ak secrets recovery remove

Gỡ một recipient khôi phục khỏi vault.

Dùng ak secrets recovery remove với đối số và tùy chọn dưới đây. Phần help nguyên bản giữ nguyên thuật ngữ, cú pháp, tác động và điều kiện thực thi của CLI để đối chiếu chính xác.

Contract và help của lệnh

Remove a recovery recipient from the vault

Synopsis

Drop a recovery recipient by fingerprint and re-encrypt the vault without it. This cuts that key out of every future write. It does not reach a copy of the vault someone already kept: anything encrypted to the key before the removal stays readable with it forever, so treat a leaked key as a reason to rotate the secrets themselves. Fingerprints are matched in full, never by prefix. Removing the last recovery recipient is refused — it would leave the passphrase as the only way in.

Effects: Opens the vault with the current passphrase and rewrites vault.age encrypted to the reduced recipient set.

Exit status: 0 success 2 that recipient is the last one left 3 no vault at that path, or no recipient with that fingerprint 5 the vault could not be rewritten

ak secrets recovery remove <fingerprint> [flags]

Examples

  ak secrets recovery remove 4f2a1c9d0e7b3a56
  ak secrets recovery list   # print the fingerprints first

Options

  -h, --help             help for remove
      --json             Emit machine-readable JSON (implies --no-interactive)
      --no-interactive   Disable interactive prompts (CI-safe)
  -q, --quiet            Suppress non-error output on stderr
  -V, --verbose          Extra diagnostic output on stderr (loses to --quiet)
  -y, --yes              Assume yes for all prompts

SEE ALSO

• ak secrets recovery - Manage the file backend's vault and its recovery keys