Enterprise Software Development System

›relman CLI: Credential Vaults

relman CLI: Credential Vaults

← Back to the relman CLI command overview

Credential vaults

list vaults <org-token> (alias: vault)

Fetches the id and name of every credential vault belonging to the organization identified by <org-token>.

list vaultfolders <org-token> <vault-token> (aliases: vaultfolder, vf)

Fetches the id, name and parent folder’s name of every folder in the vault identified by <vault-token>, flatly regardless of tree depth.

list vaultentries <org-token> <vault-token> <folder-token> (aliases: vaultentry, ve)

Fetches metadata (id, name, username, expiry, who it’s restricted to – never the secret itself) of every entry in the folder identified by <folder-token>. Use describe vaultentry to reveal a specific entry’s password/URL/key.

describe vaultentry <org-token> <vault-token> <folder-token> <entry-token> (aliases: vaultentries, ve)

Fetches and prints full detail – including the plaintext password/URL/key filename, if attached – of the entry identified by <entry-token>. The server refuses with HTTP 403 if the entry is restricted to a specific account or user group the caller isn’t part of.

Examples

1. Listing an organization’s vaults

Global flags omitted below – see Utility & global flags.

$ relman list vaults o-4kNc8Q
- id: v-Kp83Nx
  name: Production Secrets

2. Listing entries in a folder – metadata only

$ relman list vaultentries o-4kNc8Q v-Kp83Nx vf-Qm71Zx
- id: ve-Rn82Vp
  name: Payment gateway API key
  username: null
  expires: null
  restrictedTo: null
- id: ve-Tc93Xq
  name: Deploy SSH key
  username: deploy
  expires: 2027-01-01
  restrictedTo: DevOps

Edge case: the secret value itself (password/URL/key content) is never included here, on purpose – only describe vaultentry reveals it, one entry at a time.

3. Revealing an entry – and a restricted one

$ relman describe vaultentry o-4kNc8Q v-Kp83Nx vf-Qm71Zx ve-Tc93Xq
name: Deploy SSH key
username: deploy
password: null
url: null
keyFilename: deploy_id_ed25519

$ relman describe vaultentry o-4kNc8Q v-Kp83Nx vf-Qm71Zx ve-Rn82Vp
Error: The server responded with HTTP 403 for https://.../cli/vaultentry-detail?...

Edge case: the second call fails with HTTP 403, not an empty result, because ve-Rn82Vp is restricted to an account/user group the calling certificate’s account isn’t part of – list vaultentries will still show the entry exists (that’s not secret), but its actual secret stays inaccessible to this certificate.

Top