*le sigh*

The -format json option to vault doesn’t cause it to emit errors as JSON.

> vault token lookup -format json
Error looking up token: Error making API request.

Namespace: whatevs/
URL: GET https://example:8200/v1/auth/token/lookup-self
Code: 403. Errors:

* permission denied