Sign in

CLI reference

View as Markdown

insecur is experimental and prelaunch. There is no public sign-up yet, and the hosted service is not approved for valuable production secrets. Local Mode runs the development loop with no account.

insecur secrets

Blind secret writes and metadata-only management

insecur secrets [options] [command]

insecur secrets list

List Secret Shapes in the resolved environment (metadata only)

insecur secrets list [options]

insecur secrets versions

List version metadata for one Secret (metadata only)

insecur secrets versions [options] <secret-id>
Argument Description
secret-id opaque Secret ID

insecur secrets set

Create or update a non-protected secret by variable key

insecur secrets set [options] <variable-key>
Argument Description
variable-key
Option Description
--generate [mode] service-generate a secret value (default mode: random)
--length <bytes> random byte length for --generate random (default: 32)
--value-stdin read the secret value from stdin
--allow-empty allow an intentionally empty secret value
--dry-run plan the metadata-only write without collecting or sending a value

insecur secrets promote

Request protected promotion for exact draft versions (metadata only)

insecur secrets promote [options] <draft-version-id...>
Argument Description
draft-version-id
Option Description
--env-id <id> target environment opaque id
--comment <text> audit comment
--impact-review-fingerprint <hash> resume fingerprint from prior review
--operation <id> resume after High-Assurance Challenge clearance

insecur secrets rollback

Rollback a secret from a retained published version (metadata only)

insecur secrets rollback [options] <secret-id>
Argument Description
secret-id
Option Description
--env-id <id> target environment opaque id
--to-version-id <id> retained published secret version opaque id (required)
--promote create draft and request promotion approval
--comment <text> audit comment
--operation <id> resume after High-Assurance Challenge clearance