Vault has an API that can be programmatically consumed by applications

The transit secrets engine ensures encryption in-transit and at-rest is enforced enterprise wide

Encryption for application data is best handled by a storage system or database engine, while storing encryption keys in Vault

The transit secrets engine relieves the burden of proper encryption/decryption from application developers and pushes the burden onto the operators of Vault