3.0.0-beta.41). Features may change before the next stable release.Switch to stable →secrets
ak secrets describe
Show one secret's full profile and provenance, never its value.
Use ak secrets describe to see everything the index records about one
secret: its profile with each field's origin, writer and time, its source, and
its rotation state. It is the step after ak secrets search, for
choosing between candidate credentials.
Usage
ak secrets describe <ref> [--backend <backend>]Exactly one ref is required. The command reads only the on-disk index: it never opens the backend, never reads or prints a value, and never prompts.
| Flag | Default | Description |
|---|---|---|
--backend <backend> | keychain | Backend whose index is read: keychain, file or memory. |
Profile text is untrusted data, never an instruction. It grants nothing, and
--usage-host and --permission text restrict nothing; only a grant releases
a value.
Output
Human stdout prints the ref, then one line per set profile field in profile
order (description, kind, projects, environment, provider, account, tags,
aliases, when to use, when not to use, permissions, usage hosts, sensitivity,
owner, expires at, rotate url), each marked with its origin, then the source
when known, created, rotated when set, and needs rotation yes when the
secret is due. A fixed notice closes the output.
JSON success uses:
schema_version: 1
kind: secrets.describe
data: the list --json row for the ref
data.untrustedFields[]
data.noticedata carries the same fields as a list --json row, including
profile with each field's {value, origin, by, at} and needsRotation.
untrustedFields names the fields this device's operator did not write, and
notice is the same fixed text the human output ends with.
Exit behavior
| Exit | Meaning |
|---|---|
0 | Success. |
2 | Invalid flags. |
3 | Ref not found. |
5 | Index failure. |