Key Management CLI — Commands Reference

Binary: ankasecure-km
Version: 3.4.1

Every command is ankasecure-km <group> <verb> [options], except init and view-session. No command takes a tenant: the workload's token names it. Path and query parameters are options; a request body comes from --body-file <json> (- reads standard input), with convenience options for the common members, which are set over the file's content. A member the request model does not declare is refused (E_BAD_BODY, naming the member, never its value).

Global options

Listing commands that page accept --page <n> (zero-based), --size <n> and --sort <property[,asc|desc]>.

Exit codes

A usage error prints the usage and sends nothing. A server refusal prints the server's problem type.

Pending quorum approval

A destruction request, and an operation the tenant's quorum policy gates, print on stdout (with --format json):

{"status":"PENDING_APPROVAL","quorumRequestId":"8d2e4f60-1a3b-4c5d-9e7f-0a1b2c3d4e5f","operation":"KEY_MARK_FOR_DESTRUCTION",
 "target":"old-archive-key","requiredApprovals":1,"approvals":0,"expiresAt":"2026-11-09T09:15:00Z"}

and the human-readable lines on stderr, and exit 0. Approval and rejection are made in the Admin Console; quorum-requests reads and cancels the workload's own requests.

init

init authenticates once, then writes the address, the workload id and the credential reference — never a key, token or secret.

view-session

Prints the workload id, the tenant, the token's expiry, its scopes and the endpoint; never the token.

keys

The keystore password is read from standard input to its end (--password-stdin, one trailing newline removed, at most 4,096 bytes) or from the console without echo (--password-prompt), never as an option value, and zeroed after the request.

materials

rotation

destruction

See Key Destruction for the workflow.

quorum-requests

exchange-contexts

exchanges

activate makes every live grant of the exchange authorize; it names no capability. add-grant adds a grant owned by the exchange, in its context: its actor belongs to the origin or destination application, and it names one key or, for REENCRYPT or RESIGN, ordered --pair values.

capability-grants

--context is the grant's exchange context. re-pin pins the grant to a constraint policy version from its next request on; uses made while no limit was pinned do not count toward the new limit.

constraint-policies

internal-crypto-use-cases

create prints the new use case's client secret once, inside credential.clientSecret on stdout, and never writes it to a file or a log. Store it at once. renew extends the use case's validity to one year after the later of now and its current end, and makes an expired use case active again.

directory

CLI Version: 3.4.1
Last updated: 2026-10-26