> ## Documentation Index
> Fetch the complete documentation index at: https://docs.joystream.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# jstm vault

> Vaults and credentials — list, create, inspect, audit across the org, and set availability scope.

Vaults hold the credentials your agents use. No command in this group ever prints a credential's secret value.

Human output uses friendly scope labels — Org-wide and Selected workspaces. `--json` emits the raw enum values `all_workspaces` and `selected_workspaces`, which are the wire contract.

## `vault list`

```bash theme={null}
jstm vault list
jstm vault list --org acme-corp --json
```

## `vault create`

```bash theme={null}
jstm vault create --workspace acme-corp/finance
jstm vault create --workspace acme-corp --type ORG --name "Shared credentials"
```

| Option              | Description                                                |
| ------------------- | ---------------------------------------------------------- |
| `--workspace`, `-w` | Required. Handle, UUID, or FQN                             |
| `--type`, `-t`      | `PERSONAL`, `WORKSPACE`, or `ORG`. Defaults to `WORKSPACE` |
| `--name`, `-n`      | Vault name. Auto-generated if omitted                      |
| `--json`            | Emit as JSON                                               |

## `vault show`

```bash theme={null}
jstm vault show 7ac1d3f5-0b62-4e19-92c8-5f6ab0e2d411
```

Shows the vault and its credentials — metadata only.

## `vault delete`

```bash theme={null}
jstm vault delete 7ac1d3f5-0b62-4e19-92c8-5f6ab0e2d411 --yes
```

<Warning>
  Deleting a vault deletes every credential in it. Agents depending on those credentials will stop working.
</Warning>

## `vault remove-credential`

```bash theme={null}
jstm vault remove-credential 7ac1d3f5-0b62-4e19-92c8-5f6ab0e2d411 4d90c7e2-6b18-4a55-9f31-c8ab27e05d10 --yes
```

Takes the vault id and the credential id. Removing a credential cascades to its grants.

## `vault audit`

Audit every non-personal credential across the organization, grouped by availability scope.

<Info>
  Org owner or admin only. Personal vaults are excluded — a credential someone stored personally is never visible here.
</Info>

```bash theme={null}
jstm vault audit
jstm vault audit --org acme-corp --json
jstm vault audit --scope selected --workspace acme-corp/finance
```

| Option              | Default                     | Description                                                           |
| ------------------- | --------------------------- | --------------------------------------------------------------------- |
| `--org`             | Your active workspace's org | Org workspace, as UUID, handle, or FQN                                |
| `--scope`           | both                        | `all` for the org-wide group, `selected` for the per-workspace groups |
| `--workspace`, `-w` | —                           | Filter to a single workspace                                          |
| `--json`            | off                         | Emit the machine-readable envelope                                    |

The `--json` shape:

```json theme={null}
{
  "groups": [
    {
      "scope": "all_workspaces",
      "workspace_id": null,
      "workspace_name": null,
      "credentials": [
        {
          "id": "4d90c7e2-6b18-4a55-9f31-c8ab27e05d10",
          "provider": "github",
          "provider_type": "SERVICE",
          "status": "ACTIVE",
          "scope": "all_workspaces",
          "vault_id": "7ac1d3f5-0b62-4e19-92c8-5f6ab0e2d411",
          "workspace_id": "…",
          "connected_by": "…",
          "created_at": "2026-01-01T00:00:00Z"
        }
      ]
    }
  ]
}
```

Credential objects carry metadata only — there is no token field. A credential restricted to several workspaces appears under each `selected_workspaces` group.

If you pass no `--org` and have no active workspace, the command tells you to pass `--org`. If you're not an org admin, you get a permission error.

## `vault scope`

Set an org-vault credential's availability scope. Org owner or admin only.

```bash theme={null}
jstm vault scope 4d90c7e2-6b18-4a55-9f31-c8ab27e05d10 --scope all

jstm vault scope 4d90c7e2-6b18-4a55-9f31-c8ab27e05d10 --scope selected \
  --workspace acme-corp/finance --workspace acme-corp/revops
```

| Option              | Description                                                        |
| ------------------- | ------------------------------------------------------------------ |
| `--scope`           | Required. `all` for org-wide, `selected` to restrict               |
| `--workspace`, `-w` | Workspace to include. Repeatable. Required with `--scope selected` |
| `--json`            | Emit as JSON                                                       |

`--scope selected` with no `--workspace` fails locally with exit `1` and sends nothing to the server.

The `--json` shape:

```json theme={null}
{ "id": "4d90c7e2-…", "scope": "selected_workspaces", "workspace_ids": ["…"] }
```

`workspace_ids` is `[]` when the scope is `all_workspaces`.

Only org-vault credentials are scopeable. Scoping a workspace or personal credential is rejected.

## `vault grants`

Read a credential's current scope and its selected workspaces.

```bash theme={null}
jstm vault grants 7ac1d3f5-0b62-4e19-92c8-5f6ab0e2d411 4d90c7e2-6b18-4a55-9f31-c8ab27e05d10
```

Returns the same envelope as `vault scope`.

<Note>
  `vault grant` and `vault revoke` have been removed. Use `vault scope` to change availability.
</Note>

## See also

* [Credentials and vaults](/features/credentials-and-vaults) — the model.
* [Audit and scope org credentials](/guides/audit-and-scope-org-credentials) — walkthrough.