# How can i delete unused attributes?

**URL:** <https://openziti.discourse.group/t/how-can-i-delete-unused-attributes/2707>\
**Category:** Ziti Administration Console\
**Created:** [June 13, 2024, 7:01pm UTC](https://openziti.discourse.group/t/how-can-i-delete-unused-attributes/2707 "2024-06-13T19:01:52Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![fre4ki](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/fre4ki/32/2051_2.png) [@fre4ki](https://openziti.discourse.group/u/fre4ki)\
**Post date:** [June 13, 2024, 7:01pm UTC](https://openziti.discourse.group/t/how-can-i-delete-unused-attributes/2707/1 "2024-06-13T19:01:52Z")

</div>

Hey guys,

how can i delete unused attributes with Ziti Admin Console?

---

<div class="post-metadata">

**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\
**Post date:** [June 13, 2024, 7:03pm UTC](https://openziti.discourse.group/t/how-can-i-delete-unused-attributes/2707/2 "2024-06-13T19:03:34Z")

</div>

Oh, I bet that you can't... That's a good question. So you add an attribute to an object, then rename it or decide you don't want it but it shows up in your list of attributes forever....

@rgalletto there's no way to remove an attribute from "the global list", is there?

---

<div class="post-metadata">

**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\
**Post date:** [June 13, 2024, 7:11pm UTC](https://openziti.discourse.group/t/how-can-i-delete-unused-attributes/2707/3 "2024-06-13T19:11:12Z")

</div>

Looks like the only way to do it is to find the attribute from "all the things" and remove it. So somwhere there's an identity using the attribute. Find it and remove it from 'that thing'. Do that over and over and it'll eventually be "removed".

The API right now only shows you the list of defined/declared/used attributes.

---

<div class="post-metadata">

**Author:** ![fre4ki](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/fre4ki/32/2051_2.png) [@fre4ki](https://openziti.discourse.group/u/fre4ki)\
**Post date:** [June 13, 2024, 7:26pm UTC](https://openziti.discourse.group/t/how-can-i-delete-unused-attributes/2707/4 "2024-06-13T19:26:46Z")

</div>

I understand that but it is not in use. A delete button would be nice?

 ![image](https://global.discourse-cdn.com/free1/uploads/netfoundry/original/2X/0/0c638dfecc391de98bff849811625ad426e90167.png)

---

<div class="post-metadata">

**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\
**Post date:** [June 13, 2024, 7:33pm UTC](https://openziti.discourse.group/t/how-can-i-delete-unused-attributes/2707/5 "2024-06-13T19:33:17Z")

</div>

That might be a bug then. Which view is that under?

---

<div class="post-metadata">

**Author:** ![fre4ki](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/fre4ki/32/2051_2.png) [@fre4ki](https://openziti.discourse.group/u/fre4ki)\
**Post date:** [June 13, 2024, 7:34pm UTC](https://openziti.discourse.group/t/how-can-i-delete-unused-attributes/2707/6 "2024-06-13T19:34:59Z")

</div>

i was clicking to the "Attribute Explorer" on the left side menu.

---

<div class="post-metadata">

**Author:** ![fre4ki](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/fre4ki/32/2051_2.png) [@fre4ki](https://openziti.discourse.group/u/fre4ki)\
**Post date:** [June 13, 2024, 7:38pm UTC](https://openziti.discourse.group/t/how-can-i-delete-unused-attributes/2707/7 "2024-06-13T19:38:02Z")

</div>

but the most problem is, i can select it on the identities.

 ![image](https://global.discourse-cdn.com/free1/uploads/netfoundry/original/2X/2/2d16d6f6c34a50f1f5d15c6db77b8d5fbd20ed76.png)

I was changing the id-core-router to id-public-router.

---

<div class="post-metadata">

**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\
**Post date:** [June 13, 2024, 7:40pm UTC](https://openziti.discourse.group/t/how-can-i-delete-unused-attributes/2707/8 "2024-06-13T19:40:18Z")

</div>

Thanks! That's definitely some kind of strange bug and sadly, I can't reproduce it. 😕

Can you reproduce it consistently? If you click that attribute does it show anything?

![attr-exp](https://global.discourse-cdn.com/free1/uploads/netfoundry/original/2X/1/12bd6f3602baad0ed6e30f63754b0c8783dc2724.gif)

---

<div class="post-metadata">

**Author:** ![fre4ki](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/fre4ki/32/2051_2.png) [@fre4ki](https://openziti.discourse.group/u/fre4ki)\
**Post date:** [June 13, 2024, 7:44pm UTC](https://openziti.discourse.group/t/how-can-i-delete-unused-attributes/2707/9 "2024-06-13T19:44:41Z")

</div>

no, it shows nothing when i'm clicking on identity "id-core-router".

 ![image](https://global.discourse-cdn.com/free1/uploads/netfoundry/original/2X/8/84211d2301faf6c42a76dbe7865ced61a83f56c2.png)

The name in the first line is also now showing?

---

<div class="post-metadata">

**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\
**Post date:** [June 13, 2024, 7:57pm UTC](https://openziti.discourse.group/t/how-can-i-delete-unused-attributes/2707/10 "2024-06-13T19:57:28Z")

</div>

Very interesting. Can you use the `ziti` CLI and `jq` like this specifically looking for that `id-core-router` attribute:

```auto
ziti edge list identities "limit none" -j | jq '.data[] | [.name, .roleAttributes]'
[
  "ziti-edge-router-2",
  null
]
[
  "public",
  null
]
[
  "clint.dovholuk@",
  [
    "brozac.dialers",
    "docker.whale.dialers",
    "puter.dialers"
  ]
]
[
  "a",
  null
]
[
  "ryan.galletto@netfoundry.io",
  [
    "brozac.dialers",
    "docker.whale.dialers",
    "puter.dialers"
  ]
]
[
  "curt.tudor@netfoundry.io",
  [
    "brozac.dialers",
    "docker.whale.dialers",
    "puter.dialers"
  ]
]
[
  "Default Admin",
  null
]
[
  "ip-172-31-11-231-edge-router",
  [
    "brozac.binders",
    "docker.whale.binders"
  ]
]

```

---

<div class="post-metadata">

**Author:** ![fre4ki](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/fre4ki/32/2051_2.png) [@fre4ki](https://openziti.discourse.group/u/fre4ki)\
**Post date:** [June 13, 2024, 8:10pm UTC](https://openziti.discourse.group/t/how-can-i-delete-unused-attributes/2707/11 "2024-06-13T20:10:19Z")

</div>

i tried that but no output with "id-core-router".

---

<div class="post-metadata">

**Author:** ![rgalletto](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/rgalletto/32/1508_2.png) [@rgalletto](https://openziti.discourse.group/u/rgalletto)\
**Post date:** [June 13, 2024, 8:13pm UTC](https://openziti.discourse.group/t/how-can-i-delete-unused-attributes/2707/12 "2024-06-13T20:13:18Z")

</div>

Just to confirm what's been stated, ZAC doesn't support the ability to "Delete" an attribute from the system. In the attribute explorer "View" is the only available option, which should show what entities currently reference the selected attribute. A "delete from system" feature would definitely be a nice feature though, but it would need to be enabled via the API as well.

---

<div class="post-metadata">

**Author:** ![fre4ki](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/fre4ki/32/2051_2.png) [@fre4ki](https://openziti.discourse.group/u/fre4ki)\
**Post date:** [June 13, 2024, 8:21pm UTC](https://openziti.discourse.group/t/how-can-i-delete-unused-attributes/2707/13 "2024-06-13T20:21:40Z")

</div>

understand... are you caching the attributes somewhere? because they are not assigned to any identities..

---

<div class="post-metadata">

**Author:** ![rgalletto](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/rgalletto/32/1508_2.png) [@rgalletto](https://openziti.discourse.group/u/rgalletto)\
**Post date:** [June 13, 2024, 8:35pm UTC](https://openziti.discourse.group/t/how-can-i-delete-unused-attributes/2707/14 "2024-06-13T20:35:22Z")

</div>

ZAC should not be caching the attributes. If they still show as an option, I expect that's what's being returned from the API. I would try a refresh of the console though just to be sure.

---

<div class="post-metadata">

**Author:** ![plorenz](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/plorenz/32/54_2.png) [@plorenz](https://openziti.discourse.group/u/plorenz)\
**Post date:** [June 13, 2024, 9:00pm UTC](https://openziti.discourse.group/t/how-can-i-delete-unused-attributes/2707/15 "2024-06-13T21:00:56Z")

</div>

Hi @fre4ki ,  
Can you try a couple of CLI calls?

I tested this locally, to see if there was something sticking around:

```auto
plorenz@carrot:~/work/nf/ziti/zititest$ ziti edge create identity test
New identity test created with id: qVp6Wc46Y
plorenz@carrot:~/work/nf/ziti/zititest$ ziti edge update identity test -a id-core-router

plorenz@carrot:~/work/nf/ziti/zititest$ ziti edge list identity-role-attributes 'id contains "router"'
╭────────────────╮
│ ROLE ATTRIBUTE │
├────────────────┤
│ edge-router │
│ id-core-router │
╰────────────────╯
results: 1-2 of 2

plorenz@carrot:~/work/nf/ziti/zititest$ ziti edge update identity test -a id-public-router

plorenz@carrot:~/work/nf/ziti/zititest$ ziti edge list identity-role-attributes 'id contains "router"'
╭──────────────────╮
│ ROLE ATTRIBUTE │
├──────────────────┤
│ edge-router │
│ id-public-router │
╰──────────────────╯
results: 1-2 of 2

plorenz@carrot:~/work/nf/ziti/zititest$ ziti edge list identities 'anyOf(roleAttributes) contains "router"'
╭────────────┬───────────────┬─────────┬────────────────────────────────────────┬─────────────╮
│ ID │ NAME │ TYPE │ ATTRIBUTES │ AUTH-POLICY │
├────────────┼───────────────┼─────────┼────────────────────────────────────────┼─────────────┤
│ dtwfQcHrnj │ router-west │ Router │ edge-router,ert-host,host,tunneler │ Default │
│ qVp6Wc46Y │ test │ Default │ id-public-router │ Default │
│ xc.8ycUrG │ router-east-1 │ Router │ client,edge-router,terminator,tunneler │ Default │
╰────────────┴───────────────┴─────────┴────────────────────────────────────────┴─────────────╯
results: 1-3 of 3

```

Can you try specifically

`ziti edge list identity-role-attributes`  
`ziti edge list identities 'anyOf(roleAttributes) = "id-core-router"`'

Thank you,  
Paul

---

<div class="post-metadata">

**Author:** ![fre4ki](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/fre4ki/32/2051_2.png) [@fre4ki](https://openziti.discourse.group/u/fre4ki)\
**Post date:** [June 13, 2024, 9:25pm UTC](https://openziti.discourse.group/t/how-can-i-delete-unused-attributes/2707/16 "2024-06-13T21:25:39Z")

</div>

Hi Paul,

here it is.

 ![image](https://global.discourse-cdn.com/free1/uploads/netfoundry/original/2X/0/0b9fea21d35e8fca3d933b624008d0546a778079.png)

The "xx.." are placeholder

---

<div class="post-metadata">

**Author:** ![plorenz](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/plorenz/32/54_2.png) [@plorenz](https://openziti.discourse.group/u/plorenz)\
**Post date:** [June 14, 2024, 3:26pm UTC](https://openziti.discourse.group/t/how-can-i-delete-unused-attributes/2707/17 "2024-06-14T15:26:26Z")

</div>

Thanks for posting that. Can you run one more thing for me, please?

```auto
ziti fabric db start-check-integrity

```

```auto
ziti fabric db check-integrity-status

```

It should be quick, but if you've got a large DB, it may take a little bit run, so you may need to re-run the check-integrity-status a few times.

When I ran it locally, I found a bug related to nillable unique constraints, which is now fixed ([db intergrity checker doesn't take nullable flag into account when checking unique indices · Issue #73 · openziti/storage · GitHub](https://github.com/openziti/storage/issues/73)), so you may see some spurious errors that look like:

```auto
Issue: unique index identities.externalId missing value for id zh0EeI3E6. Fixed: false

```

The integrity check is read-only, unless you run it with the `--fix-errors` flag, so it should be safe to run. I'm curious if it finds the `id-core-router` attribute as an orphan in the index.

I also tried to duplicate the issue locally, both via CLI and using the admin console, with no results. Do you remember the steps you took? If it's a bug, it would be very helpful if we steps to replicate.

Thank you,  
Paul

---

<div class="post-metadata">

**Author:** ![fre4ki](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/fre4ki/32/2051_2.png) [@fre4ki](https://openziti.discourse.group/u/fre4ki)\
**Post date:** [June 14, 2024, 10:43pm UTC](https://openziti.discourse.group/t/how-can-i-delete-unused-attributes/2707/18 "2024-06-14T22:43:41Z")

</div>

Hey Paul,

i have checked that - and, of course i have many lines like this:  
`Issue: unique index identities.externalId missing value for id 8Q8G7q1K3l. Fixed: false`

than i was try the command:  
`ziti fabric db start-check-integrity --fix-errors`

after a restart of the controller the issue is gone:

```auto
ziti fabric db check-integrity-status
In Progress: false
Fixing Errors: false
Too Many Errors: false (if true, additional errors can be found in controller log)
Started At: <nil>
Finished At: <nil>
Operation Error: <nil>
no data integrity errors found
root@ctn:~#

```

but the attribute is still there.

Sorry, i don't know the way how it was created in the past. :-/

---

<div class="post-metadata">

**Author:** ![plorenz](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/plorenz/32/54_2.png) [@plorenz](https://openziti.discourse.group/u/plorenz)\
**Post date:** [June 17, 2024, 1:49pm UTC](https://openziti.discourse.group/t/how-can-i-delete-unused-attributes/2707/19 "2024-06-17T13:49:06Z")

</div>

Ok, last couple of suggestions:

Check to see if there are any hidden spaces:

```auto
ziti edge list identity-role-attributes 'id contains "core"' -j | jq .data.[0]

```

Use the attribute directly in the query, in case there's an odd character

```auto
ziti edge list identities "anyOf(roleAttributes)=\"$(ziti edge list identity-role-attributes 'id contains "core"' -j | jq -r .data.[0])\""

```

Otherwise, if you want to DM me a copy of your DB file, I can take a look and see if I find anything.

When I have time I'm going to also try adding an extra value to the index to make sure the checker correctly flags and fixes it.

Cheers,  
Paul

---

<div class="post-metadata">

**Author:** ![fre4ki](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/fre4ki/32/2051_2.png) [@fre4ki](https://openziti.discourse.group/u/fre4ki)\
**Post date:** [June 17, 2024, 2:54pm UTC](https://openziti.discourse.group/t/how-can-i-delete-unused-attributes/2707/20 "2024-06-17T14:54:52Z")

</div>

root@ctn:~# ziti edge list identity-role-attributes 'id contains "core"' -j | jq .data.[0]  
"id-core-router"

root@ctn:~# ziti edge list identities "anyOf(roleAttributes)="$(ziti edge list identity-role-attributes 'id contains "core"' -j | jq -r .data.[0])""  
╭────┬──────┬──────┬────────────┬─────────────╮  
│ ID │ NAME │ TYPE │ ATTRIBUTES │ AUTH-POLICY │  
├────┼──────┼──────┼────────────┼─────────────┤  
╰────┴──────┴──────┴────────────┴─────────────╯  
results: none  
root@ctn:~#

[Next page](https://openziti.discourse.group/t/how-can-i-delete-unused-attributes/2707.md?page=2)