diff --git a/swh/web/api/views/vault.py b/swh/web/api/views/vault.py
--- a/swh/web/api/views/vault.py
+++ b/swh/web/api/views/vault.py
@@ -31,8 +31,9 @@
                           .format(object_name, hex_id)))
 
 
-@api_route(r'/vault/directory/(?P<dir_id>[a-fA-F0-9]+)/',
+@api_route(r'/vault/directory/(?P<dir_id>[0-9a-f]+)/',
            'api-vault-cook-directory', methods=['GET', 'POST'],
+           checksum_args=['dir_id'],
            throttle_scope='swh_vault_cooking')
 @never_cache
 @api_doc('/vault/directory/')
@@ -87,8 +88,9 @@
     return res
 
 
-@api_route(r'/vault/directory/(?P<dir_id>[a-fA-F0-9]+)/raw/',
-           'api-vault-fetch-directory')
+@api_route(r'/vault/directory/(?P<dir_id>[0-9a-f]+)/raw/',
+           'api-vault-fetch-directory',
+           checksum_args=['dir_id'])
 @api_doc('/vault/directory/raw/', handle_response=True)
 def api_vault_fetch_directory(request, dir_id):
     """
@@ -120,8 +122,9 @@
     return response
 
 
-@api_route(r'/vault/revision/(?P<rev_id>[a-fA-F0-9]+)/gitfast/',
+@api_route(r'/vault/revision/(?P<rev_id>[0-9a-f]+)/gitfast/',
            'api-vault-cook-revision_gitfast', methods=['GET', 'POST'],
+           checksum_args=['rev_id'],
            throttle_scope='swh_vault_cooking')
 @never_cache
 @api_doc('/vault/revision/gitfast/')
@@ -177,8 +180,9 @@
     return res
 
 
-@api_route(r'/vault/revision/(?P<rev_id>[a-fA-F0-9]+)/gitfast/raw/',
-           'api-vault-fetch-revision_gitfast')
+@api_route(r'/vault/revision/(?P<rev_id>[0-9a-f]+)/gitfast/raw/',
+           'api-vault-fetch-revision_gitfast',
+           checksum_args=['rev_id'])
 @api_doc('/vault/revision/gitfast/raw/', handle_response=True)
 def api_vault_fetch_revision_gitfast(request, rev_id):
     """
diff --git a/swh/web/tests/api/views/test_vault.py b/swh/web/tests/api/views/test_vault.py
--- a/swh/web/tests/api/views/test_vault.py
+++ b/swh/web/tests/api/views/test_vault.py
@@ -22,7 +22,46 @@
         stub_cook = {
             'fetch_url': ('http://127.0.0.1:5004/api/1/vault/directory/{}/raw/'
                           .format(TEST_OBJ_ID)),
-            'obj_id': 'd4905454cc154b492bd6afed48694ae3c579345e',
+            'obj_id': TEST_OBJ_ID,
+            'obj_type': 'test_type',
+            'progress_message': None,
+            'status': 'done',
+            'task_uuid': 'de75c902-5ee5-4739-996e-448376a93eff',
+        }
+        stub_fetch = b'content'
+
+        mock_service.vault_cook.return_value = stub_cook
+        mock_service.vault_fetch.return_value = stub_fetch
+
+        for obj_type, (obj_type_name, obj_type_format) in OBJECT_TYPES.items():
+            url = '/api/1/vault/{}/{}/'.format(obj_type_name, TEST_OBJ_ID)
+            if obj_type_format:
+                url += '{}/'.format(obj_type_format)
+            rv = self.client.post(url, {'email': 'test@test.mail'})
+
+            self.assertEqual(rv.status_code, 200)
+            self.assertEqual(rv['Content-Type'], 'application/json')
+
+            self.assertEqual(rv.data, stub_cook)
+            mock_service.vault_cook.assert_called_with(
+                obj_type,
+                hashutil.hash_to_bytes(TEST_OBJ_ID),
+                'test@test.mail')
+
+            rv = self.client.get(url + 'raw/')
+
+            self.assertEqual(rv.status_code, 200)
+            self.assertEqual(rv['Content-Type'], 'application/gzip')
+            self.assertEqual(rv.content, stub_fetch)
+            mock_service.vault_fetch.assert_called_with(
+                obj_type, hashutil.hash_to_bytes(TEST_OBJ_ID))
+
+    @patch('swh.web.api.views.vault.service')
+    def test_api_vault_cook_uppercase_hash(self, mock_service):
+        stub_cook = {
+            'fetch_url': ('http://127.0.0.1:5004/api/1/vault/directory/{}/raw/'
+                          .format(TEST_OBJ_ID.upper())),
+            'obj_id': TEST_OBJ_ID.upper(),
             'obj_type': 'test_type',
             'progress_message': None,
             'status': 'done',