> ## Documentation Index
> Fetch the complete documentation index at: https://docs.joystream.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit and scope org credentials

> Review every credential across the organization and control which workspaces each one is available to, in the UI and the CLI.

This guide walks an org owner or admin through two tasks: reviewing all credentials across the organization, and controlling where each one is available. You can do both in the web UI and the CLI.

<Info>
  Both tasks require org owner or admin. A non-admin member sees only the credentials for workspaces they belong to.
</Info>

## Review what's connected

In the UI, open your organization's **Vault Settings**. Credentials are grouped by scope: an Org-wide section, then a section per workspace that has restricted credentials. Each row shows the provider, type, and status — never the secret.

From the CLI:

```bash theme={null}
# Audit your active org, resolved from your current workspace
jstm vault audit

# Audit a specific org, as JSON for scripting
jstm vault audit --org acme-corp --json

# Narrow to one scope or one workspace
jstm vault audit --scope all
jstm vault audit --scope selected --workspace acme-corp/finance
```

If you run `vault audit` with no `--org` and have no active workspace context, the command tells you to pass `--org`. If you're not an org admin, you get a permission error.

## Control where a credential is available

Each org credential is either Org-wide, meaning every workspace can use it, or limited to Selected workspaces.

To make a credential org-wide, choose **Org-wide** from the credential's **Scope** control in the UI, or run:

```bash theme={null}
jstm vault scope 4d90c7e2-6b18-4a55-9f31-c8ab27e05d10 --scope all
```

To restrict a credential, choose **Selected workspaces** and pick the workspaces in the picker that opens, or pass one repeatable `--workspace` per workspace:

```bash theme={null}
jstm vault scope 4d90c7e2-6b18-4a55-9f31-c8ab27e05d10 --scope selected \
  --workspace acme-corp/finance --workspace acme-corp/revops
```

<Warning>
  Selecting Selected workspaces without naming a workspace is rejected. The UI keeps the picker open and the CLI fails fast with guidance, so you can't accidentally save an empty restriction.
</Warning>

## Check a credential's current scope

```bash theme={null}
jstm vault grants 7ac1d3f5-0b62-4e19-92c8-5f6ab0e2d411 4d90c7e2-6b18-4a55-9f31-c8ab27e05d10
```

This prints the credential's scope and, when restricted, the list of selected workspaces. Add `--json` for the machine-readable envelope.

## Notes

* Only org vault credentials are scopeable. Workspace and personal vault credentials are not.
* The older `vault grant` and `vault revoke` commands have been removed. Use `vault scope` instead.

## See also

* [Credentials and vaults](/features/credentials-and-vaults) — the model behind these commands.
* [`jstm vault`](/cli/vault) — full reference with JSON schemas.