stado credentials inspect-vault
Invocation
stado credentials inspect-vault [OPTIONS] [VAULT]Purpose
List nonsecret item metadata from one owner-controlled vault file. With `--host` the vault is the one THAT host holds, read through the registry's own channel with the same read-only `skarbiec list` the fleet's vault inventory already uses. A remote host's vault is a separate store from this machine's — its capability routes, its capability state and its items are all its own — and nothing else in the product could answer "does that host hold this item" without copying an encrypted vault around. Names, kinds, states and tags only, never a field value.
Required inputs and options
| Input or option | Contract |
|---|---|
[VAULT] | Encrypted Skarbiec vault file. Omit with `--host` |
--host <HOST> | Registry host whose own vault to read instead of a local file |
--match <MATCHING> | Only report items whose name contains this text |
--json | Emit JSON instead of a table |
Output and state effect
This is an inspection/reporting operation. It emits the result described above and does not change managed state unless an explicit option in this page says otherwise. Pass `--json` when the command exposes that machine-readable option.
Refusals
- Before dispatch, Stado refuses a missing required token shown in the invocation, an unknown option, or a value outside a listed value set; argument-usage failures exit with code 2.