Skip to main content
Every time a secret is changed or deleted, Relic keeps its previous encrypted value. You can list those versions, reveal them locally, and restore any of them as the current value. Deleted secrets can be restored the same way. History follows the same zero-knowledge model as secrets: the server stores only ciphertext, and values are decrypted on your device.

​
How Versions Work

Versions are numbered per secret, starting at v1. A new version is created whenever the value, type, scope, or key name changes, or when the secret is deleted or rolled back. Saving a secret without changes does not create a version. Each history entry records who made the change and when. The current value shows who last set it.
Secrets that existed before history was enabled start at v1 and gain history with their next change.

​
Viewing History

​
CLI

A row’s WHEN and BY describe the change that replaced that version. For current, they describe who set the live value. Values are masked by default. Pass --reveal to decrypt them locally. Relic asks for confirmation before printing plaintext to your terminal:
Use --json for scripting. Values are only included when --reveal is also set:

​
TUI

Select a secret and press t to open its history. Use j/k to move between versions. Values stay masked unless secrets are shown (v), which requires your master password.

​
Rolling Back

Rolling back makes a previous version the current value. The value it replaces is recorded as a new restored entry, so a rollback can itself be undone.

​
CLI

Relic shows what will change and asks for confirmation. In non-interactive shells such as CI, pass --yes to skip the prompt. To restore a deleted secret, look up its versions and roll back to one of them:
Restoring fails if a secret with the same key already exists in that location. Rename or delete it first.

​
TUI

In the history view, select a version and press r (or enter), then y to confirm. Restored values appear in the list right away.
Deleted secrets are not listed in the TUI. Use relic rollback to restore them.
A rollback restores the version’s value, type, and scope. The key name stays the same. Every rollback is logged as secret.restored in the audit log.

​
Retention

Relic keeps the most recent previous versions of each secret and prunes older ones automatically when new versions are recorded. The limit depends on the project owner’s plan: The current value doesn’t count toward the limit. relic history shows the active limit. Deleting an environment or folder permanently deletes the history of the secrets inside it. Deleting your account deletes the history of your projects.

​
Access

History has the same access rules as the secret itself:
  • Owners can view history and roll back.
  • Active collaborators can view history. Shared projects are read-only, so only the owner can roll back.
  • Revoked collaborators lose access immediately.
  • Restricted or archived projects block history and rollback, just like their secrets.
  • Service accounts and API keys can’t access history. History requires a signed-in user.

​
Key Rotation

When the owner revokes a collaborator with key rotation, history is re-encrypted with the new project key on the owner’s device, together with the current secrets. Any history the owner’s client couldn’t re-encrypt (for example, when rotating from an older Relic version) is deleted on the server, so no ciphertext under the old key survives rotation. See Security for details.
Last modified on October 12, 2026