Enum Commands 

pub enum Commands {
    Init,
    Set {
        key: String,
        value: Option<String>,
        force: bool,
    },
    Get {
        key: String,
        clipboard: bool,
    },
    List,
    Delete {
        key: String,
        force: bool,
    },
    Run {
        command: Vec<String>,
        clean_env: bool,
        only: Option<Vec<String>>,
        exclude: Option<Vec<String>>,
        redact_output: bool,
        allowed_commands: Option<Vec<String>>,
    },
    RotateKey {
        new_keyfile: Option<String>,
    },
    Export {
        format: String,
        output: Option<String>,
    },
    Import {
        file: String,
        format: Option<String>,
        dry_run: bool,
        skip_existing: bool,
    },
    Auth {
        action: AuthAction,
    },
    Env {
        action: EnvAction,
    },
    Diff {
        target_env: String,
        show_values: bool,
    },
    Edit,
    Version,
    Update,
    Completions {
        shell: String,
    },
    Scan {
        ci: bool,
        dir: Option<String>,
        gitleaks_config: Option<String>,
    },
    Search {
        pattern: String,
    },
    Audit {
        action: Option<AuditAction>,
        last: usize,
        since: Option<String>,
    },
}

All available subcommands.

Variants

Init

Initialize a new vault (auto-imports .env)

Set

Set a secret (add or update)

Fields

key: String

Secret name (e.g. DATABASE_URL)

value: Option<String>

Secret value (omit for interactive prompt)

force: bool

Skip the shell-history warning for inline values

Get

Get a secret’s value

Fields

key: String

Secret name

clipboard: bool

Copy to clipboard (auto-clears after 30 seconds)

List

List all secrets

Delete

Delete a secret

Fields

key: String

Secret name

force: bool

Skip confirmation prompt

Run

Run a command with secrets injected

Fields

command: Vec<String>

Command and arguments (after –)

clean_env: bool

Start with a clean environment (only vault secrets, no inherited vars)

only: Option<Vec<String>>

Only inject these secrets (comma-separated)

exclude: Option<Vec<String>>

Exclude these secrets (comma-separated)

redact_output: bool

Replace secret values in child process output with [REDACTED]

allowed_commands: Option<Vec<String>>

Only allow these commands to run (comma-separated basenames)

RotateKey

Change the vault’s master password

Fields

new_keyfile: Option<String>

Path to a new keyfile (or “none” to remove keyfile requirement)

Export

Export secrets to a file or stdout

Fields

format: String

Output format: env (default) or json

output: Option<String>

Output file path (prints to stdout if omitted)

Import

Import secrets from a file

Fields

file: String

Path to the file to import

format: Option<String>

Import format: env (default) or json (auto-detected from extension)

dry_run: bool

Preview what would be imported without modifying the vault

skip_existing: bool

Skip secrets that already exist in the vault

Auth

Manage authentication methods (keyring, keyfile)

Fields

action: AuthAction

Env

Manage environments (list, clone, delete)

Fields

action: EnvAction

Diff

Compare secrets between two environments

Fields

target_env: String

Target environment to compare against

show_values: bool

Show secret values in diff output

Edit

Open secrets in an editor (decrypts to temp file, re-encrypts on save)

Version

Show version and check for updates

Update

Update envvault to the latest version

Completions

Generate shell completion scripts

Fields

shell: String

Shell to generate completions for (bash, zsh, fish, powershell)

Scan

Scan files for leaked secrets (API keys, tokens, passwords)

Fields

ci: bool

Exit with code 1 if secrets are found (for CI/CD)

dir: Option<String>

Directory to scan (default: current directory)

gitleaks_config: Option<String>

Path to a gitleaks-format TOML config for additional rules

Search

Search secrets by name pattern (supports * and ? wildcards)

Fields

pattern: String

Glob pattern to match (e.g. DB_*, *KEY, API?)

Audit

View, export, or purge the audit log

Fields

action: Option<AuditAction>

Subcommand: export, purge (omit to view entries)

last: usize

Number of entries to show (default: 50)

since: Option<String>

Show entries since a duration ago (e.g. 7d, 24h, 30m)

Trait Implementations

impl FromArgMatches for Commands

fn from_arg_matches(__clap_arg_matches: &ArgMatches) -> Result<Self, Error>

Instantiate Self from ArgMatches, parsing the arguments as needed.

fn from_arg_matches_mut( __clap_arg_matches: &mut ArgMatches, ) -> Result<Self, Error>

Instantiate Self from ArgMatches, parsing the arguments as needed.

fn update_from_arg_matches( &mut self, __clap_arg_matches: &ArgMatches, ) -> Result<(), Error>

Assign values from ArgMatches to self.

fn update_from_arg_matches_mut<'b>( &mut self, __clap_arg_matches: &mut ArgMatches, ) -> Result<(), Error>

Assign values from ArgMatches to self.

impl Subcommand for Commands

fn augment_subcommands<'b>(__clap_app: Command) -> Command

Append to Command so it can instantiate Self via FromArgMatches::from_arg_matches_mut

fn augment_subcommands_for_update<'b>(__clap_app: Command) -> Command

Append to Command so it can instantiate self via FromArgMatches::update_from_arg_matches_mut

fn has_subcommand(__clap_name: &str) -> bool

Test whether Self can parse a specific subcommand