Reference link:- https://www.vaultproject.io/docs/secrets/pki

The /sys/leader endpoint is used to check the current leader of Vault as well as high availability status.

storage backend and HTTP API are outside of the security barrier hence can't be protected.

A workspace can only be configured to a single VCS repo, however, multiple workspaces can use the same repo, if needed. A good Explanation: of how to configure your code repositories can be found here.

The TOTP secrets engine generates time-based credentials according to the TOTP standard. The secrets engine can also be used to generate a new key and validate passwords generated by that key.
The TOTP secrets engine can act as both a generator (like Google Authenticator) and a provider (like the Google.com sign-in service).
As a Generator
The TOTP secrets engine can act as a TOTP code generator. In this mode, it can replace traditional TOTP generators like Google Authenticator. It provides an added layer of security since the ability to generate codes is guarded by policies and the entire process is audited.
Reference link:- https://www.vaultproject.io/docs/secrets/totp