> For the complete documentation index, see [llms.txt](https://docs.devolutions.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.devolutions.net/cli/for-devops-and-administrators/manage/vaults-and-entries.md).

# Manage vaults and entries

Select workspaces and vaults, find entries, read their details, and create, update, organize, and delete vaults and entries with Devolutions CLI.

Use `devo vault` and `devo entry` to look through your workspace and keep it organized from a terminal or a script: pick the vault you work in, find an entry, create one, update it, move it, or delete it. The commands are the same for every workspace type, but each type allows different changes. The table at the end of this page sums them up.

These commands work on the current context. To check which workspace that is, run `devo status`. To use another one for a single command, add `--context <context-name>`. See [Switch between workspaces](/cli/guides/connect/switch-workspaces.md).

## See and select workspaces

`devo workspace list` shows the workspaces you can use, with their name, ID, kind, and whether they're available. The current one is marked with `*`. `devo workspace current` shows only the current one.

On a local Devolutions Remote Desktop Manager profile, you can also select, create, and delete workspaces:

<table><thead><tr><th width="240">TO</th><th>RUN</th></tr></thead><tbody><tr><td>Select the workspace you work in</td><td><code>devo workspace use "&#x3C;workspace-name>"</code><br><br>Use <code>id:&#x3C;workspace-id></code> to select it by ID.</td></tr><tr><td>Create a SQLite workspace</td><td><code>devo workspace create "&#x3C;workspace-name>" --passphrase-file &#x3C;passphrase-file> --yes</code><br><br>The database file is <code>&#x3C;workspace-name>.db</code> in the profile folder, unless you give another file name with <code>--path</code>. The passphrase protects the new workspace; it can also come from an environment variable with <code>--passphrase-env</code>. The new workspace becomes the current one, unless you add <code>--no-set-current</code>.</td></tr><tr><td>Delete a workspace</td><td><code>devo workspace delete id:&#x3C;workspace-id> --yes</code><br><br>Use the exact ID that <code>devo workspace list</code> shows. This deletes the workspace database file, and its temporary files, from the profile folder: it can't be undone. Available on Windows only; on macOS and Linux, the command stops with <code>sqliteWorkspaceDeleteUnsupported</code>.</td></tr></tbody></table>

## Select the vault you work in

Most entry commands use the **current vault**. On Devolutions Cloud and Devolutions Server, a command that reads entries needs one: either a current vault, or `--vault-name` or `--vault-id` on the command.

1. List the vaults you can see:

   ```bash
   devo vault list
   ```
2. Make one of them the current vault:

   ```bash
   devo vault use "<vault-name>"
   ```
3. Check which vault is current:

   ```bash
   devo vault current
   ```

To work in another vault for one command without changing the current one, add `--vault-name "<vault-name>"` or `--vault-id <vault-id>` to that command.

To see the details of one vault, run `devo vault get "<vault-name>"`. On a local profile, `devo vault settings get` shows the root settings of the current vault (or of the vault you name), and `devo vault template list` lists the vault templates.

{% hint style="info" %}
Commands select a vault, entry, user, or group by **name** by default. When two items share a name, or a name is hard to type, select by ID: write `id:<value>` or add `--id`. For example, `devo vault use id:<vault-id>`.
{% endhint %}

## Find entries

Search the current vault, or another one, by text, type, or folder:

```bash
devo entry list "<search-text>" --vault-name "<vault-name>"
```

<table><thead><tr><th width="240">OPTION</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>--type</code></td><td>Keeps only one entry type. <code>devo entry types</code> lists the type identifiers.</td></tr><tr><td><code>--group</code></td><td>Keeps only the entries under a folder path.</td></tr><tr><td><code>--limit</code></td><td>Maximum number of entries returned. The default is <code>100</code>.</td></tr><tr><td><code>--smart-folder</code></td><td>Meant to list the entries of a smart folder, but no workspace type evaluates smart folders: the command stops with <code>smartFolderUnavailable</code>. Filter with <code>--group</code> or <code>--type</code> instead.</td></tr></tbody></table>

To see one entry, use `devo entry get "<entry-name>"`. Neither command shows secret values. To use a secret, find its reference with `devo entry references` and see [Find the reference to a secret](/cli/guides/secrets/find-a-reference.md).

On a local profile, `devo entry sealed list` lists the sealed entries, with the same kind of filters (`--name`, `--type`, `--group`, `--limit`), and `devo entry template list` lists the entry templates.

## Read and change entry details

Besides its secrets, an entry holds details that aren't secret: its host, username, or domain, its attachments, its documentation pages, or its command parameters. These commands read and change them. None of them shows a secret value.

**Read or change one field.** `devo entry field get` returns a single value, which is handy in a script:

```bash
devo entry field get "<entry-name>" host
```

It reads `name`, `type`, `group`, `host`, `username`, `domain`, `port`, or another property of the entry, such as a metadata property. On Devolutions Server, only the ID, name, type, folder, and vault come back: `host` and `username` are empty. See [Entry commands](/cli/reference/commands/entries.md#devo-entry-field-get). To change a field, use `devo entry field set` with the new value in `--value`, or from `--value-env` or `--value-file`:

```bash
devo entry field set "<entry-name>" host --value <new-host> --yes
```

`devo entry field set` changes the same fields as `devo entry update`: `host`, `username`, and `domain` on Devolutions Server and a local profile, and `name` on a local profile only. It refuses `password`: to change a password, use `devo secret set`. See [Update a secret from a script](/cli/guides/secrets/update-a-secret.md).

**Other details of an entry**, on a local profile:

<table><thead><tr><th width="240">TO</th><th>RUN</th></tr></thead><tbody><tr><td>List the metadata fields</td><td><code>devo entry metadata list "&#x3C;entry-name>"</code><br><br>You can also select the entry by its path: <code>path:&#x3C;entry-path></code>.</td></tr><tr><td>List the attachments</td><td><code>devo entry attachment list "&#x3C;entry-name>"</code></td></tr><tr><td>Read a documentation page</td><td><code>devo entry documentation list &#x3C;entry-id></code><br><code>devo entry documentation get &#x3C;entry-id> --title "&#x3C;page-title>"</code><br><br>These commands take the entry ID.</td></tr><tr><td>Rename a documentation page</td><td><code>devo entry documentation update &#x3C;entry-id> --title "&#x3C;page-title>" --new-title "&#x3C;new-title>" --yes</code><br><br>A local profile can't change the content of a page.</td></tr><tr><td>List and change command parameters</td><td><code>devo entry parameter list "&#x3C;entry-name>"</code><br><code>devo entry parameter set "&#x3C;entry-name>" --label "&#x3C;label>" --new-label "&#x3C;new-label>" --yes</code><br><br>Select the parameter by <code>--label</code> or <code>--position</code>. You can change its label (<code>--new-label</code>), its type (<code>--type</code>: <code>Text</code>, <code>Secured</code>, <code>EnvironmentVariable</code>, or <code>Unused</code>), or its default value (<code>--value</code>, <code>--value-env</code>, or <code>--value-file</code>). <code>--include-unused</code> also lists the unused parameter slots.</td></tr><tr><td>List the items of a Password List entry</td><td><code>devo entry password-list list "&#x3C;entry-name>" --name "&#x3C;item-name>"</code><br><br><code>--name</code> filters the items by name. Passwords and sensitive custom fields come back empty.</td></tr></tbody></table>

## Create and update vaults

Creating, renaming, and deleting vaults is available on Devolutions Cloud and Devolutions Server.

1. Create a vault:

   ```bash
   devo vault create "<vault-name>" --description "<description>" --yes
   ```

   To create several vaults at once, use `devo vault create-many "<name-1>" "<name-2>" --yes`. Devolutions CLI reports which ones were created and which ones failed.
2. Rename a vault or change its description:

   ```bash
   devo vault update "<vault-name>" --new-name "<new-name>" --description "<description>" --yes
   ```

## Create and update entries

Creating entries is available on a local Devolutions Remote Desktop Manager profile.

Both commands below write to the local workspace, so they need its passphrase: pass `--passphrase-file <file>` or `--passphrase-env <VARIABLE_NAME>`, or keep it in a `<workspace file>.passphrase` file in the profile folder. Without one, they stop with `missingParameter`.

1. Create the entry. A local profile creates RDP entries only:

   ```bash
   devo entry create "<entry-name>" --host <host> --username <username> --group "<folder>" --passphrase-file <passphrase-file> --yes
   ```

   The entry goes to the default vault: a local profile creates entries there only, and another `--vault-id` stops with `sqliteEntryCreateVaultUnsupported`.
2. Set its password from an environment variable or a file, so the value never appears on the command line:

   ```bash
   devo secret set password "<entry-name>" --value-env <VARIABLE_NAME> --passphrase-file <passphrase-file> --yes
   ```

   See [Update a secret from a script](/cli/guides/secrets/update-a-secret.md).

To change an existing entry, use `devo entry update` with the fields to change:

```bash
devo entry update "<entry-name>" --host <new-host> --username <new-username> --yes
```

What you can change depends on the workspace type:

* **Local profile**: `--new-name`, `--host`, `--username`, and `--domain`. `--host-port` and `--password-secret-reference` are refused.
* **Devolutions Server**: `--host`, `--username`, and `--domain`.
* **Devolutions Cloud**: only the password, with `devo secret set`.

## Organize entries

These commands are available on a local profile.

<table><thead><tr><th width="240">TO</th><th>RUN</th></tr></thead><tbody><tr><td>Move entries to another folder</td><td><code>devo entry move --entry-id &#x3C;entry-id> --destination-group "&#x3C;folder>" --yes</code><br><br>Repeat <code>--entry-id</code> to move several entries. A local profile moves entries within their vault only: a different <code>--to-vault</code> stops with <code>entryMoveCrossVaultUnsupported</code>. An empty <code>--destination-group</code> moves them to the root of the vault.</td></tr><tr><td>Rename a folder</td><td><code>devo entry folder rename "&#x3C;folder-path>" --new-name "&#x3C;new-name>" --yes</code><br><br>The paths of the entries inside the folder are updated too.</td></tr><tr><td>Set the status of an entry</td><td><code>devo entry status set "&#x3C;entry-name>" --status Locked --message "&#x3C;reason>" --yes</code><br><br>Status values: <code>Archived</code>, <code>Broken</code>, <code>Default</code>, <code>Disabled</code>, <code>Expired</code>, <code>Locked</code>, or <code>Warning</code>.<br><br>To select the entry by ID with this command and <code>devo entry tag set</code>, add <code>--id</code>: these two commands don't recognize the <code>id:</code> prefix.</td></tr><tr><td>Replace the tags of an entry</td><td><code>devo entry tag set "&#x3C;entry-name>" --tag &#x3C;tag-1> --tag &#x3C;tag-2> --yes</code><br><br>The tags you pass replace the existing ones. Use <code>--clear</code> to remove them all.</td></tr></tbody></table>

To read them back, use `devo entry status get` and `devo entry tag list`. These two commands stop with `entryFieldNotFound` when the entry has no status or no tags, and always on Devolutions Cloud and Devolutions Server, which don't return them. To see the entries that were deleted, use `devo entry trash list`, with `--before <date>` to see only those deleted before a date.

## Delete entries and vaults

{% hint style="danger" %}
`--yes` is the only confirmation Devolutions CLI asks for. Check the name or ID before you delete anything, especially in a script, and prefer IDs over names.
{% endhint %}

Deleting entries and vaults is available on Devolutions Cloud and Devolutions Server.

**Delete an entry:**

```bash
devo entry delete "<entry-name>" --yes
```

On Devolutions Cloud, deleting an entry also deletes the entries under it. Devolutions CLI refuses to do it until you add `--acknowledge-recursive-scope`, which shows you know.

**Delete a vault:**

```bash
devo vault delete id:<vault-id> --yes
```

On Devolutions Cloud, select the vault by its ID: a vault name or the current vault isn't accepted. The vault goes to the recycle bin, unless you add `--permanently`.

## What each workspace type can do

<table><thead><tr><th width="260">TASK</th><th>LOCAL PROFILE</th><th>DEVOLUTIONS CLOUD</th><th>DEVOLUTIONS SERVER</th></tr></thead><tbody><tr><td>List workspaces, show the current one</td><td>Yes</td><td>Yes</td><td>Yes</td></tr><tr><td>Select, create, and delete workspaces</td><td>Yes</td><td>No</td><td>No</td></tr><tr><td>List and select vaults</td><td>Yes</td><td>Yes</td><td>Yes</td></tr><tr><td>Create, rename, and delete vaults</td><td>No</td><td>Yes</td><td>Yes</td></tr><tr><td>List, search, and get entries</td><td>Yes</td><td>Yes</td><td>Yes</td></tr><tr><td>Create entries</td><td>RDP entries</td><td>No</td><td>No</td></tr><tr><td>Read a field (<code>devo entry field get</code>)</td><td>Yes</td><td>Yes</td><td>ID, name, type, folder, and vault only</td></tr><tr><td>Update entries (<code>devo entry update</code>, <code>devo entry field set</code>)</td><td>Yes*</td><td>No (password with <code>devo secret set</code>)</td><td>Host, username, domain</td></tr><tr><td>Metadata, attachments, documentation, command parameters, Password List items</td><td>Yes*</td><td>No</td><td>No</td></tr><tr><td>Move entries, rename folders</td><td>Yes*</td><td>No</td><td>No</td></tr><tr><td>Read and set status and tags</td><td>Yes*</td><td>No</td><td>No</td></tr><tr><td>Delete entries</td><td>No</td><td>Yes, with <code>--acknowledge-recursive-scope</code></td><td>Yes</td></tr><tr><td>List deleted entries</td><td>Yes</td><td>No</td><td>No</td></tr></tbody></table>

\* When the profile allows it. `devo doctor` lists the operations the selected workspace supports. If a change isn't available on your profile, make it in Devolutions Remote Desktop Manager.

## Good to know

* `--yes` confirms the change. Without it, the command changes nothing and stops with `confirmationRequired`. See [Run without prompts](/cli/for-devops-and-administrators/automate/non-interactive.md).
* Add `--output json` to get a result a script can read. See [Read results as JSON](/cli/for-devops-and-administrators/automate/json-output.md).
* A command stops with `operationNotSupportedBySource` (Devolutions Cloud, Devolutions Server) or another code that says the local profile can't do it? The selected workspace can't make that change. See [A command says the workspace doesn't support it](/cli/help/troubleshooting/not-supported.md).

## Next

* [Manage users, groups, and access](/cli/for-devops-and-administrators/manage/users-and-access.md)
* [Review activity logs](/cli/for-devops-and-administrators/manage/logs.md)
* [Commands](/cli/reference/commands.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.devolutions.net/cli/for-devops-and-administrators/manage/vaults-and-entries.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.