CLI Reference
Manage vault entries, encrypt data, generate compliance reports, and query audit logs - all from your terminal using the quantaseal CLI.
Install & Configure#
Install the CLI globally via npm. The binary is registered as quantaseal - there is no shorter alias.
# Install globally
npm install -g @quantaseal/cli
# Verify installation
quantaseal --version
# Set your API key (stored in ~/.quantaseal/config.json, mode 0600)
quantaseal config set api-key qsk_live_…
# Verify connectivity and authentication
quantaseal health
# View current configuration
quantaseal config getThe API key can also be supplied via the QUANTASEAL_API_KEY environment variable, which takes priority over the saved config file - useful for CI/CD (see below).
Encryption Commands#
Encrypt and decrypt data with ML-KEM-768 + AES-256-GCM (NIST FIPS 203). Sign and verify payloads with ML-DSA-65 + HMAC-SHA-512 (NIST FIPS 204). Both signatures must pass on verify - verified with bitwise &. Encrypt and sign write a full JSON envelope to disk - decrypt and verify need that whole file, not a bare ciphertext or signature string.
# Encrypt a string (ML-KEM-768 + AES-256-GCM), save the envelope
quantaseal encrypt --text "my sensitive data" --out secret.enc.json
# Decrypt - requires the full envelope file produced by encrypt
quantaseal decrypt --file secret.enc.json
# Sign a payload (ML-DSA-65 + HMAC-SHA-512), save the bundle
quantaseal sign --text "payload to sign" --out sig.json
# Verify - reads the bundle; both ML-DSA-65 and HMAC-SHA-512 must pass
quantaseal verify --signature-file sig.jsonVault Commands#
Manage credentials in QuantaVault - 3-layer PQC encryption with ML-KEM-768, AWS KMS-wrap, and AES-256-GCM. Supported credential types include api_key, oauth2_token, basic_auth, mtls_cert, bearer_token, database_dsn, and more. Every seal has a platform-enforced maximum TTL of 24 hours by design - short-lived credentials so a stolen secret expires quickly.
# List all vault entries (metadata only - no plaintext values)
quantaseal vault list
# Seal (store) a new credential - defaults to a 1-day TTL, max 24h
quantaseal vault seal --name "stripe-production-key" --type api_key --secret "sk_live_…"
# Omit --secret to be prompted for it interactively instead
quantaseal vault seal --name "temp-token" --type bearer_token --ttl-days 1
# Unseal (retrieve) a credential by ID
quantaseal vault unseal <entry-id>
# Rotate - re-encrypts the EXISTING value under a fresh key (does not
# accept a new secret; seal a new entry to change the value itself)
quantaseal vault rotate <entry-id>
# Delete permanently (logged to audit chain)
quantaseal vault delete <entry-id>Integrations Commands#
Manage the 40+ system integrations connected through the QuantaSeal proxy engine.
# List all integrations for your tenant
quantaseal integrations list
# Test connectivity for an integration
quantaseal integrations test <integration-id>
# Delete an integration
quantaseal integrations delete <integration-id>
# Emergency revoke - blocks all proxy requests immediately
quantaseal integrations revoke <integration-id> --reason "Suspected credential compromise"Compliance Commands#
Generate a JSON compliance summary - overall score, framework, reporting period, and a sample of the audit-log evidence backing it - straight to your terminal.
# Generate a SOC 2 Type II summary
quantaseal compliance report --framework soc2
# Run all 9 frameworks in one command, printed as a score bar chart
quantaseal compliance allsoc2, iso27001, pci_dss, hipaa, gdpr, nist_csf, fedramp, apra, nist_800_53The CLI does not download the full PDF evidence package (executive summary, control-by-control citations, complete sample logs) - generate that from the admin console at app.quantaseal.io/compliance.
Audit Commands#
Query the immutable audit log. Every entry is ML-DSA-65 signed and chained with SHA3-256 hashes. audit logs returns your most recent events (up to 100 per call - the API does not filter server-side by event type, user, or time window). audit verify-chain runs full server-side verification of the hash chain and every ML-DSA-65 signature in range, and is available on Growth and Enterprise plans only.
# Show your 10 most recent audit events
quantaseal audit logs
# Show up to 100
quantaseal audit logs --limit 100
# Verify the entire audit hash chain + ML-DSA-65 signatures
# (Growth / Enterprise plans only - 403 on Starter/Professional)
quantaseal audit verify-chain
# Restrict verification to a date range
quantaseal audit verify-chain --from 2026-01-01 --to 2026-02-01CI/CD Integration#
Use the CLI in CI/CD pipelines to rotate credentials and verify audit integrity as part of your build process. Pass the API key via QUANTASEAL_API_KEY - never commit it to the repository.
# GitHub Actions example
name: QuantaSeal CI
on: [push]
jobs:
audit-check:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Install QuantaSeal CLI
run: npm install -g @quantaseal/cli
- name: Verify audit chain integrity
env:
QUANTASEAL_API_KEY: ${{ secrets.QUANTASEAL_API_KEY }}
run: |
quantaseal compliance report --framework soc2
quantaseal audit verify-chain# In any CI environment - the API key is read from the environment
export QUANTASEAL_API_KEY="$QUANTASEAL_API_KEY"
# Rotate a vault credential as part of a deployment
quantaseal vault rotate <entry-id>
# Verify hash chain + signature integrity after deployment
# (Growth / Enterprise plans only)
quantaseal audit verify-chainGlobal Flags#
The CLI recognizes two flags at the top level, before any subcommand:
| Flag | Description |
|---|---|
--version, -v | Print the CLI version and exit |
--help, -h | Show the top-level command reference and exit |
There is no output-format flag (JSON vs. table), quiet mode, or verbose mode - every command prints a fixed, human-readable format to stdout.