I understand this was here before and hence not your fault :-), but why do we hard-code a /tmp rooted path in the API server implementation?
That doesn't look good…

I guess it's because the API server is essentially the only way to instanciate a Vault, so the default config is put here as this is the main entry point.

If you see a better place to put that, and better default values, I'm totally open to changing it, but I want it to be part of the default config so that we know the things that can be overwritten in the config.