diff --git a/src/lib/api.ts b/src/lib/api.ts
index 939eb2b..18baabf 100644
--- a/src/lib/api.ts
+++ b/src/lib/api.ts
@@ -427,6 +427,14 @@ export const api = {
   updateSettings: (patch: Partial<AppSettings>) =>
     invoke<AppSettings>("update_settings", { patch }),
   privacySelfCheck: () => invoke<PrivacySelfCheck>("privacy_self_check"),
+
+  // At-rest encryption vault (Phase 8, T8.8, FR-SEC-3).
+  vaultStatus: () => invoke<{ enabled: boolean; unlocked: boolean }>("vault_status"),
+  enableVault: (password: string) => invoke<void>("enable_vault", { args: { password } }),
+  unlockVault: (password: string) => invoke<void>("unlock_vault", { args: { password } }),
+  lockVault: () => invoke<void>("lock_vault"),
+  changeVaultPassword: (oldPassword: string, newPassword: string) =>
+    invoke<void>("change_vault_password", { args: { oldPassword, newPassword } }),
 };
 
 // ---- Events (Rust → UI) ----