VTA management

Operational tasks for a running VTA: control who has access, retrieve secrets for services at runtime, rotate credentials, and protect against data loss with backup and restore.

Running a VTA in production means handling day-two operations: granting and revoking access as your team changes, delivering credentials to services without hardcoding them, rotating a compromised key, and recovering from data loss. Getting any of these wrong either locks out a service or leaves a credential over-exposed.

The guides in this section cover the pnm CLI commands for each task, grouped by area: access and keys, secrets, credential lifecycle, and resilience. You can run any of these operations without redeploying a service or rebuilding your VTA from scratch. Start with Grant and revoke access if you need to grant or revoke access.

Prerequisites: these guides assume you already have a running VTA and the pnm CLI installed and connected as a context admin. If you haven’t set up a VTA yet, start with Quickstart.

Manage the contexts on a VTA→

List and inspect the contexts a VTA holds, nest a sub-context under a parent, rename one, and delete a context and everything below it.

Grant and revoke access→

Grant and revoke access roles, scope permissions to contexts, set expiry, and end an existing session immediately using pnm acl commands.

Mint, inspect, and retire signing keys→

Mint a signing key in a context, list and inspect the keys a context holds, relabel one, and revoke a key that should no longer sign.

Retrieve credentials from the VTA vault at runtime→

Store any credential type in the VTA vault and deliver it to authorised services at runtime using the pnm CLI.

Rotate an application credential→

Replace a compromised, stale, or expiring application credential without re-provisioning the app or changing its context.

Rotate an integration's admin DID→

Mint a fresh admin DID for a mediator, WebVH host, or other admin-scoped integration by re-running its provisioning flow with –admin-template.

Back up and restore VTA state→

How to export and import a full VTA backup using pnm backup export and pnm backup import, including encryption details, what is included, and compatibility rules.

Read and retain the audit log→

Query the VTA audit log by time, action, actor, and outcome, page through large result sets, and set how long entries are kept.