ak secrets audit

Use ak secrets audit for the operation described below. The command help records its arguments, effects, and options.

Command contract

Show the secrets access ledger and matching grants

Synopsis

Show the secrets_audit ledger — every resolve with an identifiable caller, a release and a refusal alike — alongside the grants currently recorded. Ledger rows come newest first through secrets.QueryAudit, the same query the desktop app's AuditAPI.QuerySecretAudit binding calls, so a filter answered here and the same filter answered there read identical rows; the desktop app shows the same ledger on its Audit log page, reached from the Secrets page. Never prints a value: the ledger has no value column to begin with.

Only --secret and --agent narrow the grants list; --since, --decision, --source, --limit, and --cursor narrow the ledger rows only, so those filters can shrink the ledger table without changing which grants are shown alongside it.

--since accepts an RFC3339 timestamp or a duration measured back from now, e.g. 24h or 30m. --decision and --source must be one of the ledger's closed vocabularies (allow, block, deny; adapter, cli, desktop); passing anything else is refused rather than silently answered with an empty page.

Effects: Reads the operational store's secrets_audit table and the grants file under AGENTKIT_HOME, creating the operational store on first use like every other reader of it. Listing grants also compacts rows whose expiry has passed, the same housekeeping ak secrets grants performs. Stored secret values are not read.

Exit status: 0 success 2 invalid flags (bad fingerprint, decision, source, since, or cursor) 5 the operational store or grants file could not be read

ak secrets audit [flags]

Examples

  ak secrets audit                                    # newest 100 rows, all grants
  ak secrets audit --secret ${REF}                    # one secret's history and grants
  ak secrets audit --agent sha256:${HASH} --since 24h # one agent, last day
  ak secrets audit --decision deny --json             # machine-readable refusals

Options

      --agent string      Narrow to one agent binary fingerprint, sha256:<64 hex>
      --cursor string     Resume paging after the nextCursor a previous page returned
      --decision string   Narrow to one decision: allow, block, or deny
  -h, --help              help for audit
      --json              Emit machine-readable JSON (implies --no-interactive)
      --limit int         Maximum ledger rows to return (default 100, capped at 500)
      --no-interactive    Disable interactive prompts (CI-safe)
  -q, --quiet             Suppress non-error output on stderr
      --secret string     Narrow to one secret ref
      --since string      Only rows at or after this RFC3339 timestamp or duration ago, e.g. 24h
      --source string     Narrow to one source: adapter, cli, or desktop
  -V, --verbose           Extra diagnostic output on stderr (loses to --quiet)
  -y, --yes               Assume yes for all prompts

SEE ALSO

• ak secrets - Manage named secret values (API keys, tokens)