jstm vault

Vaults hold the credentials your agents use. No command in this group ever prints a credential’s secret value. Human output uses friendly scope labels — Org-wide and Selected workspaces. --json emits the raw enum values all_workspaces and selected_workspaces, which are the wire contract.

`vault list`

jstm vault list
jstm vault list --org acme-corp --json

`vault create`

jstm vault create --workspace acme-corp/finance
jstm vault create --workspace acme-corp --type ORG --name "Shared credentials"

Option	Description
`--workspace`, `-w`	Required. Handle, UUID, or FQN
`--type`, `-t`	`PERSONAL`, `WORKSPACE`, or `ORG`. Defaults to `WORKSPACE`
`--name`, `-n`	Vault name. Auto-generated if omitted
`--json`	Emit as JSON

`vault show`

jstm vault show 7ac1d3f5-0b62-4e19-92c8-5f6ab0e2d411

Shows the vault and its credentials — metadata only.

`vault delete`

jstm vault delete 7ac1d3f5-0b62-4e19-92c8-5f6ab0e2d411 --yes

Deleting a vault deletes every credential in it. Agents depending on those credentials will stop working.

`vault remove-credential`

jstm vault remove-credential 7ac1d3f5-0b62-4e19-92c8-5f6ab0e2d411 4d90c7e2-6b18-4a55-9f31-c8ab27e05d10 --yes

Takes the vault id and the credential id. Removing a credential cascades to its grants.

`vault audit`

Audit every non-personal credential across the organization, grouped by availability scope.

Org owner or admin only. Personal vaults are excluded — a credential someone stored personally is never visible here.

jstm vault audit
jstm vault audit --org acme-corp --json
jstm vault audit --scope selected --workspace acme-corp/finance

Option	Default	Description
`--org`	Your active workspace’s org	Org workspace, as UUID, handle, or FQN
`--scope`	both	`all` for the org-wide group, `selected` for the per-workspace groups
`--workspace`, `-w`	—	Filter to a single workspace
`--json`	off	Emit the machine-readable envelope

The --json shape:

{
  "groups": [
    {
      "scope": "all_workspaces",
      "workspace_id": null,
      "workspace_name": null,
      "credentials": [
        {
          "id": "4d90c7e2-6b18-4a55-9f31-c8ab27e05d10",
          "provider": "github",
          "provider_type": "SERVICE",
          "status": "ACTIVE",
          "scope": "all_workspaces",
          "vault_id": "7ac1d3f5-0b62-4e19-92c8-5f6ab0e2d411",
          "workspace_id": "…",
          "connected_by": "…",
          "created_at": "2026-01-01T00:00:00Z"
        }
      ]
    }
  ]
}

Credential objects carry metadata only — there is no token field. A credential restricted to several workspaces appears under each selected_workspaces group. If you pass no --org and have no active workspace, the command tells you to pass --org. If you’re not an org admin, you get a permission error.

`vault scope`

Set an org-vault credential’s availability scope. Org owner or admin only.

jstm vault scope 4d90c7e2-6b18-4a55-9f31-c8ab27e05d10 --scope all

jstm vault scope 4d90c7e2-6b18-4a55-9f31-c8ab27e05d10 --scope selected \
  --workspace acme-corp/finance --workspace acme-corp/revops

Option	Description
`--scope`	Required. `all` for org-wide, `selected` to restrict
`--workspace`, `-w`	Workspace to include. Repeatable. Required with `--scope selected`
`--json`	Emit as JSON

--scope selected with no --workspace fails locally with exit 1 and sends nothing to the server. The --json shape:

{ "id": "4d90c7e2-…", "scope": "selected_workspaces", "workspace_ids": ["…"] }

workspace_ids is [] when the scope is all_workspaces. Only org-vault credentials are scopeable. Scoping a workspace or personal credential is rejected.

`vault grants`

Read a credential’s current scope and its selected workspaces.

jstm vault grants 7ac1d3f5-0b62-4e19-92c8-5f6ab0e2d411 4d90c7e2-6b18-4a55-9f31-c8ab27e05d10

Returns the same envelope as vault scope.

vault grant and vault revoke have been removed. Use vault scope to change availability.

Using the CLI

Commands

`vault list`

`vault create`

`vault show`

`vault delete`

`vault remove-credential`

`vault audit`

`vault scope`

`vault grants`

See also

​vault list

​vault create

​vault show

​vault delete

​vault remove-credential

​vault audit

​vault scope

​vault grants

​See also

`vault list`

`vault create`

`vault show`

`vault delete`

`vault remove-credential`

`vault audit`

`vault scope`

`vault grants`

See also