> For the complete documentation index, see [llms.txt](https://docs.devolutions.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.devolutions.net/cli/reference/commands/entries.md).

# Entry commands

Every devo entry command of Devolutions CLI, with each option, its default, its allowed values and the workspace types that accept it.

This page describes every `devo entry` command and every option you can type with it. For the short list of all commands, see [Commands](/cli/reference/commands.md). For step-by-step help, see [Manage vaults and entries](/cli/for-devops-and-administrators/manage/vaults-and-entries.md). The options that every command accepts, such as `--context`, `--output json`, or `--non-interactive`, are described in [Global options](/cli/reference/global-options.md) and aren't repeated here.

{% hint style="info" %}
To see the help of a command, with its exact wording, run `devo entry <command> --help`, for example `devo entry list --help`.
{% endhint %}

## How entry commands work

* **Selecting an entry**: most commands take the entry as their first argument. By default, it's the entry **name**, matched exactly, without regard to case. To pass an ID instead, write `id:<value>` or add `--id`. `name:<value>` forces a name, which helps when a name starts with `id:`. This rule is the same on every workspace type. When two entries share a name, the command stops and asks for the ID (`entrySelectorAmbiguous`). On Devolutions Server, an entry ID must be a GUID, otherwise the command stops with `invalidParameterValue`. The exceptions are listed under each command: `entry status set` and `entry tag set` accept only `--id`, the `entry documentation` commands take the entry ID, `entry metadata list` also accepts a path, and `entry move` takes IDs only.
* **Selecting the vault**: a command works in the current vault (see `devo vault use`). To work in another vault for one command, add `--vault-name <name>` or `--vault-id <id>` when the command has them. On Devolutions Cloud and Devolutions Server, a command that reads entries needs either a current vault or one of these options, otherwise it stops with `cloudVaultSelectionRequired`.
* **Confirming a change**: every command that changes or deletes something refuses to run without `--yes` (aliases `-y` and `--confirmed`) and stops with `confirmationRequired`. Nothing is changed.
* **Repeatable options**: options marked *repeatable* can be given several times (`--tag a --tag b`) or once with several values (`--tag a b`).
* **Secret values**: no `devo entry` command returns a password or another secret value. To read or change a secret, use `devo secret`. See [Use secrets without exposing them](/cli/guides/secrets.md).
* **Workspace types**: a command that the selected workspace doesn't support stops with `operationNotSupportedBySource` (Devolutions Cloud, Devolutions Server) or with a code that says the local profile can't do it. On a local profile, the commands that change entries work only when the profile allows it: `devo doctor` lists the operations it supports. See [A command says the workspace doesn't support it](/cli/help/troubleshooting/not-supported.md).

## Command groups

<table><thead><tr><th width="300">GROUP</th><th>COMMANDS</th></tr></thead><tbody><tr><td><code>devo entry</code></td><td><code>list</code> (<code>ls</code>), <code>get</code>, <code>references</code>, <code>types</code>, <code>create</code>, <code>update</code>, <code>delete</code> (<code>rm</code>), <code>move</code>, <code>logs</code></td></tr><tr><td><code>devo entry field</code></td><td><code>get</code>, <code>set</code></td></tr><tr><td><code>devo entry status</code></td><td><code>get</code>, <code>set</code></td></tr><tr><td><code>devo entry tag</code></td><td><code>list</code> (<code>ls</code>), <code>set</code></td></tr><tr><td><code>devo entry parameter</code></td><td><code>list</code> (<code>ls</code>), <code>set</code></td></tr><tr><td><code>devo entry metadata</code></td><td><code>list</code> (<code>ls</code>)</td></tr><tr><td><code>devo entry attachment</code></td><td><code>list</code> (<code>ls</code>)</td></tr><tr><td><code>devo entry documentation</code></td><td><code>list</code> (<code>ls</code>), <code>get</code>, <code>update</code></td></tr><tr><td><code>devo entry password-list</code></td><td><code>list</code> (<code>ls</code>)</td></tr><tr><td><code>devo entry permission</code></td><td><code>get</code></td></tr><tr><td><code>devo entry access</code></td><td><code>list</code> (<code>ls</code>), <code>get</code>, <code>grant</code>, <code>revoke</code> (<code>rm</code>)</td></tr><tr><td><code>devo entry sealed</code></td><td><code>list</code> (<code>ls</code>); <code>devo entry sealed</code> alone does the same</td></tr><tr><td><code>devo entry trash</code></td><td><code>list</code> (<code>ls</code>)</td></tr><tr><td><code>devo entry folder</code></td><td><code>rename</code></td></tr><tr><td><code>devo entry template</code></td><td><code>list</code> (<code>ls</code>)</td></tr></tbody></table>

## devo entry list

Lists and searches the entries of the current vault, or of the vault you name. The result shows each entry's name, ID, type, folder, and vault, never a secret value. Alias: `devo entry ls`.

**Workspace:** All workspace types

```bash
devo entry list [<query>] [--type <type>] [--group <folder>] [--limit <number>] [--vault-name <name> | --vault-id <id>]
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;query></code></td><td></td><td>Optional search text, without regard to case. On a local profile, keeps the entries whose name, host, folder, or username contains the text. On Devolutions Cloud and Devolutions Server, keeps the entries whose name or folder contains the text (host and username aren't searched).</td></tr><tr><td><code>--type &#x3C;type></code></td><td></td><td>Keeps only one entry type, such as <code>RDPConfigured</code>, matched exactly, without regard to case, on every workspace type. <code>devo entry types</code> lists the type identifiers.</td></tr><tr><td><code>--group &#x3C;folder></code></td><td></td><td>Keeps the entries of a folder, without regard to case. On a local profile, the folder path only has to start with this value, so subfolders are included. On Devolutions Cloud and Devolutions Server, the folder must match exactly, so subfolders aren't included.</td></tr><tr><td><code>--smart-folder &#x3C;smart-folder></code></td><td></td><td>Lists the entries of a smart folder, by name, or by ID with <code>id:&#x3C;value></code>. The current workspace types don't evaluate smart folders: the command stops with <code>smartFolderUnavailable</code>.</td></tr><tr><td><code>--limit &#x3C;number></code></td><td><code>100</code></td><td>Maximum number of entries returned. <code>0</code> or a negative number means <code>100</code>. On Devolutions Server, the search looks at the first 1,000 entries of the vault, and the limit can't exceed <code>1000</code>.</td></tr><tr><td><code>--vault-id &#x3C;id></code></td><td>Current vault</td><td>Searches this vault, by ID, without changing the current vault.</td></tr><tr><td><code>--vault-name &#x3C;name></code></td><td>Current vault</td><td>Searches this vault, by name, without changing the current vault.</td></tr></tbody></table>

## devo entry get

Shows one entry: its name, ID, type, folder, vault, host, username, and the other details that aren't secret.

**Workspace:** All workspace types

```bash
devo entry get <entry> [--id] [--vault-name <name> | --vault-id <id>]
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;entry></code></td><td></td><td>Required. Entry name, or its ID with <code>id:&#x3C;value></code> or <code>--id</code>.</td></tr><tr><td><code>--id</code></td><td>Off</td><td>Treats <code>&#x3C;entry></code> as an ID.</td></tr><tr><td><code>--vault-id &#x3C;id></code></td><td>Current vault</td><td>Vault of the entry, by ID.</td></tr><tr><td><code>--vault-name &#x3C;name></code></td><td>Current vault</td><td>Vault of the entry, by name.</td></tr></tbody></table>

## devo entry references

Lists the `devo://` references of an entry's fields, ready to copy into a script, without any value. Only the fields the workspace can resolve are listed, among `password`, `username`, `host`, `domain`, and `url`. On Devolutions Server, only canonical references (with IDs) are listed. Same as `devo secret catalog entry`. See [Find the reference to a secret](/cli/guides/secrets/find-a-reference.md).

**Workspace:** All workspace types

```bash
devo entry references <entry> [--id] [--vault-name <name> | --vault-id <id>]
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;entry></code></td><td></td><td>Required. Entry name, or its ID with <code>id:&#x3C;value></code> or <code>--id</code>.</td></tr><tr><td><code>--id</code></td><td>Off</td><td>Treats <code>&#x3C;entry></code> as an ID.</td></tr><tr><td><code>--vault-id &#x3C;id></code></td><td>Current vault</td><td>Vault of the entry, by ID.</td></tr><tr><td><code>--vault-name &#x3C;name></code></td><td>Current vault</td><td>Vault of the entry, by name.</td></tr></tbody></table>

## devo entry types

Lists common entry type identifiers, such as `RDPConfigured`, with their name, category, and aliases, for use with `--type`. The list is built into Devolutions CLI: the command doesn't contact the workspace.

**Workspace:** All workspace types

```bash
devo entry types [<query>]
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;query></code></td><td></td><td>Optional filter. Keeps the types whose identifier, name, category, or alias contains the text, without regard to case.</td></tr></tbody></table>

## devo entry create

Creates an entry. A local profile creates RDP entries only, in the default vault of the current workspace. The command writes to the local workspace, so it needs the workspace passphrase.

**Workspace:** Local profile

```bash
devo entry create <name> [--host <host>] [--username <username>] [--group <folder>] [--passphrase-file <file> | --passphrase-env <variable>] --yes
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;name></code></td><td></td><td>Required. Name of the new entry. Spaces at both ends are removed; an empty name is refused.</td></tr><tr><td><code>--type &#x3C;type></code></td><td><code>RDPConfigured</code></td><td>Entry type. A local profile accepts only <code>RDPConfigured</code> (or <code>RDP</code>); any other type stops with <code>operationNotSupportedBySource</code>.</td></tr><tr><td><code>--group &#x3C;folder></code></td><td>Vault root</td><td>Folder path of the new entry.</td></tr><tr><td><code>--host &#x3C;host></code></td><td></td><td>Host of the new entry.</td></tr><tr><td><code>--username &#x3C;username></code></td><td></td><td>Username of the new entry. To set the password, run <code>devo secret set password</code> afterward. See <a href="/cli/guides/secrets/update-a-secret.md">Update a secret from a script</a>.</td></tr><tr><td><code>--password-secret-reference &#x3C;reference></code></td><td></td><td>A <code>devo://</code> reference for the entry password. A local profile refuses this option.</td></tr><tr><td><code>--vault-id &#x3C;id></code></td><td>Default vault</td><td>Vault of the new entry. A local profile creates entries in its default vault only: any other vault stops with <code>sqliteEntryCreateVaultUnsupported</code>.</td></tr><tr><td><code>--vault-name &#x3C;name></code></td><td></td><td>Vault of the new entry, by name. A local profile refuses this option.</td></tr><tr><td><code>--passphrase-file &#x3C;file></code></td><td><code>&#x3C;workspace file>.passphrase</code></td><td>Local profile only: private file that holds the workspace passphrase. Without <code>--passphrase-file</code> or <code>--passphrase-env</code>, Devolutions CLI uses the <code>&#x3C;workspace file>.passphrase</code> file in the profile folder, and stops with <code>missingParameter</code> if there's none. Use one of the two options, not both. Devolutions Cloud and Devolutions Server refuse this option.</td></tr><tr><td><code>--passphrase-env &#x3C;variable></code></td><td></td><td>Local profile only: environment variable that holds the workspace passphrase. Devolutions Cloud and Devolutions Server refuse this option.</td></tr><tr><td><code>--yes</code> (<code>-y</code>, <code>--confirmed</code>)</td><td>Off</td><td>Confirms the creation. Required.</td></tr></tbody></table>

A current local SQLite workspace is required: select one with `devo workspace use`, otherwise the command stops with `workspaceNotSelected`.

## devo entry update

Changes the details of an entry that aren't secret. What you can change depends on the workspace type. To change a password, use `devo secret set`.

**Workspace:** Devolutions Server, local profile

```bash
devo entry update <entry> [--new-name <name>] [--host <host>] [--username <username>] [--domain <domain>] [--id] [--vault-id <id>] --yes
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;entry></code></td><td></td><td>Required. Entry name, or its ID with <code>id:&#x3C;value></code> or <code>--id</code>.</td></tr><tr><td><code>--id</code></td><td>Off</td><td>Treats <code>&#x3C;entry></code> as an ID.</td></tr><tr><td><code>--new-name &#x3C;name></code></td><td></td><td>New entry name. Local profile only: up to 200 characters, not only spaces. Devolutions Server refuses it.</td></tr><tr><td><code>--host &#x3C;host></code></td><td></td><td>New host.</td></tr><tr><td><code>--username &#x3C;username></code></td><td></td><td>New username.</td></tr><tr><td><code>--domain &#x3C;domain></code></td><td></td><td>New domain.</td></tr><tr><td><code>--host-port &#x3C;port></code></td><td></td><td>New host port, a whole number. Every workspace type refuses it.</td></tr><tr><td><code>--password-secret-reference &#x3C;reference></code></td><td></td><td>A <code>devo://</code> reference for the entry password. Every workspace type refuses it. To change a password, use <code>devo secret set password</code>.</td></tr><tr><td><code>--vault-id &#x3C;id></code></td><td>Current vault</td><td>Vault of the entry, by ID. This command has no <code>--vault-name</code>.</td></tr><tr><td><code>--yes</code> (<code>-y</code>, <code>--confirmed</code>)</td><td>Off</td><td>Confirms the change. Required.</td></tr></tbody></table>

Pass at least one field to change. On a local profile, a command without any supported change stops with `sqliteEntryUpdateNoChanges`. On Devolutions Cloud, the command isn't available: change the password with `devo secret set`.

## devo entry delete

Deletes an entry. On Devolutions Cloud, deleting an entry also deletes the entries under it (they go to the recycle bin), so the command needs `--acknowledge-recursive-scope`. Alias: `devo entry rm`.

**Workspace:** Devolutions Cloud, Devolutions Server

```bash
devo entry delete <entry> [--id] [--vault-name <name> | --vault-id <id>] [--acknowledge-recursive-scope] --yes
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;entry></code></td><td></td><td>Required. Entry name, or its ID with <code>id:&#x3C;value></code> or <code>--id</code>. Prefer the ID.</td></tr><tr><td><code>--id</code></td><td>Off</td><td>Treats <code>&#x3C;entry></code> as an ID.</td></tr><tr><td><code>--vault-id &#x3C;id></code></td><td>Current vault</td><td>Vault of the entry, by ID.</td></tr><tr><td><code>--vault-name &#x3C;name></code></td><td>Current vault</td><td>Vault of the entry, by name.</td></tr><tr><td><code>--acknowledge-recursive-scope</code></td><td>Off</td><td>Devolutions Cloud: confirms that you know the entries under this one are deleted too. Without it, the command stops with <code>recursiveScopeAcknowledgementRequired</code>. Ignored by Devolutions Server.</td></tr><tr><td><code>--yes</code> (<code>-y</code>, <code>--confirmed</code>)</td><td>Off</td><td>Confirms the deletion. Required.</td></tr></tbody></table>

## devo entry move

Moves one or more entries to another folder. Entries are selected by ID only.

**Workspace:** Local profile

```bash
devo entry move --entry-id <id> [--entry-id <id>…] --destination-group <folder> [--to-vault <vault>] --yes
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>--entry-id &#x3C;id></code></td><td></td><td>Required, repeatable. ID of an entry to move. If one ID isn't found, nothing is moved.</td></tr><tr><td><code>--destination-group &#x3C;folder></code></td><td></td><td>Required. Destination folder path. An empty value (<code>--destination-group ""</code>) moves the entries to the root of the vault.</td></tr><tr><td><code>--to-vault &#x3C;vault></code></td><td>Current vault</td><td>Vault of the destination, by name or ID (a value that is a GUID is read as an ID). A local profile moves entries within their own vault only: if an entry is in another vault, the command stops with <code>entryMoveCrossVaultUnsupported</code>.</td></tr><tr><td><code>--yes</code> (<code>-y</code>, <code>--confirmed</code>)</td><td>Off</td><td>Confirms the move. Required.</td></tr></tbody></table>

What happens during a move on a local profile:

* The destination folder doesn't need to exist: the entries' folder path is set to the value you give.
* Moving a folder entry moves everything under it.
* The command stops, and moves nothing, when the same ID is given twice (`entryMoveSelectorDuplicate`), when you select a folder and something under it (`entryMoveSelectionOverlap`), when a folder would go into itself or one of its subfolders (`entryMoveFolderCycle`), when a folder of the same name already exists at the destination (`folderAlreadyExists`), or when no entry would change folder (`sqliteEntryMoveNoChanges`).

## devo entry logs

Lists the activity logs of an entry, newest first: who opened it, when, from which computer, and the comments.

**Workspace:** Local profile

```bash
devo entry logs <entry> [--start-date <date>] [--end-date <date>] [--limit <number>] [--vault-name <name> | --vault-id <id>]
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;entry></code></td><td></td><td>Required. Entry name or ID: a log is kept when its entry ID or entry name matches, without regard to case. <code>id:&#x3C;value></code> and <code>--id</code> are accepted.</td></tr><tr><td><code>--id</code></td><td>Off</td><td>Treats <code>&#x3C;entry></code> as an ID.</td></tr><tr><td><code>--start-date &#x3C;date></code></td><td></td><td>Keeps the logs that start on or after this date. Format <code>yyyy-MM-dd</code> or <code>yyyy-MM-dd HH:mm</code>. Must be before <code>--end-date</code>.</td></tr><tr><td><code>--end-date &#x3C;date></code></td><td></td><td>Keeps the logs that start on or before this date. Same format.</td></tr><tr><td><code>--limit &#x3C;number></code></td><td><code>100</code></td><td>Maximum number of logs returned. <code>0</code> or a negative number means <code>100</code>.</td></tr><tr><td><code>--vault-id &#x3C;id></code></td><td>All vaults</td><td>Keeps the logs of this vault, by ID.</td></tr><tr><td><code>--vault-name &#x3C;name></code></td><td>All vaults</td><td>Keeps the logs of this vault, by name.</td></tr></tbody></table>

To export the logs of a whole workspace, see [Review activity logs](/cli/for-devops-and-administrators/manage/logs.md).

## devo entry field get

Returns the value of one field of an entry that isn't secret. Handy in a script.

**Workspace:** All workspace types

```bash
devo entry field get <entry> <field> [--id] [--vault-name <name> | --vault-id <id>]
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;entry></code></td><td></td><td>Required. Entry name, or its ID with <code>id:&#x3C;value></code> or <code>--id</code>.</td></tr><tr><td><code>&#x3C;field></code></td><td></td><td>Required. Field to read, without regard to case: <code>id</code>, <code>name</code>, <code>type</code> (or <code>entry-type</code>), <code>group</code>, <code>host</code>, <code>username</code> (or <code>user</code>, <code>user-name</code>), <code>vault-id</code>, <code>vault-name</code>, or the name of another property of the entry, such as a metadata property listed by <code>devo entry metadata list</code>. The domain is read with <code>domain</code> and the port with <code>port</code>: <code>host-port</code> isn't a readable field name. An unknown field, or a property the entry doesn't have, stops with <code>entryFieldNotFound</code>. A property that holds a secret is marked as sensitive.</td></tr><tr><td><code>--id</code></td><td>Off</td><td>Treats <code>&#x3C;entry></code> as an ID.</td></tr><tr><td><code>--vault-id &#x3C;id></code></td><td>Current vault</td><td>Vault of the entry, by ID.</td></tr><tr><td><code>--vault-name &#x3C;name></code></td><td>Current vault</td><td>Vault of the entry, by name.</td></tr></tbody></table>

What each workspace type can return:

* **Local profile**: the fields above and the entry's other properties, such as `domain`, `port`, `status`, `statusmessage`, and `tags`. A property with an empty value doesn't exist, so reading it stops with `entryFieldNotFound`.
* **Devolutions Cloud**: the fields above, plus `domain`, `port`, and `url` when the entry has them.
* **Devolutions Server**: only `id`, `name`, `type`, `group`, `vault-id`, and `vault-name` have a value. `host` and `username` come back empty, and other properties, such as `domain`, aren't found.

## devo entry field set

Changes one field of an entry that isn't secret. It changes the same fields as `devo entry update`.

**Workspace:** Devolutions Server, local profile

```bash
devo entry field set <entry> <field> (--value <value> | --value-env <variable> | --value-file <file>) [--id] [--vault-id <id>] --yes
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;entry></code></td><td></td><td>Required. Entry name, or its ID with <code>id:&#x3C;value></code> or <code>--id</code>.</td></tr><tr><td><code>&#x3C;field></code></td><td></td><td>Required. Field to change, without regard to case: <code>host</code>, <code>username</code> (or <code>user</code>, <code>user-name</code>), <code>domain</code>, and <code>name</code> on a local profile only. <code>host-port</code> (or <code>hostport</code>, <code>port</code>) must be a whole number, and every workspace type refuses it. <code>group</code> and any other field stop with <code>invalidParameterValue</code>: to move an entry, use <code>devo entry move</code>. <code>password</code> and <code>secret</code> stop with <code>rawSensitiveValueRejected</code>: use <code>devo secret set password</code>.</td></tr><tr><td><code>--value &#x3C;value></code></td><td></td><td>New value, on the command line.</td></tr><tr><td><code>--value-env &#x3C;variable></code></td><td></td><td>Environment variable that holds the new value. The variable must exist.</td></tr><tr><td><code>--value-file &#x3C;file></code></td><td></td><td>File that holds the new value. The whole content is used as is, including a final line break.</td></tr><tr><td><code>--id</code></td><td>Off</td><td>Treats <code>&#x3C;entry></code> as an ID.</td></tr><tr><td><code>--vault-id &#x3C;id></code></td><td>Current vault</td><td>Vault of the entry, by ID. This command has no <code>--vault-name</code>.</td></tr><tr><td><code>--yes</code> (<code>-y</code>, <code>--confirmed</code>)</td><td>Off</td><td>Confirms the change. Required.</td></tr></tbody></table>

Use exactly one of `--value`, `--value-env`, and `--value-file`. The command returns the new value of the field.

## devo entry status get

Shows the status of an entry, such as `Locked` or `Expired`. It reads the `status` property, as `devo entry field get <entry> status` does.

**Workspace:** All workspace types. In practice, only a local profile returns a status: Devolutions Cloud and Devolutions Server don't return one, and the command stops with `entryFieldNotFound`. On a local profile, an entry without a status also stops with `entryFieldNotFound`.

```bash
devo entry status get <entry> [--id] [--vault-name <name> | --vault-id <id>]
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;entry></code></td><td></td><td>Required. Entry name, or its ID with <code>id:&#x3C;value></code> or <code>--id</code>.</td></tr><tr><td><code>--id</code></td><td>Off</td><td>Treats <code>&#x3C;entry></code> as an ID.</td></tr><tr><td><code>--vault-id &#x3C;id></code></td><td>Current vault</td><td>Vault of the entry, by ID.</td></tr><tr><td><code>--vault-name &#x3C;name></code></td><td>Current vault</td><td>Vault of the entry, by name.</td></tr></tbody></table>

## devo entry status set

Sets the status of an entry, with an optional message.

**Workspace:** Local profile

```bash
devo entry status set <entry> --status <status> [--message <message>] [--id] [--vault-id <id>] --yes
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;entry></code></td><td></td><td>Required. Entry name. To select the entry by ID, add <code>--id</code>: this command doesn't recognize the <code>id:</code> prefix.</td></tr><tr><td><code>--status &#x3C;status></code></td><td></td><td>Required. <code>Archived</code>, <code>Broken</code>, <code>Default</code>, <code>Disabled</code>, <code>Expired</code>, <code>Locked</code>, or <code>Warning</code>, without regard to case. Any other value stops with <code>invalidParameterValue</code>.</td></tr><tr><td><code>--message &#x3C;message></code></td><td></td><td>Status message shown with the status.</td></tr><tr><td><code>--id</code></td><td>Off</td><td>Treats <code>&#x3C;entry></code> as an ID.</td></tr><tr><td><code>--vault-id &#x3C;id></code></td><td>Current vault</td><td>Vault of the entry, by ID. This command has no <code>--vault-name</code>.</td></tr><tr><td><code>--yes</code> (<code>-y</code>, <code>--confirmed</code>)</td><td>Off</td><td>Confirms the change. Required.</td></tr></tbody></table>

## devo entry tag list

Lists the tags assigned directly to an entry. It reads the `tags` property, as `devo entry field get <entry> tags` does. Alias: `devo entry tag ls`.

**Workspace:** All workspace types. In practice, only a local profile returns tags: Devolutions Cloud and Devolutions Server don't return them, and the command stops with `entryFieldNotFound`. On a local profile, an entry without tags also stops with `entryFieldNotFound`.

```bash
devo entry tag list <entry> [--id] [--vault-name <name> | --vault-id <id>]
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;entry></code></td><td></td><td>Required. Entry name, or its ID with <code>id:&#x3C;value></code> or <code>--id</code>.</td></tr><tr><td><code>--id</code></td><td>Off</td><td>Treats <code>&#x3C;entry></code> as an ID.</td></tr><tr><td><code>--vault-id &#x3C;id></code></td><td>Current vault</td><td>Vault of the entry, by ID.</td></tr><tr><td><code>--vault-name &#x3C;name></code></td><td>Current vault</td><td>Vault of the entry, by name.</td></tr></tbody></table>

## devo entry tag set

Replaces the tags assigned directly to an entry: the tags you pass become the entry's only tags.

**Workspace:** Local profile

```bash
devo entry tag set <entry> (--tag <tag> [--tag <tag>…] | --clear) [--id] [--vault-id <id>] --yes
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;entry></code></td><td></td><td>Required. Entry name. To select the entry by ID, add <code>--id</code>: this command doesn't recognize the <code>id:</code> prefix.</td></tr><tr><td><code>--tag &#x3C;tag></code></td><td></td><td>Repeatable. A tag to assign. The tags you pass replace all existing ones.</td></tr><tr><td><code>--clear</code></td><td>Off</td><td>Removes all the tags assigned directly to the entry.</td></tr><tr><td><code>--id</code></td><td>Off</td><td>Treats <code>&#x3C;entry></code> as an ID.</td></tr><tr><td><code>--vault-id &#x3C;id></code></td><td>Current vault</td><td>Vault of the entry, by ID. This command has no <code>--vault-name</code>.</td></tr><tr><td><code>--yes</code> (<code>-y</code>, <code>--confirmed</code>)</td><td>Off</td><td>Confirms the change. Required.</td></tr></tbody></table>

Pass at least one `--tag`, or `--clear`, but not both: `--clear` with `--tag` stops with `conflictingOptions`, and neither stops with `missingParameter`.

## devo entry parameter list

Lists the command parameters of an entry: position, label, type, and whether each one is sensitive. Default values aren't returned. Alias: `devo entry parameter ls`.

**Workspace:** Local profile

```bash
devo entry parameter list <entry> [--include-unused] [--id] [--vault-name <name> | --vault-id <id>]
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;entry></code></td><td></td><td>Required. Entry name, or its ID with <code>id:&#x3C;value></code> or <code>--id</code>.</td></tr><tr><td><code>--include-unused</code></td><td>Off</td><td>Also lists the parameter slots whose type is <code>Unused</code>.</td></tr><tr><td><code>--id</code></td><td>Off</td><td>Treats <code>&#x3C;entry></code> as an ID.</td></tr><tr><td><code>--vault-id &#x3C;id></code></td><td>Current vault</td><td>Vault of the entry, by ID.</td></tr><tr><td><code>--vault-name &#x3C;name></code></td><td>Current vault</td><td>Vault of the entry, by name.</td></tr></tbody></table>

## devo entry parameter set

Changes one command parameter of an entry: its label, its type, or its default value.

**Workspace:** Local profile

```bash
devo entry parameter set <entry> (--position <number> | --label <label>) [--new-label <label>] [--type <type>] [--value <value> | --value-env <variable> | --value-file <file>] --yes
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;entry></code></td><td></td><td>Required. Entry name, or its ID with <code>id:&#x3C;value></code> or <code>--id</code>.</td></tr><tr><td><code>--position &#x3C;number></code></td><td></td><td>Selects the parameter by position, from <code>1</code> to <code>5</code>.</td></tr><tr><td><code>--label &#x3C;label></code></td><td></td><td>Selects the parameter by its current label, matched exactly, without regard to case. An unknown label stops with <code>entryParameterNotFound</code>; a label used by two parameters stops with <code>entryParameterSelectorAmbiguous</code>: use <code>--position</code>.</td></tr><tr><td><code>--new-label &#x3C;label></code></td><td></td><td>New label of the parameter.</td></tr><tr><td><code>--type &#x3C;type></code></td><td></td><td>New type: <code>Text</code>, <code>Secured</code>, <code>EnvironmentVariable</code>, or <code>Unused</code>, without regard to case.</td></tr><tr><td><code>--value &#x3C;value></code></td><td></td><td>New default value, on the command line. Refused together with <code>--type Secured</code>: pass a secured value with <code>--value-env</code> or <code>--value-file</code>.</td></tr><tr><td><code>--value-env &#x3C;variable></code></td><td></td><td>Environment variable that holds the new default value. The variable must exist.</td></tr><tr><td><code>--value-file &#x3C;file></code></td><td></td><td>File that holds the new default value. The whole content is used as is.</td></tr><tr><td><code>--id</code></td><td>Off</td><td>Treats <code>&#x3C;entry></code> as an ID.</td></tr><tr><td><code>--vault-id &#x3C;id></code></td><td>Current vault</td><td>Vault of the entry, by ID.</td></tr><tr><td><code>--vault-name &#x3C;name></code></td><td>Current vault</td><td>Vault of the entry, by name.</td></tr><tr><td><code>--yes</code> (<code>-y</code>, <code>--confirmed</code>)</td><td>Off</td><td>Confirms the change. Required.</td></tr></tbody></table>

Rules:

* Select the parameter with `--position` or `--label`, not both (`conflictingOptions`), and not neither (`missingParameter`).
* Pass at least one change: `--new-label`, `--type`, or a value option. Otherwise the command stops with `missingParameter`.
* Use at most one of `--value`, `--value-env`, and `--value-file`.
* The result lists the entry's parameters without their values.

## devo entry metadata list

Lists the metadata fields of an entry: each field's name and whether it's sensitive. Values aren't returned; read one with `devo entry field get`. Alias: `devo entry metadata ls`.

**Workspace:** Local profile

```bash
devo entry metadata list <entry> [--id | --path] [--vault-name <name> | --vault-id <id>]
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;entry></code></td><td></td><td>Required. Entry name by default. Also accepts <code>id:&#x3C;value></code>, <code>name:&#x3C;value></code>, and <code>path:&#x3C;value></code>, where the path is the entry's folder path, a backslash, and its name, such as <code>Servers\Production\web-01</code> (just the name for an entry at the vault root).</td></tr><tr><td><code>--id</code></td><td>Off</td><td>Treats <code>&#x3C;entry></code> as an ID.</td></tr><tr><td><code>--path</code></td><td>Off</td><td>Treats <code>&#x3C;entry></code> as an entry path.</td></tr><tr><td><code>--vault-id &#x3C;id></code></td><td>Current vault</td><td>Vault of the entry, by ID.</td></tr><tr><td><code>--vault-name &#x3C;name></code></td><td>Current vault</td><td>Vault of the entry, by name.</td></tr></tbody></table>

## devo entry attachment list

Lists the attachments of an entry: title, file name, size, description, author, dates, and whether the attachment can be exported. The files themselves aren't returned. Alias: `devo entry attachment ls`.

**Workspace:** Local profile

```bash
devo entry attachment list <entry> [--id] [--vault-name <name> | --vault-id <id>]
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;entry></code></td><td></td><td>Required. Entry name, or its ID with <code>id:&#x3C;value></code> or <code>--id</code>.</td></tr><tr><td><code>--id</code></td><td>Off</td><td>Treats <code>&#x3C;entry></code> as an ID.</td></tr><tr><td><code>--vault-id &#x3C;id></code></td><td>Current vault</td><td>Vault of the entry, by ID.</td></tr><tr><td><code>--vault-name &#x3C;name></code></td><td>Current vault</td><td>Vault of the entry, by name.</td></tr></tbody></table>

## devo entry documentation list

Lists the documentation pages of an entry, with their ID and title. Alias: `devo entry documentation ls`.

**Workspace:** Local profile

```bash
devo entry documentation list <entry-id>
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;entry></code></td><td></td><td>Required. ID of the entry. A name isn't accepted: find the ID with <code>devo entry get</code>.</td></tr></tbody></table>

## devo entry documentation get

Shows one documentation page of an entry, with its content.

**Workspace:** Local profile

```bash
devo entry documentation get <entry-id> --title <page-title-or-id>
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;entry></code></td><td></td><td>Required. ID of the entry.</td></tr><tr><td><code>--title &#x3C;title></code> (<code>--page-id</code>)</td><td></td><td>Required. Page title or page ID, without regard to case. When two pages have the same title, the command stops with <code>documentationPageSelectorAmbiguous</code>: use the page ID from <code>devo entry documentation list</code>.</td></tr></tbody></table>

## devo entry documentation update

Renames a documentation page. A local profile can't change the content of a page.

**Workspace:** Local profile

```bash
devo entry documentation update <entry-id> --title <page-title-or-id> --new-title <new-title> --yes
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;entry></code></td><td></td><td>Required. ID of the entry.</td></tr><tr><td><code>--title &#x3C;title></code> (<code>--page-id</code>)</td><td></td><td>Required. Current page title or page ID, without regard to case.</td></tr><tr><td><code>--new-title &#x3C;title></code></td><td></td><td>New page title. Required in practice: without it, a local profile stops with <code>documentationTitleRequired</code>.</td></tr><tr><td><code>--content &#x3C;text></code></td><td></td><td>New page content. A local profile refuses it with <code>sqliteDocumentationContentUpdateUnavailable</code>.</td></tr><tr><td><code>--content-file &#x3C;file></code></td><td></td><td>File that holds the new page content. A local profile refuses it. Use <code>--content</code> or <code>--content-file</code>, not both.</td></tr><tr><td><code>--yes</code> (<code>-y</code>, <code>--confirmed</code>)</td><td>Off</td><td>Confirms the change. Required.</td></tr></tbody></table>

## devo entry password-list list

Lists the items of a Password List entry: name, username, domain, host, description, roles, expiration, and custom fields. Passwords and sensitive custom fields come back empty; a flag tells whether each item has a password. Alias: `devo entry password-list ls`.

**Workspace:** Local profile

```bash
devo entry password-list list <entry> [--name <text>] [--case-sensitive] [--id] [--vault-name <name> | --vault-id <id>]
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;entry></code></td><td></td><td>Required. Name of the Password List entry, or its ID with <code>id:&#x3C;value></code> or <code>--id</code>.</td></tr><tr><td><code>--name &#x3C;text></code></td><td></td><td>Keeps the items whose name contains this text. On a local profile, <code>*</code> isn't a wildcard: it matches a literal <code>*</code>, so pass plain text.</td></tr><tr><td><code>--case-sensitive</code></td><td>Off</td><td>Matches <code>--name</code> with regard to case.</td></tr><tr><td><code>--id</code></td><td>Off</td><td>Treats <code>&#x3C;entry></code> as an ID.</td></tr><tr><td><code>--vault-id &#x3C;id></code></td><td>Current vault</td><td>Vault of the entry, by ID.</td></tr><tr><td><code>--vault-name &#x3C;name></code></td><td>Current vault</td><td>Vault of the entry, by name.</td></tr></tbody></table>

On a local profile, this command works only when the profile allows it.

## devo entry permission get

Shows the permissions set directly on an entry: for each right, the override and the users or groups it applies to. The result is read only.

**Workspace:** Devolutions Cloud, local profile

```bash
devo entry permission get <entry> [--right <right>] [--id] [--vault-name <name> | --vault-id <id>]
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;entry></code></td><td></td><td>Required. Entry name, or its ID with <code>id:&#x3C;value></code> or <code>--id</code>.</td></tr><tr><td><code>--right &#x3C;right></code></td><td>All rights</td><td>Keeps one right, such as <code>View</code>, <code>ViewPassword</code>, <code>Edit</code>, <code>EditSecurity</code>, or <code>Execute</code>. The match is exact, without regard to case, on both workspace types.</td></tr><tr><td><code>--id</code></td><td>Off</td><td>Treats <code>&#x3C;entry></code> as an ID.</td></tr><tr><td><code>--vault-id &#x3C;id></code></td><td>Current vault</td><td>Vault of the entry, by ID.</td></tr><tr><td><code>--vault-name &#x3C;name></code></td><td>Current vault</td><td>Vault of the entry, by name.</td></tr></tbody></table>

On a local profile, this command works only when the profile allows it.

On Devolutions Cloud:

* The entry is selected by ID, or by its exact name, without regard to case. A path isn't accepted (`cloudEntryPermissionPathUnsupported`). When two entries of the vault share the name, the command stops with `cloudEntryPermissionEntryAmbiguous`: use the ID.
* The result has one line per right and per user or group, sorted by right. Each line gives the ID of the user or group; the override is always empty.
* Devolutions Server refuses the command with `operationNotSupportedBySource`.

## devo entry access list

Lists the roles that users and groups have on one Devolutions Cloud entry. Alias: `devo entry access ls`.

**Workspace:** Devolutions Cloud

```bash
devo entry access list --vault-id <vault-id> --entry-id <entry-id>
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>--vault-id &#x3C;id></code></td><td></td><td>Required. ID (GUID) of the vault that holds the entry.</td></tr><tr><td><code>--entry-id &#x3C;id></code> (<code>--id</code>)</td><td></td><td>Required. ID (GUID) of the entry.</td></tr></tbody></table>

All the `devo entry access` commands take IDs only: a value that isn't a GUID stops with `invalidParameterValue`. To find user, group, and role IDs, see [Manage users, groups, and access](/cli/for-devops-and-administrators/manage/users-and-access.md).

## devo entry access get

Shows the role of one user or one group on a Devolutions Cloud entry.

**Workspace:** Devolutions Cloud

```bash
devo entry access get --vault-id <vault-id> --entry-id <entry-id> (--user-id <user-id> | --group-id <group-id>)
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>--vault-id &#x3C;id></code></td><td></td><td>Required. ID (GUID) of the vault that holds the entry.</td></tr><tr><td><code>--entry-id &#x3C;id></code> (<code>--id</code>)</td><td></td><td>Required. ID (GUID) of the entry.</td></tr><tr><td><code>--user-id &#x3C;id></code></td><td></td><td>ID (GUID) of the user.</td></tr><tr><td><code>--group-id &#x3C;id></code></td><td></td><td>ID (GUID) of the group.</td></tr></tbody></table>

Pass exactly one of `--user-id` and `--group-id`, otherwise the command stops with `conflictingOptions`.

## devo entry access grant

Gives one user or one group a role on a Devolutions Cloud entry, or replaces the role they have.

**Workspace:** Devolutions Cloud

```bash
devo entry access grant --vault-id <vault-id> --entry-id <entry-id> (--user-id <user-id> | --group-id <group-id>) --role-id <role-id> --yes
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>--vault-id &#x3C;id></code></td><td></td><td>Required. ID (GUID) of the vault that holds the entry.</td></tr><tr><td><code>--entry-id &#x3C;id></code> (<code>--id</code>)</td><td></td><td>Required. ID (GUID) of the entry.</td></tr><tr><td><code>--user-id &#x3C;id></code></td><td></td><td>ID (GUID) of the user.</td></tr><tr><td><code>--group-id &#x3C;id></code></td><td></td><td>ID (GUID) of the group.</td></tr><tr><td><code>--role-id &#x3C;id></code></td><td></td><td>Required. ID (GUID) of the entry role. <code>devo admin role list --scope entry</code> lists the entry roles.</td></tr><tr><td><code>--yes</code> (<code>-y</code>, <code>--confirmed</code>)</td><td>Off</td><td>Confirms the change. Required.</td></tr></tbody></table>

Pass exactly one of `--user-id` and `--group-id`.

## devo entry access revoke

Removes the role of one user or one group on a Devolutions Cloud entry. Alias: `devo entry access rm`.

**Workspace:** Devolutions Cloud

```bash
devo entry access revoke --vault-id <vault-id> --entry-id <entry-id> (--user-id <user-id> | --group-id <group-id>) --yes
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>--vault-id &#x3C;id></code></td><td></td><td>Required. ID (GUID) of the vault that holds the entry.</td></tr><tr><td><code>--entry-id &#x3C;id></code> (<code>--id</code>)</td><td></td><td>Required. ID (GUID) of the entry.</td></tr><tr><td><code>--user-id &#x3C;id></code></td><td></td><td>ID (GUID) of the user.</td></tr><tr><td><code>--group-id &#x3C;id></code></td><td></td><td>ID (GUID) of the group.</td></tr><tr><td><code>--yes</code> (<code>-y</code>, <code>--confirmed</code>)</td><td>Off</td><td>Confirms the removal. Required.</td></tr></tbody></table>

Pass exactly one of `--user-id` and `--group-id`.

## devo entry sealed list

Lists the sealed entries of the workspace. `devo entry sealed` without `list` does the same and accepts the same options. Alias: `devo entry sealed ls`.

**Workspace:** Local profile

```bash
devo entry sealed list [--name <text>] [--type <type>] [--group <folder> [--include-subfolders]] [--id <id>] [--case-sensitive] [--limit <number>]
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>--id &#x3C;id></code></td><td></td><td>Keeps the entry with this ID. Here <code>--id</code> takes a value: it's a filter, not a switch.</td></tr><tr><td><code>--name &#x3C;text></code></td><td></td><td>Keeps the entries whose name contains this text.</td></tr><tr><td><code>--group &#x3C;folder></code></td><td></td><td>Keeps the entries of exactly this folder path.</td></tr><tr><td><code>--include-subfolders</code></td><td>Off</td><td>With <code>--group</code>, also keeps the entries of its subfolders (the folder path starts with the value).</td></tr><tr><td><code>--type &#x3C;type></code></td><td></td><td>Keeps one entry type, matched exactly, without regard to case.</td></tr><tr><td><code>--case-sensitive</code></td><td>Off</td><td>Matches <code>--name</code> and <code>--group</code> with regard to case.</td></tr><tr><td><code>--limit &#x3C;number></code></td><td><code>100</code></td><td>Maximum number of entries returned. <code>0</code> or a negative number means <code>100</code>.</td></tr></tbody></table>

This command has no vault option: it looks at the entries of every vault of the local workspace. An entry counts as sealed when its seal state is `sealed`.

## devo entry trash list

Lists deleted entries that can still be restored, with their folder, type, vault, deletion date, and the user who deleted them. Alias: `devo entry trash ls`.

**Workspace:** Local profile

```bash
devo entry trash list [<entry>] [--group <folder>] [--before <date>] [--case-sensitive] [--limit <number>] [--vault-name <name> | --vault-id <id>]
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;entry></code></td><td></td><td>Optional. Keeps the deleted entries whose name contains this text. With <code>id:&#x3C;value></code> or <code>--id</code>, keeps the entry with this exact ID.</td></tr><tr><td><code>--id</code></td><td>Off</td><td>Treats <code>&#x3C;entry></code> as an ID.</td></tr><tr><td><code>--group &#x3C;folder></code></td><td></td><td>Keeps the entries whose folder path starts with this value.</td></tr><tr><td><code>--before &#x3C;date></code></td><td></td><td>Keeps the entries deleted before this date. Format <code>yyyy-MM-dd</code> or <code>yyyy-MM-dd HH:mm</code>.</td></tr><tr><td><code>--case-sensitive</code></td><td>Off</td><td>Matches the name, the ID, and <code>--group</code> with regard to case.</td></tr><tr><td><code>--limit &#x3C;number></code></td><td><code>1000</code></td><td>Maximum number of entries returned. <code>0</code> or a negative number means <code>1000</code>.</td></tr><tr><td><code>--vault-id &#x3C;id></code></td><td>All vaults</td><td>Keeps the entries deleted from this vault, by ID.</td></tr><tr><td><code>--vault-name &#x3C;name></code></td><td>All vaults</td><td>Keeps the entries deleted from this vault, by name.</td></tr></tbody></table>

## devo entry folder rename

Renames a folder entry and updates the path of every entry inside it.

**Workspace:** Local profile

```bash
devo entry folder rename <path> --new-name <name> [--vault-name <name> | --vault-id <id>] --yes
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;path></code></td><td></td><td>Required. Full path of the folder to rename, with <code>\</code> between levels, such as <code>Servers\Production</code>. An unknown path stops with <code>folderNotFound</code>; a path shared by several folder entries stops with <code>folderSelectorAmbiguous</code>.</td></tr><tr><td><code>--new-name &#x3C;name></code></td><td></td><td>Required. New name of the folder, not a full path: up to 200 characters, without a path separator, <code>..</code>, or a control character. The folder keeps its parent. The same name stops with <code>sqliteFolderRenameNoChanges</code>, and a name already used by a folder at that level with <code>folderAlreadyExists</code>.</td></tr><tr><td><code>--vault-id &#x3C;id></code></td><td>Current vault</td><td>Vault of the folder, by ID.</td></tr><tr><td><code>--vault-name &#x3C;name></code></td><td>Current vault</td><td>Vault of the folder, by name.</td></tr><tr><td><code>--yes</code> (<code>-y</code>, <code>--confirmed</code>)</td><td>Off</td><td>Confirms the change. Required.</td></tr></tbody></table>

The result lists every entry whose path was updated.

## devo entry template list

Lists the entry templates of the profile: name, ID, entry type, destination, folder, host, and username. Alias: `devo entry template ls`.

**Workspace:** Local profile

```bash
devo entry template list [<template>] [--destination <destination>] [--entry-type <type>] [--case-sensitive]
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;template></code></td><td></td><td>Optional. Keeps the templates whose name contains this text. With <code>id:&#x3C;value></code> or <code>--id</code>, keeps the template with this exact ID.</td></tr><tr><td><code>--id</code></td><td>Off</td><td>Treats <code>&#x3C;template></code> as an ID.</td></tr><tr><td><code>--destination &#x3C;destination></code></td><td>All</td><td><code>local</code> keeps the local templates; <code>shared</code> or <code>database</code> keeps the shared templates; <code>both</code> keeps all of them. Any other value doesn't filter.</td></tr><tr><td><code>--entry-type &#x3C;type></code> (<code>--type</code>)</td><td></td><td>Keeps one entry type, such as <code>RDPConfigured</code> or <code>Website</code>, matched exactly.</td></tr><tr><td><code>--case-sensitive</code></td><td>Off</td><td>Matches the name, the ID, and the entry type with regard to case.</td></tr></tbody></table>

## Related pages

* [Manage vaults and entries](/cli/for-devops-and-administrators/manage/vaults-and-entries.md)
* [Workspace, vault, and variable commands](/cli/reference/commands/workspaces-vaults-variables.md)
* [Update a secret from a script](/cli/guides/secrets/update-a-secret.md)
* [Exit codes and errors](/cli/reference/exit-codes-and-errors.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.devolutions.net/cli/reference/commands/entries.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.