Skip to main content
This guide walks an org owner or admin through two tasks: reviewing all credentials across the organization, and controlling where each one is available. You can do both in the web UI and the CLI.
Both tasks require org owner or admin. A non-admin member sees only the credentials for workspaces they belong to.

​
Review what’s connected

In the UI, open your organization’s Vault Settings. Credentials are grouped by scope: an Org-wide section, then a section per workspace that has restricted credentials. Each row shows the provider, type, and status — never the secret. From the CLI:
If you run vault audit with no --org and have no active workspace context, the command tells you to pass --org. If you’re not an org admin, you get a permission error.

​
Control where a credential is available

Each org credential is either Org-wide, meaning every workspace can use it, or limited to Selected workspaces. To make a credential org-wide, choose Org-wide from the credential’s Scope control in the UI, or run:
To restrict a credential, choose Selected workspaces and pick the workspaces in the picker that opens, or pass one repeatable --workspace per workspace:
Selecting Selected workspaces without naming a workspace is rejected. The UI keeps the picker open and the CLI fails fast with guidance, so you can’t accidentally save an empty restriction.

​
Check a credential’s current scope

This prints the credential’s scope and, when restricted, the list of selected workspaces. Add --json for the machine-readable envelope.

​
Notes

  • Only org vault credentials are scopeable. Workspace and personal vault credentials are not.
  • The older vault grant and vault revoke commands have been removed. Use vault scope instead.

​
See also