Search all skarbiec documentation

Invocation#

Shell

skarbiec recipient remove <uid> --yes

Purpose#

Remove one person from the whole vault at once: every item they can read, every historical revision, and their registry entry.

Requires one registered recipient uid that is neither the owner nor the recovery key, and --yes: every item and saved version is rewritten without them and nothing restores that. The desktop's Remove from vault sheet is the same confirmation for the operator API.

Re-encrypts every current and historical revision of every active and trashed item listing the uid onto the remaining recipients plus owner and recovery, deletes the registry entry so share refuses the uid until recipient add registers it again, cancels its pending emergency grant, and saves only after every rewrap succeeded. Re-encryption cannot take back a value already read, so the report names each item the person could open: rotation_marked_due lists those with a rotation policy, now due with reason recipient <uid> was removed, and rotate_manually lists the rest. Prints ok, uid, fingerprint, items_rewrapped, historical_versions, emergency_grant_cancelled, exposed, rotation_marked_due and rotate_manually; appends the audit operation remove-user.

usage: recipient remove <uid> --yes (exit 2); for a registered uid without --yes: recipient remove would rewrite every item and every saved version without <uid>; nothing was changed. Rerun with --yes to remove <uid>, or revoke single items with `skarbiec revoke <item-id> <uid>`; <uid> is the vault owner; install another owner with rotate-owner first, then remove <uid>; unknown recipient: <uid>; <uid> holds the recovery key; the recovery recipient cannot be removed; <id> uses a legacy envelope; run `skarbiec upgrade --apply` before changing who can read it; and on a replica: this vault replicates bond <name> from <source>; a direct recipient remove here is replaced by the next pull. Write it on the source vault. A refusal leaves the vault file unchanged.