Skip to content

CLI Reference

Two binaries ship with Record Store:

Binary Purpose
record-store The operational CLI, including record-store server
record-store-server The daemon alone; accepts only --config

Use record-store for everything. record-store server starts the same daemon.

Global options

Option Effect
--json Emit JSON suitable for automation

--json is global and may appear anywhere.

Endpoints

Every command that talks to a running server takes --endpoint, defaulting to http://127.0.0.1:7601.

--endpoint goes after the subcommand

record-store bucket list --endpoint https://management.example.com

Not record-store --endpoint ... bucket list.

Authentication

The CLI reads credentials from the environment:

Variable Used for
RECORD_STORE_MANAGEMENT_TOKEN Bearer authentication — preferred
RECORD_STORE_ROOT_ACCESS_KEY + RECORD_STORE_ROOT_SECRET_KEY Basic authentication fallback
export RECORD_STORE_MANAGEMENT_TOKEN=<your-management-token>
record-store bucket list --endpoint https://management.example.com

version

record-store version

server

Starts the server, or operates on its data offline.

record-store server --config /etc/record-store/config.toml

--config may also come from RECORD_STORE_CONFIG_FILE. With no config file, the server runs on defaults plus environment variables.

server check-config

record-store server --config /etc/record-store/config.toml check-config

Loads the file, applies the environment, validates, and exits. Binds nothing and writes nothing.

server backup-metadata

record-store server backup-metadata /backups/2026-08-29

Takes the exclusive data lock, so the server must be stopped. The destination must not already exist.

server restore-metadata

record-store server restore-metadata /backups/2026-08-29

Requires an empty metadata/ directory and verifies every checksum. See Backup and Restore.

status

record-store status --endpoint https://management.example.com

Checks /ready, then prints system information when a management token is present. Exits non-zero if the server is not ready, which is what makes it usable as a container healthcheck with no credential at all.

bucket

record-store bucket list --endpoint <endpoint>
record-store bucket create <name> --endpoint <endpoint>
record-store bucket delete <name> --endpoint <endpoint>

record-store bucket versioning get <name> --endpoint <endpoint>
record-store bucket versioning enable <name> --endpoint <endpoint>
record-store bucket versioning suspend <name> --endpoint <endpoint>

delete requires the bucket to be empty. There is no versioning disable — see Versioning.

service-account

record-store service-account list --endpoint <endpoint>
record-store service-account create <name> --endpoint <endpoint>
record-store service-account inspect <id> --endpoint <endpoint>
record-store service-account enable <id> --endpoint <endpoint>
record-store service-account disable <id> --endpoint <endpoint>
record-store service-account revoke <id> --endpoint <endpoint>

create always prints JSON, because it contains the secret key — shown once.

revoke permanently deletes the account and its access-key lookups. Use disable if you might want it back.

credential

record-store credential rotate <account-id> --endpoint <endpoint>
record-store credential enable <account-id> <credential-id> --endpoint <endpoint>
record-store credential disable <account-id> <credential-id> --endpoint <endpoint>
record-store credential temporary <account-id> \
  --expires-in-seconds 3600 --endpoint <endpoint>

rotate issues a new credential alongside the existing one. The old one keeps working until you disable it.

--expires-in-seconds defaults to 3600 and must be between 60 and 86400.

policy

record-store policy list --endpoint <endpoint>
record-store policy create <file> --endpoint <endpoint>
record-store policy attach <policy-id> <account-id> --endpoint <endpoint>
record-store policy detach <policy-id> <account-id> --endpoint <endpoint>

create takes a path to a JSON policy document. See Policies.

webhook

record-store webhook list --endpoint <endpoint>
record-store webhook create <file> --endpoint <endpoint>
record-store webhook deliveries --limit 100 --endpoint <endpoint>

create takes a path to a JSON document and returns the signing secret once.

audit

record-store audit \
  --limit 100 \
  --principal <principal> \
  --operation <operation> \
  --endpoint <endpoint>

--limit defaults to 100; the API accepts 1–1000. The API supports more filters than the CLI exposes — see Audit Log.

verify

record-store verify object <bucket> <key> --endpoint <endpoint>
record-store verify bucket <bucket> --endpoint <endpoint>

Reads the bytes back and compares them to the stored checksum. verify bucket reads every object — run it off-peak.

storage

record-store storage inspect --maximum-entries 100000 --endpoint <endpoint>
record-store storage repair  --maximum-entries 100000 --endpoint <endpoint>
record-store storage repair --apply --endpoint <endpoint>

repair is dry-run unless --apply is given. It removes orphaned payloads and never removes files it does not recognise.

Scripting

--json makes every command's output machine-readable:

#!/usr/bin/env bash
set -euo pipefail

export RECORD_STORE_MANAGEMENT_TOKEN=<your-management-token>
ENDPOINT=https://management.example.com

missing=$(record-store --json storage inspect --endpoint "$ENDPOINT" \
  | jq '.metadata_without_data')

if [ "$missing" -gt 0 ]; then
  echo "ALERT: $missing objects have missing payloads"
  exit 1
fi

Commands exit non-zero on failure, so set -e does the right thing.