skarbiec credential remove

Invocation#

skarbiec credential remove <item-id> --consumer <consumer> [--purpose <text>] --as <caller> --token-file <path>
# canonical-host mode
skarbiec credential remove <item-id> --provider <provider> --consumer <consumer> [--dry-run] --local

Purpose#

Revoke a managed credential at its provider before removing it locally.

Required inputs and options#

• Requires item id and consumer plus remote caller authentication, or provider/consumer with --local.

Output and state effects#

• Persists provider removal evidence and trashes the managed local item only after the provider operation is confirmed.

Refusals#

• Refuses unmanaged/quarantined items, provider or identity mismatch, unsupported removal, and local deletion before provider confirmation.