Version: v5.7.0

opschain admin secrets bindings resolve

Included from Basic tier

Answers resolution provenance for a node path — the node resolving a reference (a step's run target, a refresh task's node, a reveal's owner): which provider governs it and which scope binding decided — the deepest covering scope, or the single-enabled default when nothing binds ("no binding declared"). With several providers enabled and no covering binding (not even /), the verb refuses by name rather than guessing, matching resolution itself.

opschain admin secrets bindings resolve /projects/payments/environments/prod
Provider:  prod-vault (https://prod-bao.corp:8200)
Decided by: binding /projects/payments/environments/prod
Health:     ok

With --origin <node-path> — the node whose properties supplied a value — the answer adds the origin's provider and lays the reference forms side by side, so a property on one node read under another can be checked before a change runs: a bare reference entered in a node's properties and the origin@ form route by the origin; a bare reference committed in the repository, a per-run override and the here@ form route by the resolving node; the provider-qualified form names its own provider.

opschain admin secrets bindings resolve /projects/payments/environments/prod --origin /projects/payments
Provider:  prod-vault (https://prod-bao.corp:8200)
Decided by: binding /projects/payments/environments/prod
Health:     ok

Reference forms for a value supplied by /projects/payments, resolved at /projects/payments/environments/prod:
  secret-vault://<path>/<key> from a database layer  -> payments (binding /projects/payments)
  secret-vault://<path>/<key> from the repository    -> prod-vault (binding /projects/payments/environments/prod)
  secret-vault://origin@<path>/<key>                  -> payments (binding /projects/payments)
  secret-vault://here@<path>/<key>                    -> prod-vault (binding /projects/payments/environments/prod)
  secret-vault://<code>@<path>/<key>                  -> the named provider

Flags

Flag	Meaning
`--origin <node-path>`	The node whose properties supplied the value; adds the origin's provider and the reference forms side by side.
`--server <url>`	Server base URL (default: the active context / `OPSCHAIN_SERVER`).
`--auth-token <token>`	Admin bearer token override (default: your `opschain login` session, then `$OPSCHAIN_ADMIN_TOKEN`, then the token stored by `opschain admin login`).

Flags​

See also​

Flags

See also