Version: v5.6.1

opschain admin secrets bindings

Included from Basic tiersecrets:multi-vault

Manage the secrets-provider scope bindings that route secret resolution under multi-vault: a binding is a declared scope path → provider mapping — declared and auditable, never inferred — with / binding the estate default, /projects/<code> and /projects/<code>/environments/<code> overriding it down the node tree, the deepest covering scope winning. Unprefixed secret-vault:// references resolve through the binding of the step's node position; the provider-qualified form secret-vault://<code>@<path>/<key> is the explicit cross-provider escape hatch.

Declaring a binding (set) requires the secrets:multi-vault entitlement — the first enabled provider is base platform, multiples and their bindings are the entitled capability. delete is deliberately ungated so a lapsed estate can always unwind. Every write is audited (api:secrets_provider_bindings:*).

Subcommand	Purpose
`list`	Every declared binding with its provider's enabled state and health.
`set <scope-path>`	Declare (or re-point) the binding for a scope path.
`delete <scope-path>`	Remove a binding (the scope falls back to the default).
`resolve <node-path>`	Which provider governs a node path, and which scope decided.

See also​

See also