cub user key list

cub user key list

List the public keys registered against an identity

Synopsis

List the public keys an identity can authenticate with.

Keys are shown in full with -o json rather than redacted. They are public material, and a key nobody registered is only noticeable if it is visible.

The Last-Used column is what makes a key safe to retire: a key nothing has used is a key nothing depends on. It is also how an injected key gives itself away, by starting to be used.

Examples:

  # List the keys a worker can authenticate with
  cub user key list --worker my-worker

  # Full key material, for comparing against what a client holds
  cub user key list --worker my-worker -o json

  # Just the thumbprints, for scripting
  cub user key list --worker my-worker --no-headers -o jq='.[].Kid'

cub user key list [flags]

Options

      --columns strings               columns to display; can be repeated or comma-separated (e.g., Slug,Labels.Environment)
      --contains string               Free text search for entities containing the specified text. Searches across string fields (like Slug, DisplayName) and map fields (like Labels, Annotations). Case-insensitive matching. Can be combined with --where using AND logic. Example: "backend" to find entities with backend in any searchable field
      --filter string                 Filter entity to apply to the list. Specify as 'space/filter' for cross-space filters or just 'filter' for current space. Supports both slugs and UUIDs. The filter will be combined with any --where clause using AND logic. Examples: "production-filters/security-check", "my-filter-uuid", "validation-rules"
  -h, --help                          help for list
      --include-hidden string[="*"]   Also select hidden entities, to list or to act on: those hidden for the given HiddenReasons, comma-separated, as in --include-hidden=BackingUnit, or for any reason when given no value or "*". ConfigHub/YAML Units, which hold the configuration of other entities, are hidden with the reason BackingUnit. A --where naming entities by Slug or ID selects them whether hidden or not
      --no-headers                    Don't print headers for table output
  -o, --output string                 Output format. One of: json, yaml, name, wide, mutations, jq=<expr>, yq=<expr>, custom-columns=<spec>
      --quiet                         No default output.
      --select string                 Comma-separated list of fields to retrieve and display. Entity IDs and Slug are always included. Example: "DisplayName,CreatedAt,Labels"
      --verbose                       Detailed output, additive with default output
      --where string                  Filter expression using SQL-inspired syntax. Supports conjunctions with AND. String operators: =, !=, <, >, <=, >=, LIKE, NOT LIKE, ILIKE, ~~, !~~, ~, ~*, !~, !~*. Pattern matching with LIKE/ILIKE uses % and _ wildcards. Regex operators (~, ~*, !~, !~*) support POSIX regular expressions. A related entity is referenced by prefix, as in "UpstreamUnit.Slug = 'base'"; when the reference names a list, a * segment matches any element, as in "FromLink.*.Slug = 'upgrade-app'". Examples: "Slug LIKE 'app-%'", "DisplayName ILIKE '%backend%'", "Slug ~ '^[a-z]+-[0-9]+$'"

Options inherited from parent commands

      --component string   the Component of --variant, when that names the variant alone; --variant <component>/<variant> says the same in one flag
      --context string     The context to use for this command
      --debug              Debug output
      --space string       space to operate in, by slug or UUID. Omitted, a list or bulk operation spans the organization and a single entity is named as <space>/<slug>
      --user string        identity to manage keys for, by username or UUID
      --variant string     variant to operate in, as <component>/<variant>, or as <variant> with --component: the space naming that Component whose Variant label is <variant>. The same scope as --space, named by what it is rather than by the space's slug; the two cannot be combined
      --worker string      worker whose bot user to manage keys for, by slug or UUID

SEE ALSO

• cub user key - Manage the public keys registered against an identity