Lists the Enpass vaults registered on this machine, whether their file exists, whether a master password is stored in the OS keychain, and whether they are currently unlocked in this session.

Unlocks a registered vault using the master password stored in the OS keychain. The password is never passed as an argument and never reaches the model. Must be called before listing or reading entries.

Locks a vault and clears its derived key from memory for this session.

Lists entries in an unlocked vault. Returns titles, usernames and URLs but no passwords or other sensitive values. Supports optional search, category and folder filters.

Returns a full entry from an unlocked vault including sensitive field values (password, TOTP, etc.). Use this when the user explicitly wants the credentials.

Returns just the password (and TOTP if present) of an entry in an unlocked vault.

Generates the current TOTP / two-factor one-time code for an entry that stores an OTP secret. Returns the code and how many seconds until it rotates, so it can be entered for 2FA.

Lists the file attachments of an entry in an unlocked vault (name, size, MIME). Use export_attachment to get the file itself.

Decrypts a file attachment from an unlocked vault. By default it writes the file to disk and returns the path (works for any size). Set inline=true to get small files as base64 instead.

Lists every vault that uses Enpass folder sync, where its sync folder is, and whether the copy there is newer than the local one. Vaults without folder sync are not listed. Answers include a reason, so 'no baseline yet' is distinguishable from 'up to date'.