phacility/phabricator · error · PhutilArgumentUsageException

Specify a public key to revoke trust for with --id.

Error message

Specify a public key to revoke trust for with --id.

What it means

Usage error from the Almanac 'untrust-key' workflow: the required --id argument was omitted or empty. $args->getArg('id') returned a falsy value before any database lookup happened, so Phabricator immediately rejects the invocation.

Source

Thrown at src/applications/almanac/management/AlmanacManagementUntrustKeyWorkflow.php:25

    $this
      ->setName('untrust-key')
      ->setSynopsis(pht('Revoke trust of a public key.'))
      ->setArguments(
        array(
          array(
            'name' => 'id',
            'param' => 'id',
            'help' => pht('ID of the key to revoke trust for.'),
          ),
        ));
  }

  public function execute(PhutilArgumentParser $args) {
    $console = PhutilConsole::getConsole();

    $id = $args->getArg('id');
    if (!$id) {
      throw new PhutilArgumentUsageException(
        pht('Specify a public key to revoke trust for with --id.'));
    }

    $key = id(new PhabricatorAuthSSHKeyQuery())
      ->setViewer($this->getViewer())
      ->withIDs(array($id))
      ->executeOne();
    if (!$key) {
      throw new PhutilArgumentUsageException(
        pht('No public key exists with ID "%s".', $id));
    }

    if (!$key->getIsTrusted()) {
      throw new PhutilArgumentUsageException(
        pht('Public key with ID %s is not trusted.', $id));
    }

    $key->setIsTrusted(0);

View on GitHub (pinned to 5720a38cfe)

Solutions

1. Run ./bin/almanac untrust-key --id <keyID> with the numeric ID of the trusted key.
2. Find the ID on the device's page in Almanac or via SSH key search before running.
3. In scripts, guard the variable: [ -n "$KEY_ID" ] || { echo 'missing KEY_ID'; exit 1; }

// Shell-level guard before invoking:
// [ -n "$KEY_ID" ] || { echo 'error: KEY_ID is required (--id)' >&2; exit 1; }
// ./bin/almanac untrust-key --id "$KEY_ID"
// PHP-level, when building the parser args programmatically:
if (!strlen((string)$args->getArg('id'))) {
  throw new PhutilArgumentUsageException(pht('Specify a public key to revoke trust for with --id.'));
}

try {
  $err = new PhutilArgumentUsageException(...); // or call workflow
} catch (PhutilArgumentUsageException $ex) {
  // Missing-argument usage error: show help text and exit 2 (usage convention).
  fwrite(STDERR, $ex->getMessage()."\n");
  exit(2);
}

When it happens

Trigger: Running ./bin/almanac untrust-key with no --id flag, or with --id followed by an empty string.

Common situations: Muscle-memory invocation copied from trust-key docs without editing; shell scripts where the $KEY_ID variable expanded to empty.

Related errors

• You can only trust keys associated with Almanac devices.
• User aborted workflow.
• No public key exists with ID "%s".
• Public key with ID %s is not trusted.
• Request parameter "%s" is not formatted properly. Expected a

AI-assisted analysis of phacility/phabricator@5720a38cfe (2026-08-21). Data as JSON: /api/errors/4acbbf1bdacaf190. Report an issue: GitHub.