'Decrypt a piece of vault encrypted data.
:arg vaulttext: a string to decrypt.  Since vault encrypted data is an
ascii text format this can be either a byte str or unicode string.
:kwarg filename: a filename that the data came from.  This is only
used to make better error messages in case the data cannot be
decrypted.
:returns: a byte string containing the decrypted data'

def decrypt(self, vaulttext, filename=None):

    b_vaulttext = to_bytes(vaulttext, errors='strict', encoding='utf-8')
    if (self.secrets is None):
        raise AnsibleVaultError('A    vault    password    must    be    specified    to    decrypt    data')
    if (not is_encrypted(b_vaulttext)):
        msg = 'input    is    not    vault    encrypted    data'
        if filename:
            msg += ('%s    is    not    a    vault    encrypted    file' % filename)
        raise AnsibleError(msg)
    (b_vaulttext, dummy, cipher_name, vault_id) = parse_vaulttext_envelope(b_vaulttext)
    if (cipher_name in CIPHER_WHITELIST):
        this_cipher = CIPHER_MAPPING[cipher_name]()
    else:
        raise AnsibleError('{0}    cipher    could    not    be    found'.format(cipher_name))
    b_plaintext = None
    if (not self.secrets):
        raise AnsibleVaultError('Attempting    to    decrypt    but    no    vault    secrets    found')
    vault_id_matchers = []
    if vault_id:
        display.vvvvv(('Found    a    vault_id    (%s)    in    the    vaulttext' % vault_id))
        vault_id_matchers.append(vault_id)
        _matches = match_secrets(self.secrets, vault_id_matchers)
        if _matches:
            display.vvvvv(('We    have    a    secret    associated    with    vault    id    (%s),    will    try    to    use    to    decrypt    %s' % (vault_id, filename)))
        else:
            display.vvvvv(('Found    a    vault_id    (%s)    in    the    vault    text,    but    we    do    not    have    a    associated    secret    (--vault-id)' % vault_id))
    if (not C.DEFAULT_VAULT_ID_MATCH):
        vault_id_matchers.extend([_vault_id for (_vault_id, _dummy) in self.secrets if (_vault_id != vault_id)])
    matched_secrets = match_secrets(self.secrets, vault_id_matchers)
    for (vault_secret_id, vault_secret) in matched_secrets:
        display.vvvvv(('Trying    to    use    vault    secret=(%s)    id=%s    to    decrypt    %s' % (vault_secret, vault_secret_id, filename)))
        try:
            display.vvvv(('Trying    secret    %s    for    vault_id=%s' % (vault_secret, vault_secret_id)))
            b_plaintext = this_cipher.decrypt(b_vaulttext, vault_secret)
            if (b_plaintext is not None):
                display.vvvvv(('decrypt    succesful    with    secret=%s    and    vault_id=%s' % (vault_secret, vault_secret_id)))
                break
        except AnsibleError as e:
            display.vvvv(('Tried    to    use    the    vault    secret    (%s)    to    decrypt    (%s)    but    it    failed.    Error:    %s' % (vault_secret_id, filename, e)))
            continue
    else:
        msg = 'Decryption    failed    (no    vault    secrets    would    found    that    could    decrypt)'
        if filename:
            msg += ('    on    %s' % filename)
        raise AnsibleVaultError(msg)
    if (b_plaintext is None):
        msg = 'Decryption    failed'
        if filename:
            msg += ('    on    %s' % filename)
        raise AnsibleError(msg)
    return b_plaintext
