---
title: "axiom secret ls"
description: "List secret names and their dev-arming state"
category: reference
surfaces: [cli]
related: [reference/cli/axiom-secret]
last_reviewed: 2026-06-06
---

<!-- GENERATED by docs/scripts/gen-cli-reference — DO NOT EDIT.
     Source of truth: the cobra command definitions in cmd/axiom/cmd/.
     Regenerate from the repo root with: go run ./docs/scripts/gen-cli-reference -->

# axiom secret ls

List secret names and their dev-arming state

List the tenant's secret names with created/updated times and dev-arming
state. Values are never shown (or transmitted).

A HUMAN secret that exists but is NOT armed will fail flow runs in development
with reason "dev_not_armed" — arm it in the Console (Settings → Secrets).

MACHINE secrets (ORIGIN "machine" — minted by the platform, e.g. an app's
database DSN) are EXEMPT from dev-arming and deliver whether armed or not, so
their ARMED column reads "n/a (machine)". Arming one changes nothing and
disarming one is refused; revoke it by tearing down the resource that owns it.

```text
axiom secret ls
axiom secret ls --json | jq -r '.[] | select(.armed|not) | .name'
```

## Usage

```sh
axiom secret ls [flags]
```

## Flags

| Flag | Shorthand | Type | Default | Description |
|---|---|---|---|---|
| `--help` | `-h` | bool |  | help for ls |
| `--json` |  | bool |  | Emit the secret listing as a JSON array |

## See also

- [axiom secret](./axiom-secret.md) — Inspect tenant secrets (names and state — never values)