How to specify 'password' that is not in section

Hi @xophermc ,

it looks that in the example you have provided there are 2 valid candidates for the query op read op://3xfy2ylmwshb5jwyurn3yiv274/demo.company.com/password. Those are:

{
  "id": "username",
  "type": "CONCEALED",
  "label": "password",
  "reference": "op://3xfy2ylmwshb5jwyurn3yiv274/demo.company.com/password"
}

and

{
  "id": "password",
  "type": "STRING",
  "label": "tsm-linux username",
  "reference": "op://3xfy2ylmwshb5jwyurn3yiv274/demo.company.com/tsm-linux username"
}.

For the first one, its label="password" causes it to match the query and for the second one, it's the ID="password" that causes the field to match the query. I realise this is confusing because the json object clearly shows that the secret reference is op read op://3xfy2ylmwshb5jwyurn3yiv274/demo.company.com/password only for one field that matches the query. In practice however, a secret can have multiple secret references other than the ones displayed in the json representation of an item. That is because op read tries to match both labels and ids when provided with a query.

In your case, I would suggest using "op://3xfy2ylmwshb5jwyurn3yiv274/demo.company.com/username" for finding the first field above and "op://3xfy2ylmwshb5jwyurn3yiv274/demo.company.com/tsm-linux username" for finding the second. Otherwise, you could consider changing the label of the field with id "username" to something else than "password".

I hope this was helpful. Please let us know your thoughts!
Cheers,
Andi