custodian resolve

custodian resolve reads a JSON document, replaces every token in it with the value it stands for, and prints the result. The substitution happens on this machine: a tokenised field's value comes back from the server, and a client_encrypted field is unwrapped locally, which needs an enrolled device. Be signed in first.

custodian resolve --input document.json

• --input <file> — the document to resolve. -, or omitting it, reads standard input.
• --batch-size <n> — the most distinct tokens to send in one request (default 50).

A token is recognised only as a whole string value in the document, at any depth. Take a document like this:

{ "tax_id": "tok_A1B2C3D4E5F6G7H8", "name": "Acme Ltd" }

and resolve it:

cat document.json | custodian resolve

{"tax_id":"123-45-6789","name":"Acme Ltd"}

Failure is total

If any token cannot be resolved, the whole command fails and no document is written — a half-resolved document, real values in some places and tokens in others, would be the worst possible output. The error names every token that failed:

error: These tokens could not be resolved, so no document was written:
  tok_A1B2C3D4E5F6G7H8 (field tax_id, record rec_8VN…): it does not exist, or it belongs to another vault

A token embedded inside a longer string is not substituted — a token must be the whole value — and is reported by location, rather than guessed at.

A note when you resolve to a terminal

When the resolved document is printed to a terminal, Custodian reminds you that the values are now on screen and points at the safer command:

note: these values are now on your terminal. `custodian exec` pipes resolved values straight into a child process without printing them — prefer it for anything automated.

For anything automated, use custodian exec, which pipes the values straight into a program without printing them.