Based on https://docs.splunk.com/Documentation/Phantom/4.10.7/PlatformAPI/RESTVault, it appears you’re doing the right thing already:
What seems not to be happening when you hit that API endpoint?
from User warren – Stack Overflow https://stackoverflow.com/questions/75750855/splunk-phantom-api-retrieve-document-from-vault/75758158#75758158
via IFTTT