kici-admin: secrets, tokens & context
secret — scoped secret management
Section titled “secret — scoped secret management”kici-admin secret scopes <orgId>kici-admin secret list <orgId> <scope>kici-admin secret set [orgId] [scope] [key] [--value <v> | --prompt | --from-stdin | --from-file <p> | --from-env <var>] [--no-trim] [--confirm-fingerprint <sha256>] [--dry-run] [--database-url <url>]kici-admin secret set --org <orgId> --context <name> --key <k> [value-source flags as above]kici-admin secret delete <orgId> <scope> <key> [--yes]kici-admin secret scope create <orgId> <scope> [--json]kici-admin secret scope rename <orgId> <oldScope> <newScope> [--json]kici-admin secret scope delete <orgId> <scope> [--yes] [--json]<orgId>is an org id this orchestrator holds.kici-admin org listprints them.- Secret values are write-only — there is no command to read a secret value.
- A
<scope>may be qualified with the backend that owns it (pg:production,openbao-prod:aws/creds). The qualifier selects the backend and is not part of the stored name; an unqualified scope targets the PG backend. A head that names no registered backend stays part of the path. scopesaggregates every registered backend and prints each scope in qualified form. A backend that is unreachable at that moment is skipped with a warning.setaccepts either the positional<orgId> <scope> <key>form or the context-scope sugar form (--org+--context+--key). The two forms are mutually exclusive.- Value sources (mutually exclusive; first matching wins):
--prompt(interactive no-echo, default on TTY),--from-stdin(read piped stdin until EOF; default when stdin is a pipe),--from-file <path>(file body, trailing newline trimmed unless--no-trim),--from-env <var>(named env var),--value <plaintext>(visible in shell history — discouraged). --confirm-fingerprint <sha256hex>refuses the write unlessSHA-256(value)matches the supplied 64-hex string. Pair with a value source for unattended automation.--dry-runparses + validates the value, prints fingerprint + length, and skips the write.--database-url(onset) switches to direct-DB mode and writes the caller-suppliedencrypted_valueverbatim intoscoped_secrets— for a test setup that seeds secrets before the orchestrator is up.deleteasks for confirmation unless--yesis passed.scope create,scope renameandscope deleteact on a whole scope. They are the operator path for the dashboard’s scope writes (secrets.scope.*in the dashboard-write policy). Only the PG backend supports them; a scope in another backend gets an error that names the backend.scope createmakes an empty scope. An existing scope stays unchanged.scope renamekeeps the scope in its backend. It re-encrypts every secret under the new name, and the bindings to the old name move with it. It refuses a move to another backend and a rename onto a scope that already exists.scope deleteremoves the scope, every secret in it, and the bindings to it. It asks for confirmation unless--yesis passed.- Each verb writes a row to the secret audit log:
createScope,renameScopeordeleteScope. Query them withkici-admin audit --action <action>.
- After a successful
set, the command checks whether a context has the same name as the scope. When that context is a fixed or glob context with no binding, it prints a warning on stderr. Jobs that list that context incontexts:get none of its secrets until a scope is bound to it. The secret still reaches any other context bound to its scope. A<context>:<key>git credential or registry reference to that context resolves nothing either. The warning names thekici-admin context bindcommand. The exit code stays 0.
For full details on encryption, backends, and key rotation, see Secrets management.
secret — scoped secret management (purge)
Section titled “secret — scoped secret management (purge)”kici-admin secret purge --confirm # All orgs (nuclear — use rotate-key first)kici-admin secret purge --confirm --org <orgId> # One orgkici-admin secret purge --confirm --database-url $URL --yes # Offline modepurge bulk-deletes scoped_secrets rows. Recovery path for “the encryption key is lost and I can’t decrypt”. Prefer kici-admin rotate-key first — it re-encrypts rather than discards. purge is the path when the old key is gone or the ciphertext is corrupt.
variable — context variable management
Section titled “variable — context variable management”kici-admin variable list <orgId> <context> [--values]kici-admin variable get <orgId> <context> <key>kici-admin variable set <orgId> <context> <key> [--value <v> | --prompt | --from-stdin | --from-file <p> | --from-env <var>] [--no-trim] [--locked] [--confirm-fingerprint <sha256>] [--dry-run]kici-admin variable delete <orgId> <context> <key> [--yes]Manages org-level context variables (plaintext-at-rest in the orchestrator DB). Variables are the non-secret sibling of scoped secrets — both write to the same per-context trust cone, gated by the variables.set / variables.delete switches in the dashboard-write policy. This CLI is the always-available authority path when the dashboard is disabled for either switch.
listprints keys +[locked]flag only; pass--valuesto include the inline values.getprints a single variable’s value (exits non-zero if the key is missing).setaccepts the same value-source flag set assecret set(--prompt,--from-stdin,--from-file,--from-env,--value,--no-trim,--confirm-fingerprint,--dry-run). Add--lockedto mark the variable as locked so source-level overrides cannot replace it.deleteasks for confirmation unless--yesis passed.
backend — secret backend management
Section titled “backend — secret backend management”kici-admin backend add <name> --type <pg|vault> [options]kici-admin backend remove <name> [--yes]kici-admin backend listkici-admin backend test [name] [--type <pg|vault> options]kici-admin backend sync [name]kici-admin backend purge-stale [--database-url <url>] [--json]Manages external secret backends (PostgreSQL or Vault/OpenBao) for multi-source secret resolution.
add <name>registers a new backend.--typeis required (pgorvault).remove <name>deregisters a backend and makes its scopes unavailable. Prompts for confirmation unless--yesis passed.listshows all registered backends with health status, scope count, last sync time, and sync interval.test [name]tests connectivity of a named backend. Alternatively, pass--typewith inline config options to test without registering.sync [name]triggers scope discovery. Omit the name to sync all backends.purge-stale(direct-DB only) deletes backends whose encrypted config can no longer be decrypted (e.g. after losingKICI_SECRET_KEY). Break-glass bootstrap verb that must run before the orchestrator starts, becauseBackendRegistry.loadAllStores()would otherwise crash on the stale row. Accepts--database-url(orKICI_DATABASE_URL) and--jsonfor{ deleted }output.
Vault options (--vault-url, --auth-method, --role-id, --secret-id, --secret-id-file, --token, --namespace, --mount-path, --base-path), the PostgreSQL option (--connection-string), and the options common to both (--scope-filter, --sync-interval) are listed with their defaults under backend add and backend test in the reference below. Prefer --secret-id-file over --secret-id so the AppRole secret never enters shell history.
audit — secrets audit log
Section titled “audit — secrets audit log”kici-admin audit [--context <name>] [--routing-key <key>] [--action <action>] [--from <date>] [--to <date>] [--limit <n>] [--offset <n>] [--include-archived]Queries the secrets operation audit log. All date filters use ISO 8601 format. Default limit is 100. --include-archived also reads rows moved to cold storage; the cold-storage scan needs --routing-key.
api-key — deprecated
Section titled “api-key — deprecated”kici-admin api-key create and kici-admin api-key add-routing-key are
deprecated and have no effect: no KiCI server serves the route they call. Both
exit with an error that points at kici-admin token create. They are removed
in v1.0.0 (see Deprecations). To give a
developer access, mint a per-person token as described in
Tokens for developers.
token — admin API token management
Section titled “token — admin API token management”kici-admin token create <label> --role <role> [--routing-key <key>] [--expires <value>] [--subject <id>]kici-admin token listkici-admin token revoke <id>createreturns the plaintext token once. Save it immediately.--roleis required:owner,admin, orauditor.--routing-keyoptionally scopes the token to a specific routing key.--expiresoptionally sets an expiry: a duration from now (30d,12h,45m) or an ISO-8601 datetime. Omit it for a non-expiring token;token listshowsneverin theExpirescolumn and marks a past expiry with[expired].--subjectoptionally records who the token is for.
Recording the holder with --subject
Section titled “Recording the holder with --subject”--subject takes the OIDC subject or the email address of the person the token
is issued to:
kici-admin token create alice-ops --role admin --subject alice@example.comThe orchestrator stores the value and shows it in token list. It cannot
verify it, and it never reads it when it authorizes a request — the token’s
role and --routing-key scope decide that. --subject is advisory metadata.
The orchestrator returns it to the token’s holder (kici connect prints it),
and the dashboard’s RBAC drift report joins it against your organization’s
membership. The report answers: whose token is this, is
that person still a member, and does the token’s orchestrator role exceed their
dashboard permissions.
A token created without --subject is listed as unlinked and reported as
unlinked in the drift report. That is a finding, not an error: nobody can say
whose token it is. Re-issue it with a subject and revoke the old one.
See Two-layer RBAC for how to read the report.
Tokens for developers
Section titled “Tokens for developers”A developer who runs kici run remote or kici types straight against this
orchestrator, with no KiCI Platform account, uses an orchestrator admin token.
Issue one token per person, so each run and each access-log row names who
started it:
kici-admin token create alice-dev --role admin --subject alice@example.com --expires 30dThe developer saves it with kici connect <orchestrator-url> (or sets
KICI_ORCHESTRATOR_TOKEN). An auditor token can follow test runs but cannot
start or cancel one. The test-run routes refuse a token created with
--routing-key, because the orchestrator chooses the routing key for a test
run. When the person leaves, revoke the token:
kici-admin token listkici-admin token revoke <id>Routing-key-scoped tokens cannot manage secrets
Section titled “Routing-key-scoped tokens cannot manage secrets”A token created with --routing-key <key> is restricted to that one routing key,
and every admin secret route refuses it with 403. This is deliberate:
routing keys and secret scopes are different namespaces. A routing key is
<provider>:<id> and identifies an inbound source; a secret scope is a path in a
backend namespace, where : is reserved to qualify the backend. There is no
per-routing-key slice of the secret store to grant, so there is nothing a scoped
token could safely be allowed to write.
Use an unscoped admin token to manage secrets. Source-owned credentials are a
separate mechanism: they live under the reserved __source__/<sourceId> scope
and are managed through the source commands, not by scoping a token.
rotate-key — master key rotation
Section titled “rotate-key — master key rotation”kici-admin rotate-keyRe-encrypts all PostgreSQL-stored secrets with the current master key. When KICI_SECRET_KEY_OLD is configured alongside KICI_SECRET_KEY, this performs a true key rotation. Without the old key, it re-encrypts at an incremented key version.
See Secrets management > Key rotation for the full procedure.
context — context management (dual-mode)
Section titled “context — context management (dual-mode)”kici-admin context create --org <id> --name <name> [--type fixed|glob|template] [--glob-pattern <pattern>] [--enabled true|false] [--branch-restrictions <json>] [--repo-patterns <json>] [--required-reviewers <csv>] [--wait-timer <seconds>] [--hold-expiry <seconds>] [--minimum-trust trusted] [--database-url <url>] [--json]kici-admin context bind --org <id> --env <name> --scope <pattern> [--host <pattern>] [--database-url <url>] [--json]kici-admin context set-policy --org <id> --env <name> [--branch-restrictions <json>] [--repo-patterns <json>] [--required-reviewers <csv>] [--wait-timer <seconds>] [--hold-expiry <seconds>] [--minimum-trust trusted|null] [--enabled true|false] [--allow-local-execution true|false] [--database-url <url>] [--json]kici-admin context list --org <id> [--database-url <url>] [--json]kici-admin context show --org <id> --name <name> [--database-url <url>] [--json]kici-admin context delete --org <id> --name <name> [--database-url <url>] [--json]kici-admin context create-template --org <id> --template <name> [--type template] [--branch-restrictions <json>] [--required-reviewers <csv>] [--wait-timer <seconds>] [--hold-expiry <seconds>] [--minimum-trust trusted] [--variables <json>] [--database-url <url>] [--json]kici-admin context purge [--org <id>] [--database-url <url>] [--json]kici-admin context source-override list --org <id> --env <name> [--routing-key <key>] [--json]kici-admin context source-override set --org <id> --env <name> --routing-key <key> --key <key> --value <value> [--json]kici-admin context source-override delete --org <id> --env <name> --routing-key <key> --key <key> [--json]Seeds and mutates context rows (plus their variables and scope bindings). Defaults to the orchestrator admin API; pass --database-url (or set KICI_DATABASE_URL) to run the SQL directly — for a test setup that seeds contexts before the orchestrator is up.
createupserts a context (idempotent byorg + name). On a new context, an omitted policy flag leaves that rule unset. On an existing context, an omitted policy flag leaves the stored value unchanged in both modes, and an explicit empty value ('[]', an empty CSV, or--minimum-trust null) clears it.--glob-patternis required when--type globand sets the match pattern that resolves run scopes to this context; passing it with any other--typeis an error.--repo-patternslimits the context to repositories whoseowner/repomatches one of the globs (see Repository patterns).createprints a warning on stderr when the context it created or updated is a fixed or glob context with no binding, because such a context delivers no secrets to the jobs that list it incontexts:. A<context>:<key>reference to such a context resolves nothing either. The warning names thekici-admin context bindcommand. The exit code stays 0.bindupserts acontext_bindingsrow mapping a scope pattern to a context.--host <pattern>scopes the binding to a subset of hosts (default**= all hosts) — see Per-host secret scoping for the host dimension, the templating syntax, and precedence.set-policyupdates only the provided policy fields on an existing context. Pass--minimum-trust nullto clear the tier gate,--repo-patterns '[]'to clear the repository patterns, and--hold-expiry ''(an empty value) to clear the hold expiry. Omitting a flag leaves that field untouched, which is why clearing needs an explicit empty /nullvalue rather than omission.--allow-local-execution true|falsesets whether test runs may resolve the context (see TheallowLocalExecutioncontext flag).list/showread back the current state;showalso returns variables and bindings.deleteremoves a context and cascades its bindings, variables, and overrides. Reportsdeleted=trueon success and exits non-zero if no matching context exists. Pending held runs block the deletion with a clear error (HTTP mode returns 409) — approve or reject them first; resolved held-run history survives the deletion with its context reference cleared.create-templatecreates/updates a template context and seeds its variables in one call (--variables '{"K":"V"}'). Likecreate, it leaves the policy fields you omit unchanged.purge(direct-DB only) bulk-deletes every context for an org (cascading bindings, variables, and overrides) and removes the org’s held runs for a clean slate. Omit--orgto clear all orgs. Destructive break-glass / test-reset verb with no orchestrator HTTP wire; requires--database-url(orKICI_DATABASE_URL). Reports{ contextsDeleted, heldRunsDeleted }with--json.source-overridemanages per-source overrides: the value one source (routing key) sees for a context variable key. A locked context variable keeps its own value. These verbs are the operator path for the dashboard’scontexts.source_overrides.*writes in the dashboard-write policy. They call the orchestrator admin API only;--database-urldoes not apply.source-override listprints every source’s overrides in the context.--routing-keynarrows the list to one source.source-override setcreates or replaces one override.source-override deleteremoves one override, so the source resolves the key from the context variables.- A context that does not exist in the org is refused with HTTP 404 and a non-zero exit.
See Contexts for the broader feature walkthrough.
Reference
Section titled “Reference”kici-admin api-key
Section titled “kici-admin api-key”Deprecated: use kici-admin token create (removed in v1.0.0)
Synopsis: kici-admin api-key
kici-admin api-key add-routing-key
Section titled “kici-admin api-key add-routing-key”Deprecated: use kici-admin token create (removed in v1.0.0)
Synopsis: kici-admin api-key add-routing-key <id> <pattern>
Arguments
| Argument | Required | Variadic | Description |
|---|---|---|---|
id | yes | no | |
pattern | yes | no |
kici-admin api-key create
Section titled “kici-admin api-key create”Deprecated: use kici-admin token create (removed in v1.0.0)
Synopsis: kici-admin api-key create [options]
Options
| Option | Default | Description |
|---|---|---|
--label <label> | unnamed | Ignored |
--routing-keys <keys> | Ignored |
kici-admin audit
Section titled “kici-admin audit”Query the secrets audit log
Synopsis: kici-admin audit [options]
Options
| Option | Default | Description |
|---|---|---|
--context <name> | Filter by context name | |
--routing-key <rk> | Filter by routing key (required for cold-store scan) | |
--action <action> | Filter by action type | |
--from <date> | From date (ISO 8601) | |
--to <date> | To date (ISO 8601) | |
--limit <n> | 100 | Max entries to return |
--offset <n> | Offset for pagination | |
--include-archived | false | Include rows from cold storage |
kici-admin backend
Section titled “kici-admin backend”Manage secret backends
Synopsis: kici-admin backend
kici-admin backend add
Section titled “kici-admin backend add”Register a new secret backend
Synopsis: kici-admin backend add <name> [options]
Arguments
| Argument | Required | Variadic | Description |
|---|---|---|---|
name | yes | no |
Options
| Option | Default | Description |
|---|---|---|
--type <type> | Backend type: pg or vault | |
--vault-url <url> | Vault/OpenBao URL (env: KICI_BACKEND_VAULT_URL) | |
--auth-method <method> | approle | Vault auth method: approle or token |
--role-id <id> | Vault AppRole role ID (env: KICI_BACKEND_ROLE_ID) | |
--secret-id <id> | Vault AppRole secret ID (env: KICI_BACKEND_SECRET_ID) | |
--secret-id-file <path> | Read Vault secret ID from file (avoids shell history) | |
--token <token> | Vault token (env: KICI_BACKEND_TOKEN) | |
--namespace <ns> | Vault namespace | |
--mount-path <path> | secret | Vault mount path |
--base-path <path> | Vault base path for secrets | |
--connection-string <url> | PG connection string (env: KICI_BACKEND_PG_URL) | |
--scope-filter <pattern> | ** | Scope filter glob pattern |
--sync-interval <ms> | 300000 | Sync interval in milliseconds |
kici-admin backend list
Section titled “kici-admin backend list”List all registered secret backends
Synopsis: kici-admin backend list
kici-admin backend purge-stale
Section titled “kici-admin backend purge-stale”Delete backends with encrypted config that can no longer be decrypted (direct-DB, pre-orchestrator)
Synopsis: kici-admin backend purge-stale [options]
Options
| Option | Default | Description |
|---|---|---|
--database-url <url> | Orchestrator DB URL (or KICI_DATABASE_URL / DATABASE_URL) | |
--json | Emit JSON output |
kici-admin backend remove
Section titled “kici-admin backend remove”Remove a registered secret backend
Synopsis: kici-admin backend remove <name> [options]
Arguments
| Argument | Required | Variadic | Description |
|---|---|---|---|
name | yes | no |
Options
| Option | Default | Description |
|---|---|---|
--yes | Skip confirmation prompt |
kici-admin backend sync
Section titled “kici-admin backend sync”Trigger scope discovery sync (all backends if name omitted)
Synopsis: kici-admin backend sync [name]
Arguments
| Argument | Required | Variadic | Description |
|---|---|---|---|
name | no | no |
kici-admin backend test
Section titled “kici-admin backend test”Test backend connectivity (by name or inline config)
Synopsis: kici-admin backend test [name] [options]
Arguments
| Argument | Required | Variadic | Description |
|---|---|---|---|
name | no | no |
Options
| Option | Default | Description |
|---|---|---|
--type <type> | Backend type: pg or vault | |
--vault-url <url> | Vault/OpenBao URL (env: KICI_BACKEND_VAULT_URL) | |
--auth-method <method> | approle | Vault auth method: approle or token |
--role-id <id> | Vault AppRole role ID (env: KICI_BACKEND_ROLE_ID) | |
--secret-id <id> | Vault AppRole secret ID (env: KICI_BACKEND_SECRET_ID) | |
--secret-id-file <path> | Read Vault secret ID from file | |
--token <token> | Vault token (env: KICI_BACKEND_TOKEN) | |
--namespace <ns> | Vault namespace | |
--mount-path <path> | secret | Vault mount path |
--base-path <path> | Vault base path | |
--connection-string <url> | PG connection string (env: KICI_BACKEND_PG_URL) |
kici-admin context
Section titled “kici-admin context”Context management (dual-mode)
Synopsis: kici-admin context
kici-admin context bind
Section titled “kici-admin context bind”Upsert a context_bindings row (scope_pattern → context)
Synopsis: kici-admin context bind [options]
Options
| Option | Default | Description |
|---|---|---|
--org <id> | Org id (kici-admin org list prints the org ids) | |
--env <name> | Context name | |
--scope <pattern> | Scope pattern (e.g. “staging” or “aws/prod/**“) | |
--host <pattern> | ** | Host selector (exact/glob/regex over agentId/host/labels); ”**” = all hosts |
--database-url <url> | Use direct DB access instead of HTTP (offline mode) | |
--json | Emit JSON output |
kici-admin context create
Section titled “kici-admin context create”Upsert a context (idempotent by org+name)
Synopsis: kici-admin context create [options]
Options
| Option | Default | Description |
|---|---|---|
--org <id> | Org id (kici-admin org list prints the org ids) | |
--name <name> | Context name | |
--type <t> | fixed | Context type (fixed|glob|template) |
--glob-pattern <pattern> | Glob pattern matched against declared context names (required with —type glob) | |
--enabled <bool> | Enabled flag (true|false); a new context is enabled, an existing one keeps its flag | |
--branch-restrictions <json> | JSON array of allowed branches (e.g. ’[“main”]‘) | |
--repo-patterns <json> | JSON array of owner/repo globs the context is limited to (e.g. ’[“acme/*”]’; ’[]’ clears) | |
--required-reviewers <csv> | CSV of required reviewer user IDs (or empty to clear) | |
--wait-timer <seconds> | Wait timer before release (seconds) | |
--hold-expiry <seconds> | Hold expiry TTL (seconds) | |
--minimum-trust <level> | Minimum trust (trusted) | |
--database-url <url> | Use direct DB access instead of HTTP (offline mode) | |
--json | Emit JSON output |
kici-admin context create-template
Section titled “kici-admin context create-template”Create or update a context template + its seed variables
Synopsis: kici-admin context create-template [options]
Options
| Option | Default | Description |
|---|---|---|
--org <id> | Org id (kici-admin org list prints the org ids) | |
--template <name> | Template name | |
--type <t> | template | Context type |
--branch-restrictions <json> | JSON array of allowed branches | |
--required-reviewers <csv> | CSV of required reviewer user IDs | |
--wait-timer <seconds> | Wait timer (seconds) | |
--hold-expiry <seconds> | Hold expiry TTL (seconds) | |
--minimum-trust <level> | Minimum trust (trusted) | |
--variables <json> | JSON object of env variables to seed (e.g. ’{“K”:“V”}‘) | |
--database-url <url> | Use direct DB access instead of HTTP (offline mode) | |
--json | Emit JSON output |
kici-admin context delete
Section titled “kici-admin context delete”Delete a context (cascades bindings, variables, overrides; held-run history survives; pending held runs block with a clear error, resolved holds do not)
Synopsis: kici-admin context delete [options]
Options
| Option | Default | Description |
|---|---|---|
--org <id> | Org id (kici-admin org list prints the org ids) | |
--name <name> | Context name | |
--database-url <url> | Use direct DB access instead of HTTP (offline mode) | |
--json | Emit JSON output |
kici-admin context list
Section titled “kici-admin context list”List contexts for an org
Synopsis: kici-admin context list [options]
Options
| Option | Default | Description |
|---|---|---|
--org <id> | Org id (kici-admin org list prints the org ids) | |
--database-url <url> | Use direct DB access instead of HTTP (offline mode) | |
--json | Emit JSON output |
kici-admin context purge
Section titled “kici-admin context purge”Delete all contexts (and held runs) for an org — direct-DB break-glass / warm-start reset
Synopsis: kici-admin context purge [options]
Options
| Option | Default | Description |
|---|---|---|
--database-url <url> | Use direct DB access (or KICI_DATABASE_URL) | |
--org <id> | Restrict purge to a single org (omit to purge all orgs; kici-admin org list prints the org ids) | |
--json | Emit JSON output |
kici-admin context set-policy
Section titled “kici-admin context set-policy”Update policy fields on a context (only provided fields change)
Synopsis: kici-admin context set-policy [options]
Options
| Option | Default | Description |
|---|---|---|
--org <id> | Org id (kici-admin org list prints the org ids) | |
--env <name> | Context name | |
--branch-restrictions <json> | JSON array of allowed branches | |
--repo-patterns <json> | JSON array of owner/repo globs the context is limited to (e.g. ’[“acme/*”]’; ’[]’ clears) | |
--required-reviewers <csv> | CSV of required reviewer user IDs (empty to clear) | |
--wait-timer <seconds> | Wait timer before release (seconds) | |
--hold-expiry <seconds> | Hold expiry TTL in seconds (empty to clear) | |
--minimum-trust <level> | Minimum trust (trusted, or “null” to clear) | |
--enabled <bool> | Enabled flag (true|false) | |
--allow-local-execution <bool> | Allow CLI/test runs to resolve this env (true|false) | |
--database-url <url> | Use direct DB access instead of HTTP (offline mode) | |
--json | Emit JSON output |
kici-admin context show
Section titled “kici-admin context show”Show a single context with variables + bindings
Synopsis: kici-admin context show [options]
Options
| Option | Default | Description |
|---|---|---|
--org <id> | Org id (kici-admin org list prints the org ids) | |
--name <name> | Context name | |
--database-url <url> | Use direct DB access instead of HTTP (offline mode) | |
--json | Emit JSON output |
kici-admin context source-override
Section titled “kici-admin context source-override”Per-source variable overrides in a context (HTTP only)
Synopsis: kici-admin context source-override
kici-admin context source-override delete
Section titled “kici-admin context source-override delete”Delete one source override, so the source resolves the key from the context variables
Synopsis: kici-admin context source-override delete [options]
Options
| Option | Default | Description |
|---|---|---|
--org <id> | Org id (kici-admin org list prints the org ids) | |
--env <name> | Context name | |
--routing-key <key> | Routing key of the source the override applies to | |
--key <key> | Variable key | |
--json | Emit JSON output |
kici-admin context source-override list
Section titled “kici-admin context source-override list”List the source overrides in a context, for every source unless —routing-key
Synopsis: kici-admin context source-override list [options]
Options
| Option | Default | Description |
|---|---|---|
--org <id> | Org id (kici-admin org list prints the org ids) | |
--env <name> | Context name | |
--routing-key <key> | Only list the overrides for this source routing key | |
--json | Emit JSON output |
kici-admin context source-override set
Section titled “kici-admin context source-override set”Set the value one source sees for a context variable key. A locked context variable keeps its own value.
Synopsis: kici-admin context source-override set [options]
Options
| Option | Default | Description |
|---|---|---|
--org <id> | Org id (kici-admin org list prints the org ids) | |
--env <name> | Context name | |
--routing-key <key> | Routing key of the source the override applies to | |
--key <key> | Variable key | |
--value <value> | Override value | |
--json | Emit JSON output |
kici-admin rotate-key
Section titled “kici-admin rotate-key”Rotate the master encryption key (re-encrypts every master-key-wrapped store: scoped_secrets, config_versions, secret_backends, orchestrator_signing_keys, dashboard_encryption_keys, run_ephemeral_keys, run_secret_outputs and the sealed secrets of queued and waiting jobs)
Synopsis: kici-admin rotate-key
kici-admin secret
Section titled “kici-admin secret”Manage scoped secrets
Synopsis: kici-admin secret
kici-admin secret delete
Section titled “kici-admin secret delete”Delete a secret
Synopsis: kici-admin secret delete <orgId> <scope> <key> [options]
Arguments
| Argument | Required | Variadic | Description |
|---|---|---|---|
orgId | yes | no | Org id (kici-admin org list prints the org ids) |
scope | yes | no | |
key | yes | no |
Options
| Option | Default | Description |
|---|---|---|
--yes | Skip confirmation prompt |
kici-admin secret list
Section titled “kici-admin secret list”List secret key names in a scope (values are never shown)
Synopsis: kici-admin secret list <orgId> <scope>
Arguments
| Argument | Required | Variadic | Description |
|---|---|---|---|
orgId | yes | no | Org id (kici-admin org list prints the org ids) |
scope | yes | no |
kici-admin secret purge
Section titled “kici-admin secret purge”Bulk-delete scoped_secrets. Irreversible — pair with rotate-key for recovery.
Synopsis: kici-admin secret purge [options]
Options
| Option | Default | Description |
|---|---|---|
--database-url <url> | Use direct DB access instead of HTTP (offline mode) | |
--confirm | Explicit confirmation flag | |
--org <orgId> | Restrict to a single org (defaults to ALL orgs; kici-admin org list prints the org ids) | |
--yes | Skip interactive confirmation prompt (for scripted use) |
kici-admin secret scope
Section titled “kici-admin secret scope”Create, rename or delete a secret scope
Synopsis: kici-admin secret scope
kici-admin secret scope create
Section titled “kici-admin secret scope create”Create an empty secret scope. A
Synopsis: kici-admin secret scope create <orgId> <scope> [options]
Arguments
| Argument | Required | Variadic | Description |
|---|---|---|---|
orgId | yes | no | Org id (kici-admin org list prints the org ids) |
scope | yes | no |
Options
| Option | Default | Description |
|---|---|---|
--json | Emit JSON output |
kici-admin secret scope delete
Section titled “kici-admin secret scope delete”Delete a secret scope and every secret in it
Synopsis: kici-admin secret scope delete <orgId> <scope> [options]
Arguments
| Argument | Required | Variadic | Description |
|---|---|---|---|
orgId | yes | no | Org id (kici-admin org list prints the org ids) |
scope | yes | no |
Options
| Option | Default | Description |
|---|---|---|
--yes | Skip confirmation prompt | |
--json | Emit JSON output |
kici-admin secret scope rename
Section titled “kici-admin secret scope rename”Rename a secret scope inside its backend. Refuses a move between backends and a rename onto a scope that already exists.
Synopsis: kici-admin secret scope rename <orgId> <oldScope> <newScope> [options]
Arguments
| Argument | Required | Variadic | Description |
|---|---|---|---|
orgId | yes | no | Org id (kici-admin org list prints the org ids) |
oldScope | yes | no | |
newScope | yes | no |
Options
| Option | Default | Description |
|---|---|---|
--json | Emit JSON output |
kici-admin secret scopes
Section titled “kici-admin secret scopes”List secret scopes for an organization, from every registered backend, qualified as
Synopsis: kici-admin secret scopes <orgId>
Arguments
| Argument | Required | Variadic | Description |
|---|---|---|---|
orgId | yes | no | Org id (kici-admin org list prints the org ids) |
kici-admin secret set
Section titled “kici-admin secret set”Set a secret value. Positional form: “set