SHOW VAULTS / SHOW CREDENTIALS

Lists vault entries, optionally filtered by entry kind and a LIKE substring on display_name. VAULTS and CREDENTIALS are keyword aliases.

Category: configurationPrivilege: adminDeltaForge extension

Syntax

SHOW { VAULTS | CREDENTIALS }
  [ OF TYPE { ENCRYPTION_KEY | CREDENTIAL } ]
  [ LIKE '<pattern>' ]

Description

## Overview SHOW VAULTS enumerates the vault_entries table. Secret material is never returned. Use DESCRIBE VAULT for per-entry metadata. The VAULTS and CREDENTIALS keywords are interchangeable and return identical results. ## Behavior - Secret material (key bytes, secret_value) is stored in the backing credential store keyed by entry id and is never surfaced by this command. - OF TYPE is applied server-side via a query-string parameter. LIKE is applied client-side on the Control Plane host (case-insensitive substring) for parity with the GUI. - Output lists display_name, entry_type, algorithm, current_version, and storage_backend_name per row. Entries whose storage_backend_id is null are shown as backed by 'os_keychain' (the default). - The v1 output is a plain multi-line text message. Upgrading to Arrow is tracked separately. ## Access Control Requires the admin role. The Control Plane enforces vault:read on GET /vault/entries. ## Compatibility DeltaForge extension. No standard SQL equivalent.

Parameters

Name	Type	Description
`type_filter`		Specifies an optional entry-kind filter. ENCRYPTION_KEY returns only key entries; CREDENTIAL returns only credential entries. Omit to list both.
`like_pattern`		Specifies a case-insensitive substring filter on display_name. Not a standard SQL LIKE; implemented as to_lowercase().contains() for parity with the GUI filter box.

Examples

-- List every vault entry (keys + credentials)
SHOW VAULTS;

-- Same result, alias spelling
SHOW CREDENTIALS;

-- Only encryption keys
SHOW VAULTS OF TYPE ENCRYPTION_KEY;

-- Only credentials (API tokens, passwords, connection secrets)
SHOW CREDENTIALS OF TYPE CREDENTIAL;

-- Narrow by name substring
SHOW VAULTS LIKE 'pii';

-- Combine kind and substring filters
SHOW CREDENTIALS OF TYPE CREDENTIAL LIKE 'api_';

Pitfalls

LIKE is a case-insensitive substring match, not a standard SQL LIKE. The pattern 'api%' is treated literally, not as a prefix match. Drop the wildcards and just supply the substring.
Linked-external entries show the same columns as locally-stored entries but their external_secret_name field (not shown in the summary line) points at a secret in the backend's namespace. Use DESCRIBE VAULT <name> to see the distinction.
The output is not currently an Arrow RecordBatch. SELECT * FROM (SHOW VAULTS) does not work in v1.