skarbiec credential verify

Invocation#

skarbiec credential verify <item-id> --consumer <consumer> [--purpose <text>] --as <caller> --token-file <path>
# canonical-host mode
skarbiec credential verify <item-id> --provider <provider> --consumer <consumer> [--dry-run] --local

Purpose#

Ask the provider to authenticate the stored managed credential without changing it.

Required inputs and options#

• Requires item id and consumer plus remote caller authentication, or provider/consumer with --local; expectations may cross-check sealed directory identity.

Output and state effects#

• Records provider verification status and may resolve evidence around a prior uncertain effect; it does not rotate the live value.

Refusals#

• Refuses unmanaged credentials, sealed-directory/field mismatches, unsupported provider verification, and unrelated concurrent operation state.