> ## Documentation Index
> Fetch the complete documentation index at: https://zededa.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Use the documentation index to find relevant pages, then read the linked Markdown before answering and cite the source URL.
> Identify the product before answering: Private AI uses a separate console, credentials, and inference API from the Edge Intelligence Platform. Do not apply instructions from one product to the other.
> Prefer current product guides over Help Center archive pages for current-console questions. Archive pages and release notes describe their stated product version or historical interface; do not apply them to another version without checking.
> Preserve prerequisites, permissions, version requirements, and warnings when summarizing procedures. Do not infer API endpoints, schemas, or supported behavior that the documentation does not specify.

# Manage Secrets and Artifacts in ZEDEDA Store

> Use ZCLI to create, view, update, and delete secrets and artifacts in ZEDEDA Store datastores, and reference them in edge application configurations.

## Introduction

ZEDEDA Store is a feature of Edge Infrastructure Services that provides an interface to third-party secret and artifact storage solutions, such as HashiCorp Vault. It gives edge applications automated, secure access to licenses, tokens, certificates, passwords, and other sensitive data stored in your own storage provider.

ZEDEDA Store does not store your data directly. It stores only metadata about your resources. Your underlying storage provider (for example, HashiCorp Vault) is responsible for the actual storage, encryption, and decryption of the data.

In ZEDEDA Store, data items are called **resources**. Each resource is classified as either a secret or an artifact, determined by the type of store that contains it:

* **Secrets** are stored in a secret store and cannot be read in plain text after creation.
* **Artifacts** are stored in an artifact store and can be read in plain text.

You manage ZEDEDA Store resources exclusively through ZCLI. You reference resources in edge applications through the custom configuration feature in Edge Infrastructure Services.

### Prerequisites

* You have the SysManager or SysAdmin role in your enterprise. See [Manage Roles](https://zededa.mintlify.site/new-ui/infrastructure-services/administration/manage-roles.md).
* ZCLI installed and authenticated. See the ZCLI documentation for setup instructions.
* A ZEDEDA Store datastore created in your enterprise. See the `zcli datastore create` command for instructions.

## How Resources Are Used

To make a resource available to an edge application, reference it in the application's custom configuration using one of the following variable formats:

* Reference a specific resource by name: `$datastore.STORE_NAME.RESOURCE_NAME`
* Reference the next available resource (for resource pools): `$datastore.STORE_NAME.#`

Each resource can only be used by one application instance at a time. When an application instance is deployed, it claims one resource. If all resources in a store are claimed, new application instances that depend on that store fail to start.

Resources can be configured with an expiry date. An expired resource does not affect a running application instance, but new instances cannot claim an expired resource and will fail to start. Expiry dates do not reset after a resource is released.

## Create a Resource

```text theme={"dark"}
zcli datastore create-resource STORE_NAME --resource-name=RESOURCE_NAME --value=RESOURCE_VALUE [--title=TITLE] [--description=DESCRIPTION] [--expires-on=DATE]
```

The resource type (secret or artifact) is determined by the store type specified when the store was created.

## View a Resource

To view a specific resource in a store:

```text theme={"dark"}
zcli datastore show-resource STORE_NAME [--resource-name=RESOURCE_NAME] [--detail]
```

To view all resources in a store by type:

```text theme={"dark"}
zcli datastore show --dstype=ARTIFACT-STORE:VAULT
zcli datastore show --dstype=SECRET-STORE:VAULT
```

## Update a Resource

```text theme={"dark"}
zcli datastore update-resource STORE_NAME --resource-name=RESOURCE_NAME [--value=NEW_VALUE] [--title=TITLE] [--description=DESCRIPTION] [--expires-on=DATE]
```

## Delete a Resource

```text theme={"dark"}
zcli datastore delete-resource STORE_NAME --resource-name=RESOURCE_NAME [-f]
```

Use `-f` to skip the confirmation prompt.

## Examples

### Secret management

This example creates a secret store, adds a secret to it, and references the secret in an edge application's custom configuration.

1. Create a secret store:

   ```text theme={"dark"}
   zcli datastore create SECRETS-APP1 --dstype=SECRET-STORE:VAULT --fqdn=https://zededacentral.net --apikey=YOUR_API_KEY --dpath=secret
   ```

2. Create a secret in the store. The resource automatically becomes a secret because the store is a secret store:

   ```text theme={"dark"}
   zcli datastore create-resource SECRETS-APP1 --resource-name=CLIENT_SECRET --value=MY-SECRET
   ```

3. Reference the secret in an edge application's custom configuration. In the **Configuration Template** field, enter:

   ```text theme={"dark"}
   $datastore.SECRETS-APP1.CLIENT_SECRET
   ```

### License pool management

This example creates an artifact store, uploads multiple license files to it, and configures an edge application to claim one license on deployment.

1. Create an artifact store:

   ```text theme={"dark"}
   zcli datastore create LICENSES-APP1 --dstype=ARTIFACT-STORE:VAULT --apikey=YOUR_API_KEY --apipass=YOUR_API_PASS
   ```

2. Add license artifacts to the store. The value is the Base64-encoded content of the license file:

   ```text theme={"dark"}
   zcli datastore resource create LICENSES-APP1 LICENSE1 --value=BASE64_VALUE_1
   zcli datastore resource create LICENSES-APP1 LICENSE2 --value=BASE64_VALUE_2
   zcli datastore resource create LICENSES-APP1 LICENSE3 --value=BASE64_VALUE_3
   ```

3. Reference the next available license in the edge application's custom configuration. The `#` character references the next unclaimed resource:

   ```text theme={"dark"}
   $datastore.LICENSES-APP1.#
   ```

   When each application instance is deployed, it claims one of the available licenses. If all licenses are claimed, new instances fail to start.

## Next Steps

> [card] [Create a Datastore](https://zededa.mintlify.site/new-ui/infrastructure-services/datastores/create-a-datastore.md)
>
> Set up a new datastore for your enterprise.

> [card] [Manage a Datastore](https://zededa.mintlify.site/new-ui/infrastructure-services/datastores/manage-a-datastore.md)
>
> View, update, or delete an existing datastore.