skarbiec credential reset

Invocation#

skarbiec credential reset <item-id> --consumer <consumer> [--purpose <text>] --as <caller> --token-file <path>
# canonical-host mode
skarbiec credential reset <item-id> --provider <provider> --consumer <consumer> [--dry-run] --local

Purpose#

Request provider-side replacement when the current credential is lost rather than available for ordinary rotation.

Required inputs and options#

• Requires item id and consumer plus remote caller authentication, or provider/consumer with --local; optional purpose/expectations/dry-run follow the lifecycle contract.

Output and state effects#

• Persists the request and provider evidence, stages verified replacement state, and commits only after the provider reports completion.

Refusals#

• Refuses unmanaged/quarantined items, identity or field mismatch, unsupported reset trajectories, and uncertain effects that require quarantine resolution.