44,7 +44,7 @@ export const HCVaultSyncFields = () => {
             helperText={
               <Tooltip
                 className="max-w-md"
-                content="Ensure the Secrets Engine mount exists and that your App Role / Access Token has permission to access it. Infisical only supports version 2 KV Secrets Engine mounts."
+                content="Ensure the Secrets Engine mount exists and that your App Role / Access Token has permission to access it. Infisical only supports version 2 KV Secrets Engine mounts. If you're using Hashicorp Cloud Platform, ensure that you correctly defined your 'namespace' when creating the App Connection."
               >
                 <div>
                   <span>Don&#39;t see the mount you&#39;re looking for?</span>{" "}
@@ -72,7 +72,7 @@ export const HCVaultSyncFields = () => {
         render={({ field: { value, onChange }, fieldState: { error } }) => (
           <FormControl
             tooltipClassName="max-w-sm"
-            tooltipText="The Secrets Engine mount path where secrets should be synced to."
+            tooltipText="The Secrets Engine mount path where secrets should be synced to. If the path does not exist, it will be created."
             isError={Boolean(error)}
             errorText={error?.message}
             label="Path"