# Dgraph decrypt command has ACL options
**URL:** https://discuss.dgraph.io/t/dgraph-decrypt-command-has-acl-options/13319
**Category:** Dgraph
**Tags:** ticket:created, status:accepted, kind:bug
**Created:** [March 21, 2021, 7:20am UTC](https://discuss.dgraph.io/t/dgraph-decrypt-command-has-acl-options/13319 "2021-03-21T07:20:27Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@joaquin](https://discuss.dgraph.io/u/joaquin)
#### Post date: [March 21, 2021, 7:20am UTC](https://discuss.dgraph.io/t/dgraph-decrypt-command-has-acl-options/13319/1 "2021-03-21T07:20:27Z")
## Report a Dgraph Bug
The **`dgraph decrypt`** command has **`vault`** superflag with ACL options of **`acl-field`** and **`acl-format`**. This does not belong in the decrypt command.
### What version of Dgraph are you using?
- build from **`release/v21.03`** branch, with commit **`e489fd2e8`**
- published docker image for that commit: **`darknerd/dgraph:v21.03.0-e489fd2e8`**
### Have you tried reproducing the issue with the latest release?
- n/a
### What is the hardware spec (RAM, OS)?
- dgraph docker image (ubuntu focal fossa)
### Steps to reproduce the issue (command/config used to run Dgraph).
- `dgraph decrypt --help`
### Expected behavior and actual result.
#### Actual Results
The usage for for `dgraph decrypt --help` will show `acl-field` and `acl-format`.
```auto
Vault options
acl-field=; Vault field containing ACL key.
acl-format=base64; ACL key format, can be 'raw' or 'base64'.
addr=http://localhost:8200; Vault server address (format: http://ip:port).
enc-field=; Vault field containing encryption key.
enc-format=base64; Encryption key format, can be 'raw' or 'base64'.
path=secret/data/dgraph; Vault KV store path (e.g. 'secret/data/dgraph' for KV V2, 'kv/dgraph' for KV V1).
role-id-file=; Vault RoleID file, used for AppRole authentication.
secret-id-file=; Vault SecretID file, used for AppRole authentication.
(default "addr=http://localhost:8200; role-id-file=; secret-id-file=; path=secret/data/dgraph; acl-field=; acl-format=base64; enc-field=; enc-format=base64")
```
#### Expected Results
There should only be options to retrieve the encryption key as ACL secrets do not mean anything in the context of `dgraph decrypt`
---
### Author:  [@ajeet](https://discuss.dgraph.io/u/ajeet)
#### Post date: [April 8, 2021, 5:13am UTC](https://discuss.dgraph.io/t/dgraph-decrypt-command-has-acl-options/13319/3 "2021-04-08T05:13:18Z")
Fixed: [fix(vault): Hide ACL flags when not required by ajeetdsouza · Pull Request #7701 · dgraph-io/dgraph · GitHub](https://github.com/dgraph-io/dgraph/pull/7701)