Trash and Audit

Review deleted resources

Deleting a secret, environment, or vault creates a deletion batch and removes the affected resources from normal access. Open Secrets → Trash to see recoverable items, their scope, and contained item counts. A parent deletion can cover many values, so read the summary before restoring or purging.

Members can view Trash. Owners and admins perform restore using the dashboard. Permanent purge is also restricted to an owner/admin dashboard session; runtime machine tokens do not grant either action. The current Trash screen provides recovery controls, not a purge button.

Restore an item

Select an item, review its original location, and enter the deleted item name exactly when prompted. Confirm production impact where relevant. Restore can fail if its parent is unavailable or a current resource conflicts with the deleted name/key.

Resolve the parent or naming conflict before retrying. Do not repeatedly submit an old confirmation after another administrator changes the deletion state. Restoring a value makes it available to future reads; it does not retroactively change an already-running process.

Permanently purge

Purge is irreversible removal, not another form of delete or a Secrets CLI command. The separately authorized purge operation requires PURGE followed by the exact deleted item name. Protected production resources require additional confirmation.

Nested Trash items may need to be restored or purged before a vault/environment can be permanently purged. Review those dependencies rather than assuming a parent purge silently includes independently deleted children. There is no promised automatic recovery after purge.

Review the audit trail

Open Secrets → Audit to inspect recorded actions. Events can identify a human or machine actor, credential type, action, result, target, request ID, time, and request metadata such as IP address or user agent. Reveal and copy events record which version was accessed without making the audit screen a plaintext-value browser.

Use events to answer a narrow question: which token imported values, who restored a historical version, or when a share was created or revoked. Actor and target metadata is evidence about a recorded operation, not a copy of the secret itself.

If an expected action is absent, check filters and the selected organization. A failed or unavailable audit query is not evidence that no action occurred. Keep exported values and complete share links out of notes and screenshots while investigating.