skarbiec credential status

Invocation#

skarbiec credential status <item-id> --as <caller> --token-file <path>
# canonical-host mode: skarbiec credential status <item-id> --local

Purpose#

Read the persisted lifecycle, provider-effect, receipt, blocker, and quarantine state for one credential.

Required inputs and options#

• Requires item id. Remote mode requires caller/token file. --local reads the canonical vault directly. The command reads once; it never sleeps and reads again.

Output and state effects#

• Prints the operation snapshot with settled: true when its status is one no later read can change (completed, operation_failed, needs_human_approval, inconsistent, unsupported_operation, unsupported_secret, needs_configuration, quarantined, approval_expired, quarantine_resolved) and settled: false otherwise, so a caller that needs the outcome reads again on its own schedule. It starts no new provider operation.

Refusals#

• Refuses unsafe authentication and any flag but --local (canonical host) or --as/--token-file (remote) with usage: credential status <item-id> … ; it reads once and reports settled, and does not watch the operation. Malformed records are refused; missing prerequisites are returned as explicit blockers rather than guessed from a partial state.