Agent ops

The local agent holds the keys and the store. The CLI, the macOS app, the browser extensions and the mobile apps talk to it with ops. An op is one JSON request with a name and parameters, and one JSON answer. This is protocol version 1. New ops only add to it.

The shape column shows the parameters and the result as the source states them. The types are Go types of the source. Each op is a heading, so search finds it.

approvals.decide

Approves or denies a per-use approval.

Shape: decideParams -> psync.DecisionResponse

approvals.pending

Lists the per-use approvals that wait for the user.

Shape: {} -> psync.PendingApprovalsResponse

autofill.snapshot

Writes the read-only snapshot of the items for the iOS AutoFill extension.

Shape: snapshotParams -> snapshotResult

card.get

Returns the values of one card item, for autofill.

Shape: fillGetParams (card kinds) -> fillGetResult (DESIGN 13.15)

card.match

Finds the card items for a page, for autofill.

Shape: cardMatchParams -> fillMatchResult (DESIGN 13.15)

e2e.accept_rollback

Accepts the state of an end-to-end folder after the server was restored from a backup.

e2e.grants

Reads the grants of the session and returns the status.

Shape: {} -> e2eStatus

e2e.jit

Returns the fields of one item for one read, with a just-in-time grant.

Shape: e2eJITReq -> e2e.Entity (one item, for one read)

e2e.lock

Drops the end-to-end keys from memory.

Shape: {} -> {}

e2e.newbox

Makes the temporary key pair of a device-code login.

Shape: {} -> newBoxResult (needs no open store)

e2e.newkey

Makes the key material of a new scoped key.

Shape: e2eNewKeyReq -> e2eNewKeyResult

e2e.purge

Purges an entity inside an end-to-end folder for good, with a signed purge record.

e2e.revoke

Signs the revocation record of a scoped key.

e2e.rotate

Builds and sends a rotation of the user keys.

e2e.rotation_plan

Syncs, plans a rotation of the user keys, and opens and checks every root.

e2e.status

Returns whether the end-to-end keys are in memory and what they can open.

Shape: {} -> e2eStatus

e2e.unlock

Opens the end-to-end keys with the master password or a key.

Shape: e2eUnlockReq -> e2eStatus

e2e.view

Returns the decrypted scopes of a space, with secret values.

Shape: {space} -> e2eSpaceView

e2e.write

Builds and signs ops for an end-to-end scope and commits one group.

Shape: e2eWriteReq -> e2eWriteResult

fill.get

Returns the values of one item for a page, for autofill.

Shape: fillGetParams -> fillGetResult

fill.match

Finds the items that fit a page URL, for autofill.

Shape: fillMatchParams -> fillMatchResult

gen.password

Generates a password. Needs no open store.

Shape: genPassParams -> genPassResult (needs no open store)

hello

Built in. Returns the protocol version, the build, the owner, the process and the expiry. A client uses it to check the agent.

Shape: {} -> hello

item.create

Makes an item. Works for plain and end-to-end items.

Shape: itemCreateParams -> itemWriteResult

item.delete

Moves an item to the trash.

Shape: itemDeleteParams -> itemWriteResult

item.show

Returns an item for display, with secrets hidden.

Shape: itemParams -> itemShowResult

item.update

Changes the fields of an item.

Shape: itemUpdateParams -> itemWriteResult

item.value

Returns one value of an item, by field or by kind.

Shape: itemValueParams -> itemValueResult

peer.add

Adds an endpoint that the device tries for all peers.

Shape: peerAddParams -> peerStatus

peer.confirm

Confirms the key fingerprint of a peer.

Shape: peerConfirmParams -> peerStatus

peer.set

Changes a peer sync setting.

Shape: peerSetParams -> peerStatus

peer.status

Returns the state of peer sync: the key fingerprint, the peers and the last exchange.

Shape: {} -> peerStatus

search

Finds items by name, user name and URL.

Shape: searchParams -> searchResult

status

Built in. The same as hello.

Shape: {} -> hello

stop

Built in. Stops the agent.

Shape: {} -> {}

vault.blob.get

Reads one small value from the local store by key.

Shape: {key} -> blobResult

vault.blob.put

Writes one small value to the local store by key.

Shape: {key, value} -> {}

vault.commit

Writes field changes to one space as one group.

Shape: {space, steps} -> commitResult

vault.open

Opens the local store with the stored key. Returns the number of pending groups and the spaces.

Shape: {} -> openResult

vault.server.fields

Lists the fields of a server-readable item with no values.

Shape: fieldsParams -> psync.ItemFieldsResponse

vault.server.keys

Lists, makes or revokes scoped keys on the server.

Shape: keysParams -> keysResult

vault.server.read

Reads a secret value from the server for a session or a scoped key. Starts a per-use approval if the item needs one.

Shape: readParams -> psync.ReadResponse

vault.server.revoke

Revokes the device on the server.

Shape: {purpose} -> {}

vault.server.spaces

Asks the server for the list of spaces.

Shape: {purpose} -> psync.SpacesResponse

vault.state

Returns the state of one space: its entities and fields.

Shape: {space} -> psync.State

vault.sync

Pulls and pushes changes, and returns the reports of the settlement.

Shape: {purpose} -> syncResult

vault.tree

Returns the tree of spaces, folders and items for the apps.

Shape: {} -> treeResult

vault.unlock

Opens the local store with the passphrase of the key store.

Shape: {passphrase} -> openResult