VTA management

Operational tasks for a running VTA: control who has access, retrieve secrets for services at runtime, rotate credentials, and protect against data loss with backup and restore.

Keeping a VTA running means handling day-two operations: granting and revoking access as your team changes, delivering credentials to services without hardcoding them, rotating a compromised key, and recovering from data loss. Getting these wrong can lock out a service, leave a credential over-exposed, or lose state you cannot rebuild.

The guides in this section cover the pnm CLI commands for each task, grouped by area: access and keys, secrets, credential lifecycle, and resilience. Most of these operations run against a live VTA. Rotating a credential means restarting the service that holds it, and a restore restarts the VTA. Start with Grant and revoke access if you need to grant or revoke access.

Prerequisites: these guides assume you already have a running VTA and the pnm CLI installed and connected as an admin. Some tasks, such as creating a top-level context, changing audit retention, or exporting and importing a backup, need a super-admin, and each guide lists what it needs. If you haven’t set up a VTA yet, start with Quickstart.

Manage the contexts on a VTA→

List and inspect the contexts a VTA holds, nest a sub-context under a parent, rename one, and delete a context and everything below it.

Grant and revoke access→

Grant and revoke access roles, scope permissions to contexts, set expiry, and end an existing session immediately using pnm acl commands.

Mint, inspect, and retire signing keys→

Mint a signing key in a context, list and inspect the keys a context holds, replace one whose label is out of date, and revoke a key that should no longer sign.

Retrieve credentials from the VTA vault at runtime→

Store any credential type in the VTA vault and deliver it to authorised services at runtime using the pnm CLI.

Rotate an application credential→

Replace a compromised, stale, or expiring application credential without re-provisioning the app or changing its context.

Rotate an integration's admin DID→

Mint a fresh admin DID for a mediator, WebVH host, or other admin-scoped integration by re-running its provisioning flow with –admin-template.

Back up and restore VTA state→

How to export and import a full VTA backup using pnm backup export and pnm backup import, including encryption details, what is included, and compatibility rules.

Read and retain the audit log→

Query the VTA audit log by time, action, actor, and outcome, page through large result sets, and set how long entries are kept.