Skip to main content
The Items view is where you store and manage individual credentials. Every item carries a storage mode that determines whether the server can decrypt it.

​
Listing items

The items table shows every item in the active organization. Each row shows:
  • Label (links to the item detail page)
  • Storage mode (Zero-knowledge or Server-managed)
  • Agents — how many agents hold a permission on the item
  • Created timestamp
Search by label, and filter by storage mode. The table never displays secret values.

​
Creating an item

Click Add item to open the create panel.
1

Name the item

The label is cleartext and shown in lists.
2

Pick a kind

Choose api_key, login, token, certificate, ssh_key, json, or opaque. The panel shows the typed fields for that kind — for example, login prompts for username, password, URL, and TOTP secret. json lets you add arbitrary key/value pairs.
3

Choose a profile

Each profile has a fixed storage mode, so picking the profile picks the mode. Options are labeled name · mode:
  • A zero-knowledge profile encrypts the item in your browser before it leaves; only that profile’s key can decrypt it. Cannot be accessed by remote agents.
  • A server-managed profile has the API encrypt on receipt with AES-256-GCM. Accessible by local and remote agents.
The item is stored in the selected profile and inherits its mode. When the org has a single profile, the panel shows it as a read-only line instead of a dropdown.
4

Save

For a zero-knowledge profile, the browser prompts for that profile’s password (if it isn’t already unlocked), encrypts locally, and uploads only ciphertext. For a server-managed profile, the plaintext is sent over HTTPS and encrypted by the API.
Storing a zero-knowledge item requires a zero-knowledge profile in the org. Newly created orgs start with a single default server-managed profile — add a zero-knowledge profile from the Profiles page first if you need one.

​
Viewing an item

Click a row to open the item detail page. It shows:
  • Label and storage-mode badge
  • The Secret value section (personal accounts only — see below)
  • Metadata cards: Item ID, content version, last modified, active permission count
  • Agent permissions — every grant pointing at this item, each revocable
  • Recent access events — audit entries scoped to this item
  • Edit — update the item’s name, kind, and field values (personal accounts only — see below)
  • Delete — soft-deletes the item and revokes its permissions

​
Editing an item

On a personal account, the item page shows an Edit button. It reveals the current value (decrypting in your browser for zero-knowledge items, or via items.ownerReveal for server-managed), pre-fills the form, and lets you change the name, kind, and field values. Storage mode cannot be changed. Saving uses optimistic concurrency: the dashboard submits the item’s current contentVersion, and a concurrent edit elsewhere fails with STALE_VERSION (reload and retry). Zero-knowledge items are re-encrypted in your browser under the profile root key before upload. Editing rides the same custody gate as Reveal: it is offered only where the dashboard may show plaintext (personal accounts). In a team organization (custody mode), edit an item with the CLI (abadge item update) or the API (PATCH /v1/items/{itemId}).

​
Custody mode vs. personal vault

Whether the dashboard reveals a secret value depends on the active workspace:
  • Personal account — your own vault. The item page shows a Reveal control. Server-managed values are decrypted by items.ownerReveal (recorded in the audit log); zero-knowledge values are decrypted in your browser after you unlock the profile. Reveal shows the full item payload as JSON.
  • Team organization — custody mode. The dashboard never displays plaintext. Zero-knowledge items show an informational note instead of a reveal control. To read a value, use the CLI (abadge item --reveal, abadge export) or an authorized agent.

​
Storage mode badges

​
Multi-field items

Items can carry multiple named fields. When you grant an agent access, the agent can request a specific field with --field (CLI) or the field parameter (API/SDK/MCP). The dashboard’s reveal shows the whole payload. See Field delivery for resolution rules.

​
Soft delete

Deleting an item sets deletedAt but preserves the ciphertext. Future access attempts return ITEM_DELETED with result: cascade audit entries. There is no restore action in v1.