finnest secrets

Rotate runtime secrets and manage persisted regulated material.

Rotate runtime secrets and manage persisted regulated material (Open Finance & Open Insurance). write validates and persists regulated material in the operator-local store (directory/file mode 0700/0600); the CLI seeds the cloud vault during deploy. This is not a direct cloud-vault write. An exported FINNEST_* value overrides the local value per key.

Examples

finnest secrets rotate jwt-signing-key --cloud=aws --environment=prod --yes

finnest secrets write brcac-tls-cert-pem --file ./brcac.crt --environment=sandbox

finnest secrets write provider-dcr-opin-issuer --value https://directory.opin.example

finnest secrets list --scope regulatory --cloud=azure --environment=sandbox

Options

• --cloud <cloud> — Target cloud for setup, deploy, and diagnostics.
• --environment <environment> — Target environment: sandbox or prod.
• --yes — Approve a mutating operation.
• --non-interactive — Disable interactive prompts where a command supports a prompt-based flow.
• --json — Emit a schema-versioned JSON envelope to stdout.
• --output <format> — Select text, json, or ndjson output.
• --no-color — Disable ANSI color without changing the output content mode.
• --no-evidence — Do not write .finnest run evidence.
• --verbose — Enable debug-level diagnostics.

Subcommands

• rotate — Rotate one runtime secret.
• write — Validate and persist one regulated secret in the operator-local store for env-less deploys.
• list — Show regulated material status (missing/seeded-env/persisted/demo).