> For the complete documentation index, see [llms.txt](https://docs.enclaive.cloud/virtual-hsm/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enclaive.cloud/virtual-hsm/cli/secret-management/vhsm-secrets/vhsm-secrets-disable.md).

# vhsm secrets disable

This command disables a secrets engine at a specified `PATH`. The argument corresponds to the enabled `PATH` of the engine, **not the TYPE**.

Disabling a secrets engine results in:

* Immediate revocation of all secrets created by the engine.
* Removal of vHSM data associated with the engine.

{% hint style="info" %}
**Note:** If the secrets engine has a large number of secrets, the revocation process can cause high system load.
{% endhint %}

### **Usage**

```sh
vhsm secrets disable <path>
```

### **Example**

Disable the secrets engine enabled at `aws/`

```sh
vhsm secrets disable aws/
```

***

### **Force Disable**

If revocation errors occur, the secrets engine may not be disabled. Possible solutions:

1. Identify the issue and attempt to disable the engine after fixing it.
2. Increase the timeout if the failure is due to timeout errors.
3. Force disable in extreme cases:
   * Perform a prefix force revoke on the mount prefix.
   * Run `vhsm secrets disable <path>` after the revoke completes.
   * This may lead to dangling credentials if secrets are not manually removed from the backing service.