CLI Reference

# Install globally
npm install -g @quantaseal/cli

# Verify installation
qs --version

# Set your API key (stored in ~/.quantaseal/config.json)
qs config set api-key qs_live_...

# Verify connectivity and authentication
qs health

# View current configuration
qs config show

# Encrypt a string (ML-KEM-768 + AES-256-GCM)
qs encrypt --text "my sensitive data"

# Encrypt from a file
qs encrypt --file secrets.txt --out encrypted.json

# Decrypt
qs decrypt --file encrypted.json

# Sign a payload (ML-DSA-65 + HMAC-SHA-512)
qs sign --text "payload to sign" --out sig.json

# Verify - both ML-DSA-65 and HMAC-SHA-512 must pass
qs verify --text "payload to sign" --sig-file sig.json

# List all vault entries (metadata only - no plaintext values)
qs vault list

# Seal (store) a new credential
qs vault seal --name "stripe-production-key" --type api_key

# Seal with TTL (auto-expire after 90 days)
qs vault seal --name "temp-token" --type bearer_token --ttl 90

# Unseal (retrieve) a credential by ID
qs vault unseal cred_abc123

# Rotate - re-encrypt with a new ML-KEM-768 key pair
qs vault rotate cred_abc123

# Delete permanently (logged to audit chain)
qs vault delete cred_abc123

# List all integrations for your tenant
qs integrations list

# Test connectivity for an integration
qs integrations test int_abc123

# Emergency revoke - disables integration immediately
qs integrations revoke int_abc123 --reason "Suspected credential compromise"

# Generate a SOC 2 Type II report (returns signed S3 PDF URL)
qs compliance report --framework soc2

# Run all 9 frameworks in one command
qs compliance all

# Get compliance score (0–100) without generating a PDF
qs compliance score --framework pci_dss

# Show recent audit events (last 24 hours)
qs audit logs --hours 24

# Filter by event type
qs audit logs --event-type CREDENTIAL_UNSEALED --hours 24

# Filter by user
qs audit logs --user-id usr_abc123

# Verify the entire audit hash chain integrity
qs audit verify-chain

# Export to JSON
qs audit logs --hours 72 --output audit_export.json

# GitHub Actions example
name: QuantaSeal CI

on: [push]

jobs:
  compliance-check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install QuantaSeal CLI
        run: npm install -g @quantaseal/cli

      - name: Check compliance score
        env:
          QUANTASEAL_API_KEY: ${{ secrets.QUANTASEAL_API_KEY }}
        run: |
          qs compliance score --framework soc2
          qs audit verify-chain

# In any CI environment - pass API key via environment variable
export QUANTASEAL_API_KEY="$QUANTASEAL_API_KEY"

# Rotate a vault credential as part of a deployment
qs vault rotate cred_abc123

# Verify hash chain integrity after deployment
qs audit verify-chain