ReferenceCommand line
custodian audit list
Review which devices were enrolled in a vault and who approved each.
custodian audit list --devices shows the vault's device-enrolment audit: every device
enrolled, in order, with its approver named. It is how you review the enrolment chain
after the fact. Be signed in first.
custodian audit list --devices --vault acmeDevice audit for vault "acme" at https://custodian.example.com — 2 enrolments
2026-08-20T09:14:00Z enrolled dev_3Kp9… ops-laptop [secure_enclave · holding] — first device, no approver
2026-08-21T10:00:00Z enrolled dev_9Xy4… finance-laptop [secure_enclave · holding] — approved by dev_3Kp9…The first device of a vault has no approver, and its row says so. A revoked device shows a second line with its revocation time.
--json emits the same data.
--devices is required.