Skip to main content
blob show answers what a reference actually points at: the blob record — id, org, domain, type, format, visibility, status — and the phase of its latest revision. Two read-only calls, no manifest, no local state. Reach for it when a command that does take a manifest has just refused the blob. show applies none of the gates that refusal came from, so it still answers.

​
Synopsis

The command has no flags of its own. --org and --json are global, so they go before the subcommand:

​
What it does

  1. Parses the reference. A bare name takes the org from --org or BLOBHUB_ORG; more than one /, an empty org before the /, or an empty blob name is BLOB_REFERENCE_INVALID.
  2. Fetches the blob record. A 403 here is BLOB_NOT_ACCESSIBLE.
  3. If the record names a latest revision, fetches it for its phase and status. This call is enrichment: any failure leaves the revision block unresolved and the command still exits 0, because the record is already an answer.
  4. Prints one field per line:
Under --json the same payload carries blob (the <org>/<name> label, qualified even when your reference was bare), record, and latest_revision — null when the revision was not resolved — alongside the envelope’s schema_version.

​
The three readings of Latest:

The last two are distinct on purpose. One says mint a better key; the other says this blob has never had a revision, and blaming the key for that is a wrong answer.

​
What it deliberately does not check

Every manifest-driven command — workflow deploy, workflow diff, scheduler deploy, all of them — resolves its blob through one shared resolver, and that resolver applies two gates before it returns a target. blob show applies neither. An inspector has to answer for a blob of any domain in any phase, and the states a deploy refuses are precisely the states someone runs show to diagnose. If workflow deploy told you the blob is not a workflow blob, show is what tells you what it is instead. If it told you the revision cannot be written, show is what tells you the phase it is actually in. show reports the latest revision only. For every other revision, and for which phases allow what, use blobhub blob revisions.

​
Errors

That table leaves two things implicit, and both are worth stating outright. A rejected key also arrives as BLOB_NOT_ACCESSIBLE. The client raises one error for 401 and 403 alike, and the blob fetch translates it. That is why the hint on this code is blobhub whoami rather than blobhub login — run it, and if the key is fine the blob really is the problem. When the org segment is not a UUID, the message adds one more clause: an org-scoped key must address its org by UUID, not by alias, because the platform’s target check is a raw string comparison against the org UUID. An org alias yields exactly this 403 on every call. AUTH_INVALID cannot surface from show. The only call that can be rejected is translated above, and the revision read swallows every failure it sees.

​
See also