stado credentials get
Invocation
stado credentials get [OPTIONS] [NAME]Purpose
Print one credential item value or one exact string field to stdout, naming the item by its id or by the role it plays
Required inputs and options
| Input or option | Contract |
|---|---|
[NAME] | Credential item id. A value whose stored text is an encrypted `{"v":…,"c":…}` envelope is refused with the item, the field and the envelope version, and nothing is printed |
--role <ROLE> | Read the one live item carrying the tag `stado:role:<ROLE>` instead of naming an item. No item in the role, or several, is refused with the role and the number of items carrying it. With --route the consumer's grant must be `read:role:<ROLE>#<FIELD>`, and Skarbiec resolves the role, since a scoped consumer cannot list the vault |
--field <FIELD> | Print only this string field. The item id and field remain separate. A field that is absent or empty is refused |
--route <ROUTE> | Skarbiec route for a delegated field read. Requires --consumer, --grant-file and --field; never uses the store administrator |
--consumer <CONSUMER> | Identity granted access to this exact field |
--grant-file <GRANT_FILE> | File holding that consumer's grant |
Output and state effect
This is an inspection/reporting operation. It emits the result described above and does not change managed state unless an explicit option in this page says otherwise. Pass `--json` when the command exposes that machine-readable option.
Refusals
- A value whose stored text is an encrypted `{"v":…,"c":…}` envelope is refused with the item, the field and the envelope version, and nothing is printed
- No item in the role, or several, is refused with the role and the number of items carrying it.
- With --route the consumer's grant must be `read:role:<ROLE>#<FIELD>`, and Skarbiec resolves the role, since a scoped consumer cannot list the vault
- A field that is absent or empty is refused
- Requires --consumer, --grant-file and --field; never uses the store administrator
- Before dispatch, Stado refuses a missing required token shown in the invocation, an unknown option, or a value outside a listed value set; argument-usage failures exit with code 2.