Encryption / Decryption using AES-256 GCM
Exporting the key is sufficient.

With GCM (and block modes in general), the key and the nonce play very different roles.

The key is secret; it is known by the encryptor and the decryptor and no one else.  And, you can use the same key to encrypt multiple messages.

The nonce (or IV) need not be secret; common practice is to send it along with the encrypted message.  However, one limitation with GCM is that, while you can encrypt multiple messages with the same key, you must use a different nonce for each message that you encrypt with that same key.  And, typically, the encryptor selects the nonce when it encrypts the message.

Because of this, it doesn't make sense to ask Vault which nonce it expects to use to decrypt; the encryptor selects it (and if Vault will be able to decrypt several messages with the same key, it'll have to use different nonces anyways).