> For the complete documentation index, see [llms.txt](https://docs.devolutions.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.devolutions.net/cli/reference/commands.md).

# Commands

Every Devolutions CLI command, grouped by top-level command, with the workspace types it supports, and links to the full option reference of each command group.

This page lists every `devo` command, grouped by top-level command, in the order `devo --help` shows them. For step-by-step help, start from the guides; for the options every command accepts, such as `--context` or `--output json`, see [Global options](/cli/reference/global-options.md).

## Every option, by command group

This page gives an overview of each command. Every argument and option, with its default value, allowed values, and the rules Devolutions CLI checks, is on the page of its command group:

* [Sign-in and context commands](/cli/reference/commands/sign-in-and-contexts.md): `login`, `logout`, `status`, `info`, `context`
* [Workspace, vault, and variable commands](/cli/reference/commands/workspaces-vaults-variables.md): `workspace`, `vault`, `variable`
* [Entry commands](/cli/reference/commands/entries.md): `entry`
* [Secret commands](/cli/reference/commands/secrets.md): `secret`, `secretspec`, `generate`
* [MCP, background process, and configuration commands](/cli/reference/commands/mcp-daemon-config.md): `mcp`, `daemon`, `runtime`, `doctor`, `config`
* Administration: [users and groups](/cli/reference/commands/admin-users-and-groups.md), [roles and access](/cli/reference/commands/admin-access-and-roles.md), [settings, licenses, and gateways](/cli/reference/commands/admin-settings-licenses-gateways.md), [logs](/cli/reference/commands/admin-logs.md)

{% hint style="info" %}
To see the built-in help of a command, run `devo <command> --help`, for example `devo secret run --help`.
{% endhint %}

## Conventions

* **Aliases**: `ls` works for every `list` command, and `rm` for most `delete`, `revoke`, and `remove` commands. For example, `devo vault ls` is the same as `devo vault list`.
* **Selecting an item**: commands that take an entry, vault, workspace, user, or group accept its name by default. To pass an ID instead, write `id:<value>` or add `--id`. Some user commands also accept `email:<value>` or `--email`.
* **Confirming a change**: commands that change or delete something refuse to run without `--yes` (aliases `-y` and `--confirmed`). This protects you from running a destructive command by accident in a script.
* **Values from a variable or a file**: passwords, passphrases, API keys, and application secrets are read from an environment variable (`--…-env <variable-name>`) or a file (`--…-file <path>`), so the value never shows up in your shell history. The Devolutions Cloud application key (`--application-key`) is the only one passed as is: it identifies the application, and its secret still comes from a variable or a file.
* **Workspace types**: the commands are the same for Devolutions Cloud, Devolutions Server, and local Devolutions Remote Desktop Manager profiles, but not every workspace type can run every command. The **WORKSPACE** column shows where a command works when it doesn't work everywhere; an empty cell means all three. A command that the selected workspace can't run says so instead of failing silently. See [Compare workspace types](/cli/guides/understand/workspace-types.md).

## Sign in and contexts

<table><thead><tr><th width="260">COMMAND</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>login &#x3C;name></code></td><td>Saves a workspace as a context: signs in to Devolutions Cloud or Devolutions Server, or points at a local Devolutions Remote Desktop Manager profile. The new context becomes the current one, unless you add <code>--no-set-current</code>. See <a href="/cli/guides/connect.md">Connect to your workspaces</a>.</td></tr><tr><td><code>logout [&#x3C;name>]</code></td><td>Clears the stored sign-in of a Devolutions Cloud or Devolutions Server context. Without a name, uses the current context. The context itself is kept.</td></tr><tr><td><code>status [&#x3C;name>]</code></td><td>Shows the selected workspace: its context, its kind, and, for Devolutions Cloud or Devolutions Server, whether you're signed in. Add <code>--online</code> to contact the workspace and check the sign-in.</td></tr><tr><td><code>info [&#x3C;name>]</code></td><td>Shows information about a Devolutions Cloud or Devolutions Server instance, for a context or for a URL given with <code>--cloud &#x3C;url></code> or <code>--server &#x3C;url></code>, without signing in. With Devolutions Server, <code>--private</code> adds private information, using the context's sign-in.</td></tr><tr><td><code>context list</code></td><td>Lists your contexts, of every workspace type.</td></tr><tr><td><code>context use &#x3C;name></code></td><td>Makes a context the current one.</td></tr><tr><td><code>context inspect [&#x3C;name>]</code></td><td>Shows the details of a context. Without a name, shows the current context.</td></tr><tr><td><code>context delete &#x3C;name></code></td><td>Removes a context. Deleting a Devolutions Cloud or Devolutions Server context also discards its stored session, and needs <code>--yes</code>.</td></tr></tbody></table>

### Options of `devo login`

Pick the options that match your workspace type and sign-in method. See [Sign in to Devolutions Cloud](/cli/guides/connect/devolutions-cloud.md), [Sign in to Devolutions Server](/cli/guides/connect/devolutions-server.md), and [Use a local Devolutions Remote Desktop Manager profile](/cli/guides/connect/local-profile.md).

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;name></code></td><td></td><td>Name of the context to create. Required.</td></tr><tr><td><code>--cloud &#x3C;url></code></td><td></td><td>Devolutions Cloud URL, for example <code>https://example.devolutions.app</code>.</td></tr><tr><td><code>--server &#x3C;url></code></td><td></td><td>Devolutions Server URL.</td></tr><tr><td><code>--sqlite &#x3C;folder></code></td><td></td><td>Folder of the local Devolutions Remote Desktop Manager profile that holds the SQLite workspace.</td></tr><tr><td><code>--oauth</code></td><td>Off</td><td>Signs in through your browser. Uses a local browser redirect, unless you add <code>--use-device-code</code>.</td></tr><tr><td><code>--use-device-code</code></td><td>Off</td><td>With <code>--oauth</code>, signs in with a device code instead of the local browser redirect, for a computer without a browser. With Devolutions Cloud, a device-code sign-in gets no account key, so only <code>status</code> and <code>logout</code> work: sign in without <code>--use-device-code</code> for full access.</td></tr><tr><td><code>--application-key &#x3C;key></code> (<code>--app-key</code>)</td><td></td><td>Devolutions Cloud application key. Not used with <code>--oauth</code>.</td></tr><tr><td><code>--application-secret-env &#x3C;variable></code> (<code>--app-secret-env</code>)</td><td></td><td>Environment variable that holds the Devolutions Cloud application secret.</td></tr><tr><td><code>--application-secret-file &#x3C;path></code> (<code>--app-secret-file</code>)</td><td></td><td>File that holds the Devolutions Cloud application secret.</td></tr><tr><td><code>--api-key-env &#x3C;variable></code></td><td></td><td>Environment variable that holds the Devolutions Server API key.</td></tr><tr><td><code>--api-key-file &#x3C;path></code></td><td></td><td>File that holds the Devolutions Server API key.</td></tr><tr><td><code>--username &#x3C;username></code></td><td></td><td>Devolutions Server username, for username and password sign-in.</td></tr><tr><td><code>--password-env &#x3C;variable></code></td><td></td><td>Environment variable that holds the Devolutions Server password.</td></tr><tr><td><code>--password-file &#x3C;path></code></td><td></td><td>File that holds the Devolutions Server password.</td></tr><tr><td><code>--windows-auth</code></td><td>Off</td><td>Signs in to Devolutions Server with Windows authentication.</td></tr><tr><td><code>--as-application</code></td><td>Off</td><td>Signs in to Devolutions Server as an application user.</td></tr><tr><td><code>--domain-id &#x3C;id></code></td><td></td><td>Devolutions Server domain ID, for domain authentication.</td></tr><tr><td><code>--timeout &#x3C;seconds></code></td><td><code>15</code></td><td>Request timeout, from 3 to 600 seconds.</td></tr><tr><td><code>--no-set-current</code></td><td>Off</td><td>Saves the context without making it the current one.</td></tr><tr><td><code>--workspace &#x3C;name></code></td><td></td><td>Local profile only: default workspace hint, for people and agents.</td></tr><tr><td><code>--vault &#x3C;name></code></td><td></td><td>Local profile only: default vault hint, for people and agents.</td></tr><tr><td><code>--description &#x3C;text></code></td><td></td><td>Local profile only: description of the context.</td></tr><tr><td><code>--replace</code></td><td>Off</td><td>Local profile only: replaces an existing context with the same name.</td></tr></tbody></table>

### Options of the `devo context` commands

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>context delete --kind &#x3C;kind></code></td><td></td><td>Kind of context to delete, when the same name exists for more than one kind.</td></tr><tr><td><code>context delete --yes</code></td><td>Off</td><td>Confirms deleting a Devolutions Cloud or Devolutions Server context.</td></tr></tbody></table>

`context list`, `context use`, and `context inspect` have no options of their own. To use another context for a single command, add the global option `--context <name>`. See [Switch between workspaces](/cli/guides/connect/switch-workspaces.md).

## Workspaces

`devo workspace` lists, selects, creates, and deletes workspaces. Creating and deleting work on the workspaces of a local Devolutions Remote Desktop Manager profile.

<table><thead><tr><th width="260">COMMAND</th><th>WHAT IT DOES</th><th width="170">WORKSPACE</th></tr></thead><tbody><tr><td><code>workspace list</code></td><td>Lists the workspaces.</td><td></td></tr><tr><td><code>workspace current</code></td><td>Shows the current workspace.</td><td></td></tr><tr><td><code>workspace use &#x3C;workspace></code></td><td>Makes a workspace the current one, by name or ID.</td><td>Local profile</td></tr><tr><td><code>workspace create &#x3C;name></code></td><td>Creates a workspace. <code>--kind</code> defaults to <code>sqlite</code>. For a local SQLite workspace, <code>--path</code> is the database file name in the profile folder (default <code>&#x3C;name>.db</code>), and <code>--passphrase-env</code> or <code>--passphrase-file</code> sets the passphrase that protects it. The new workspace becomes the current one, unless you add <code>--no-set-current</code>.</td><td>Local profile</td></tr><tr><td><code>workspace delete &#x3C;workspace></code></td><td>Removes a workspace.</td><td>Local profile</td></tr><tr><td><code>workspace variable list [&#x3C;name>]</code></td><td>Lists the custom variables of the current workspace. The name filter accepts <code>*</code> and <code>?</code>.</td><td>Local profile</td></tr><tr><td><code>workspace variable set &#x3C;name></code></td><td>Creates or updates a custom variable, with its value from <code>--value-env</code> or <code>--value-file</code>. The <code>$</code> delimiters around the name are optional.</td><td>Local profile</td></tr><tr><td><code>workspace variable delete &#x3C;name>…</code></td><td>Deletes custom variables.</td><td>Local profile</td></tr></tbody></table>

## Vaults

<table><thead><tr><th width="260">COMMAND</th><th>WHAT IT DOES</th><th width="170">WORKSPACE</th></tr></thead><tbody><tr><td><code>vault list [&#x3C;vault>]</code></td><td>Lists the vaults.</td><td></td></tr><tr><td><code>vault get &#x3C;vault></code></td><td>Shows one vault, by name or ID.</td><td></td></tr><tr><td><code>vault current</code></td><td>Shows the current vault.</td><td></td></tr><tr><td><code>vault use &#x3C;vault></code></td><td>Makes a vault the current one, by name or ID.</td><td></td></tr><tr><td><code>vault create &#x3C;name></code></td><td>Creates a vault, with an optional <code>--description</code>.</td><td>Devolutions Cloud, Devolutions Server</td></tr><tr><td><code>vault create-many &#x3C;name>…</code></td><td>Creates several vaults at once, with the same optional <code>--description</code>.</td><td>Devolutions Cloud, Devolutions Server</td></tr><tr><td><code>vault update &#x3C;vault></code></td><td>Renames a vault (<code>--new-name</code>) or changes its description (<code>--description</code>).</td><td>Devolutions Cloud, Devolutions Server</td></tr><tr><td><code>vault delete &#x3C;vault></code></td><td>Deletes a vault. With Devolutions Cloud, <code>--permanently</code> deletes it instead of moving it to the recycle bin.</td><td>Devolutions Cloud, Devolutions Server</td></tr><tr><td><code>vault settings get [&#x3C;vault>]</code></td><td>Shows the root settings of the current or selected vault.</td><td>Local profile</td></tr><tr><td><code>vault template list</code></td><td>Lists the vault templates.</td><td>Local profile</td></tr><tr><td><code>vault access list &#x3C;vault></code></td><td>Lists the users and groups that have access to a vault. Filter with <code>--user</code> or <code>--group</code>.</td><td>Devolutions Cloud</td></tr><tr><td><code>vault access grant &#x3C;vault></code></td><td>Gives one user (<code>--user</code>) or one group (<code>--group</code>) a role on a vault (<code>--role</code>): <code>Restricted</code>, <code>Readers</code>, <code>PrivilegedReaders</code>, <code>Operators</code>, <code>PrivilegedOperators</code>, <code>Contributors</code>, or <code>VaultOwners</code>.</td><td>Devolutions Cloud</td></tr><tr><td><code>vault access revoke &#x3C;vault></code></td><td>Removes the access of one user (<code>--user</code>) or one group (<code>--group</code>) to a vault.</td><td>Devolutions Cloud</td></tr><tr><td><code>vault variable list [&#x3C;name>]</code></td><td>Lists the custom variables of the current vault, or of the vault given with <code>--vault</code>.</td><td>Local profile</td></tr><tr><td><code>vault variable set &#x3C;name></code></td><td>Creates or updates a vault custom variable, with its value from <code>--value-env</code> or <code>--value-file</code>.</td><td>Local profile</td></tr><tr><td><code>vault variable delete &#x3C;name>…</code></td><td>Deletes vault custom variables.</td><td>Local profile</td></tr></tbody></table>

## Entries

To work in another vault without changing the current one, most entry commands accept `--vault-name` or `--vault-id`. `entry update`, `entry field set`, `entry status set`, and `entry tag set` accept only `--vault-id`, `entry move` uses `--to-vault` for the destination, and the `entry documentation` commands take the entry ID.

<table><thead><tr><th width="260">COMMAND</th><th>WHAT IT DOES</th><th width="170">WORKSPACE</th></tr></thead><tbody><tr><td><code>entry list [&#x3C;query>]</code></td><td>Lists and searches entries. Filter with <code>--group</code> or <code>--type</code>. <code>--smart-folder</code> isn't evaluated by any workspace type. <code>--limit</code> defaults to <code>100</code>.</td><td></td></tr><tr><td><code>entry get &#x3C;entry></code></td><td>Shows one entry, by name or ID.</td><td></td></tr><tr><td><code>entry references &#x3C;entry></code></td><td>Lists the <code>devo://</code> references of an entry's fields, ready to copy, without any value. See <a href="/cli/guides/secrets/find-a-reference.md">Find the reference to a secret</a>.</td><td></td></tr><tr><td><code>entry types [&#x3C;query>]</code></td><td>Lists common entry type identifiers, for scripts.</td><td></td></tr><tr><td><code>entry create &#x3C;name></code></td><td>Creates an RDP entry (<code>--type</code> <code>RDPConfigured</code>, the default), with <code>--host</code>, <code>--username</code>, and <code>--group</code>. A local profile refuses <code>--password-secret-reference</code> and <code>--vault-name</code>.</td><td>Local profile</td></tr><tr><td><code>entry update &#x3C;entry></code></td><td>Changes an entry's host (<code>--host</code>), username (<code>--username</code>), or domain (<code>--domain</code>). A local profile also accepts a new name (<code>--new-name</code>). <code>--host-port</code> and <code>--password-secret-reference</code> are refused. To change a password, use <code>secret set</code>.</td><td>Devolutions Server, local profile</td></tr><tr><td><code>entry delete &#x3C;entry></code></td><td>Deletes an entry. With Devolutions Cloud, deleting an entry also deletes what's under it: add <code>--acknowledge-recursive-scope</code> to accept it.</td><td>Devolutions Cloud, Devolutions Server</td></tr><tr><td><code>entry move</code></td><td>Moves entries (<code>--entry-id</code>, repeatable) to a group (<code>--destination-group</code>; an empty value is the vault root). Entries stay in their vault: a local profile refuses a move to another vault.</td><td>Local profile</td></tr><tr><td><code>entry field get &#x3C;entry> &#x3C;field></code></td><td>Shows a field that isn't secret, such as <code>name</code>, <code>host</code>, <code>username</code>, <code>domain</code>, <code>port</code>, or a metadata property. Devolutions Server returns only the ID, name, type, folder, and vault.</td><td></td></tr><tr><td><code>entry field set &#x3C;entry> &#x3C;field></code></td><td>Changes a field that isn't secret: <code>host</code>, <code>username</code>, or <code>domain</code>, and <code>name</code> on a local profile. To change a password, use <code>secret set</code>.</td><td>Devolutions Server, local profile</td></tr><tr><td><code>entry status get &#x3C;entry></code></td><td>Shows an entry's status.</td><td>Local profile</td></tr><tr><td><code>entry status set &#x3C;entry></code></td><td>Sets an entry's status (<code>--status</code>): <code>Archived</code>, <code>Broken</code>, <code>Default</code>, <code>Disabled</code>, <code>Expired</code>, <code>Locked</code>, or <code>Warning</code>, with an optional <code>--message</code>.</td><td>Local profile</td></tr><tr><td><code>entry tag list &#x3C;entry></code></td><td>Lists the tags assigned directly to an entry.</td><td>Local profile</td></tr><tr><td><code>entry tag set &#x3C;entry></code></td><td>Replaces an entry's tags (<code>--tag</code>, repeatable), or removes them all (<code>--clear</code>).</td><td>Local profile</td></tr><tr><td><code>entry parameter list &#x3C;entry></code></td><td>Lists an entry's command parameters.</td><td>Local profile</td></tr><tr><td><code>entry parameter set &#x3C;entry></code></td><td>Changes a command parameter: label, type (<code>Text</code>, <code>Secured</code>, <code>EnvironmentVariable</code>, or <code>Unused</code>), or default value.</td><td>Local profile</td></tr><tr><td><code>entry metadata list &#x3C;entry></code></td><td>Lists an entry's metadata fields. The entry can also be selected by path (<code>path:&#x3C;value></code> or <code>--path</code>).</td><td>Local profile</td></tr><tr><td><code>entry password-list list &#x3C;entry></code></td><td>Lists the items of a Password List entry. <code>--name</code> filters them and accepts <code>*</code>.</td><td>Local profile</td></tr><tr><td><code>entry permission get &#x3C;entry></code></td><td>Shows the permissions set directly on an entry, optionally for one right (<code>--right</code>), such as <code>View</code>, <code>ViewPassword</code>, <code>Edit</code>, <code>EditSecurity</code>, or <code>Execute</code>.</td><td>Devolutions Cloud, local profile</td></tr><tr><td><code>entry access list</code>, <code>get</code>, <code>grant</code>, <code>revoke</code></td><td>Lists, shows, gives, or removes the role of a user or group on an entry (<code>--vault-id</code> and <code>--entry-id</code>).</td><td>Devolutions Cloud</td></tr><tr><td><code>entry documentation list &#x3C;entry-id></code></td><td>Lists the documentation pages of an entry.</td><td>Local profile</td></tr><tr><td><code>entry documentation get &#x3C;entry-id></code></td><td>Shows one documentation page (<code>--title</code>).</td><td>Local profile</td></tr><tr><td><code>entry documentation update &#x3C;entry-id></code></td><td>Renames a documentation page (<code>--new-title</code>). A local profile can't change the content of a page.</td><td>Local profile</td></tr><tr><td><code>entry attachment list &#x3C;entry></code></td><td>Lists an entry's attachments.</td><td>Local profile</td></tr><tr><td><code>entry logs &#x3C;entry></code></td><td>Lists an entry's activity logs, optionally between <code>--start-date</code> and <code>--end-date</code>. <code>--limit</code> defaults to <code>100</code>.</td><td>Local profile</td></tr><tr><td><code>entry sealed list</code></td><td>Lists sealed entries. <code>--limit</code> defaults to <code>100</code>.</td><td>Local profile</td></tr><tr><td><code>entry trash list [&#x3C;entry>]</code></td><td>Lists deleted entries that can still be restored. <code>--limit</code> defaults to <code>1000</code>.</td><td>Local profile</td></tr><tr><td><code>entry folder rename &#x3C;path></code></td><td>Renames a folder entry (<code>--new-name</code>) and updates the path of everything in it.</td><td>Local profile</td></tr><tr><td><code>entry template list [&#x3C;template>]</code></td><td>Lists entry templates, optionally by destination (<code>--destination</code>: <code>local</code>, <code>shared</code>, <code>database</code>, or <code>both</code>) or entry type.</td><td>Local profile</td></tr></tbody></table>

## Secrets

`devo secret` reads, injects, and runs with `devo://` references. Not sure which command to use? See [Use secrets without exposing them](/cli/guides/secrets.md).

<table><thead><tr><th width="260">COMMAND</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>secret run -- &#x3C;command></code></td><td>Runs a command with references resolved into its environment only. Resolved values are hidden in what the command prints. See <a href="/cli/guides/secrets/run-with-secrets.md">Run a command with its secrets</a>.</td></tr><tr><td><code>secret read &#x3C;reference></code></td><td>Reads one reference and writes the value to the terminal or a file.</td></tr><tr><td><code>secret get &#x3C;field> &#x3C;entry></code></td><td>Reads one field of an entry, by entry name or ID, without writing a reference.</td></tr><tr><td><code>secret inject</code></td><td>Replaces the references in a text, from standard input or a file, with their values. See <a href="/cli/guides/secrets/fill-a-template.md">Fill a configuration file from a template</a>.</td></tr><tr><td><code>secret set &#x3C;field> &#x3C;entry></code></td><td>Writes one secret field from an environment variable or a file. Devolutions Server can write any entry data property; the other workspace types write <code>password</code>. See <a href="/cli/guides/secrets/update-a-secret.md">Update a secret from a script</a>.</td></tr><tr><td><code>secret shell enter</code></td><td>Prints shell code that loads references into your current Bash or PowerShell session. See <a href="/cli/guides/secrets/current-shell.md">Use secrets in your current shell</a>.</td></tr><tr><td><code>secret shell leave</code></td><td>Prints shell code that undoes the last <code>secret shell enter</code>.</td></tr><tr><td><code>secret shell status</code></td><td>Shows the secrets loaded in the current shell by <code>secret shell enter</code>, without their values.</td></tr><tr><td><code>secret catalog entry &#x3C;entry></code></td><td>Same as <code>entry references</code>: lists the <code>devo://</code> references of an entry's fields, without any value.</td></tr><tr><td><code>secret capabilities</code></td><td>Describes, for each workspace type, what the secret commands support. No value is returned.</td></tr></tbody></table>

{% hint style="warning" %}
`secret read`, `secret get`, `secret inject`, and `secret shell enter` hand the value over to you: it appears in the terminal, in a file, or in your shell session. `secret run` is the only command that keeps it out of your terminal. See [What stays hidden, and what doesn't](/cli/guides/understand/security-model.md).
{% endhint %}

### Options of `devo secret run`

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>-- &#x3C;command> [&#x3C;arguments>]</code></td><td></td><td>The command to run and its arguments, after <code>--</code>. References written as arguments are refused: pass them with <code>--env-ref</code>, <code>--stdin-reference</code>, or <code>--manifest</code>.</td></tr><tr><td><code>--env-ref &#x3C;NAME>=&#x3C;reference></code></td><td></td><td>Puts the value of a reference in the environment variable <code>NAME</code> of the command. Repeat for several variables.</td></tr><tr><td><code>--env-file &#x3C;path></code></td><td></td><td>Environment file of <code>KEY=value</code> lines. Values can be references. See <a href="/cli/guides/secrets/replace-env-files.md">Take the passwords out of a .env file</a>.</td></tr><tr><td><code>--stdin-reference &#x3C;reference></code></td><td></td><td>Reference whose value is written, exactly, to the command's standard input. Named and canonical references both work.</td></tr><tr><td><code>--manifest &#x3C;path></code></td><td></td><td>Launch manifest: a versioned JSON file that holds the command and its references.</td></tr><tr><td><code>--timeout-seconds &#x3C;seconds></code></td><td>None</td><td>Maximum run time of the command. When it's exceeded, the command is stopped and <code>devo</code> exits with code <code>124</code>.</td></tr><tr><td><code>--receipt-file &#x3C;path></code></td><td></td><td>Writes a receipt of the launch, a JSON file without any value.</td></tr><tr><td><code>--check</code></td><td>Off</td><td>Checks that the command exists and that the references are well formed, without reading any secret or starting the command. On a local profile, and for a named reference, it also checks that the vault and the entry exist; on Devolutions Cloud and Devolutions Server, a canonical reference isn't looked up.</td></tr><tr><td><code>--dry-run</code></td><td>Off</td><td>Checks the launch plan without reading any secret or starting the command.</td></tr><tr><td><code>--no-masking</code></td><td>Off</td><td>Stops replacing resolved values with <code>&#x3C;concealed by Devolutions></code> in what the command prints.</td></tr></tbody></table>

### Options of `devo secret read` and `devo secret get`

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;reference></code> (<code>read</code>)</td><td></td><td>The reference to read, such as <code>devo://&#x3C;workspace>/&#x3C;vault>/&#x3C;entry>/password</code>. See <a href="/cli/reference/secret-references.md">Secret reference syntax</a>.</td></tr><tr><td><code>&#x3C;field> &#x3C;entry></code> (<code>get</code>)</td><td></td><td>The field, such as <code>password</code>, <code>username</code>, <code>domain</code>, <code>host</code>, <code>otp</code>, or <code>privatekey</code>, then the entry name, or its ID with <code>id:&#x3C;value></code> or <code>--id</code>. Devolutions Server reads any entry data property.</td></tr><tr><td><code>--attribute &#x3C;attribute></code> (<code>--attr</code>)</td><td></td><td>What to read about the field: <code>value</code>, <code>type</code>, <code>id</code>, <code>title</code>, or <code>purpose</code>. Without this option, the reference's own <code>?attribute=</code> applies, or <code>value</code>. See <a href="/cli/reference/secret-references.md#attributes">Attributes</a>.</td></tr><tr><td><code>--out-file &#x3C;path></code> (<code>-f</code>)</td><td></td><td>Writes the value to a file instead of the terminal.</td></tr><tr><td><code>--force</code></td><td>Off</td><td>Overwrites the <code>--out-file</code> file if it exists.</td></tr><tr><td><code>--raw</code></td><td>Off</td><td>Writes exactly the value to standard output, without a line break at the end.</td></tr><tr><td><code>--workspace</code>, <code>--vault</code>, <code>--vault-id</code> (<code>get</code>)</td><td>Current</td><td>Workspace and vault (name or ID) of the entry.</td></tr><tr><td><code>--section &#x3C;section></code> (<code>get</code>)</td><td></td><td>Section of the field, when the field is in a section.</td></tr><tr><td><code>--passphrase-env</code>, <code>--passphrase-file</code> (<code>get</code>)</td><td></td><td>Local profile only: the passphrase of a protected workspace, from an environment variable or a private file.</td></tr></tbody></table>

### Options of the other `devo secret` commands

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>inject --in-file &#x3C;path></code> (<code>-i</code>)</td><td>Standard input</td><td>Template to read.</td></tr><tr><td><code>inject --out-file &#x3C;path></code> (<code>-f</code>)</td><td>Standard output</td><td>File to write.</td></tr><tr><td><code>inject --force</code></td><td>Off</td><td>Overwrites the <code>--out-file</code> file if it exists.</td></tr><tr><td><code>set --value-env &#x3C;variable></code></td><td></td><td>Environment variable that holds the new value.</td></tr><tr><td><code>set --value-file &#x3C;path></code></td><td></td><td>File that holds the new value.</td></tr><tr><td><code>set --vault-id &#x3C;id></code></td><td></td><td>Vault of the entry.</td></tr><tr><td><code>set --passphrase-env &#x3C;variable></code></td><td></td><td>Local profile only: environment variable that holds the passphrase of a protected workspace.</td></tr><tr><td><code>set --passphrase-file &#x3C;path></code></td><td><code>&#x3C;workspace file>.passphrase</code></td><td>Local profile only: private file that holds the passphrase of a protected workspace.</td></tr><tr><td><code>set --yes</code></td><td>Off</td><td>Confirms the change. Required.</td></tr><tr><td><code>shell enter --shell &#x3C;shell></code></td><td></td><td>Shell to write code for: <code>bash</code> or <code>pwsh</code>. Required, also for <code>leave</code> and <code>status</code>.</td></tr><tr><td><code>shell enter --env-ref &#x3C;NAME>=&#x3C;reference></code></td><td></td><td>Variable to load and its reference. Repeat for several variables.</td></tr><tr><td><code>shell enter --check</code></td><td>Off</td><td>Checks the references, as <code>secret run --check</code> does, without reading any secret or writing shell code. Needs <code>--output json</code>.</td></tr><tr><td><code>catalog entry --vault-name</code>, <code>--vault-id</code>, <code>--id</code></td><td></td><td>Selects the vault and the entry.</td></tr></tbody></table>

## SecretSpec

`devo secretspec` lets SecretSpec read and write secrets through Devolutions CLI. See [Use Devolutions CLI with SecretSpec](/cli/guides/secrets/secretspec.md).

<table><thead><tr><th width="260">COMMAND</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>secretspec register</code></td><td>Registers this <code>devo</code> as the SecretSpec provider for <code>devo://</code> URIs, by writing a <code>devo.secretspec.json</code> claim for the current user. <code>--system</code> writes the claim for every user of the computer, which usually needs administrator rights. <code>--environment</code> (<code>--env</code>) adds a variable, or a prefix such as <code>DEVO_*</code>, that SecretSpec may pass to Devolutions CLI; <code>RDM_CONFIG_PATH</code> and <code>DEVO_CLI_CONFIG_HOME</code> are always included. <code>--dry-run</code> shows the claim without writing it.</td></tr><tr><td><code>secretspec uri</code></td><td>Prints the provider URI to put in <code>secretspec.toml</code> for the selected workspace. <code>--vault-id</code> sets a default vault. For a local profile, <code>--workspace-id</code> is required, such as <code>sqlite:Connections.db</code>.</td></tr><tr><td><code>secretspec status</code></td><td>Shows the user and system claims for <code>devo://</code>, and whether they point at this <code>devo</code>.</td></tr><tr><td><code>secretspec unregister</code></td><td>Removes the claim, so SecretSpec no longer starts Devolutions CLI. <code>--system</code> removes the machine-wide claim.</td></tr><tr><td><code>secretspec provider</code></td><td>Serves the SecretSpec provider protocol over standard input and output. SecretSpec starts it on its own; you don't run it yourself.</td></tr></tbody></table>

## Generate passwords and keys

`devo generate` works on your computer only: it doesn't contact any workspace or start the background process. See [Generate passwords and SSH keys](/cli/guides/generate.md).

<table><thead><tr><th width="260">COMMAND</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>generate password</code></td><td>Generates a strong random password. <code>--length</code> sets its length, from 8 to 4096; 32 by default.</td></tr><tr><td><code>generate human-readable</code></td><td>Generates a password that's easy to read: <code>--syllables</code> (default <code>4</code>), then <code>--numerics</code> digits (default <code>1</code>) and <code>--symbols</code> (default <code>1</code>).</td></tr><tr><td><code>generate passphrase</code></td><td>Generates a passphrase: <code>--words</code> (default <code>5</code>), <code>--separator</code> (default <code>-</code>), <code>--dictionary</code> <code>English</code> (default), <code>French</code>, or <code>German</code>.</td></tr><tr><td><code>generate pattern &#x3C;pattern></code></td><td>Generates a password from a pattern: <code>u</code> uppercase, <code>l</code> lowercase, <code>d</code> digit, <code>s</code> symbol, <code>x</code> any. <code>--shuffle</code> mixes the characters.</td></tr><tr><td><code>generate ssh-key</code></td><td>Generates an SSH key pair in <code>--out-file</code>, with the public key in <code>&#x3C;out-file>.pub</code> unless you set <code>--public-out-file</code>. <code>--algorithm</code> is <code>rsa</code>; <code>--bits</code> is <code>2048</code>, <code>3072</code> (default), or <code>4096</code>. Protect the private key with <code>--passphrase-env</code> or <code>--passphrase-file</code>.</td></tr></tbody></table>

## Custom variables

<table><thead><tr><th width="260">COMMAND</th><th>WHAT IT DOES</th><th width="170">WORKSPACE</th></tr></thead><tbody><tr><td><code>variable export</code></td><td>Exports custom variables to a JSON file (<code>--out-file</code>, required; <code>--force</code> overwrites an existing file). <code>--scope</code> is required: <code>workspace</code>, <code>vault</code>, <code>user-vault</code>, or <code>option</code>. <code>--vault</code> selects the vault by name, or by ID with <code>id:&#x3C;value></code> or <code>--id</code>. <code>--name</code> filters the variables and accepts <code>*</code> and <code>?</code>.</td><td>Local profile</td></tr></tbody></table>

`variable export` is the only `devo variable` command. To list, create, or delete custom variables, use `devo workspace variable` and `devo vault variable`.

## MCP server

`devo mcp` runs Devolutions CLI as an MCP server over standard input and output, for an AI client such as Claude Code or GitHub Copilot. See [Connect an AI client with MCP](/cli/guides/ai-agents/connect-mcp.md).

<table><thead><tr><th width="260">COMMAND</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>mcp</code></td><td>Starts the MCP server in this <code>devo</code> process. Your AI client starts it for you.</td></tr><tr><td><code>mcp catalog</code></td><td>Prints the tools that match the same options, without starting the MCP server. The catalog leaves out the tools that return secret values, which <code>devo mcp</code> offers to the AI client that starts it.</td></tr></tbody></table>

### Options of `devo mcp` and `devo mcp catalog`

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>--read-only</code></td><td>Off</td><td>Offers only the tools that don't change anything.</td></tr><tr><td><code>--deny-destructive</code></td><td>Off</td><td>Hides the tools marked as destructive.</td></tr><tr><td><code>--deny-open-world</code></td><td>Off</td><td>Hides the tools that can reach external hosts or networks.</td></tr><tr><td><code>--allow-tool &#x3C;tool></code></td><td></td><td>Offers only the named tool. Repeat for several tools.</td></tr><tr><td><code>--deny-tool &#x3C;tool></code></td><td></td><td>Hides the named tool. Repeat for several tools.</td></tr><tr><td><code>--server-name &#x3C;name></code> (<code>mcp</code> only)</td><td><code>Remote Desktop Manager Devo CLI MCP Server</code></td><td>Name the server gives the AI client when it connects.</td></tr></tbody></table>

{% hint style="warning" %}
`--read-only` hides the tools that change data, not the tools that read secrets. A read-only MCP server can still return a secret value to the model. See [Limit what an agent can do](/cli/guides/ai-agents/limit-tools.md).
{% endhint %}

## Background process

To stay fast, `devo` runs a background process under your user account. You don't need these commands for daily use. See [How Devolutions CLI works](/cli/guides/understand/how-it-works.md#the-background-process) and [The background process won't start](/cli/help/troubleshooting/daemon-wont-start.md).

<table><thead><tr><th width="260">COMMAND</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>daemon status</code></td><td>Shows the status of the background process. <code>--session-id</code> selects another one.</td></tr><tr><td><code>daemon start</code></td><td>Starts the background process. It stops after 60 minutes without requests, unless you set <code>--idle-timeout</code> (such as <code>30s</code>, <code>15m</code>, or <code>1h</code>) or <code>--no-idle-timeout</code>. <code>--foreground</code> runs it in the current terminal. <code>--pipe-name</code> defaults to <code>devo</code>.</td></tr><tr><td><code>daemon ensure</code></td><td>Starts the background process if needed, or repairs it, and shows its status.</td></tr><tr><td><code>daemon stop</code></td><td>Stops the background process. <code>--wait</code> waits until it has stopped.</td></tr><tr><td><code>daemon restart</code></td><td>Restarts the background process. <code>--session-id</code> selects which one, and <code>--wait</code> waits until the previous one has stopped. It keeps its idle timeout and profile folder unless you set <code>--idle-timeout</code>, <code>--no-idle-timeout</code>, or <code>--config-root</code>.</td></tr><tr><td><code>daemon sessions</code></td><td>Lists the background processes registered for your user account. <code>--details</code> adds their status and runtime information.</td></tr><tr><td><code>daemon profile start</code>, <code>status</code>, <code>stop</code></td><td>Records the time spent on each request to the background process, for troubleshooting. <code>--out-file</code> writes one line per request to a <code>.jsonl</code> file.</td></tr><tr><td><code>runtime status</code></td><td>Shows the status of the workspace runtime loaded by the background process.</td></tr><tr><td><code>runtime reload</code></td><td>Reloads the workspace runtime of the background process.</td></tr></tbody></table>

## Diagnostics and configuration

<table><thead><tr><th width="260">COMMAND</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>doctor</code></td><td>Shows a diagnostics snapshot of Devolutions CLI. See <a href="/cli/help/troubleshooting/collect-diagnostics.md">Collect diagnostics for support</a>.</td></tr><tr><td><code>config path</code></td><td>Prints the folder of the local Devolutions Remote Desktop Manager profile that Devolutions CLI uses, without starting the background process.</td></tr><tr><td><code>config export</code></td><td>Exports the local Devolutions CLI configuration (contexts and tooling information) to a <code>.json</code> file (<code>--out-file</code>). <code>--no-contexts</code> and <code>--no-tooling</code> leave parts out. Needs <code>--yes</code>.</td></tr><tr><td><code>config telemetry get</code></td><td>Shows the telemetry preference. See <a href="/cli/guides/understand/privacy.md">What data Devolutions CLI sends</a>.</td></tr><tr><td><code>config telemetry set &#x3C;true|false></code></td><td>Turns telemetry on or off. Needs <code>--yes</code>.</td></tr><tr><td><code>config unlock</code></td><td>Unlocks a local profile protected by an application password, for the running background process. The password comes from <code>--password-env</code> or <code>--password-file</code>. Needs <code>--yes</code>.</td></tr></tbody></table>

## Administration

`devo admin` manages the selected workspace: users, groups, roles, licenses, access, gateways, settings, and logs. Most of these commands work with one workspace type only. Run `devo admin <command> --help` to see every option. See [Manage users, groups, and access](/cli/for-devops-and-administrators/manage/users-and-access.md) and [Review activity logs](/cli/for-devops-and-administrators/manage/logs.md).

### Users and groups

<table><thead><tr><th width="260">COMMAND</th><th>WHAT IT DOES</th><th width="170">WORKSPACE</th></tr></thead><tbody><tr><td><code>admin user list</code></td><td>Lists users.</td><td></td></tr><tr><td><code>admin user get &#x3C;user></code></td><td>Shows one user, by name, email, or ID.</td><td></td></tr><tr><td><code>admin user create &#x3C;name></code></td><td>Creates a user. The initial password comes from <code>--password-env</code> or <code>--password-file</code>.</td><td>Devolutions Server</td></tr><tr><td><code>admin user update &#x3C;user></code></td><td>Changes a user. Some options are for Devolutions Cloud only, others for Devolutions Server only: see <code>--help</code>.</td><td>Devolutions Cloud, Devolutions Server</td></tr><tr><td><code>admin user delete &#x3C;user></code></td><td>Deletes a user.</td><td>Devolutions Cloud, Devolutions Server</td></tr><tr><td><code>admin user groups list &#x3C;user></code></td><td>Lists the groups a user belongs to.</td><td>Devolutions Cloud, local profile</td></tr><tr><td><code>admin user trash list</code>, <code>restore</code>, <code>purge</code></td><td>Lists, restores, or permanently deletes deleted users.</td><td>Devolutions Server</td></tr><tr><td><code>admin user 2fa set</code>, <code>clear</code></td><td>Sets up or clears a user's two-factor authentication method: <code>google-authenticator</code>, <code>yubikey</code>, <code>email</code>, <code>sms</code>, <code>duo</code>, <code>azure-mfa</code>, or <code>radius</code>.</td><td>Devolutions Server</td></tr><tr><td><code>admin group list</code>, <code>get</code></td><td>Lists user groups or shows one.</td><td>Devolutions Cloud; read-only for a local profile</td></tr><tr><td><code>admin group create</code>, <code>update</code>, <code>delete</code></td><td>Creates, changes, or deletes a user group.</td><td>Devolutions Cloud</td></tr><tr><td><code>admin group members list &#x3C;group></code></td><td>Lists the members of a group.</td><td>Devolutions Cloud; read-only for a local profile</td></tr><tr><td><code>admin group members add</code>, <code>remove</code></td><td>Adds a user to a group or removes one.</td><td>Devolutions Cloud</td></tr><tr><td><code>admin invitation list</code>, <code>get</code>, <code>delete</code>, <code>remove-email</code></td><td>Lists, shows, or deletes user invitations, or removes an email address from one.</td><td>Devolutions Cloud</td></tr><tr><td><code>admin owner get</code>, <code>set</code></td><td>Shows or changes the owner of the organization.</td><td>Devolutions Cloud</td></tr><tr><td><code>admin domain list</code></td><td>Lists the Active Directory domains, without their bind secrets.</td><td>Devolutions Server</td></tr><tr><td><code>admin domain users</code></td><td>Lists the users found in an Active Directory domain (<code>--domain</code>).</td><td>Devolutions Server</td></tr></tbody></table>

### Roles and access

<table><thead><tr><th width="260">COMMAND</th><th>WHAT IT DOES</th><th width="170">WORKSPACE</th></tr></thead><tbody><tr><td><code>admin role list</code></td><td>Lists vault or entry roles (<code>--scope</code>, default <code>vault</code>).</td><td>Devolutions Cloud</td></tr><tr><td><code>admin role get &#x3C;role-id></code></td><td>Shows one vault or entry role.</td><td>Devolutions Cloud</td></tr><tr><td><code>admin access permission-sets</code></td><td>Lists permission sets.</td><td>Devolutions Server</td></tr><tr><td><code>admin access system list</code>, <code>get</code>, <code>grant</code>, <code>revoke</code></td><td>Manages the system permissions of users and groups.</td><td>Devolutions Cloud</td></tr><tr><td><code>admin access system-vault list</code>, <code>get</code>, <code>grant</code>, <code>revoke</code></td><td>Manages the system vault roles of users and groups.</td><td>Devolutions Cloud</td></tr></tbody></table>

### Licenses, settings, and gateways

<table><thead><tr><th width="260">COMMAND</th><th>WHAT IT DOES</th><th width="170">WORKSPACE</th></tr></thead><tbody><tr><td><code>admin license list</code></td><td>Lists licenses, with their serial numbers partly hidden.</td><td>Devolutions Server</td></tr><tr><td><code>admin license register</code></td><td>Registers a license serial or license JWT, from <code>--serial-env</code> or <code>--serial-file</code>.</td><td>Devolutions Server</td></tr><tr><td><code>admin license trial start</code></td><td>Starts a trial license.</td><td>Devolutions Server</td></tr><tr><td><code>admin license users list</code></td><td>Lists the users assigned to a license.</td><td>Devolutions Server</td></tr><tr><td><code>admin settings get</code>, <code>update</code></td><td>Shows or changes system settings, such as SSO sign-in, two-factor authentication, the IP allow list, or the system message.</td><td>Devolutions Cloud</td></tr><tr><td><code>admin settings auth-modes get</code>, <code>set</code></td><td>Shows or changes the authentication modes: Azure AD, custom, and domain.</td><td>Devolutions Server</td></tr><tr><td><code>admin settings two-factor get</code></td><td>Shows the two-factor authentication configuration.</td><td>Devolutions Server</td></tr><tr><td><code>admin gateway list</code>, <code>get</code>, <code>delete</code></td><td>Lists, shows, or deletes Devolutions Gateway instances, without their secrets.</td><td>Devolutions Cloud</td></tr><tr><td><code>admin gateway settings get</code></td><td>Shows the gateway settings.</td><td>Devolutions Cloud</td></tr><tr><td><code>admin gateway revocation-list publish</code></td><td>Publishes the revocation list of one gateway (<code>--gateway-id</code>) or of all of them.</td><td>Devolutions Server</td></tr><tr><td><code>admin cache reset</code></td><td>Resets server caches (<code>--element</code>): <code>all</code>, <code>connections</code>, <code>domain</code>, <code>repositories</code>, <code>roles</code>, <code>office365</code>, or <code>users</code>.</td><td>Devolutions Server</td></tr><tr><td><code>admin pam account list</code></td><td>Lists privileged accounts.</td><td>Devolutions Server</td></tr><tr><td><code>admin pam provider list</code>, <code>get</code></td><td>Lists privileged access providers or shows one.</td><td>Devolutions Server</td></tr></tbody></table>

### Logs

<table><thead><tr><th width="260">COMMAND</th><th>WHAT IT DOES</th><th width="170">WORKSPACE</th></tr></thead><tbody><tr><td><code>admin logs activity</code></td><td>Lists activity logs.</td><td>Devolutions Server</td></tr><tr><td><code>admin logs administration</code></td><td>Lists administration logs.</td><td>Devolutions Server</td></tr><tr><td><code>admin logs login-attempts</code></td><td>Lists sign-in attempts.</td><td>Devolutions Server</td></tr><tr><td><code>admin logs pam</code></td><td>Lists privileged access activity logs.</td><td>Devolutions Server</td></tr><tr><td><code>admin logs rotation</code></td><td>Lists password rotation logs of privileged accounts.</td><td>Devolutions Server</td></tr><tr><td><code>admin logs archived</code></td><td>Lists archived log summaries for one date (<code>--date</code>, <code>yyyy-MM-dd</code>).</td><td>Devolutions Cloud</td></tr><tr><td><code>admin logs siem</code></td><td>Lists SIEM report logs. <code>--period</code> is <code>all</code> (default), <code>daily</code>, <code>weekly</code>, or <code>monthly</code>.</td><td>Devolutions Cloud</td></tr><tr><td><code>admin logs export</code></td><td>Exports activity logs to a CSV report (<code>--out-file</code>, which must end in <code>.csv</code>).</td><td>Local profile</td></tr></tbody></table>

The Devolutions Server log commands share these options: `--after` and `--before` (dates), `--date-filter` (`today`, `yesterday`, `custom`, `last-7-days`, `last-30-days`, `last-60-days`, `last-90-days`, or `last-180-days`), `--filter`, `--page` (default `1`) and `--page-size` (default `10000`, from 1 to 10000).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.devolutions.net/cli/reference/commands.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.