Skip to content

cub user key list

cub user key list

List the public keys registered against an identity

Synopsis

List the public keys an identity can authenticate with.

Keys are shown in full with -o json rather than redacted. They are public material, and a key nobody registered is only noticeable if it is visible.

The Last-Used column is what makes a key safe to retire: a key nothing has used is a key nothing depends on. It is also how an injected key gives itself away, by starting to be used.

Examples: 

  # List the keys a worker can authenticate with
  cub user key list --worker my-worker

  # Full key material, for comparing against what a client holds
  cub user key list --worker my-worker -o json

  # Just the thumbprints, for scripting
  cub user key list --worker my-worker --no-headers -o jq='.[].Kid'

cub user key list [flags]

Options

      --columns strings   columns to display; can be repeated or comma-separated (e.g., Slug,Labels.Environment)
      --contains string   Free text search for entities containing the specified text. Searches across string fields (like Slug, DisplayName) and map fields (like Labels, Annotations). Case-insensitive matching. Can be combined with --where using AND logic. Example: "backend" to find entities with backend in any searchable field
      --filter string     Filter entity to apply to the list. Specify as 'space/filter' for cross-space filters or just 'filter' for current space. Supports both slugs and UUIDs. The filter will be combined with any --where clause using AND logic. Examples: "production-filters/security-check", "my-filter-uuid", "validation-rules"
  -h, --help              help for list
      --no-headers        Don't print headers for table output
  -o, --output string     Output format. One of: json, yaml, name, wide, mutations, jq=<expr>, yq=<expr>, custom-columns=<spec>
      --quiet             No default output.
      --select string     Comma-separated list of fields to retrieve and display. Entity IDs and Slug are always included. Example: "DisplayName,CreatedAt,Labels"
      --verbose           Detailed output, additive with default output
      --where string      Filter expression using SQL-inspired syntax. Supports conjunctions with AND. String operators: =, !=, <, >, <=, >=, LIKE, NOT LIKE, ILIKE, ~~, !~~, ~, ~*, !~, !~*. Pattern matching with LIKE/ILIKE uses % and _ wildcards. Regex operators (~, ~*, !~, !~*) support POSIX regular expressions. A related entity is referenced by prefix, as in "UpstreamUnit.Slug = 'base'"; when the reference names a list, a * segment matches any element, as in "FromLink.*.Slug = 'upgrade-app'". Examples: "Slug LIKE 'app-%'", "DisplayName ILIKE '%backend%'", "Slug ~ '^[a-z]+-[0-9]+$'"

Options inherited from parent commands

      --context string   The context to use for this command
      --debug            Debug output
      --space string     space ID to perform command on
      --user string      identity to manage keys for, by username or UUID
      --worker string    worker whose bot user to manage keys for, by slug or UUID

SEE ALSO

  • cub user key - Manage the public keys registered against an identity