> For the complete documentation index, see [llms.txt](https://docs.devolutions.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.devolutions.net/cli/reference/commands/workspaces-vaults-variables.md).

# Workspace, vault, and variable commands

Every devo workspace, devo vault, and devo variable command, with each option, its default, its allowed values and the workspace types that accept it.

This page describes every `devo workspace`, `devo vault`, and `devo variable` command and every option you can type with it. For the short list of all commands, see [Commands](/cli/reference/commands.md). For step-by-step help, see [Manage vaults and entries](/cli/for-devops-and-administrators/manage/vaults-and-entries.md) and [Use custom variables](/cli/for-devops-and-administrators/manage/custom-variables.md). The options that every command accepts, such as `--context`, `--output json`, or `--non-interactive`, are described in [Global options](/cli/reference/global-options.md) and aren't repeated here. For the entry commands, see [Entry commands](/cli/reference/commands/entries.md).

{% hint style="info" %}
To see the help of a command, with its exact wording, run `devo <command> --help`, for example `devo vault list --help`.
{% endhint %}

## How these commands work

* **Selecting a workspace or a vault**: commands take its **name** by default, matched exactly, without regard to case. To pass an ID instead, write `id:<value>` or add `--id`. `name:<value>` forces a name. Exceptions are listed under each command, such as `devo workspace delete`, which needs the exact workspace ID.
* **Current workspace and current vault**: most commands work in the current workspace and the current vault. Set them with `devo workspace use` and `devo vault use`. To use another context for one command, add `--context <name>`. See [Switch between workspaces](/cli/guides/connect/switch-workspaces.md).
* **Confirming a change**: every command that creates, changes, or deletes something refuses to run without `--yes` (aliases `-y` and `--confirmed`) and stops with `confirmationRequired`. Nothing is changed.
* **Workspace types**: a command that the selected workspace doesn't support stops with `operationNotSupportedBySource` (Devolutions Cloud, Devolutions Server) or with a code that says the local profile can't do it. See [A command says the workspace doesn't support it](/cli/help/troubleshooting/not-supported.md).

## Command groups

<table><thead><tr><th width="300">GROUP</th><th>COMMANDS</th></tr></thead><tbody><tr><td><code>devo workspace</code></td><td><code>list</code> (<code>ls</code>), <code>current</code>, <code>use</code>, <code>create</code>, <code>delete</code> (<code>rm</code>)</td></tr><tr><td><code>devo workspace variable</code></td><td><code>list</code> (<code>ls</code>), <code>set</code>, <code>delete</code> (<code>rm</code>)</td></tr><tr><td><code>devo vault</code></td><td><code>list</code> (<code>ls</code>), <code>get</code>, <code>current</code>, <code>use</code>, <code>create</code>, <code>create-many</code>, <code>update</code>, <code>delete</code> (<code>rm</code>)</td></tr><tr><td><code>devo vault settings</code></td><td><code>get</code></td></tr><tr><td><code>devo vault template</code></td><td><code>list</code> (<code>ls</code>)</td></tr><tr><td><code>devo vault access</code></td><td><code>list</code> (<code>ls</code>), <code>grant</code>, <code>revoke</code> (<code>rm</code>)</td></tr><tr><td><code>devo vault variable</code></td><td><code>list</code> (<code>ls</code>), <code>set</code>, <code>delete</code> (<code>rm</code>)</td></tr><tr><td><code>devo variable</code></td><td><code>export</code></td></tr></tbody></table>

## devo workspace list

Lists the workspaces you can use, with their name, ID, kind, and whether each one is available, the current one, and the default one. The current workspace is marked with `*`. A new local profile without any workspace returns an empty list. Alias: `devo workspace ls`.

**Workspace:** All workspace types

```bash
devo workspace list
```

This command has no options of its own.

## devo workspace current

Shows the current workspace.

**Workspace:** All workspace types

```bash
devo workspace current
```

This command has no options of its own.

## devo workspace use

Makes a workspace the current one.

**Workspace:** Local profile

```bash
devo workspace use <workspace> [--id] [--password-env <variable>]
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;workspace></code></td><td></td><td>Required. Workspace name, or its ID with <code>id:&#x3C;value></code> or <code>--id</code>. An unknown workspace stops with <code>workspaceNotFound</code>.</td></tr><tr><td><code>--id</code></td><td>Off</td><td>Treats <code>&#x3C;workspace></code> as an ID.</td></tr><tr><td><code>--password-env &#x3C;variable></code></td><td></td><td>Environment variable that holds the password of the workspace. When you pass it, the variable must exist, otherwise the command stops with <code>invalidParameterValue</code>. A local profile doesn't need a password to select a workspace.</td></tr></tbody></table>

On Devolutions Cloud and Devolutions Server, the command stops with `operationNotSupportedBySource`: select another workspace with `--context` or `devo context use`.

## devo workspace create

Creates a SQLite workspace in the local profile folder and, unless you add `--no-set-current`, makes it the current one. The passphrase you give protects the new workspace.

**Workspace:** Local profile

```bash
devo workspace create <name> (--passphrase-file <file> | --passphrase-env <variable>) [--path <file-name>] [--no-set-current] --yes
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;name></code></td><td></td><td>Required. Name of the workspace. Without <code>--path</code>, it's also the database file name.</td></tr><tr><td><code>--kind &#x3C;kind></code></td><td><code>sqlite</code></td><td>Kind of workspace. A local profile creates <code>sqlite</code> workspaces only; any other kind stops with <code>operationNotSupportedBySource</code>.</td></tr><tr><td><code>--path &#x3C;file-name></code></td><td><code>&#x3C;name>.db</code></td><td>File name of the database, created in the profile folder. Pass a file name, not a path with folders: a path stops with <code>invalidParameterValue</code>. <code>.db</code> is added if the name doesn't end with it.</td></tr><tr><td><code>--passphrase-file &#x3C;file></code></td><td></td><td>Private file that holds the passphrase that protects the new workspace. Devolutions Cloud and Devolutions Server refuse this option.</td></tr><tr><td><code>--passphrase-env &#x3C;variable></code></td><td></td><td>Environment variable that holds the passphrase that protects the new workspace. Devolutions Cloud and Devolutions Server refuse this option.</td></tr><tr><td><code>--password-env &#x3C;variable></code></td><td></td><td>Environment variable that holds password material for the workspace. A local profile refuses it: use <code>--passphrase-file</code> or <code>--passphrase-env</code>.</td></tr><tr><td><code>--no-set-current</code></td><td>Off</td><td>Creates the workspace without making it the current one.</td></tr><tr><td><code>--yes</code> (<code>-y</code>, <code>--confirmed</code>)</td><td>Off</td><td>Confirms the creation. Required.</td></tr></tbody></table>

On a local profile, pass exactly one of `--passphrase-file` and `--passphrase-env`. With neither, or both, the command stops with `invalidParameterValue`. On Devolutions Cloud and Devolutions Server, the command stops with `operationNotSupportedBySource`, with or without `--password-env`.

## devo workspace delete

Deletes a SQLite workspace of the local profile: its database file, and its temporary files, are deleted from the profile folder. This can't be undone. Alias: `devo workspace rm`.

Available on Windows only. On macOS and Linux, the command stops with `sqliteWorkspaceDeleteUnsupported` (exit code `3`).

**Workspace:** Local profile

```bash
devo workspace delete <workspace-id> --yes
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;workspace></code></td><td></td><td>Required. The exact workspace ID that <code>devo workspace list</code> shows, such as <code>sqlite:Connections.db</code>, with or without the <code>id:</code> prefix. A workspace name isn't accepted.</td></tr><tr><td><code>--id</code></td><td>Off</td><td>Treats <code>&#x3C;workspace></code> as an ID. Not needed when you pass the <code>sqlite:</code> ID.</td></tr><tr><td><code>--yes</code> (<code>-y</code>, <code>--confirmed</code>)</td><td>Off</td><td>Confirms the deletion. Required.</td></tr></tbody></table>

## devo workspace variable list

Lists the custom variables of the current workspace, with their name, value, scope, source, and description. Values are shown in plain text, except for variables whose name, or one of whose stored fields, contains `password`, `secret`, `token`, `encrypt`, `protected`, or `safevalue`: their value comes back empty and they are marked `redacted`. Alias: `devo workspace variable ls`.

**Workspace:** Local profile

```bash
devo workspace variable list [<name>]
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;name></code></td><td>All variables</td><td>Optional name filter, without regard to case. <code>*</code> matches any text and <code>?</code> one character. Without a wildcard, the name must match exactly. The <code>$</code> delimiters are optional.</td></tr></tbody></table>

## devo workspace variable set

Creates a custom variable of the current workspace, or updates it if it exists. The value comes from an environment variable or a file, never from the command line.

**Workspace:** Local profile

```bash
devo workspace variable set <name> (--value-env <variable> | --value-file <file>) [--description <text>] --yes
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;name></code></td><td></td><td>Required. Variable name: letters, numbers, and underscores only. The <code>$</code> delimiters are optional; the name is saved in uppercase, between <code>$</code> signs.</td></tr><tr><td><code>--value-env &#x3C;variable></code></td><td></td><td>Environment variable that holds the value. The variable must exist.</td></tr><tr><td><code>--value-file &#x3C;file></code></td><td></td><td>File that holds the value. The whole content is used as is, including a final line break.</td></tr><tr><td><code>--description &#x3C;text></code></td><td>Unchanged</td><td>Description of the variable. Without it, an existing description is kept.</td></tr><tr><td><code>--yes</code> (<code>-y</code>, <code>--confirmed</code>)</td><td>Off</td><td>Confirms the change. Required.</td></tr></tbody></table>

Pass exactly one of `--value-env` and `--value-file`: both stop with `conflictingOptions`, neither with `missingParameter`. Setting the same value and description again stops with `sqliteVariableUpdateNoChanges`. Changes need an unencrypted local database.

## devo workspace variable delete

Deletes custom variables of the current workspace. Alias: `devo workspace variable rm`.

**Workspace:** Local profile

```bash
devo workspace variable delete <name> [<name>…] --yes
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;name>…</code></td><td></td><td>Required. One or more variable names. If a name doesn't exist, or appears twice, the command fails and deletes nothing.</td></tr><tr><td><code>--yes</code> (<code>-y</code>, <code>--confirmed</code>)</td><td>Off</td><td>Confirms the deletion. Required.</td></tr></tbody></table>

## devo vault list

Lists the vaults of the current workspace, with their name, ID, and type. The current vault is marked. Alias: `devo vault ls`.

**Workspace:** All workspace types

```bash
devo vault list [<vault>] [--id]
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;vault></code></td><td>All vaults</td><td>Optional. Keeps only the vault with this name, or this ID with <code>id:&#x3C;value></code> or <code>--id</code>. The name is matched exactly, without regard to case, on every workspace type. On Devolutions Cloud and Devolutions Server, the vaults are sorted by name.</td></tr><tr><td><code>--id</code></td><td>Off</td><td>Treats <code>&#x3C;vault></code> as an ID.</td></tr></tbody></table>

## devo vault get

Shows one vault.

**Workspace:** All workspace types

```bash
devo vault get <vault> [--id]
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;vault></code></td><td></td><td>Required. Vault name, or its ID with <code>id:&#x3C;value></code> or <code>--id</code>. The name is matched exactly, without regard to case, on every workspace type. When no vault matches, the command stops with <code>vaultNotFound</code>; when several vaults share the name, with <code>vaultSelectorAmbiguous</code>: use the ID.</td></tr><tr><td><code>--id</code></td><td>Off</td><td>Treats <code>&#x3C;vault></code> as an ID.</td></tr></tbody></table>

## devo vault current

Shows the current vault.

**Workspace:** All workspace types

```bash
devo vault current
```

This command has no options of its own.

## devo vault use

Makes a vault the current one. Entry commands then work in this vault unless you pass `--vault-name` or `--vault-id`.

**Workspace:** All workspace types

```bash
devo vault use <vault> [--id]
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;vault></code></td><td></td><td>Required. Vault name, or its ID with <code>id:&#x3C;value></code> or <code>--id</code>. The name is matched exactly, without regard to case, on every workspace type. When several vaults share the name, the first one found becomes the current vault: use the ID to be sure. An unknown vault stops with <code>vaultNotFound</code>.</td></tr><tr><td><code>--id</code></td><td>Off</td><td>Treats <code>&#x3C;vault></code> as an ID.</td></tr></tbody></table>

## devo vault create

Creates a vault.

**Workspace:** Devolutions Cloud, Devolutions Server

```bash
devo vault create <name> [--description <text>] --yes
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;name></code></td><td></td><td>Required. Name of the new vault. An empty name stops with <code>missingParameter</code>.</td></tr><tr><td><code>--description &#x3C;text></code></td><td></td><td>Description of the new vault.</td></tr><tr><td><code>--yes</code> (<code>-y</code>, <code>--confirmed</code>)</td><td>Off</td><td>Confirms the creation. Required.</td></tr></tbody></table>

## devo vault create-many

Creates several vaults in one command, one after the other, and reports for each name whether it was created or failed.

**Workspace:** Devolutions Cloud, Devolutions Server

```bash
devo vault create-many <name> [<name>…] [--description <text>] --yes
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;name>…</code></td><td></td><td>Required. One or more vault names.</td></tr><tr><td><code>--description &#x3C;text></code></td><td></td><td>Description given to every vault created.</td></tr><tr><td><code>--yes</code> (<code>-y</code>, <code>--confirmed</code>)</td><td>Off</td><td>Confirms the creation. Required.</td></tr></tbody></table>

A failure doesn't stop the others. When some vaults were created and others weren't, the result says `partialFailure`; when none was created, `vaultCreateFailed`.

## devo vault update

Renames a vault or changes its description.

**Workspace:** Devolutions Cloud, Devolutions Server

```bash
devo vault update <vault> [--new-name <name>] [--description <text>] [--id] --yes
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;vault></code></td><td></td><td>Required. Vault name, or its ID with <code>id:&#x3C;value></code> or <code>--id</code>.</td></tr><tr><td><code>--id</code></td><td>Off</td><td>Treats <code>&#x3C;vault></code> as an ID.</td></tr><tr><td><code>--new-name &#x3C;name></code></td><td>Unchanged</td><td>New vault name.</td></tr><tr><td><code>--description &#x3C;text></code></td><td>Unchanged</td><td>New vault description. An empty value is ignored, so this command can't clear a description.</td></tr><tr><td><code>--yes</code> (<code>-y</code>, <code>--confirmed</code>)</td><td>Off</td><td>Confirms the change. Required.</td></tr></tbody></table>

Pass at least one of `--new-name` and `--description`, otherwise the command stops with `missingParameter`.

## devo vault delete

Deletes a vault. Alias: `devo vault rm`.

**Workspace:** Devolutions Cloud, Devolutions Server

```bash
devo vault delete id:<vault-id> [--permanently] --yes
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;vault></code></td><td></td><td>Required. Vault name, or its ID with <code>id:&#x3C;value></code> or <code>--id</code>. On Devolutions Cloud, only the ID is accepted: a name stops with <code>cloudVaultCanonicalIdRequired</code>.</td></tr><tr><td><code>--id</code></td><td>Off</td><td>Treats <code>&#x3C;vault></code> as an ID.</td></tr><tr><td><code>--permanently</code></td><td>Off</td><td>Devolutions Cloud: deletes the vault permanently instead of moving it to the recycle bin. Ignored by Devolutions Server.</td></tr><tr><td><code>--yes</code> (<code>-y</code>, <code>--confirmed</code>)</td><td>Off</td><td>Confirms the deletion. Required.</td></tr></tbody></table>

## devo vault settings get

Shows the root settings of the current vault, or of the vault you name: description, root entry, and tag configuration mode. The result is read only.

**Workspace:** Local profile

```bash
devo vault settings get [<vault>] [--id]
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;vault></code></td><td>Current vault</td><td>Optional. Vault name, or its ID with <code>id:&#x3C;value></code> or <code>--id</code>.</td></tr><tr><td><code>--id</code></td><td>Off</td><td>Treats <code>&#x3C;vault></code> as an ID.</td></tr></tbody></table>

This command works only when the profile allows it.

## devo vault template list

Lists the vault templates of the profile, with their name and ID. Alias: `devo vault template ls`.

**Workspace:** Local profile

```bash
devo vault template list [--vault-name <template-name> | --vault-id <template-id>]
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>--vault-id &#x3C;id></code></td><td>All templates</td><td>Keeps the vault template with this ID. The value is matched against the templates, not against your vaults.</td></tr><tr><td><code>--vault-name &#x3C;name></code></td><td>All templates</td><td>Keeps the vault template with this name, without regard to case. Ignored when <code>--vault-id</code> is given.</td></tr></tbody></table>

## devo vault access list

Lists the users and groups that have access to a vault, with their role. Alias: `devo vault access ls`.

**Workspace:** Devolutions Cloud

```bash
devo vault access list <vault> [--id] [--user <user> | --group <group>] [--case-sensitive]
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;vault></code></td><td></td><td>Required. Vault name, or its ID with <code>id:&#x3C;value></code> or <code>--id</code>.</td></tr><tr><td><code>--id</code></td><td>Off</td><td>Treats <code>&#x3C;vault></code> as an ID.</td></tr><tr><td><code>--user &#x3C;user></code></td><td>Everyone</td><td>Keeps one user: name by default, or <code>id:&#x3C;value></code>, <code>name:&#x3C;value></code>, or <code>email:&#x3C;value></code>. A bare GUID is read as an ID.</td></tr><tr><td><code>--group &#x3C;group></code></td><td>Everyone</td><td>Keeps one user group: name by default, or <code>id:&#x3C;value></code> or <code>name:&#x3C;value></code>. A bare GUID is read as an ID.</td></tr><tr><td><code>--application &#x3C;application></code></td><td></td><td>Keeps one application identity. Devolutions Cloud refuses it with <code>cloudVaultAccessApplicationUnsupported</code>.</td></tr><tr><td><code>--case-sensitive</code></td><td>Off</td><td>Matches names and emails with regard to case. By default, the case doesn't matter. A user name matches the user name or the display name; an email matches the email or the sign-in email; a group name matches the group name.</td></tr></tbody></table>

Use at most one of `--user`, `--group`, and `--application`, otherwise the command stops with `conflictingOptions`.

## devo vault access grant

Gives one user or one group a role on a vault.

**Workspace:** Devolutions Cloud

```bash
devo vault access grant <vault> (--user <user> | --group <group>) --role <role> [--id] [--case-sensitive] --yes
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;vault></code></td><td></td><td>Required. Vault name, or its ID with <code>id:&#x3C;value></code> or <code>--id</code>.</td></tr><tr><td><code>--id</code></td><td>Off</td><td>Treats <code>&#x3C;vault></code> as an ID.</td></tr><tr><td><code>--user &#x3C;user></code></td><td></td><td>User who gets the role: name by default, or <code>id:&#x3C;value></code>, <code>name:&#x3C;value></code>, or <code>email:&#x3C;value></code>. A bare GUID is read as an ID.</td></tr><tr><td><code>--group &#x3C;group></code></td><td></td><td>User group that gets the role: name by default, or <code>id:&#x3C;value></code> or <code>name:&#x3C;value></code>. A bare GUID is read as an ID.</td></tr><tr><td><code>--application &#x3C;application></code></td><td></td><td>Application identity that gets the role. Devolutions Cloud refuses it with <code>cloudVaultAccessPrincipalUnsupported</code>.</td></tr><tr><td><code>--role &#x3C;role></code></td><td></td><td>Vault role, by name or ID, without regard to case: <code>Restricted</code>, <code>Readers</code>, <code>PrivilegedReaders</code>, <code>Operators</code>, <code>PrivilegedOperators</code>, <code>Contributors</code>, or <code>VaultOwners</code>. An unknown role stops with <code>cloudVaultRoleNotFound</code>.</td></tr><tr><td><code>--case-sensitive</code></td><td>Off</td><td>Matches names and emails with regard to case. By default, the case doesn't matter. A user name matches the user name or the display name; an email matches the email or the sign-in email; a group name matches the group name.</td></tr><tr><td><code>--yes</code> (<code>-y</code>, <code>--confirmed</code>)</td><td>Off</td><td>Confirms the change. Required.</td></tr></tbody></table>

Pass exactly one of `--user` and `--group`: none stops with `missingParameter`, several with `conflictingOptions`. When the name matches several users or groups, the command stops with `principalAmbiguous`: use the ID.

## devo vault access revoke

Removes the access of one user or one group to a vault. Alias: `devo vault access rm`.

**Workspace:** Devolutions Cloud

```bash
devo vault access revoke <vault> (--user <user> | --group <group>) [--id] [--case-sensitive] --yes
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;vault></code></td><td></td><td>Required. Vault name, or its ID with <code>id:&#x3C;value></code> or <code>--id</code>.</td></tr><tr><td><code>--id</code></td><td>Off</td><td>Treats <code>&#x3C;vault></code> as an ID.</td></tr><tr><td><code>--user &#x3C;user></code></td><td></td><td>User whose access is removed: name by default, or <code>id:&#x3C;value></code>, <code>name:&#x3C;value></code>, or <code>email:&#x3C;value></code>.</td></tr><tr><td><code>--group &#x3C;group></code></td><td></td><td>User group whose access is removed: name by default, or <code>id:&#x3C;value></code> or <code>name:&#x3C;value></code>.</td></tr><tr><td><code>--application &#x3C;application></code></td><td></td><td>Application identity whose access is removed. Devolutions Cloud refuses it with <code>cloudVaultAccessPrincipalUnsupported</code>.</td></tr><tr><td><code>--all</code></td><td>Off</td><td>Removes every access assignment of the vault. Can't be combined with <code>--user</code>, <code>--group</code>, or <code>--application</code>. Devolutions Cloud refuses it with <code>cloudVaultAccessPrincipalUnsupported</code>: revoke one user or group at a time.</td></tr><tr><td><code>--case-sensitive</code></td><td>Off</td><td>Matches names and emails with regard to case. By default, the case doesn't matter. A user name matches the user name or the display name; an email matches the email or the sign-in email; a group name matches the group name.</td></tr><tr><td><code>--yes</code> (<code>-y</code>, <code>--confirmed</code>)</td><td>Off</td><td>Confirms the removal. Required.</td></tr></tbody></table>

## devo vault variable list

Lists the custom variables of the current vault, or of the vault you name, with their name, value, scope, source, and description. Values are shown in plain text, except for variables whose name, or one of whose stored fields, contains `password`, `secret`, `token`, `encrypt`, `protected`, or `safevalue`: their value comes back empty and they are marked `redacted`. Alias: `devo vault variable ls`.

**Workspace:** Local profile

```bash
devo vault variable list [<name>] [--vault <vault>] [--id]
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;name></code></td><td>All variables</td><td>Optional name filter, without regard to case. <code>*</code> matches any text and <code>?</code> one character. Without a wildcard, the name must match exactly. The <code>$</code> delimiters are optional.</td></tr><tr><td><code>--vault &#x3C;vault></code></td><td>Current vault</td><td>Vault name, or its ID with <code>id:&#x3C;value></code> or <code>--id</code>. An unknown vault stops with <code>vaultNotFound</code>.</td></tr><tr><td><code>--id</code></td><td>Off</td><td>Treats <code>--vault</code> as an ID.</td></tr></tbody></table>

## devo vault variable set

Creates a custom variable of the current vault, or of the vault you name, or updates it if it exists. The value comes from an environment variable or a file, never from the command line.

**Workspace:** Local profile

```bash
devo vault variable set <name> (--value-env <variable> | --value-file <file>) [--description <text>] [--vault <vault>] [--id] --yes
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;name></code></td><td></td><td>Required. Variable name: letters, numbers, and underscores only. The <code>$</code> delimiters are optional; the name is saved in uppercase, between <code>$</code> signs.</td></tr><tr><td><code>--value-env &#x3C;variable></code></td><td></td><td>Environment variable that holds the value. The variable must exist.</td></tr><tr><td><code>--value-file &#x3C;file></code></td><td></td><td>File that holds the value. The whole content is used as is, including a final line break.</td></tr><tr><td><code>--description &#x3C;text></code></td><td>Unchanged</td><td>Description of the variable. Without it, an existing description is kept.</td></tr><tr><td><code>--vault &#x3C;vault></code></td><td>Current vault</td><td>Vault name, or its ID with <code>id:&#x3C;value></code> or <code>--id</code>.</td></tr><tr><td><code>--id</code></td><td>Off</td><td>Treats <code>--vault</code> as an ID.</td></tr><tr><td><code>--yes</code> (<code>-y</code>, <code>--confirmed</code>)</td><td>Off</td><td>Confirms the change. Required.</td></tr></tbody></table>

Pass exactly one of `--value-env` and `--value-file`: both stop with `conflictingOptions`, neither with `missingParameter`. Setting the same value and description again stops with `sqliteVariableUpdateNoChanges`. Changes need an unencrypted local database.

## devo vault variable delete

Deletes custom variables of the current vault, or of the vault you name. Alias: `devo vault variable rm`.

**Workspace:** Local profile

```bash
devo vault variable delete <name> [<name>…] [--vault <vault>] [--id] --yes
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;name>…</code></td><td></td><td>Required. One or more variable names. If a name doesn't exist, or appears twice, the command fails and deletes nothing.</td></tr><tr><td><code>--vault &#x3C;vault></code></td><td>Current vault</td><td>Vault name, or its ID with <code>id:&#x3C;value></code> or <code>--id</code>.</td></tr><tr><td><code>--id</code></td><td>Off</td><td>Treats <code>--vault</code> as an ID.</td></tr><tr><td><code>--yes</code> (<code>-y</code>, <code>--confirmed</code>)</td><td>Off</td><td>Confirms the deletion. Required.</td></tr></tbody></table>

## devo variable export

Writes the custom variables of one scope to a JSON file. Each variable is written with its name, value, description, scope, and source. As with `list`, a variable whose name, or one of whose stored fields, contains `password`, `secret`, `token`, `encrypt`, `protected`, or `safevalue` is written with an empty value. Exporting only reads the variables: it doesn't need `--yes`, and it works for every scope, including the ones you can't change from Devolutions CLI. `variable export` is the only `devo variable` command.

**Workspace:** Local profile

```bash
devo variable export --scope <scope> --out-file <file> [--vault <vault>] [--id] [--name <filter>] [--force]
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>--scope &#x3C;scope></code></td><td></td><td>Required. Which variables to export, without regard to case: <code>workspace</code> (the variables of the current workspace), <code>vault</code> (the variables of a vault), <code>option</code> (also written <code>options</code>: the variables saved in the Devolutions Remote Desktop Manager options file of the profile; a value saved in obfuscated form comes back empty and is marked <code>unavailable</code>), or <code>user-vault</code> (also written <code>uservault</code>: accepted, but a local profile has no user vault variables, so the file holds an empty list). Any other value stops with <code>invalidVariableScope</code>.</td></tr><tr><td><code>--out-file &#x3C;file></code></td><td></td><td>Required. JSON file to write. Its folder must exist (<code>directoryNotFound</code> otherwise), and the path can't be a folder.</td></tr><tr><td><code>--force</code></td><td>Off</td><td>Replaces the file if it exists. Without it, an existing file stops the command with <code>fileExists</code>.</td></tr><tr><td><code>--vault &#x3C;vault></code></td><td>Current vault</td><td>For the <code>vault</code> and <code>user-vault</code> scopes, the vault to export: name, or ID with <code>id:&#x3C;value></code> or <code>--id</code>.</td></tr><tr><td><code>--id</code></td><td>Off</td><td>Treats <code>--vault</code> as an ID.</td></tr><tr><td><code>--name &#x3C;filter></code></td><td>All variables</td><td>Keeps only the variables whose name matches, without regard to case. <code>*</code> matches any text and <code>?</code> one character.</td></tr></tbody></table>

{% hint style="warning" %}
The exported file contains the values in plain text, and Devolutions CLI doesn't make it private. Don't commit it, and delete it when you no longer need it.
{% endhint %}

## Related pages

* [Manage vaults and entries](/cli/for-devops-and-administrators/manage/vaults-and-entries.md)
* [Use custom variables](/cli/for-devops-and-administrators/manage/custom-variables.md)
* [Manage users, groups, and access](/cli/for-devops-and-administrators/manage/users-and-access.md)
* [Entry commands](/cli/reference/commands/entries.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.devolutions.net/cli/reference/commands/workspaces-vaults-variables.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.