# VTA management

> Operational tasks for a running VTA: control who has access, retrieve secrets for services at runtime, rotate credentials, and protect against data loss with backup and restore.

Keeping a VTA running means handling day-two operations: granting and revoking access as your team changes, delivering credentials to services without hardcoding them, rotating a compromised key, and recovering from data loss. Getting these wrong can lock out a service, leave a credential over-exposed, or lose state you cannot rebuild.

The guides in this section cover the pnm CLI commands for each task, grouped by area: access and keys, secrets, credential lifecycle, and resilience. Most of these operations run against a live VTA. Rotating a credential means restarting the service that holds it, and a restore restarts the VTA. Start with [Grant and revoke access](/products/affinidi-elements/vta/vta-management/acl-management.md) if you need to grant or revoke access.

Prerequisites: these guides assume you already have a running VTA and the pnm CLI installed and connected as an admin. Some tasks, such as creating a top-level context, changing audit retention, or exporting and importing a backup, need a super-admin, and each guide lists what it needs. If you haven’t set up a VTA yet, start with [Quickstart](/products/affinidi-elements/vta/get-started.md).

## Pages in this section
- [Manage the contexts on a VTA](/products/affinidi-elements/vta/vta-management/manage-contexts.md): List and inspect the contexts a VTA holds, nest a sub-context under a parent, rename one, and delete a context and everything below it.
- [Grant and revoke access](/products/affinidi-elements/vta/vta-management/acl-management.md): Grant and revoke access roles, scope permissions to contexts, set expiry, and end an existing session immediately using pnm acl commands.
- [Mint, inspect, and retire signing keys](/products/affinidi-elements/vta/vta-management/manage-signing-keys.md): Mint a signing key in a context, list and inspect the keys a context holds, replace one whose label is out of date, and revoke a key that should no longer sign.
- [Retrieve credentials from the VTA vault at runtime](/products/affinidi-elements/vta/vta-management/vault-deliver-secrets.md): Store any credential type in the VTA vault and deliver it to authorised services at runtime using the pnm CLI.
- [Rotate an application credential](/products/affinidi-elements/vta/vta-management/rotate-application-credential.md): Replace a compromised, stale, or expiring application credential without re-provisioning the app or changing its context.
- [Rotate an integration's admin DID](/products/affinidi-elements/vta/vta-management/rotate-integration-admin-did.md): Mint a fresh admin DID for a mediator, WebVH host, or other admin-scoped integration by re-running its provisioning flow with --admin-template.
- [Back up and restore VTA state](/products/affinidi-elements/vta/vta-management/backup-and-restore.md): How to export and import a full VTA backup using pnm backup export and pnm backup import, including encryption details, what is included, and compatibility rules.
- [Read and retain the audit log](/products/affinidi-elements/vta/vta-management/read-the-audit-log.md): Query the VTA audit log by time, action, actor, and outcome, page through large result sets, and set how long entries are kept.