# VTA management

> Operational tasks for a running VTA: control who has access, retrieve secrets for services at runtime, rotate credentials, and protect against data loss with backup and restore.

Running a VTA in production means handling day-two operations: granting and revoking access as your team changes, delivering credentials to services without hardcoding them, rotating a compromised key, and recovering from data loss. Getting any of these wrong either locks out a service or leaves a credential over-exposed.

The guides in this section cover the pnm CLI commands for each task, grouped by area: access and keys, secrets, credential lifecycle, and resilience. You can run any of these operations without redeploying a service or rebuilding your VTA from scratch. Start with [Grant and revoke access](/products/affinidi-elements/vta/vta-management/acl-management.md) if you need to grant or revoke access.

Prerequisites: these guides assume you already have a running VTA and the pnm CLI installed and connected as a context admin. If you haven’t set up a VTA yet, start with [Quickstart](/products/affinidi-elements/vta/get-started.md).

## Pages in this section
- [Manage the contexts on a VTA](/products/affinidi-elements/vta/vta-management/manage-contexts.md): List and inspect the contexts a VTA holds, nest a sub-context under a parent, rename one, and delete a context and everything below it.
- [Grant and revoke access](/products/affinidi-elements/vta/vta-management/acl-management.md): Grant and revoke access roles, scope permissions to contexts, set expiry, and end an existing session immediately using pnm acl commands.
- [Mint, inspect, and retire signing keys](/products/affinidi-elements/vta/vta-management/manage-signing-keys.md): Mint a signing key in a context, list and inspect the keys a context holds, relabel one, and revoke a key that should no longer sign.
- [Retrieve credentials from the VTA vault at runtime](/products/affinidi-elements/vta/vta-management/vault-deliver-secrets.md): Store any credential type in the VTA vault and deliver it to authorised services at runtime using the pnm CLI.
- [Rotate an application credential](/products/affinidi-elements/vta/vta-management/rotate-application-credential.md): Replace a compromised, stale, or expiring application credential without re-provisioning the app or changing its context.
- [Rotate an integration's admin DID](/products/affinidi-elements/vta/vta-management/rotate-integration-admin-did.md): Mint a fresh admin DID for a mediator, WebVH host, or other admin-scoped integration by re-running its provisioning flow with --admin-template.
- [Back up and restore VTA state](/products/affinidi-elements/vta/vta-management/backup-and-restore.md): How to export and import a full VTA backup using pnm backup export and pnm backup import, including encryption details, what is included, and compatibility rules.
- [Read and retain the audit log](/products/affinidi-elements/vta/vta-management/read-the-audit-log.md): Query the VTA audit log by time, action, actor, and outcome, page through large result sets, and set how long entries are kept.